Why not make Cloudron fully open source again?

[ntnsndr]

Thanks for raising this question, @jdaviescoates.

I am personally not sure open-sourcing is critical here, as I think the first beneficiaries would be big cloud platforms (AWS, etc) that would then be able to host it and cut out any income for the developers. The current source available arrangement strikes me as probably necessary and appropriate.

I'm increasingly convinced that OSS as such is broken as a means of protecting against corporate exploitation, and it should not be celebrated as an end in itself. Based on my conversations with @girish, I think the single most important fact about Cloudron is that the company is bootstrapping (based on our subscription fees) and not seeking an exit. As long as that's the case, I think the community should support their self-defense through licensing.

Rather than fixating on licensing, it might be more relevant to all of us to discuss the possibility of an "exit to community" for Cloudron, in which ultimately the company we pay into becomes owned by—and accountable to—the people who rely on it. This could help ensure that the company we're paying into, and that is stewarding the code we depend on, doesn't get captured by forces beyond our control.

[necrevistonnezr]

@ntnsndr said in Why not make Cloudron fully open source again?:

Thanks for raising this question, @jdaviescoates.

I am personally not sure open-sourcing is critical here, as I think the first beneficiaries would be big cloud platforms (AWS, etc) that would then be able to host it and cut out any income for the developers. The current source available arrangement strikes me as probably necessary and appropriate.

I'm increasingly convinced that OSS as such is broken as a means of protecting against corporate exploitation, and it should not be celebrated as an end in itself. Based on my conversations with @girish, I think the single most important fact about Cloudron is that the company is bootstrapping (based on our subscription fees) and not seeking an exit. As long as that's the case, I think the community should support their self-defense through licensing.

Rather than fixating on licensing, it might be more relevant to all of us to discuss the possibility of an "exit to community" for Cloudron, in which ultimately the company we pay into becomes owned by—and accountable to—the people who rely on it. This could help ensure that the company we're paying into, and that is stewarding the code we depend on, doesn't get captured by forces beyond our control.

+1!
Very good points.

[marcusquinn]

@ntnsndr wise words!

[rmdes]

@ntnsndr wait, are you https://twitter.com/ntnsndr ?
if yes, it's really nice to have you here, I was sensing some "social coop" approach to your comment and I think it's really great to have you here

[jdaviescoates]

@rmdes said in Why not make Cloudron fully open source again?:

@ntnsndr wait, are you https://twitter.com/ntnsndr ?

It is

I know Nathan uses Cloudron with his students at at the University of Colorado Boulder and so I reached out to him to chime in here

As I mentioned to him in email:

re protecting against corporate exploitation, given it is "specifically designed to ensure cooperation with the community in the case of network server software" my understanding is that the AGPL provides at least some protection against that as per https://www.gnu.org/licenses/agpl-3.0.en.html

@ntnsndr replied:

The AGPL is indeed oriented this way, though from what I understand its protections have proved overly ambiguous and inadequate against the present threats.

So whilst I really love co-ops and 'exit to community stuff' (and I'd fully support, and be really excited by such a future for Cloudron were @nebulon and @girish open to such ideas?) I think my question still stands:

What exactly is it about Cloudron and/or the AGPL that leads @nebulon and @girish to the conclusion that if Cloudron were fully AGPL licensed they would be unable to continue with the existing sustainable business model of selling subscriptions for updates and support?

Given the tech giants are already the most powerful human entities on the planet, ever, with almost unfathomable resources (this visualisation of e.g. just Bezos' personal personal wealth is pretty gut wrenching), I think if they wanted to directly compete with Cloudron they could very easily do so regardless of how the code is licensed: they could just allocate an infinitesimally small percentage of their budget to reverse engineer it. But, really, why would they bother? They already own and run the infrastructure the powers the vast majority of the Internet, including nearly all web and mobile apps.

[jdaviescoates]

@jdaviescoates said in Why not make Cloudron fully open source again?:

re protecting against corporate exploitation, given it is "specifically designed to ensure cooperation with the community in the case of network server software" my understanding is that the AGPL provides at least some protection against that as per https://www.gnu.org/licenses/agpl-3.0.en.html

Moreover, to outsiders, Cloudron itself looks exactly like the "corporate exploitation" we're supposedly protecting ourselves against with proprietary code: if Docker and the 80+ open source app we can all run on Cloudron weren't themselves open source (and Ubuntu and so much else), well then Cloudron couldn't exist.

I know this isn't strictly true given upstream contributions and the genuine desire of @nebulon & @girish to be able to increase such contributions in the future, but it's nevertheless a valid perspective and criticism to make: Cloudron has built a successly business off the back of open source, just like the tech giants (and basically every business using tech, i.e. basically every business).

And this isn't hypothetical either. If you click in some of the links I included in my OP these are exactly the arguments some people are making against recommending/ using/ promoting Cloudron.

[rmdes]

Maybe I'm wrong and hopefully @girish @nebulon will find the time to chime in here but I think this issue is related to survival, ability to live from one's work more than anything else.
I may be wrong, I don't know.

But this thread here : Open Collective could be a way to do both : securing funds from the community, in full transparency, funds that could even benefit other OSS projects AND at the same time, secure a line of income for those that contribute directly and make the Cloudron project possible.

The argument that X or Y have made a business off the back of open source is valid in the absolute but also worthless until the big tech giants, the entire web has been powered by open-source without ever, society, either in the US/EU etc...ever considering that The Internet is a common good, a public service and that those that built it, from kernel developers to external contributors are in fact creating common value that is largely sucked by big corps and big players, at a scale impossible to compare to what Cloudron staff is taking.

This question is a structural global problem more than a particular approach that concerns only cloudron; its good to have this discussion but it's even better to put those giants that extract wealth in vast orders of magnitude compared to cloudron, in front of the problem.

it's easier to rant and even attack little projects, it's much more complicated to bring this disucssion at european, american, global level and actually find ways to fix this mess from a global perspective.

[necrevistonnezr]

Maybe we should all give it a rest now in trying to tell Girish und Nebulon what do do with their project and their income and trying to nudge them into one direction.

[jdaviescoates]

@rmdes said in Why not make Cloudron fully open source again?:

The Internet is a common good, a public service and that those that built it, from kernel developers to external contributors are in fact creating common value that is largely sucked by big corps and big players, at a scale impossible to compare to what Cloudron staff is taking.

This is true, but just for devil's advocate's sake it's also true (and often unmentioned) that big corps have actually also been the primary funders/ developers of of lots of open source too e.g. the Linux kernel: I'm not sure of current figures but I remember in the past IBM employees had written something like 70% of the code.

But yeah, I totally want to ensure @girish and @nebulon can continue to work on and get properly paid for working full time on Cloudron. They've created a really amazing product, and in some ways even more impressively have built a really fantastic community around it too. Both of those things are Really Hard (TM) and they've totally nailed it.

I'm also totally up for hearing, and open to being convinced by, arguments that if Cloudron were AGPL again it would somehow make it harder to pay @girish and @nebulon to work on it and to have sustainable livelihoods. I just can't see that myself (I might be blind) and don't think anyone has actually made that case yet?

I'm beginning to sound like a stuck record, but all I can see are positives.

I guess the potential risk isn't really that tech giants would clone and undercut Cloudron at all. The risk is that some random freelancer or agency could potentially do so. This is actually the story of how Sharetribe became proprietary: someone did clone their business and undercut them, cutting into their revenues.

As I understand it (please someone correct me if I'm wrong) AGPL is designed specifically be used to prevent that (well, at the very least to prevent people doing that without also contributing back - but perhaps that's all it does and that's the problem?), but that wasn't the understanding of Sharetribe's developers.

How real is that risk? How many paying customers here would go elsewhere? Given how much we all value the community here, I think very few.

There are loads of GPL premium wordpress plugins out there, many of which can be found for free out in the wild. But in most cases it pays to pay. In the end it's just so much easier to get updates and support in a timely manner by paying.

[marcusquinn]

@necrevistonnezr Yeah, the thread should locked, everyone's had their say now. Developer time is precious. Their work, their choice, their freedom to change and change again. I believe in good work more than I believe in good intentions.

[jdaviescoates]

@marcusquinn said in Why not make Cloudron fully open source again?:

@necrevistonnezr Yeah, the thread should locked, everyone's had their say now. Developer time is precious. Their work, their choice, their freedom to change and change again. I believe in good work more than I believe in good intentions.

Um, actually, the two most important people @girish and @nebulon have not yet had their say.

And nor have most of the other people who have so far packaged apps for Cloudron.

Moreover, the very first response to this thread was @nebulon who said:

Thanks for your elaborate post, we will answer in more detail,

I'm actually as happy as every one else that they are busy spending their time developing instead of replying here, but I'd still really like to hear that more detailed answer at some point!

And I'd still love to hear what other app packaging contributors think too.

I really don't understand this desire to shut down healthy debate and discussion between members of the Cloudron community.

But sure, if either @girish or @nebulon themselves would like to lock this thread they could of course choose to do so.

[Lonkle]

I think this thread is valuable for @girish and @nebulon - because there are people like us who are passionate about open-source and we all have different reasons why we want to develop for and maintain apps for Cloudron and though I don’t have any issue with “semi-open-source” - I know a lot of other developers that do. Which this discussion and girish's / nebulon's reaction to the entire thread of opinions - may be a way to attract new develoeprs: “Cloudron goes fully open source” kind of headline.

I will say tho - if Cloudron became closed source I would stop creating apps for it (and I have 5 apps I have in mind to continue to port already)...okay maybe, I'm 50 / 50 on that (I really like Cloudron ). But I couldn't have created the apps I have now without direct access to their very readable and commented source. Though, they’ve made it decently clear thats not what the developers want to do (close the source entirely).

So yeah, I want to continue to hear people’s passion about their open source software beliefs and how they feel about it in the Cloudron context.

[scooke]

@jdaviescoates I went back and read a link you shared, a convo in a Mastodon instance, by someone who seemed to brush away Cloudron's approach and mindset automatically. I wouldn't take that opinion expressed in such a way seriously, especially since they didn't in any way outline exactly how they can see Cloudron managing or limiting access. I mean, the first and most important part of Cloudron is that we host it ourselves on our own servers and backup things to destinations we control.

Somehow the negative viewpoint (not saying this is yours) that Cloudron has benefited off the back of open source projects ignores all that it conversely has done to broaden each projects exposure, without (I assume) asking for financial renumeration from those projects for doing so, nor excluding projects if they won't pay up. I think if Cloudron went that way then a negative view of Cloudron would totally understandable.

I can take a step back and look historically at all the times I tried to self-host something, and got stuck, with minimal help from said-project's forums, and came away with nothing, and remember thinking, "I'd pay some one to help me with this!"... voila, that is the role Cloudron has played. I share your enthusiasm for this project!

Like you (in the mastodon thread), I tried Yunohost and Sandstorm and the like... just too many complicated problems that no help from forums could provide. They always forced me back to doing it myself: I've had a heck of a time trying to get nginx and apache running on the same server; I've never successfully gotten docker or docker-compose to seamlessly add services or apps to an existing two-app setup (mysql and wordpress) even though it is supposed to be so incredibly easy (even with the promised answer of portainer). I can setup and run a basic VPS running LAMP... going beyond that.... I am soo thankful for Cloudron!

I wonder if the licencing can play a role in how much ownership @girish and @nebulon and the Cloudron team feel toward their code and their subsequent "responsibility" to keep it running well. I mean, if it were as open as can be, and others started forking it and running it and offering their own specialized subscriptions for their version of Cloudron, I could see that there would be some run-off of problems and complaints back to the Cloudron team that this or that isn't working on Fork A or Subscription Service D, and then they end up maintaining code for ideological reasons rather than offering and improving a service for productivity and (user-)independence reasons.

[jdaviescoates]

@scooke thanks for your further input. I agree that some of the commenters on Mastodon were basically just rude and seemingly unable to capture any nuance, others less so.

I think I may try and find and reach out to licensing experts to see to what extent releasing AGPL could protect from (or not) people cloning Cloudron and pulling updates then selling the same service for less (which I guess could be a real risk).

Also, just thinking out load, but I notice loads of premium WordPress plugins are GPL but the manage to keep going without someone buying lifetime updates and the re-selling on the cheap. But thinking about it, in many cases such projects, whilst technically GPL are actually much less open than Cloudron (I guess because they have to be to reduce risk), in that none of their repositories are publicly available.

https://premium.wpmudev.org/ is one such example. And, actually, just searching for 'wpmu GPL' to check I'd remembered correctly that that is how they are licensed the top result for me was actually https://www.gplvault.com/product-category/wordpress-plugins/wpmu-dev/ who are selling their plugins for less (I presume).

I also note that, having subscribed to WPMU in the past, I never actually thought much of their support, whereas Cloudron support is great!

Lots to ponder. Perhaps there are good reasons for Cloudron to not be re-released as AGPL... even though right now I'd still support that

[mehdi]

@jdaviescoates said in Why not make Cloudron fully open source again?:

I think I may try and find and reach out to licensing experts to see to what extent releasing AGPL could protect from (or not) people cloning Cloudron and pulling updates then selling the same service for less (which I guess could be a real risk).

You also have to remember that for someone to clone Cloudron and re-sell it, they would have to re-write the whole app-store back-end code, which is not open-source / source-available.

So cloning Cloudron would really not be that easy.

[Lonkle]

This thread got so big. I wanted to clarify with Cloudron - is it just the dashboard, and the billing / licensing that is closed off source-wise?

As for Premium Wordpress plugins GPL debacle. There have been attempts to capitalize off the fact they can legally resell the plugins once bought and numerous sites have tried and failed. They never last more than a couple years.

Reason being that people don't buy software off of shady sites that could inject things and they had no way to automatically update like the official licenses allowed. So most of them were dead pretty quickly.

[jdaviescoates]

@mehdi said in Why not make Cloudron fully open source again?:

You also have to remember that for someone to clone Cloudron and re-sell it, they would have to re-write the whole app-store back-end code, which is not open-source / source-available.
So cloning Cloudron would really not be that easy.

I know it's not open source (hence this whole thread), and the scenario I was positing would only apply post-re-open-sourcing.

But I was under the impression everything is already source-available, no?

[mehdi]

@jdaviescoates No, I mean the app store part (what's installed on the Cloudron.io infrastructure) has never been open-source. And I believe nobody ever asked for it to be. The cloudron dashboard (what's installed on your own server) is what used to be open-source.

[necrevistonnezr]

@marcusquinn said in Why not make Cloudron fully open source again?:

Interesting weekend read: https://plausible.io/blog/open-source-funding

More interesting reading material dated 12 October 2020 from the same source: https://plausible.io/blog/open-source-licenses

So we want a “don’t be evil” license and here’s what we are trying to accomplish with it:

• We want to prevent corporations from taking our code and using it as part of their closed-source proprietary products
• We want to prevent corporations from offering Plausible as a service without contributing to the open source project

We want to prevent corporations from confusing people and making them think that the service they sell is in any shape or form approved by the original team. [...]
Although we don’t want closed source corporations to directly compete with us using our own work, it’s important to leave the space open for forking of the project and incorporating it into other open source works.

This is the best way to future-proof the project against bad actors, including ourselves if we become evil at some point. By allowing open source forks and competitors to exist, we are opening ourselves up to healthy competition and accountability from the open source community.

Plausible is now AGPLv3 licensed
So how do we accomplish all that? We do it by changing our license. Plausible Analytics has now changed the license from the MIT to a newer licensing scheme called GNU Affero General Public License V3 (AGPLv3) or any later version. [...]

This change makes no difference to any of you who subscribe to Plausible Cloud or who self-host Plausible, but it may upset a few corporations who tried to use our software to directly compete with us without contributing back.
[...]

The goal of the AGPL license is to maximize user freedom and to encourage companies to contribute to open source.

What is the GNU AGPLv3 license?
Copyleft license: “If you make a derivative work of this, and distribute it or run it as a service on a server to others then you have to provide the source code under this license”

What are the benefits of the AGPLv3?
The AGPL license is identical to the original GPL license with the only additional term being to allow users who interact with the licensed software over a network to receive the source for that program.

AGPL is designed to ensure corporations contribute back to the open source community even when running the software as a service in the cloud.

If you used AGPL-licensed code in your web service in the cloud, you are required to open source it. It basically prevents corporations that never had any intention to contribute to open source from profiting from the open source work.

It explicitly prohibits corporations from parasitically competing with an open source project. They won’t be able to take the code, make changes to it and sell it as a competing product without contributing those changes back to the original project.

Here’s that extra paragraph:
“If you run a modified program on a server and let other users communicate with it there, your server must also allow them to download the source code corresponding to the modified version running there”.

What are the restrictions with the AGPLv3?
A corporation needs to be clear and provide a prominent mention and link to the original project so people that are considering to use their version of software can be aware of the original source

If a corporation modifies the original software, they need to open source and publish their modifications by for instance contributing back to the original project

So how can a corporation commercialize a FOSS project without open sourcing their modified code? They can purchase a commercial license to remove the copyleft restrictions and in that way support the original project.

[jdaviescoates]

@mehdi said in Why not make Cloudron fully open source again?:

No, I mean the app store part (what's installed on the Cloudron.io infrastructure) has never been open-source.

But all the app packages themselves are open source, no?

I think I'm missing something. Like @Lonk said, be good to get some greater clarity on the status quo.

[avatar1024]

@jdaviescoates Most but not all I don't think (TeamSpeak isn't, right?). Sorry I don't have a lot of time at the moment to contribute much but I think this is a very important conversion. At least in my circle, it's difficult to promote cloudron due to its licensing choice and I would need more info to explain / justify such a choice (and everyone of course wants the dev to get reliable income, people just think a free software license would not endanger the business model).
Anyway, thanks for starting this thread. I will write more on the topic soon

[ruihildt]

@avatar1024 Correct, not all apps are free software. It never was a requirement for apps to have a specific license to be packaged.

It just happens that most apps available for packaging -and thus on which you can freely base a businees model on- are free software.

[murgero]

@ruihildt said in Why not make Cloudron fully open source again?:

It never was a requirement for apps to have a specific license to be packaged.

Not to say that all licenses types can be packaged - the license for the app needs to allow free distribution of the software in order for us to package it.

[jdaviescoates]

@avatar1024 said in Why not make Cloudron fully open source again?:

@jdaviescoates Most but not all I don't think (TeamSpeak isn't, right?).

Confluence and Emby too. Possibly others (I would still really like a filter in the app store for licences and LDAP support)

But, I think the additional Cloudron code in the Cloudron packages for those apps is still MIT even for these non-open-source apps too.

@avatar1024 said in Why not make Cloudron fully open source again?:

At least in my circle, it's difficult to promote cloudron due to its licensing choice and I would need more info to explain / justify such a choice

Same.

@avatar1024 said in Why not make Cloudron fully open source again?:

and everyone of course wants the dev to get reliable income, people just think a free software license would not endanger the business model

Exactly.

Although I'm still open to being convinced otherwise if there is some genuine risk I've not fully considered as a non-developer.

@avatar1024 said in Why not make Cloudron fully open source again?:

I will write more on the topic soon

Thanks

[nilesh]

IMHO, there are serious problems with AGPL-licensed software that is hosted on servers - namely, it allows Amazon AWS , Google GCP, Microsoft Azure etc to take the code and start charging for it without contributing anything back to upstream. The access to code has stopped being the bottleneck. The problem is now centralization. We've seen this happen again and again with Redis, Elastic etc.

The question is whether this risk is worth the developer contributions and user adoption that Cloudron is missing out by NOT being open-source.

[Lonkle]

@nilesh The devs seem to imply they don’t want code contributions but will allow them if it allows a new app in the store that couldn’t exist without them.

That’s the vibe I’ve gotten anyway. I’ve written code contributions to box for my VPN Client app and plan to add contributions to dashboard. But I’ll let you guys know what happens.

[scooke]

@nilesh I signed up way before there were the amount of developer contributions we can see now because what the Cloudron team could offer was already awesome. I've seen the forums get really busy with lots of dev suggestions; I've tried non-Cloudron submitted apps that didn't work out for this or that reason - even though some are still on offer, I'm not sure to what degree the Cloudron team has taken "full" responsibility for these dev-contributed apps, but it has all made me wonder just how much busier these contributions have made the Cloudron team, and to what detriment to existing users or road plans. Obviously the Cloudron team has a better picture of who the paying users are, but I suspect there are many like me. Don't get me wrong, I super appreciate the time outside devs and users have freely given to helping make the overall Cloudron platform broader, but the people I'm looking at getting to sign up and pay for Cloudron are more like me , though they have less awareness or interest in open-source in general, they do like things that work, and they like having ownership and control over their data (meaning we won't ever sign up with an AWS, GC or Azure-branded cloudron). My main concern is that Cloudron remains functioning to be able to offer their service.

[Lonkle]

@scooke That sounds spot on and the best demographic to go after. Since I’m just a dev that finds this stuff fun (not the target market); they still do go out of the way to help me which I think shows how much character both of them have. Which is another reason I’ve backed Cloudron so much.

I did want to ask what you meant by installing apps outside of the official AppStore and what was your experience with that?

[jdaviescoates]

@nilesh said in Why not make Cloudron fully open source again?:

IMHO, there are serious problems with AGPL-licensed software that is hosted on servers - namely, it allows Amazon AWS , Google GCP, Microsoft Azure etc to take the code and start charging for it without contributing anything back to upstream.

Two things.

1. The scenario you describe is actually exactly what AGPL was designed to protect against, no? See https://www.gnu.org/licenses/agpl-3.0.html and lots of relevant quotes from that and other write-ups in posts above.

Perhaps you're thinking of a different license?

But, also,

2. as I said above, I think the risk of someone cloning Clouron is MUCH higher from a small tech agency than the Tech Giants taking the code. The Tech Giants have unfathomable resources. If they wanted to reverse engineer Cloudron it would take an unimaginably tiny fraction of their immense budgets.

[ianhyzy]

@jdaviescoates The Fair Code license makes this explicit - I think it might work well here if they choose to go open-source. https://faircode.io/

[ruihildt]

@ianhyzy Fair code is not a license, and it's not open source (OSI compliant).

[avatar1024]

This post is deleted!

[marcusquinn]

Just dropping this link here for inspiration while I remember: https://ghost.org/about/

[marcusquinn]

Reference the above and thinking out loud; I'm thinking to turn our efforts on the whole Brandlight WP/Woo stack, and probably wider peripheral development & maintenance business, into a Foundation.

Mostly for simplicity and arguments' sake, team, users & contributors become beneficiaries. Better trust for what happens with income & expenses.

I'm sure there's other advantages I need to research too but mostly a deceleration to the world that the work is for the quality of the products and no-one's looking for a quick-flip or windfall, just sustainable satisfaction and protection to keep on evolving.

[robi]

@marcusquinn Like a .coop too.

[marcusquinn]

@robi Maybe, I don't know much about either - but living in Jersey, I know Trusts and Foundations are in many ways big business as much as Companies.

[ruihildt]

The meeting with Cloudron enthusisats we had on Workadventure and reading the following article by ERP Next developers made me remember about this thread.

When this discussion started back in July 2020, nebulon said "we will answer in more details", but since then, we haven't heard from him and girish directly on whether Cloudron could become fully open source again.

@nebulon @girish With the time passed and the discussions, is it a question you feel ready to answer?

[marcusquinn]

I can't answer for Cloudron but if it were me, to go FOSS I'd want to split the functionality to a core FOSS package and commercial license for add-ons and support to protect the business IP.

Similar to Freescout & EspoCRM, plus the standard CLA that's now common with FOSS.

With that in mind, I don't know that gains would be quite what people would be hoping for since it's already source-available and any would-be contributor can already get involved with a free install.

I can understand the ideology, but in practice, for me, the experience, enthusiasm and renumeration of the creators is more important to me for security of continuity.

I'm sure the feature requests will eventually plateau, and the community supplement many more apps, at which time I guess that would afford more headspace for this.

In the meantime, it's the coming features and apps that have most value to me, so I guess anything distracting from that is going to be an intermittent long range conversation.

Sorry, I know you addressed the comment directly but I guess there's also other interests here that don't have this at the top of the wishlist still.

[Lonkle]

@marcusquinn said in Why not make Cloudron fully open source again?:

I can understand the ideology, but in practice, for me, the experience, enthusiasm and renumeration of the creators is more important to me for security of continuity.

I live and breathe open-source, but this right here is the most important for me in all projects I contribute to (longevity).

[necrevistonnezr]

@nebulon @girish
Just thinking out loud here but have you considered the consequences of MongoDB‘s license (SSPL = Server Side Public License) for apps on a Cloudron yet? I came across it at my work recently and it’s a quite drastic „viral“ copyleft license:

13. Offering the Program as a Service.

If you make the functionality of the Program or a modified version available to third parties as a service, you must make the Service Source Code available via network download to everyone at no charge, under the terms of this License. Making the functionality of the Program or modified version available to third parties as a service includes, without limitation, enabling third parties to interact with the functionality of the Program or modified version remotely through a computer network, offering a service the value of which entirely or primarily derives from the value of the Program or modified version, or offering a service that accomplishes for users the primary purpose of the Program or modified version.

“Service Source Code” means the Corresponding Source for the Program or the modified version, and the Corresponding Source for all programs that you use to make the Program or modified version available as a service, including, without limitation, management software, user interfaces, application program interfaces, automation software, monitoring software, backup software, storage software and hosting software, all such that a user could run an instance of the service using the Service Source Code you make available.

So I think it does not affect the Cloudron source code but potentially the source code on all apps using MongoDB.

Overview: https://www.percona.com/blog/2020/06/16/why-is-mongodbs-sspl-bad-for-you/

[mehdi]

@necrevistonnezr said in Why not make Cloudron fully open source again?:

So I think it does not affect the Cloudron source code but potentially the source code on all apps using MongoDB.

That is not the case. The SSPL provision in question only applies when you sell Mongo itself as a service. Key phrase in you citation :

offering a service the value of which entirely or primarily derives from the value of the Program or modified version

The point is to prevent Cloud service providers like AWS & such to sell managed versions of Mongo, with their own modifications & optimizations, without contributing back to the upstream Mongo.

[marcusquinn]

@necrevistonnezr Very interesting, thanks for sharing! I like to think I understand things given enough reading, but it does seem to be one minefield of cost and IP claims risk.

[marcusquinn]

@mehdi Also interesting, I'm not sure I'd trust Amazon's commentary on anything but I kinda feel Percona's seems well intended.

Given most SaaS are just hosted CRUD apps, it would seem to me legit Mongo could slide into your Inbox with some demands if they chose to?

[necrevistonnezr]

@mehdi
Nope, Sec. 13 of the license does contain „selling“ a service, it speaks of „make the functionality of the Program (…) available to third parties“.
If you provide access to a MongoDB instance - e.g. you host an app that others can interact with - and that uses MongoDB, you’re in.

And the definition of „Service Source Code“ - the one you have to publish - is extremely broad.

The same applies to Elastic / Kabana by the way, they switched to SSPL as well (they also use Elastic V2 license but that’s worse).

[marcusquinn]

@necrevistonnezr Correct me if I'm misunderstanding this but is this what they are saying?

• If you use MongoDB in your XaaS, you have to make all your code available AGPL or buy a MongoDB licence to keep your code private.
• If you use a MongoDB SaaS you can legit ask that company to give you a copy of all code necessary to run your own instance.

Is that what it says?

To me that sounds good for consumers, and bad for close-source SaaS businesses or open-source ones that are less obligatory than AGPL?

I'm in the "who gives a monkeys about the code, the business is the people who know how to use it" camp - but then I doubt that's compatible with venture capital aspirations to own stuff - but then I've not seen anything VC backed that couldn't have been made cheaper and as successful other ways.

[mehdi]

@necrevistonnezr said in Why not make Cloudron fully open source again?:

make the functionality of the Program (…) available to third parties

This means directly. When you host an app that uses MongoDB in the back-end, you are making the app itself available, not mongodb, so no, it does not apply.

CF this citation from Mongo's own FAQ about SSPL:

Does section 13 of the SSPL apply if I’m offering MongoDB as a service for internal-only use?

No. We do not consider providing MongoDB as a service internally or to subsidiary companies to be making it available to a third party.

Or also :

What will happen if someone in the community is currently building something on MongoDB Community Server?

There will be no impact to anyone in the community building an application using MongoDB Community Server unless it is a publicly available MongoDB as a service. The copyleft condition of Section 13 of the SSPL does not apply to companies building other applications or a MongoDB as a service offering for internal-only use.

Source https://www.mongodb.com/licensing/server-side-public-license/faq

[necrevistonnezr]

@mehdi
The FAQ is not binding in any way. Only the license text is binding and (purposefully) vague (in order to create uncertainty and thus motivate companies to license).
As a lawyer, I would not recommend to built a business on the mere hope that implementing MongoDB code is conforming to the License Agreement.

[jdaviescoates]

This is very interesting and relevant to this discussion:

https://autonomic.zone/blog/co-op-cloud/

Basically, a UK based worker co-op digital agency who used to use Cloudron no longer do so and have now started yet another project to fulfil very similar goals called Co-op Cloud.

This is primarily because Cloudron is no longer open source.

I really love their project and wish them well and will do all I can to support them, but I can't help also feeling a bit sad that it needs to exist at all.

I reckon if Cloudron had remained open source their energy could been usefully put into helping to improving Cloudron rather than starting another project.

[fbartels]

@jdaviescoates said in Why not make Cloudron fully open source again?:

Co-op Cloud

It's an interesting, but also really quite different approach. I like cloudron because it's so "hands off". Their system really just seems to be a deployment utility for docker swarm along with a standardised way of deployment.

[scooke]

@jdaviescoates I like that they are still using Cloudron. It's interesting to me that their user-initiated installation all takes place on and from the local machine, not the server. That actually worries me because if my laptop dies, and I haven't made that most recent backup, what happens to my server setup? I like that Cloudron can do its work on the server. Of course, this point has not alot to do with their reason (morr libre) for trying to move away from Cloudron. I just thought I'd check out the blog and the service since you mentioned it. Seems easier to use than caprover, albeit with far fewer ready-to-go apps.

[danboarder]

@nebulon I have been following this conversation and testing Cloudron for over a year. I would like to see it fully open source for the same reason that Wordpress and Joomla CMS tools are fully open source: more people will use it and create a larger ecosystem that floats all boats. I for one would like to use Cloudron white-labeled on my own servers for hosting CMS websites and email for small businesses. Cloudron, as easy as it is, is still way too complex for the average small business owner or even their web guys. I host several hundred sites for small businesses and they generally "have a web guy" or an agency that they pay to "handle the website and email". Usually there is one person in a small company or organization who might want to login to Wordpress to post updates but beyond that it's too technical. Even maintaining plugin updates and backups are "handled by our web guy" from their perspective but they usually fall behind and eventually get hacked. So my goal is to build a better tool for web guys that have lots of small business hosting clients like myself. But at the moment I don't see a path forward for fully running Cloudron on my own servers for "web guys" and small agencies, so I'm hesitant to pursue it and I'm exploring alternatives, but it is very close to what I would like to provide if I can find a way to make it work.

[marcusquinn]

@danboarder FWIW I've been in the web business 20 years, and probably used every server control panel and managed/wordpress hosting, and none compare to the ease and value of Cloudron - for this web guy at least.

I don't know why the source code licence would stop you doing anything you want.

It sounds to me like you have the same options we all went through to end up here and happier.

I'm happy to recommend, and think you'll find Cloudron very time-liberating - but I can't see why the licence model would stop you using it?

Every action has a reaction, and every choice has an opportunity cost.

I guess your options are things like host server control panels like Plesk, managed services like Cloudways. Best I can say is I've been through those and time and gotchyas with those brought me here.

Personally, life experience tells me there's more than enough to do in business, if you have something that solves 90%+ of one area, you've probably got other areas that the freed up time would help you to get to 90%+ solutions in those other areas sooner than holding out for 100% solutions every time.

Don't know if that helps but then I didn't quite get the relationship between a common use-case and what that has to do with the licence model.

Maybe worth considering that being mass-market isn't always a good thing? Wordpress & Joomla for me are 90% wading through poor plugins, themes and bullshit marketing to find the small percent of things that are actually good. Focus trumps spray & pray every time in my world.

[3wordchant]

@jdaviescoates, thanks for the shout-out. I'd been meaning to hop over here and let people know about Co-op Cloud, but you beat me to it!

(Writing here in my personal capacity as a Co-op Cloud hacker, not speaking for Autonomic or for the project)

I'm personally really grateful that Cloudron exists, and the Cloudron team has been super-supportive to Autonomic over the years. Again, not speaking for the coöp, but I don't think we're fixin' to stop using Cloudron completely

You're absolutely right that the licence change was a huge factor in motivating me to help make Co-op Cloud, though – I'm proud that Autonomic had otherwise strictly avoided using proprietary software for our own infrastructure, and I share your sadness that we're maybe reinventing a wheel when there's such a great option available already That said, it's totally Cloudron's prerogative to re-license, and I wish them every continued success with the closed model

@fbartels, I think you're absolutely right that Cloudron is intended for a different group of people than Co-op Cloud is: I think Cloudron will continue to be a better "hands off" option, especially for people who don't know or don't like the command-line

To me, the main exciting things about Co-op Cloud are being able to keep your configuration in version control, using docker-compose (i.e. multi-service) format instead of Dockerfile format to package apps, and the licence. I guess, as @marcusquinn is saying, that there'll be many people who'll be more interested in the ease-of-use and automation of Cloudron, than that stuff.

@fbartels I'd also agree with you about what Co-op Cloud is:

a deployment utility for docker swarm along with a standardised way of deployment.

I'd just add that, as well as those two things, it's a collection of 30+ applications packaged using that format https://docs.cloud.autonomic.zone/apps/

Lastly, @scooke, that's a really good point about where the data is stored:

It's interesting to me that their user-initiated installation all takes place on and from the local machine, not the server. That actually worries me because if my laptop dies, and I haven't made that most recent backup, what happens to my server setup?

Co-op Cloud has a (so-far-undocumented) feature to mitigate this: you can store the ~/.abra/servers/ directory which contains app definitions in version control, or even symlink to folders in different repositories, if you have maintain different sets of apps with different servers with different teams. I use this myself and it works great, with minimal risk of losing work if my computer blows up.

A next step would be to auto-deploy the apps based on changes to repositories, which is something I'd like to add in time for the beta.

One other alternative (also not yet documented), which I'm also using on one project, is that you can install and run Co-op Cloud on the VPS you're managing – in which case the app definitions live on the server just as you're saying.

Caprover is definitely pretty similar: I'd started a comparison between it and Co-op Cloud but it doesn't look like it's made it into the docs yet. Watch this space!

[scooke]

@3wordchant Thank you for dropping in and sharing. Even though the topic here has been "which licence Cloudron uses", I am super keen for people be able to take control over their own data and manage it. I've slowly been disentangling myself from Facebook (actually did this 3 years ago), Instagram, Zoom, and have even started separating from gasp Google. I have Cloudron on more than one server; I even used Caprover*, which, despite its relative complexity, was useful for setting up and testing poste-io, wordpress was a breeze, etc. It is heartening to read your kind and enthusiastic words to the Cloudron team.

*I had to poke around to find the apps available on caprover: https://github.com/caprover/one-click-apps/tree/master/public/v4/apps)

[ntnsndr]

@3wordchant This is really exciting. Thank you for sharing this project!

[gabrielcossette]

There are many advantages to open source, but if I could point the most important to me in this case, it would be this one already mentioned by @ryangorley:

• Long-Term Assurance. The choice to self-host one's own infrastructure can be stressful. It becomes less stressful when you know that the software your using is open source and will be viable as long as there is a community willing to keep it going. This is one reason open source users become such loud advocates. They want that thriving community to live on forever, in a way they can't necessarily ensure a company will.

Whether I'm contributing apps or fixes as a:

• User (because I use Cloudron for my personal needs)
• Company (because I deploy Cloudron to my customers)
• App Author (because I want my app to be available in Cloudron)

I don't want my investment ( + ) to go to waste if Cloudron UG (the company), in the future:

• decides to change its terms in a certain way that don't fit my needs (or that I simply can't afford money-wise)
• is bought out by a company that has a different approach/view
• simply goes under

And to top it off, I would have to abruptly migrate all my apps to a different platform, costing me even more + .

But I still wish the best to the Cloudron team, which is doing an amazing job!

[marcusquinn]

@gabrielcossette If you can't afford Cloudron, you probably have bigger problems.

I'm an open-source first person too, but the source code is available, so I think that the reasoning is that the current team need to focus more on development than discussion, and open-source comes with a lot of admin overhead for discussion and rights-management.

I'm sure that will change in future, but probably just easier just not to get involved in all of that for now if we want all the main wish-list development things done any time soon.

[gabrielcossette]

@marcusquinn said in Why not make Cloudron fully open source again?:

@gabrielcossette If you can't afford Cloudron, you probably have bigger problems.

Maybe I didn't word it correctly, but that's not what I meant. I wanted to express that Cloudron terms and pricing could change in the future, in a way that could not be appropriate anymore for some users. And as the platform is not open source, you have no choice than migrating to a different platform.

It's all about risk management.
Personally, I find it too risky to host all my digital infrastructure on a platform that doesn't provide a good exit strategy.

[...] open-source comes with a lot of admin overhead for discussion and rights-management.

As long as you manage expectations, you can do open source and not burn you out.

You could state: "Hey, feel free to use the code, ask questions and make contributions, but as our team has limited resources (for now), we can't make any promise regarding support. Also, if you are interested in reliable support, check out our commercial offer. "