Sentry Blog

I overlapped a bit with Chad in 2015, as he was navigating a professional transition. I wasn't in an especially high role back then- just a guy in the back of the room. In the times I saw him since, I consistently saw someone who thought hard every day about how to help others, and didn't lose sight of the human element. Sentry worked hard to create a viable business, without losing sight of open source goals. (you can see some of his efforts at https://blog.sentry.io/authors/chad-whitacre/ ) I tell my younger colleagues to do the best work they can sustainably do... but too often in this field, the big roles become too intense to be sustained forever. I hope his new role shows him the same warmth and support that he tried to put out there for others.

[disclaimer: Sentry employee] > don't act sad when you alienate swathes of your contributors This is ill-informed, for what it's worth. Our relicensing had essentially no effect on the ratio of commits from outside the company: it went from 3.5% to 3.4%. I wrote about this when OSI published the DOSP paper that we underwrote. https://blog.sentry.io/nows-the-time-for-delayed-open-source/ > the company effectively doing a rugpull on third party users/contributors Since Sentry has always been built by Sentry, our relicensing wasn't a rugpull. I wrote about this when Redis relicensed most recently: https://openpath.chadwhitacre.com/2024/relicensing-and-rug-pulls/

Hi, Armin from Sentry here. I wrote a blog post alongside the TOS change that goes into details here that addresses some of the questions I hope: https://blog.sentry.io/ai-privacy-and-terms-of-service-updates/ I'm also happy to answer specific questions about the TOS change or what we're intending on using. As for the opt-out: given the scope of how we are using usage and service data it did not seem all that obvious an opt-out was needed. We did receive the feedback however and will follow up here.

I don’t feel it’s deflection because Armin is the creator of Flask, a founding engineer, and our Principal Architect. He additionally is a member Sentry’s senior engineering/product leadership, and a key contributor to our licensing efforts. It’s his blog and his personal comments, and we are not a monolith, but I feel his statements are a good reflection of our values. Mine at least. (Disclosure: I’m also a part of this group.) The Head of Open Source has followed up on the Codecov conversation and expanded on those comments [1]. I earnestly hope you’ll weigh these official comms higher than an HN comment. [1] https://blog.sentry.io/sentrys-open-source-values/

I think this is a great question, especially with the continued shift towards data residency and customer protection in recent years (GDPR, CCPA). When we did this at Sentry - which is also built on rrweb (we help fund rrweb btw, everyone else should too!) - we realized privacy was really hard to get right (let alone data security), so we just block all elements that are at risk by default and it turns out the experience is still pretty usable. Ben wrote a bit more about this here: https://blog.sentry.io/2023/02/16/introducing-session-replay-from-sent… Not commenting on highlight, but most of the mainstream players in this space take an opt-in protection approach, and often its "you can block this specific HTML element".. which glhf getting right

I think this is the problem for open source software. It's not a one size fit all. We all do complex software and you all know its complexity. Sharding, failover, retry, back off, schema etc...everything in a high scale systems. The problem is user who used it but doesn't need other features feels frustrated. At the same time, user who used it at scale need feature others don't like? What can we do? I don't know. A good example is Sentry: https://blog.sentry.io/2019/05/14/sentry-9-1-and-upcoming-changes Say you are a small single person SaaS? are you going to install ZooKeeper, Kafka, Snuba...No. But they need it...

Rust shines where you need robust code, speed (including reliable multicore processing, low memory usage) and possibly low-level interaction with the OS or hardware. For me the robustness is great. It's not just memory safety, but strong type system without nulls is superb for avoiding stupid bugs (no more "undefined is not a function"). If you're writing a small blog, you probably don't need any of this — you won't hit resource limits, and you'll manage to write 100 lines properly in any language. But if you need to process gigabytes of data, Rust may be super helpful: https://blog.sentry.io/2016/10/19/fixing-python-performance-with-rust.…

What I've noticed, and personally experienced, about these porting projects is that they're generally a premature optimization but are a great way to learn a new language. The gains from a port are largely intrinsic in nature, residing with the programmers. However, systems and operations largely carry on just fine with the original language chosen. Only one story comes to mind where a programmer had a legitimate problem using a high-level language and solved it with a lower-level language, and that was Armin Roacher, who solved a significant performance issue using Rust: https://blog.sentry.io/2016/10/19/fixing-python-performance-with-rust.… Can you think of other stories? Please, share. I encourage all to be more skeptical about potential gains and realistic about who is actually gaining.

This is what happens when you follow the fashion driven development merry go round: https://docs.google.com/presentation/d/1LO_WI3N-3p2Wp9PDWyv5B6EGFZ8XTO… Re-implementing the hot path (which is likely to be a small piece of code) in a non-garbage collected language (C or ideally Rust) is a much more sane approach than the big bang rewrite: https://blog.sentry.io/2016/10/19/fixing-python-performance-with-rust.…

Have you heard about Helix? - http://blog.skylight.io/introducing-helix/ I think this is a great way to introduce large existing Ruby codebases to Rust in increments, much like Sentry demonstrated recently, but for Python: https://blog.sentry.io/2016/10/19/fixing-python-performance-with-rust.…

For additional context, here is a copy of the email we (as a current Sentry customer) received earlier today: --- As you may have heard, we are beginning to make investments in machine learning ([0]) to improve our product experience along with launching an EU data region ([1]) for Sentry. To support these new product offerings, we need to make the following changes to our Terms of Service (TOS): - Update Sentry's data usage rights to use the error and other data sent by our customers to Sentry for AI model training and other product development efforts (but only in an aggregate and anonymous manner for any external-facing uses); and - Update our existing data locality language to align with our making new data regions available. We are also making a few administrative changes to our TOS for further clarity. Please check out our Change Log ([2]) and the full text of our updated TOS ([3]) for more details. The updated TOS goes into effect on February 3, 2024 (the “TOS Effective Date”). The updated TOS applies to [removed customer name] as follows: - If you have an existing free subscription to use our products and services (“Service”), your continued use or access of our Service on or after the TOS Effective Date will be deemed to be your assent to the updated TOS; or - If you have an existing paid subscription to use the Service, you will stay on the existing TOS through the end of your current subscription period. The updated TOS will apply to you beginning on your…

I wonder if they have a major Postgres database that hit transaction ID wraparound? Postgres uses int32 for transaction IDs, and IDs are only reclaimed by a vacuum maintenance process which can fall behind if the DB is under heavy write load. Other companies have been bitten by this before, eg Sentry in 2015 (https://blog.sentry.io/2015/07/23/transaction-id-wraparound-in-postgre… Depending on the size of the database, you could be down several days waiting for Postgres to clean things up. Even though it’s a well documented issue with Postgres and you have an experienced team keeping an eye on it, a new write pattern could accelerate things into the danger zone quite quickly. At Notion we had a scary close call with this about a year ago that lead to us splitting a production DB over the weekend to avoid hard downtime. Whatever the issue is, I’m wishing the engineers working on it all the best.

There is a lot of overlap between logging, monitoring and crash/error reporting. In Sentry with some systems it does hook up to your logging framework to gather extra context through breadcrumbs or adds a hook to send logged error reports (in addition to the error reports from exceptions and crashes). They also follow logging good practices and integrate with them, but if you need logging, you can't use sentry for that. It only keeps the relevant information to a specific crash, and it aggregates data from crashes of a specific type so you won't even get historical data from crashes in some instances. Quoting from one of their blogs: >>> Sentry is built on top of best practices like logging. However, this can cause confusion and signal-to-noise issues if you don’t understand the the difference between logging and error reporting. Throughout your application you are likely logging many kinds of events. While these are commonly errors, you are probably logging a lot of debug information as well. This is the fundamental reason why logging has levels (e.g., debug, warning, error). When we abstract our crash reporting through logs, the challenge is to differentiate between actual errors and debug noise. >>> https://blog.sentry.io/2016/02/09/what-is-crash-reporting

I have a tremendous amount of and appreciation for Armin Ronacher and many of their fabulous Python libraries which I use regularly. However, this blog post is odd. It says that the open source sass model "has worked out very well for us", but then goes on to say "at one point someone has to make money somewhere.." in order to justify abandoning open source licensing of Sentry. Maybe "worked out great" means that they got a ton of publicity and traction because they were open source, and now they are ready to abandon open source so they can monetize the traction they gained from being open source in the first place? Sentry certainly doesn't have any obligation to continue being open source- the old code is still open source- but these events make me question any companies commitment when they claim to be open source. It seems that you can't take any company at their word, even when they publish multiple blog posts about how "committed" they are to open source- because in the end, many companies will do what Sentry did and will dump open source the minute they have gotten what they want from it. [https://blog.sentry.io/2019/02/14/sentry-thrives-open-source-software-… https://blog.sentry.io/2016/10/24/building-an-open-source-service, https://blog.sentry.io/2015/06/30/driven-by-open-source] And if there was any doubt about Sentry's willingness to use and abuse open source- months after this announcement, they continue to advertise being open source on their site,…

I have been aware of Sentry for years, but I've never used it and haven't followed the company closely. Reading Armin's post, and the official Sentry announcement [0], this strikes me as pretty reasonable. Sentry is about 11 years old. The industry has changed a lot in 11 years. There are people and companies around now that can build direct competitors more quickly than they could 11 years ago. The question raised in the Sentry post is completely valid: Was the license chosen 11 years ago the best one to base a company off of? A company relicensing its software after 11 years is a lot different than a company waving the open source flag for a year and then closing off access. I appreciate the work people are doing to find a middle ground in the open source world. Purist approaches are important in many areas, but can't work for everyone and for every project. People who are suggesting that Sentry is no longer open source have a point, but there is also a world of difference to me between a company using a BSL, and a company whose entire codebase is a black box to the outside world. One of the key questions I ask about companies built around open source, is "Are you being honest about your business structure?" I'm fine with middle-ground open source licenses as long as the terms are clear and transparent. I have no respect for hidden small-text clauses that put legal limits in place which contradicts what a company's PR copy says. I say all of this from the perspective…

Sentry stores logs in ClickHouse - https://blog.sentry.io/how-sentry-queries-unstructured-data-in-clickho…

These requests to the Sentry company used to be sent over HTTP with no encryption https://blog.sentry.io/sentry-ingestion-domains-updates/ https://cloud.google.com/blog/topics/partners/using-sentry-to-monitor-… https://old.reddit.com/r/PleX/comments/1b12phf/plex_sending_requests_t… There has never been any resource record for any sentry.io domain in the DNS that is used by computers I control. This DNS is local and I control it. I saw a request to an ingest.sentry.io domain once while experimenting with Firefox. It failed The DNS used by me only contains addresses for servers that I find useful But every user has their own preferences. It is possible that some end-users might see value in allowing their computers to automatically send requests to sentry.io while receiving nothing in return. I am not one of those users

For more context, the FSL was created by Sentry, who explain why it's been created and what problems it was trying to solve here: https://blog.sentry.io/introducing-the-functional-source-license-freed…

It was open source for about 10 years. They built themselves a name by being open source. Then they went and changed their license to a non-OSI-approved license. https://blog.sentry.io/relicensing-sentry/ Not everyone went along with it, but a lot did.

The term appears to be a new one. There's a definition here: https://blog.sentry.io/sentry-is-now-fair-source/

> FWIW, if Sentry had stayed GPL Sentry has never been GPL. https://blog.sentry.io/lets-talk-about-open-source/ > pretending it's an OSS license They are not pretending it's an OSS license. The article states: > “Just don’t call it Open Source.” Point taken. Fair Source is our new term.

> Anyone that isn't in it for the money won't give your product a second look. I think Sentry in particular has proven that you're wrong here. They have over 10k users self-hosting their software under a Fair Source license [0], which goes against your assumption that it will fail. It has already succeeded. [0]: https://blog.sentry.io/sentry-is-now-fair-source/

I personally like Sentry's approach more, their program focused on supporting the breadth and depth of their dependency tree rather than just the critical components https://blog.sentry.io/we-just-gave-500-000-dollars-to-open-source-mai… Disclaimer: I work for thanks.dev

Perhaps they should consider the FSL (Functional Source License)[1]. There is an introductory blog post about it here[2]. [1] https://fsl.software/ [2] https://blog.sentry.io/introducing-the-functional-source-license-freed…

No, it's actually FSL https://blog.sentry.io/introducing-the-functional-source-license-freed…

Sentry is not open source, it's BuSL: https://blog.sentry.io/relicensing-sentry/

I wonder if this is just them aligning themselves with the new EU AI Act at the same time that they are rolling out a EU region[1]. From my understanding that act, soon to take affect makes it a requirement to explicitly explain the use cases for AI in your use of data in TOS. Before this law you didn't really have to say if you used AI [1] https://blog.sentry.io/sentrys-eu-data-region-now-in-early-access/

Sentry as well https://blog.sentry.io/introducing-snuba-sentrys-new-search-infrastruc…

I don’t know how it is viewed here, but have a look at the licensing scheme adopted by Sentry.io. They faced a similar concern when people were selling the exact same product using a new name. > For example, this past year, we’ve had to deal with funded businesses plagiarizing or copying our work to directly compete with Sentry. This has included taking marketing content from our website, plagiarizing our documentation and framing it as their own, or straight-up copy/pasting our product visuals. Their defense? “Well, it’s free open-source, and we can do that.” These businesses are not using Sentry to improve how they develop software; they’re lifting its code and assets to build their closed-source products to compete directly with us. https://blog.sentry.io/2019/11/06/relicensing-sentry/

Sentry used Redis to buffer writes for a similar use case: https://blog.sentry.io/2016/02/23/buffering-sql-writes-with-redis