Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Announcing Caddy Commercial Licenses

caddyserver.com

Post reply on HN
Print view View original

71–80 of 295 posts

Re: Announcing Caddy Commercial Licenses

#71

Post by Karunamon »

ddevault wrote: post #47
lol768 wrote: post #23

> As of version 0.10.9, Caddy emits an HTTP response header, Caddy-Sponsors, which is similar to the Server header that Caddy already has, except that this one credits our sponsors who make it possible to keep Caddy free for personal use. This header cannot be removed by the Caddyfile, and its presence is required by the non-commercial EULA. This requirement is waived by the commercial license, so the header is not p…

With that statement, Caddy is officially nonfree software. It breaks freedom 1. Edit: I have been corrected. For the record, I still think this is a braindead move from Caddy.

..with regard to the distributed binaries only. The source code that you can compile yourself has no such restrictions and is still Apache 2.0. Dual licensing like this is common.

Re: Announcing Caddy Commercial Licenses

#72

Post by diggan »

ddevault wrote: post #47
lol768 wrote: post #23

> As of version 0.10.9, Caddy emits an HTTP response header, Caddy-Sponsors, which is similar to the Server header that Caddy already has, except that this one credits our sponsors who make it possible to keep Caddy free for personal use. This header cannot be removed by the Caddyfile, and its presence is required by the non-commercial EULA. This requirement is waived by the commercial license, so the header is not p…

With that statement, Caddy is officially nonfree software. It breaks freedom 1. Edit: I have been corrected. For the record, I still think this is a braindead move from Caddy.

Hm, I don't think so (but I'm no expert)

> The freedom to study how the program works, and change it so it does your computing as you wish (freedom 1). Access to the source code is a precondition for this.

Even with or without the above statement, this freedom is not broken by Caddy. You are still allowed to download the source and remove the headers, just as before.

Re: Announcing Caddy Commercial Licenses

#73

Post by mholt »

rlonstein wrote: post #60
lol768 wrote: post #23

> As of version 0.10.9, Caddy emits an HTTP response header, Caddy-Sponsors, which is similar to the Server header that Caddy already has, except that this one credits our sponsors who make it possible to keep Caddy free for personal use. This header cannot be removed by the Caddyfile, and its presence is required by the non-commercial EULA. This requirement is waived by the commercial license, so the header is not p…

dists/EULA: 3. Restrictions 3.1 You SHALL NOT, and shall not allow any third party, to: (a) decompile, disassemble, or otherwise reverse engineer the Software or attempt to reconstruct or discover any source code, underlying ideas, algorithms, file formats or programming interfaces of the Software by any means whatsoever (except and only to the extent that applicable law prohibits or restricts reverse engineering res…

Remember this only applies to official binaries. The EULA itself states it doesn't apply to the source code.

Re: Announcing Caddy Commercial Licenses

#74

Post by ddevault »

diggan wrote: post #72
ddevault wrote: post #47

Earlier quoted context omitted.

With that statement, Caddy is officially nonfree software. It breaks freedom 1. Edit: I have been corrected. For the record, I still think this is a braindead move from Caddy.

Hm, I don't think so (but I'm no expert) > The freedom to study how the program works, and change it so it does your computing as you wish (freedom 1). Access to the source code is a precondition for this. Even with or without the above statement, this freedom is not broken by Caddy. You are still allowed to download the source and remove the headers, just as before.

>its presence is required by the non-commercial EULA

This statement reads to me that you _cannot_ remove it.

It also combines with freedom 3, if you can't distribute your modified version.

Re: Announcing Caddy Commercial Licenses

#75

Post by Touche »

mholt wrote: post #28
lol768 wrote: post #23

> As of version 0.10.9, Caddy emits an HTTP response header, Caddy-Sponsors, which is similar to the Server header that Caddy already has, except that this one credits our sponsors who make it possible to keep Caddy free for personal use. This header cannot be removed by the Caddyfile, and its presence is required by the non-commercial EULA. This requirement is waived by the commercial license, so the header is not p…

Thanks for your feedback. I'd like to know more. > The fact that the headers aren't seen by most non-technical users is moot. Why's that? (And even among your technical visitors, how many of them actually inspect the response headers?) > I find this practice pretty obnoxious to the point of looking at NGINX Plus for commercial use instead. It's good to know that price isn't the bottleneck, then. Does it make any diff…

Hi mholt, I have used Caddy almost since you started it. Great product!

My issue with this is that there isn't an affordable license for small non-profit websites (like a person's personal website). I'd gladly pay if it were affordable, but it is not. So now I have to choose between incurring the wasted bandwidth of this header to my users, or choosing a different web server.

Re: Announcing Caddy Commercial Licenses

#76

Post by jayrox »

andkenneth wrote: post #37
StavrosK wrote: post #30

Earlier quoted context omitted.

> And even among your technical visitors, how many of them actually inspect the response headers? I find that a bit disingenuous. You can't both include annoying headers and argue that they aren't annoying anyone because nobody will see them. If nobody will see them, why add them in the first place?

I think the headers are there so they can see if commercial sites are using the personal version and get them to pony up.

commercial sites have the easy ability to go to https://github.com/mholt/caddy; download the source; remove the header from header.go and server.go; compile; run

i'd venture to guess many build the binary themselves already. so they can add their own tweaks.

how would anyone be able to prove a website is being ran by caddy if the server doesn't announce that it is caddy?

Re: Announcing Caddy Commercial Licenses

#77

Post by djsumdog »

rlonstein wrote: post #60
lol768 wrote: post #23

> As of version 0.10.9, Caddy emits an HTTP response header, Caddy-Sponsors, which is similar to the Server header that Caddy already has, except that this one credits our sponsors who make it possible to keep Caddy free for personal use. This header cannot be removed by the Caddyfile, and its presence is required by the non-commercial EULA. This requirement is waived by the commercial license, so the header is not p…

dists/EULA: 3. Restrictions 3.1 You SHALL NOT, and shall not allow any third party, to: (a) decompile, disassemble, or otherwise reverse engineer the Software or attempt to reconstruct or discover any source code, underlying ideas, algorithms, file formats or programming interfaces of the Software by any means whatsoever (except and only to the extent that applicable law prohibits or restricts reverse engineering res…

I don't understand. It's still open source. I mean I realize it's boiler plate stuff to keep people from just changing the binaries to remove stuff they don't want, but it's open source. You can just recompile it.

Boiler plate stuff like this really makes me question their commitment to open source.

They really should have just created a commercial or enterprise version, with new features geared towards large businesses available as plugins only for that version (AD/LDAP auth, single signon, more complicated stats, etc. etc.)

It's like they didn't learn from the 90s. Don't start charging for what was free; add new features to the paid version, or for OSS companies, up your commercial support and custom offerings.

Re: Announcing Caddy Commercial Licenses

#78

Post by mholt »

lol768 wrote: post #38
mholt wrote: post #28

Earlier quoted context omitted.

Thanks for your feedback. I'd like to know more. > The fact that the headers aren't seen by most non-technical users is moot. Why's that? (And even among your technical visitors, how many of them actually inspect the response headers?) > I find this practice pretty obnoxious to the point of looking at NGINX Plus for commercial use instead. It's good to know that price isn't the bottleneck, then. Does it make any diff…

> Why's that? (And even among your technical visitors, how many of them actually inspect the response headers?) I dislike this for a few reasons. Firstly, it honestly comes across as petty. I'm using the server for personal reasons, it's for a non-commercial site which I don't make money off. I don't display ads, and suddenly I'm now being forced to serve ads to my visitors. The medium of delivery is utterly irreleva…

> Secondly, it makes it more difficult to take steps to make it less obvious which web server is being used. I'd do this to make it slightly more difficult for script kiddies looking to exploit recent vulnerabiltiies - not because I think security through obscurity is a good idea.

I thought about this as well, but I'm not convinced that hiding the Server header or anything like unto it is really that beneficial. Most exploits are automated anyway. And if it becomes common to hide or remove the Server header for Caddy instances, then guess what becomes its new signature?

> used it for personal use (costing you nothing)

This unfortunately isn't true. It costs a LOT of time and effort to maintain the build infrastructure and the Caddy project itself, even if its users don't make a profit from it.

Re: Announcing Caddy Commercial Licenses

#79

Post by bpicolo »

ddevault wrote: post #74
diggan wrote: post #72

Earlier quoted context omitted.

Hm, I don't think so (but I'm no expert) > The freedom to study how the program works, and change it so it does your computing as you wish (freedom 1). Access to the source code is a precondition for this. Even with or without the above statement, this freedom is not broken by Caddy. You are still allowed to download the source and remove the headers, just as before.

>its presence is required by the non-commercial EULA This statement reads to me that you _cannot_ remove it. It also combines with freedom 3, if you can't distribute your modified version.

The EULA only applies to precompiled binaries

Re: Announcing Caddy Commercial Licenses

#80

Post by [deleted] »

ddevault wrote: post #74
diggan wrote: post #72

Earlier quoted context omitted.

Hm, I don't think so (but I'm no expert) > The freedom to study how the program works, and change it so it does your computing as you wish (freedom 1). Access to the source code is a precondition for this. Even with or without the above statement, this freedom is not broken by Caddy. You are still allowed to download the source and remove the headers, just as before.

>its presence is required by the non-commercial EULA This statement reads to me that you _cannot_ remove it. It also combines with freedom 3, if you can't distribute your modified version.

[deleted]
Post reply on HN