airwave-weekly-2026-10-09

[Quixomatic]

Comment thread for airwave-weekly-2026-10-09 (airwave-weekly-2026-10-09).

Managed by fuma-comment.

[Quixomatic]

Would love to hear your thoughts. Let me know what you think.

[cashcon57]

Hey @Quixomatic ! First off, thank you for building Airwave--it's seriously cool stuff. I've been working on a fork of Airwave for the last few weeks and it has diverged from Airwave.... A lot. I'd love to contribute back some of what I've built for myself, and maintain a fork with my tastes if they don't happen to be yours, but the license you've released under is kinda... Conflicting.

It states that you can fork it, but then in the same breath says you cannot release a competing product, so I'm unclear on if I can actually fork it and make that fork public and release artifacts on GH. Can you clarify? I have zero intention of selling anything related to this, but some of my modifications are pretty huge and at about +85,000 loc above what Airwave has, that's a pretty impolite PR.

I'm contemplating just doing a clean-room rewrite of the entire thing so I don't have to worry about licensing stuff, but that also feels impolite, as I like the base you created and want to credit it. Got any opinions? Just trying not to upset anyone.

[Quixomatic]

Hey @cashcon57, thanks for the kind words, and genuinely, thank you for asking first instead of just doing it. That matters to me.

The license line here is deliberate, so I'll be straight with you:

• Forking and modifying it for your own use is completely fine. Build whatever you want for yourself, as much as you want. That's the point of making the source available.
• Contributing back is what I'm hoping for. I'd love to see what you've built. Big changes are welcome too. If something's too large for a single PR, open an issue or a discussion and we'll figure out how to land it in pieces. There's no such thing as an "impolite PR" here, and you'd get the credit for your work.
• Making your fork public and shipping your own artifacts is the one thing the license is written to prevent. PolyForm Perimeter's Noncompete and Competition terms cover "providing to others any product that competes with the software," and they're deliberately broad: a competing release still counts even if it's free, rebranded, or ported to another stack. So a public, installable fork of Airwave isn't something I can sign off on. Your read on that was right.

Why that line exists: I'm pouring everything I have into getting Airwave off the ground, and it's free to self-host and free in the browser on purpose. The only way that holds together is if the native apps and the hosted side aren't competing against free forks of the same project. The license is how I keep the whole codebase available for people to read, run, learn from, and improve, while protecting the small part that keeps the lights on. A public fork, even a well-meant one, pulls the floor out from under that while I'm still trying to build the community in the first place.

So where that leaves us: I'd really like your changes upstream, and I'm happy to talk through how to bring the big pieces in so everyone benefits and your name is on them. A separate public fork I can't agree to.

If you want to talk any of this through directly rather than in a thread, I'm around, just say the word. And again, thanks for building on it and for raising this the right way.

[cashcon57]

Thanks for the straight answer, that totally makes sense. My fork stays private.

Quick heads-up before any PRs: while working on it I found three security issues that are still in current main (v0.15.65). I've filed them as private advisories through the Security tab, per your SECURITY.md, so nothing's disclosed here. Happy to send the fixes through the advisory flow or as normal PRs, whichever you prefer.

After that I'll start sending PRs, small ones first. The performance and compatibility work for low-end Google TV boxes is probably the most useful part (I've been testing on a TCL QM8 and an NVIDIA Shield). For the bigger pieces I'll open a discussion first, like you suggested.

[Quixomatic]

Thank you for this. Airwave has grown into a much bigger system than I planned for, and past a certain size one person can't keep all of it in their head. Security is where that catches up with you first. The security advisories you submitted are real gaps I'd have walked right past, and you found them by sitting down and reading the code carefully. That means a lot, and the timing didn't hurt: I'd stepped away from the project for about a week because I was starting to burn out, and coming back to reports this careful was a good reason to pick it back up.

You handled the reports exactly right: privately, with clear write-ups, nothing dropped in the open. All three were real and well spotted. I've already got fixes for all three on a branch, going out shortly. Your write-ups were detailed enough that I built the fixes straight from them, so I hope that's alright, and you're credited as the reporter on each advisory. I'll publish them once the fix ships.

On PRs: yes, please, and starting small is perfect. The low-end Google TV and compatibility work might be the most useful thing you could send right now. Those cheap boxes are where I most want Airwave to run well, and I don't have a TCL QM8 or a Shield here to test against, so you can see gaps there that I can't.

Thanks again for building on it, and for handling all of this the way you did. Looking forward to what you send.

[cashcon57]

100% okay to have built the fixes straight from them. I'm never going to gate-keep security fixes.