search

milesmcc / shynet

Modern, privacy-friendly, and detailed web analytics that works without cookies or JS.
Apache License 2.0
2.91k stars 188 forks source link

Don't commit MaxMind license key to your repository #292

Closed ugexe closed 11 months ago

ugexe commented 12 months ago

https://github.com/milesmcc/shynet/blob/45fafc35070416bbc9df420e2df6593f43efd4dd/Dockerfile#L18

milesmcc commented 11 months ago

This is intentional; we want anyone to be able to create a build. It's functionally only an access code. I'm comfortable with it being public.

ugexe commented 11 months ago

Typically one would allow users to provide their own maxmind license key, as distributing the license key itself is probably against the ToS or licensing agreement. If the key were to be deactivated because of this, then this software would be broken for users and they would have no way to work around it.

milesmcc commented 11 months ago

Yeah — I agree that it's less than ideal, but I don't want to require everyone to get their own MaxMind key in order to build the image/develop locally. If the access key is deactivated, we can take a new approach. That being said, existing images would not break because we embed the database as part of the image build; thankfully only new builds would fail.

kevcenteno commented 11 months ago

For local development, you can use test databases: https://github.com/maxmind/MaxMind-DB/tree/main/test-data

milesmcc commented 11 months ago

Thanks! That said, I'd really like everything to "just work" out of the box without users having to create MaxMind API keys.

milesmcc commented 11 months ago

(I also recognize that you work at MaxMind; perhaps we can work out some kind of licensing system that allows us to distribute the MMDB with our package? IIRC the API key gating is to comply with GDPR requirements.)