[Very unsure] Indy vs sgcIndy

[FearDC 1]

Hi to everyone.

 

Today I've been looking for any official news about TLS 1.3 in Indy (included in latest Delphi CE or later version) and came across a new project that I never seen before, it's called sgcIndy.

 

At first all sounds very nice, OpenSSL 1.1.1 and 3.0.0 support is available - exactly what I need. But then it shows up that sgcIndy don't have source code available for free users - I'm kind of person that actually wants to see what's inside before actually using the third-party stuff.

 

Then I looked again on the website that provides sgcIndy and the menu says "Other products > Indy > Download Indy" - so I get even more unsure, it's a different project, but it's called Indy. Very confusing.

 

As I understand, sgcIndy is not Indy, right? Then what is it @esegece? I mean the original Indy is a free project, but if there is another project that builds on it, shouldn't there be at least a changelog or something that explains exactly what has been changed in the original code? It says that sgcIndy always builds on latest Indy, but do we speak about latest release, latest Git commits, unpulled requests? If sgcIndy had a different name with a simple list of new features, then I would understand. No mean to be rude, anything that is new is welcome on the market, and I really respect that, and I understand that you spend your time rewriting a lot of the code and making sure it works with latest Delphi and OpenSSL. But Indy is free, your project is not, while your project is called Indy, while it's not. I got really confused here.

 

@Remy Lebeau what do you say about all this? I really would like to hear. Maybe I'm just too paranoid.

 

And a question to the rest of community: Has anyone actually tested the free version of sgcIndy, what is the difference, does anything work sketchy at runtime? I don't know, maybe someone paid for full version and actually took a look at code and compared it with Indy?

 

Again, no mean to be rude to anyone. Just asking what's new, what's old, why and why not. 

 

Regards.

Edited March 20, 2023 by FearDC

[esegece 47]

Hello,

 

I am the eSeGeCe developer, sgcIndy is a product based on Indy that it's used by the sgcWebSockets library because requires some additional features that are not supported, some of them officially, by the indy library like openSSL 1.1 and 3.0, ALPN, IOCP, EPOLL... some users asked me that they were interested in using the Indy library with this modifications but were not interested in purchase the full sgcWebSockets library, so I released some months ago the sgcIndy library so they could purchase only the sgcIndy package with source at a lower price than the full sgcWebSockets package. 

 

I offer for free the sgcIndy library to all delphi / Cbuilder users, which includes a setup which installs automatically this package. Only is required to purchase, if you want the source code, that's all.

 

Kind Regards,

Sergio

[Lars Fosdal 1789]

Open source without the source... not sure what I think about that - particularly when it is based on another open source project.

[Stefan Glienke 1998]

1 hour ago, Lars Fosdal said:

Open source without the source... not sure what I think about that - particularly when it is based on another open source project.

You might not like it but it's according to the Licenses.

Open source does not mean that any modification automatically has to be open and free - that would be the case if choosing MPL.

Edited March 21, 2023 by Stefan Glienke

[Lars Fosdal 1789]

True, but still not thrilled about the use of the concept of taking something open and making a derivative work semi-closed.

Can I make a derivative of sgcWebSockets and publish that as open source with source included?

[Stefan Glienke 1998]

17 minutes ago, Lars Fosdal said:

Can I make a derivative of sgcWebSockets and publish that as open source with source included?

I doubt that because sgcWebSockets is not published under a license that allows this.

[Lars Fosdal 1789]

Hence open source effectively stopped being open source.

[shineworld 73]

To propagate open-source state, on an inherited library, project must be under LGPL.

[Fr0sT.Brutal 899]

59 minutes ago, Lars Fosdal said:

Can I make a derivative of sgcWebSockets and publish that as open source with source included?

Yes you can but only for the derivative you wrote. Your code => your rules, not your code => not your rules 🙂

32 minutes ago, shineworld said:

To propagate open-source state, on an inherited library, project must be under LGPL.

Or at least MPL which requires modifications being published but allows any private derivatives (inherited classes etc)

Edited March 21, 2023 by Fr0sT.Brutal

[Stefan Glienke 1998]

I love it when people that don't do open source (or at least not that I know - please correct me if I am wrong) try to force people to make their code free and open source.

[Lars Fosdal 1789]

What can I say - I like open source where the source is included.

[Remy Lebeau 1388]

19 hours ago, FearDC said:

Today I've been looking for any official news about TLS 1.3 in Indy

No recent updates, still pending review: https://github.com/indySockets/indy/pull/299

Quote

As I understand, sgcIndy is not Indy, right?

Correct.  It is just built on top of Indy.

Quote

It says that sgcIndy always builds on latest Indy, but do we speak about latest release, latest Git commits, unpulled requests?

Their website says: https://www.esegece.com/products/indy/features-overview

Quote

Always updated to latest Indy Official version that comes with Rad Studio.

Quote

Indy is free, your project is not, while your project is called Indy, while it's not. I got really confused here.

I agree.

Quote

@Remy Lebeau what do you say about all this? I really would like to hear. Maybe I'm just too paranoid.

As already pointed out, Indy's license does allow them to sell their derivative work.  However, I don't like that their website is advertising their product as "Indy", it really should be advertised as "sgcIndy" instead.

 

@esegece I would really appreciate it if you changed the product naming on your website accordingly, and actually explain on it what your product actually is.  It is not Indy itself, it is a modification/addon to Indy.  Also, your "Quick Start" guide suggests that you have made custom modifications to Indy's default OpenSSL SSLIOHandler, rather than introducing a new SSLIOHandler, as the pending pull request is doing.  I would be interested in knowing what kind of modifications you have made to enable that in the default SSLIOHandler, given the extensive and breaking API changes that were introduced in OpenSSL 1.1.x.

Edited March 21, 2023 by Remy Lebeau

[esegece 47]

Hi @Remy Lebeau,

 

Sorry for the late response, absolutely no problem in renaming the sgcIndy package. I've removed from the website because I need some time to implement those changes. The components have been renamed to sgcInternet. Thanks for your feedback, I really appreciate it.

 

Kind Regards,

Sergio

Edited March 26, 2023 by esegece
update state

[Remy Lebeau 1388]

On 3/26/2023 at 3:11 AM, esegece said:

Hi @Remy Lebeau,

 

Sorry for the late response, absolutely no problem in renaming the sgcIndy package. I've removed from the website because I need some time to implement those changes. The components have been renamed to sgcInternet. Thanks for your feedback, I really appreciate it.

 

I didn't have any issue with the PACKAGE being named sgcIndy, that is clearly a custom name that is different than Indy's own packages.  My only issue was with your WEBSITE ADVERTISING your package as just "Indy" instead of as "sgcIndy".

Edited March 27, 2023 by Remy Lebeau

[FearDC 1]

Thank you everyone.

 

Now sgcIndy website displays correct names, so people can distinguish two different projects and stop thinking that Indy has become a commercial project, because it's not.

 

Also I wonder if any of Indy or sgcIndy have fixed the SOCKS4 response issue. SendV4Response returns LResponse[0] := 4 - which is wrong according to > https://en.wikipedia.org/wiki/SOCKS#SOCKS4 - it should be null/zero instead. Aswell as Sendv4Response(AContext, 90) is faulty in HandleConnectV4. @Remy Lebeau I was going to commit this fix a couple of years ago, but did not remember to do so. 

[Remy Lebeau 1388]

2 hours ago, FearDC said:

Also I wonder if any of Indy or sgcIndy have fixed the SOCKS4 response issue.

I have just now fixed the two issues you mentioned: https://github.com/IndySockets/Indy/issues/456

[FearDC 1]

Great, thank you RL.