TheRealBrianF
Joined 5 years ago
Joined 5 years ago
This is factually incorrect and has been documented and discussed many times. The issue at hand is if something is open source vs "open source" but is really a free to paid go to market motion. This includes "open source" sdks that are only really used to build products against a paid commercial service.
We spend great time and care assessing each situation and discussing the results with the companies engaged with us to reach a fair conclusion.
If you think we got something wrong here, all you have to do is reach out and we are happy to walk you through what we see and drive to resolution.
--Brian (cofounder/CTO Sonatype)
I covered some of this in one of my previous blogs where i talked about the systemic challenges here that I've uncovered. The heavy users that I spoke to, 100% of them had a repository manager, some Nexus, others Artifactory. And yet the high levels of consumption still persisted. I discussed some of the reasons for this in the blog link below... but I think this refutes the theory that simply having yet another caching proxy solves the problem. It really doesn't. Additionally as Mike discussed, bandwidth is only part of the challenge. Without the people behind the repositories doing the malware response, the curation of namespaces etc, there wouldn't be anything to proxy anyway.
https://www.sonatype.com/blog/free-isnt-free-the-hidden-cost...
https://blog.sonatype.com/mapping-the-javascript-genome-for-...
-> This too is also factually incorrect. Self service rolled out on 10/1 along side the new updated limits that had a -30 day- grace period reset for everyone. So minimally you had 30 days before anything would be impacted...we are still at day 19 so no one has been impacted at all yet. The actual grace periods don't start until you go over the monthly limits so practically speaking it would take a few months before most things would have any impact.