- cross-posted to:
- [email protected]
- cross-posted to:
- [email protected]
Hello everyone,
I’ve been using Standard Notes on the recommendation of Privacy Guides since the beginning of this year, I believe, and it has truly been a fantastic experience. It serves my purpose perfectly, is truly cross-platform, open source, and lightweight. It was a real find, and I couldn’t be happier to have it installed. However, it seems that they are planning to change the licensing to one that restricts companies from abusing their code (which makes sense), but I wanted to know if this goes against the guidelines in terms of considering it recommendable.
I don’t really understand licenses, so correct me if I’m wrong, but with this change if the project becomes private, a fork couldn’t be created for all users who want to continue having the software format but not the backend… Is that correct?
Thanks
In terms of privacy, nothing would change, it’s still the same as ever so I think the recommendation can absolutely stay up, even proprietary apps are suggested on Privacy Guides.
In terms of software freedom, this is a terrible change and I really dislike projects moving to source-available models, in this case, as the other commenters said there, I don’t even think it’s legal, unless every contributor has signed a CLA in the past.
I feel for not wanting to be explioted by corporate, but they could have gone the dual licensing path and instead chose to restrict everyone’s freedom, even us users. Now that doesn’t mean forks can’t be made I believe, it’s just that anyone who does that, won’t ever be able to sell the service which could be unsustainable since they made the server CC-BY-NC-SA, that’s a big turn off for those who want to host that
deleted by creator
Even if it were true (it is not: there are techniques like static analysis, intercepting client-server communication, etc., that can confirm application behavior), how is having “zero expectations of privacy with closed source apps as you cannot independently verify what they [sic] app is doing” relevant when the source is available?
Why do you say their actions were illegal? In every repository of theirs that I looked through (just app (formerly web), server, self-hosted, mobile, and desktop), the contributors on every single PR that had been merged was from someone in the org. Unless there are some other contributions that I’m unaware of, their license change was completely legal.
There are tons of community created plugins, e.g., for editors (heck, I created and maintain one) but the licenses on those haven’t been changed and aren’t impacted. For any plugin that’s bundled with SN, an AGPL license can be a problem, and I didn’t check the contributions on their plugins, so maybe there’s an issue there and that’s what you’re saying is illegal? If those are still licensed as AGPL my understanding is that’s still legally allowed when they’re doing it, so long as there are no community contributors.
Personally I don’t understand how moving away from AGPL could accomplish their goals - AGPL already prevents another company from forking their server, changing the code, and not distributing those changes to their users… is the concern that some major companies are doing that and charging for it or using it internally? But regardless, being source available instead of FOSS doesn’t impact privacy expectations.
In fact, the way SN handles this is much better than the way Signal does, even though Signal uses a FOSS license. With Signal, development takes place in a private repository and it is later (sometimes as much as a year later) merged to the public one. My point is, the license isn’t the only thing that matters.
In terms of impact on contributions from the community - well, given that there haven’t been any, there won’t be an impact to the server or app repos. But I could see this impacting the willingness of the community to continue to build and maintain plugins.
Even if what they’re doing is legal, it still has a negative impact on the privacy community. F-droid no longer providing Standard Notes builds is going to cut off people from using this app’s updates going forward. It may end up being relegated to the IzzyOnDroid repo, but still not everyone uses that.
At least Signal provides a method outside of F-droid for automatic updates.
Good point. I’m not sure if IzzyOnDroid considers the CC license to be “free as in freedom” but even if they do, they allegedly have a 30 MB limit per application, and the most recent SN apk is just under 100 MB.
Signal’s approach is useful if the goal is to avoid being tracked by Google without losing out on the convenience of auto-upgrades, but it’s still bad in that they could theoretically introduce a client-side vulnerability that nobody external would have a chance to audit.
You can also use Standard Notes via the web app, which can be installed as a PWA. And even though it’s not FOSS anymore, the source is at least kept up to date.
I did too, but because I’m broke lol.
That is true, but for the front end applications, if that is open source and has sound encryption then the server could even be proprietary, it won’t be able to break the encryption, so your data would be safe, maybe not so much for some metadata though.
In this case the apps were changed to be all AGPL as I understand, so that should be ok.Agree with all the rest, don’t like the maintainer’s attitude.
Edit: I was wrong, even the app is source available now (CC Noncommercial), not exactly good, but better than proprietary I guess
I just checked their Github and the app is CC-BY-NC-SA but the server is still GPL v3.