Fossa-cli
Dev tools
dependency license scanner
SHOW HN2018
How HN took it
3 positive, 5 neutral or asking, 2 mixed, 7 critical, out of 17 comments about the project. Thread score -0.16.
Privacy: 0 for, 4 againstIdea: 2 for, 0 againstDocs: 0 for, 2 againstDesign: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Useful for simplifying compliance work
From 2 comments
Impressive work. It takes courage to tackle the over-complicated compliance area - a headache to a lot of startup owners including myself. Thanks for simplifying the annoying…
mypitch on HNAn update, since I see some upvotes. I followed @XiZhao's advise and managed to sign up without giving access to github which is very good. If I want to have scans run…
andmarios on HN
Good idea for scanning dependencies, eating own dog food
From 2 comments
I like that FOSSA scans FOSSA. Here's the link from the "license scan" badge on github:…
achou on HNImho, eating your own dog food is one higher virtues of software development (although I wouldn't recommend it in real life due to dog food vs human food quality standards).…
aequitas on HN
Objections
Requires GitHub write access when signing up
From 2 comments
This looks great, alas I am unable to test it. When I try to sign up, they want write access to my repos, to the org repos I am a member off, etc. Let's make this clear: I am not…
andmarios on HNThis is a GitHub limitation. I get around it for other services by making a dedicated GitHub user account, granting that user read-only access, and then connecting to the…
lancefisher on HN
Hosted service risks misuse of uploaded license data
From 2 comments
Step One: Get low level developers to upload evidence of major corporate license violations to your server. Step Two: Sell evidence to legal firms. Step Three: Profit. This seems…
johnnyo on HNI don’t see that as against your business model at all. You could build up a large database of say, violations of Oracle licenses, then get Oracle to buy out your company. You’d…
johnnyo on HN
Documentation is poor and Go errors are cryptic
From 1 comment
This looks great, alas I am unable to test it. When I try to sign up, they want write access to my repos, to the org repos I am a member off, etc. Let's make this clear: I am not…
andmarios on HN
Title overstates language support
From 1 comment
> for any codebase > Supports over 15+ languages & environments (JavaScript, Java, Ruby, Golang, PHP, etc...) The title here is overly broad, bordering on click bait. I suggest…
cjp on HN
Requests
Python support
From 1 comment
+1 for Python (https://github.com/fossas/fossa-cli/issues/13)
julienchastang on HN
Read-only GitHub access
From 1 comment
This looks great, alas I am unable to test it. When I try to sign up, they want write access to my repos, to the org repos I am a member off, etc. Let's make this clear: I am not…
andmarios on HN
Better Go error feedback and documentation
From 1 comment
Unfortunately, the permissions issue is a limitation of Github's Oauth API. There's no way to ask for "read-only" permissions using their current integration scheme. You can,…
XiZhao on HN
Questions
How are users protected from misuse of the license violation data?
From 1 comment
I don’t see that as against your business model at all. You could build up a large database of say, violations of Oracle licenses, then get Oracle to buy out your company. You’d…
johnnyo on HN