One of the founders here. Here's a copy of the response I posted on Twitter.<p>--<p>A response to @JohnONolan here to clear up some serious misunderstandings
<a href="https://twitter.com/JohnONolan/status/1602330377812643850" rel="nofollow">https://twitter.com/JohnONolan/status/1602330377812643850</a><p>First of all, huge respect to the Ghost team. Their open source contributions are valuable, and their approach to theming enables some great-looking things. That said, some important corrections:<p>Substack is not "powered by Ghost". Rather, we built our own theming API that’s compatible with themes built for Ghost, including those built by third parties.<p>The Free Press is using a modified Tripoli theme, built by Ahmad Ajmi, under a paid license. This is how this is supposed to work. It's good for the theme developer if we support this – you should check them out here.
<a href="https://aspirethemes.com/themes/tripoli" rel="nofollow">https://aspirethemes.com/themes/tripoli</a><p>This was relatively quick to build for Substack devs, because the structure of Ghost sites matches Substack fairly closely.<p>With respect to the search library, this is an open source library that we are using in a fully compliant way. John's own screen shot shows that we don't load it "from Ghost’s own CDN", it comes from jsDelivr
<a href="https://www.jsdelivr.com" rel="nofollow">https://www.jsdelivr.com</a><p>This is a standard way to use an open source library. It's pulling from the version that the sodo-search maintainers published to NPM (thank you!).<p>It is a good point that we should lock a version, so that if they accidentally published a minor version revision with breaking changes it doesn't cause problems for us. We’ve fixed that.<p>We’re grateful to the developer of the Tripoli theme and to Ghost for its contributors to open source work. We’re exploring ways to give writers more customization on Substack. This is one approach we’re considering but it’s too early to know if we’ll scale it up.<p>And @JohnONolan, thanks for the note at the end about potential collaboration. In our minds, we’re on the same side of an important battle for a better internet. We’re definitely up to chat.
Chris Best of Substack replied: <a href="https://twitter.com/cjgbest/status/1602370307884318720" rel="nofollow">https://twitter.com/cjgbest/status/1602370307884318720</a><p><i>Substack is not "powered by Ghost". Rather, we built our own theming API that’s compatible with themes built for Ghost, including those built by third parties.</i><p><i>The Free Press is using a modified Tripoli theme, built by Ahmad Ajmi, under a paid license. This is how this is supposed to work. It's good for the theme developer if we support this – you should check them out here.</i>
> One thing that’s a little disappointing: Ghost uses the MIT license, one of the most permissive OSS licenses there is. Essentially, anyone can do anything they want with our code, with ONE basic requirement: You must include copyright attribution. Which they have not.<p>For a SaaS app, wouldn't that copyright attribution be on the server side, where the code is (hidden from the end user)?<p>Is John stating he expects that copyright attribution to be in the "view source" of the HTML or some other user accessible location? What happens if that HTML/JS is minified/stripped/"compiled"?<p>IANAL: but I'm genuinely curious how this situation is handled.<p><a href="https://twitter.com/JohnONolan/status/1602330414269472769" rel="nofollow">https://twitter.com/JohnONolan/status/1602330414269472769</a>
I've always found open source projects to build superior libraries that commercial entities always end up adopting.<p>I've always found commercial entities to build superior products that open source projects always end up adopting.<p>One makes the tools, the other assembles them and sells it.<p>Must be the focus on profits that helps push companies to build products users want, while the love of the craft pushes developers to make the best foundations.
On the one hand, it does seem like it'd be nice if Substack had signed a support/integration deal with the Ghost team. That way Ghost could have gotten paid <i>something</i> for their hard work, and Substack could have avoided critical mistakes like the CDN security issue.<p>On the other hand, this seems like what success looks like for an MIT licensed project. A big company using the code to power their product without even having to contact, let alone ask permission of, anyone.<p>It seems to feel different for end-user applications like Ghost. But it's not actually any different than if they had powered Substack with SQLite or Postgres.
A response from substack.<p><a href="https://mobile.twitter.com/cjgbest/status/1602370307884318720" rel="nofollow">https://mobile.twitter.com/cjgbest/status/160237030788431872...</a><p>Seems like this is a bit of a clickbait. The theme is made by the substack user, substack is only using a single library from ghost to show search, and the cdn in question is jsdeliver which isn't ghost's cdn, it is basically a cdn for any open source javascript.
I quite O'Nolan's tone here. It's obviously not a collaboration as you might first expect from the top tweet (and title on HN), but he's quite gracious about it at the same time. It would be quite easy to get frustrated and outraged at Substack, we've seen it happen before. However despite the two, fairly substantial, issues he's pretty gracious about it while poking a bit of fun.<p>Hopefully Substack do the right thing here and correct those two problems openly. It would only be a good thing for blogging/publishing if they actually contributed back as well.
I've been a big fan of ghost for a while, both the software and the company & its values.<p>This thread is really making me rethink the latter.<p>He's just so confidently wrong in every tweet.
This is why you should use the AGPL.<p>Otherwise, corporations can and will make immense profits from your unpaid work without contributing anything in return.<p>The goal of FOSS should be to create a new ecosystem that puts users in control, not to provide free labor to private enterprises.
Have any writers migrated from Substack to Ghost?<p>Substack support has been nonexistent for the past 6 months. I've reached out about a handful of broken features and get no response, except in one case months ago where they dismissed it in the weirdest way. Archive search does not work; ex. I have a post about monkeys, it has "monkey" in the title and the body, and when I search "monkey" it doesn't come up in results. The support response said "this is normal, just because a post has a keyword in the title or body doesn't mean it's always included in search results"...what? I asked for clarification and they never replied.<p>It feels like Substack has strayed from the promise of being focused on writing and email. They added "Save" and "Listen" buttons to the top of emails, which are visually prominent; and those buttons make no sense in an email. They're a trick to take people to the iOS app.<p>They endlessly promote new features to writers and readers and it all feels like their trying to lock you into something that's harder to migrate out of.
<p><pre><code> The way they used our search library is kind of interesting. They could've
copied the code locally and modified it to work with the Substack API, but I
guess Substack doesn’t have an API?
</code></pre>
Substack doesn't have an API. Their editor is laughably primitive compared with other solutions. Their visual look hasn't changed at all since their inception. They don't have discoverability. Can anyone tell me what Substack is doing with all the millions of dollars of funding they've taken? We joke about Twitter being massively overstaffed, but Substack, to me, looks just as bloated, organizationally.
Whoa!<p>Hotlinking Ghost CDN URLs in Substack production HTML.<p>Yes this is a bad look for Substack. And it puts them - and their users - at Ghost's mercy.
Based on Ghost's MIT license, seems Substack using it is fine, but damn would have been nice to have at least some kind of attribution... leaves a sour taste to take without acknowledging.
I really enjoyed this interview with Ghost founder John O’Nolan. Seems like a very smart, classy guy leaving the world better than he found it<p><a href="https://www.indiehackers.com/podcast/139-john-onolan-of-ghost" rel="nofollow">https://www.indiehackers.com/podcast/139-john-onolan-of-ghos...</a>
in a non-gotcha world, john of ghost reaches out privately to chris (or someone else) of substack to compare notes and clarify what's going on here. but those regretful days of chivalry are long gone, aren't they? they're replaced by the superior practice of submitting your grievances to the universal jury, in the absence of the accused. civility and principle of charity be damned. a few people have highlighted the calmness of the exchange—i think the public part was absolutely unnecessary. my one-and-a-half cents.
Here's [1] the actual JS file which Substack is loading, pulled directly from the network tab on the page linked in the thread.<p>Notably, the first line is "For license information please see sodo-search.min.js.LICENSE.txt". But if you go to that file [2], it's not the license _for this file_; it's the licenses _for the OSS code it includes_. I suspect that Substack thought that link pointed to the actual license; I did too before I started writing this comment. Possibly that confusion has lead to some talking past each other.<p>The actual license is at [3], which is obvious if you know how npm packages work, and probably not obvious otherwise. I don't see a link to that file anywhere.<p>[1] <a href="https://cdn.jsdelivr.net/npm/@tryghost/sodo-search@1.1/umd/sodo-search.min.js" rel="nofollow">https://cdn.jsdelivr.net/npm/@tryghost/sodo-search@1.1/umd/s...</a><p>[2] <a href="https://cdn.jsdelivr.net/npm/@tryghost/sodo-search@1.1/umd/sodo-search.min.js.LICENSE.txt" rel="nofollow">https://cdn.jsdelivr.net/npm/@tryghost/sodo-search@1.1/umd/s...</a><p>[3] <a href="https://cdn.jsdelivr.net/npm/@tryghost/sodo-search@1.1/LICENSE" rel="nofollow">https://cdn.jsdelivr.net/npm/@tryghost/sodo-search@1.1/LICEN...</a>
Response from Chris Best Substack's CEO: <a href="https://twitter.com/cjgbest/status/1602370307884318720" rel="nofollow">https://twitter.com/cjgbest/status/1602370307884318720</a>
Funny side-note: @substack is the wrong handle, I assume John meant to tag @SubstackInc.<p>AFAIK there's no formal mechanism for bidding on naming rights, but Twitter could easily set up an auction platform, take a small cut off the top, and do quite nicely.
If you are like me and had never heard of Ghost before today, here's a link to their Github repo:<p><a href="https://github.com/TryGhost/Ghost" rel="nofollow">https://github.com/TryGhost/Ghost</a>
So at what point does Substack cut the man and his team a check because from the looks of his observations Substack will likely need consultation and support.
It's a known thing, and it's called the SaaS loophole.<p><a href="https://opensource.stackexchange.com/questions/11467/can-i-use-gpl-software-to-provide-a-commercial-cloud-service" rel="nofollow">https://opensource.stackexchange.com/questions/11467/can-i-u...</a>
Mildly off-topic, but I'm somewhat tired of the reuse of names for different software. Originally, I was confused by this post and why Substack would be using Norton Ghost. There's also the Android post-explotation framework and ImmersionRC's Ghost radio control protocol.
I think one of the points that Substack reverse engineered how search works. They use this package <a href="https://github.com/TryGhost/sodo-search" rel="nofollow">https://github.com/TryGhost/sodo-search</a> which does not have any docs.
When John says "product engineers" does that mean "the engineers who specifically work on the code that gets used by customers"? Ie. excluding the engineers who do all the support stuff: CI/CD/testing/etc. ?
Response from Chris Best, Substack's CEO: <a href="https://twitter.com/cjgbest/status/1602370307884318720" rel="nofollow">https://twitter.com/cjgbest/status/1602370307884318720</a>
I'd loved to have implemented this for my chrismas themed solitaire: <a href="https://online-solitaire.com/?theme=christmas" rel="nofollow">https://online-solitaire.com/?theme=christmas</a>.<p>Good job!
Hi Chris! Love what you're doing with Substack. One quick thing though - this may seem weird, but Substack at the moment does not, in my opinion, offer a lot of customisation of the website. If you see a website, it's extremely easy to tell its a Substack.<p>Over the past year, I've only read high quality Substack posts - and my brain has sort of come to instinctively believe that if I see that specific layout, the post will be high quality. E.g. (not a very nice one) but in general, if I see the Medium layout, my brain almost immediately get turned off, believing the quality of the content to be sub-par.<p>I think individual theming, as in the case of The Free Press, takes away that immediate notion. I understand that the vast majority of people will not face this issue, but I think I will. I just wanted to know if you think this is an issue, and if it is, what you'll do to 'counter' it. I'd really like to hear your thoughts on this!
Sleazy and disrespectful behavior by substack. Just like medium, all these publishing/newsletter platforms go to $%@& real quick. The first time I saw the "sign up to continue reading" banner I knew substack was done, this just confirms it.