Announcing Caddy Commercial Licenses • Hacker News Board

Re: Announcing Caddy Commercial Licenses

#201

Post by tylersmith » Wed, Sep 13, 2017, 10:01 PM UTC

mholt wrote: post #28

lol768 wrote: post #23

> As of version 0.10.9, Caddy emits an HTTP response header, Caddy-Sponsors, which is similar to the Server header that Caddy already has, except that this one credits our sponsors who make it possible to keep Caddy free for personal use. This header cannot be removed by the Caddyfile, and its presence is required by the non-commercial EULA. This requirement is waived by the commercial license, so the header is not p…

Thanks for your feedback. I'd like to know more. > The fact that the headers aren't seen by most non-technical users is moot. Why's that? (And even among your technical visitors, how many of them actually inspect the response headers?) > I find this practice pretty obnoxious to the point of looking at NGINX Plus for commercial use instead. It's good to know that price isn't the bottleneck, then. Does it make any diff…

I think the biggest issue is that you've shown you're willing to modify traffic for license control. If you'd simply released commercial support for $500/mo/instance I'd have gladly paid for it in my products and think many others would have too. Showing such obtrusive forms of DRM makes me not want to ever use any of your software again. I've spent the past couple of hours migrating from Caddy to nginx and I've contacted them about buying support. I guess the silver lining was the nginx was was easy to migrate to.

Re: Announcing Caddy Commercial Licenses

#202

Post by tylersmith » Wed, Sep 13, 2017, 10:03 PM UTC

JosephLark wrote: post #57

lol768 wrote: post #38

Earlier quoted context omitted.

> Why's that? (And even among your technical visitors, how many of them actually inspect the response headers?) I dislike this for a few reasons. Firstly, it honestly comes across as petty. I'm using the server for personal reasons, it's for a non-commercial site which I don't make money off. I don't display ads, and suddenly I'm now being forced to serve ads to my visitors. The medium of delivery is utterly irreleva…

> No. The point is, you've annoyed someone who liked your software, used it for personal use (costing you nothing) and would've happily recommended it to colleagues. This is worth keeping in mind. Personally, this change is putting me off Caddy to the point that I might stop using it for personal sites. The big feature for me - instant LetsEncrypt TLS certificates - can be done on other servers now fairly simply. So…

I was pleasantly surprised at how quickly I was able to rip out Caddy and replace it with nginx and Traefik (in different cases), even with the LE automation. It shouldn't be much of a burden to move your person projects I don't think.

Re: Announcing Caddy Commercial Licenses

#203

Post by tylersmith » Wed, Sep 13, 2017, 10:05 PM UTC

mholt wrote: post #56

StavrosK wrote: post #30

Earlier quoted context omitted.

> And even among your technical visitors, how many of them actually inspect the response headers? I find that a bit disingenuous. You can't both include annoying headers and argue that they aren't annoying anyone because nobody will see them. If nobody will see them, why add them in the first place?

I know devs who use Sublime Text almost indefinitely without paying. They don't mind the little "Hey don't forget to buy" popup every once in a while. We aren't putting popups on your site. :P

No, you're injecting data into traffic. That's way worse than a text editor occasionally reminding you you haven't paid.

Re: Announcing Caddy Commercial Licenses

#204

Post by tempay » Wed, Sep 13, 2017, 10:07 PM UTC

deftnerd wrote: post #167

e12e wrote: post #119

Earlier quoted context omitted.

I get that a project want to sell licenses - but as a sibling comment states, Caddy appears to no longer be Free software, breaking freedom 1 (modify), 3 (distribute modified copies). [ed: it appears I misunderstood, only the binaries are under eula - so Caddy is in the (somewhat) unique position of distributing non-free binaries and Free source code. Kind of like a gpled iOS program I guess.] In addition, I'd consid…

Synergy, the app that allows a computer to share its mouse and keyboard over the network to other computers, did a more aggressive move a few years ago. It's still technically GPL because you can compile it yourself, but they charge $20 for a binary license and to enable certain features. I have similar concerns. I practice good security but I also enjoy security through obscurity. I prefer to prevent my users from k…

> Alternative is to run Caddy behind HAProxy or Nginx or something similar that can strip those headers out.

The EULA specifically states that this isn't permitted.

Re: Announcing Caddy Commercial Licenses

#205

Post by pheeney » Wed, Sep 13, 2017, 10:07 PM UTC

unethical_ban wrote: post #181

mattbee wrote: post #172

@mholt is being exceedingly generous to the whingers on this thread, on top of the generosity he's shown in writing Caddy to start with. It's not 2005 any more, Sun Microsystems is long gone. You won't raise any money from a business model that gives away your best work or selling support contracts alone. Caddy is a real innovation, and brings web server defaults bang up to date - it makes loads of complex configurat…

Eh. Still kind of shitty to have had access and then have it removed, and then say 'nothing has really changed, guys!'. If they rephrased it to admit they're moving to a Red Hat model of "pay for binary", the news would have fared better. More straightforward, with a direct comparison to a current, successful brand. Let's face it: They realized their product was popular, took advantage of tons of interest and documen…

> Let's face it: They realized their product was popular, took advantage of tons of interest and documentation/blogs/hype in the community, then decided to charge for binary distribution. It's a bit of a burn.

Or another way of looking at it: Open source has to be subsidized (either through free time or commercial backing) in order to continue to contribute to open source. The amount of time and effort to maintain a popular open source product is insane. They are creating a business model to continue to subsidize their open source contributions. Whats the alternative? Burnout and stagnation which would just result in forks and fracturing of the community if they are lucky.

Re: Announcing Caddy Commercial Licenses

#206

Post by tylersmith » Wed, Sep 13, 2017, 10:08 PM UTC

PenguinCoder wrote: post #189

To everyone saying that Caddy made it simple for automated LE; I agree, but also, it's not that difficult to setup with NGINX: Edit /var/nginx/ssl_common.conf ssl_certificate /etc/letsencrypt/live/ /fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/ /privkey.pem; location ^~ /.well-known/acme-challenge/ { default_type "text/plain"; allow all; root /var/www/example; auth_basic off; } Edit crontab, add: 30 2 * *…

Thanks for posting this. This is pretty much the setup I just replaced Caddy with and it's working well so far.

Re: Announcing Caddy Commercial Licenses

#207

Post by zzzcpan » Wed, Sep 13, 2017, 10:11 PM UTC

mholt wrote: post #197

NuSkooler wrote: post #193

Hi Matt! I've been using and advocating for Caddy for a while now, but I have to say this is a huge put-off. Don't get me wrong here, I'm in full support of a commercial version... but as you can see from the feedback here, this kind of thing is really frowned upon in the personal / OSS space for a variety of reasons. I encourage you to re-consider added headers. Perhaps look at a more heavy handed download process s…

Thanks for your comments. I think that this thread can be added to the bucket of all the others that reveal the unhealthy expectation in the FOSS community, and I'm not convinced that the "variety of reasons" are compelling. It's regrettable that our announcement today is so controversial. As much as a donation model is easy and safe, it is not a business plan. (We tried it.)

Maybe there is no big enough market for what Caddy is offering right now. Have you considered pursuing other directions, make it really diverge from nginx, apache features and stand out? Maybe more into an out of the box security solution with integrated scraping protection, ddos protection, vulnerability scanning protection, exploit protection, overload protection, xss/csrf protection, WAF features, full-page caching. Or even into an edge infrastructural solution for hosting companies and such, with dns management and everything.

Re: Announcing Caddy Commercial Licenses

#208

Post by tylersmith » Wed, Sep 13, 2017, 10:13 PM UTC

StavrosK wrote: post #168

djvdorp wrote: post #164

Earlier quoted context omitted.

My thoughts exactly. And I am afraid we are moving even further away from packages with this move..

Yeah... What I don't understand is why nginx doesn't have built-in LetsEncrypt cert fetching yet.

After this I would bet they have it before very long.

Re: Announcing Caddy Commercial Licenses

#209

Post by tylersmith » Wed, Sep 13, 2017, 10:16 PM UTC

Whitestrake wrote: post #135

andmarios wrote: post #112

Not being able to use the release binaries (even from github) for commercial purposes is a bummer but if this is the price to pay for having caddy available as open source, then it is fair. What I am afraid of, is that this friction to start with caddy (because $50 per month is way too much for most use cases) will affect its user base and as a consequence the participation in development. Of course mholt and the tea…

To compile without the `Caddy-Sponsors` header, include this line before the plugin comment: sed -ie '/Header().Set("Caddy-Sponsors/d' ../caddyhttp/httpserver/server.go

This only helps until they start injecting data in different places. Maybe soon they'll add HTML comments or JavaScript to popup a notification. Now that they've shown they don't care about users' data security I don't know why anybody would expect them to stop here.

Re: Announcing Caddy Commercial Licenses

#210

Post by tylersmith » Wed, Sep 13, 2017, 10:23 PM UTC

mholt wrote: post #197

NuSkooler wrote: post #193

Hi Matt! I've been using and advocating for Caddy for a while now, but I have to say this is a huge put-off. Don't get me wrong here, I'm in full support of a commercial version... but as you can see from the feedback here, this kind of thing is really frowned upon in the personal / OSS space for a variety of reasons. I encourage you to re-consider added headers. Perhaps look at a more heavy handed download process s…

Thanks for your comments. I think that this thread can be added to the bucket of all the others that reveal the unhealthy expectation in the FOSS community, and I'm not convinced that the "variety of reasons" are compelling. It's regrettable that our announcement today is so controversial. As much as a donation model is easy and safe, it is not a business plan. (We tried it.)

"the unhealthy expectation in the FOSS community"

Nobody is "expecting" you to make good software, we're just saying that now that you've turned a formally mostly decent piece of software into adware with an untrustworthy author there's no reason to not just use better software. Software that doesn't molest your traffic. I wish you luck with your business but don't know why anybody would pay for software written by you two ever again.