10 ms·

> As of version 0.10.9, Caddy emits an HTTP response header, Caddy-Sponsors, which is similar to the Server header that Caddy already has, except that this one

by lol768 9y ago

> As of version 0.10.9, Caddy emits an HTTP response header, Caddy-Sponsors, which is similar to the Server header that Caddy already has, except that this one credits our sponsors who make it possible to keep Caddy free for personal use. This header cannot be removed by the Caddyfile, and its presence is required by the non-commercial EULA. This requirement is waived by the commercial license, so the header is not present in those binaries. Really not a fan of this, guess I'll be compiling my own builds from now on. Don't get me wrong, I think charging for commercial licenses (which come with proper support) is a good business model, but my personal site shouldn't suddenly become an advertising outlet. The fact that the headers aren't seen by most non-technical users is moot. I find this practice pretty obnoxious to the point of looking at NGINX Plus for commercial use instead. Edit: Here's my fork https://github.com/WedgeServer/wedge https://github.com/WedgeServer/wedge Second edit: Accusation of trademark violation within an hour of the fork, classy! https://github.com/WedgeServer/wedge/issues/2 https://github.com/WedgeServer/wedge/issues/2

UseStrict 9y ago
Wow, in the course of this HN thread I went from learning about Caddy, to deciding against using it. Definitely not cool to immediately threaten legal action almost instantly after forking. Definitely not cool to force a header. I'll be sticking with nginx.
- callahad 9y ago
  Which is frustrating, because Caddy is a great product, especially from a solo operator standpoint. Configuration is simple and the defaults are sane. The humans behind Caddy are nice people. And while this move has somewhat soured my opinion of the project, I'm not so much angry as I am... sad. I want to use Caddy. I am using Caddy. But I don't want to use this Caddy, at the moment.
  - kuschku 9y ago
    Actually, the defaults are quite insane. For example: You might know that all domain names are in the root zone, named ".", so any domain actually is resolved to e.g. news.ycombinator.com. And if you enter the domain with the dot, it is the same DNS name, and should give you the same result. Apache does that, Nginx does that, Google’s cloud does that, Amazon’s cloud does that, all major sites do that... Caddy considers it irrelevant, and something users should add manually for all of their rules if they want it. Ignoring all the RFCs, because of personal ideals. https://github.com/mholt/caddy/issues/1632 https://github.com/mholt/caddy/issues/1632
- Posibyte 9y ago
  Exactly. I've heard raving reviews of how amazing Caddy is, but as I said earlier in this thread, the threat of filing trademark violations before even giving time for intent to be reasonably argued feels like a power play to scare the forks. It also makes their "We love Open Source!" claims feel much less genuine. I'm not excited about it as much anymore :\
- llao 9y ago
  It is worth revisiting the trademark-thread, the responses of everyone involved are level-headed and civil.
mholt 9y ago
Thanks for your feedback. I'd like to know more. > The fact that the headers aren't seen by most non-technical users is moot. Why's that? (And even among your technical visitors, how many of them actually inspect the response headers?) > I find this practice pretty obnoxious to the point of looking at NGINX Plus for commercial use instead. It's good to know that price isn't the bottleneck, then. Does it make any difference to know that commercially-licensed Caddy builds don't have that header?
- StavrosK 9y ago
  > And even among your technical visitors, how many of them actually inspect the response headers? I find that a bit disingenuous. You can't both include annoying headers and argue that they aren't annoying anyone because nobody will see them. If nobody will see them, why add them in the first place?
  - andkenneth 9y ago
    I think the headers are there so they can see if commercial sites are using the personal version and get them to pony up.
    - nopzor 9y ago
      Wouldn't they already know who their customers are?
    - jayrox 9y ago
      commercial sites have the easy ability to go to https://github.com/mholt/caddy; https://github.com/mholt/caddy; download the source; remove the header from header.go and server.go; compile; run i'd venture to guess many build the binary themselves already. so they can add their own tweaks. how would anyone be able to prove a website is being ran by caddy if the server doesn't announce that it is caddy?
      - detaro 9y ago
        If you do build it yourself, you don't fall under the commercial license, so it's correct if those are not detected.
Sir_Cmpwn 9y ago
With that statement, Caddy is officially nonfree software. It breaks freedom 1. Edit: I have been corrected. For the record, I still think this is a braindead move from Caddy.
- Karunamon 9y ago
  ..with regard to the distributed binaries only. The source code that you can compile yourself has no such restrictions and is still Apache 2.0. Dual licensing like this is common.
- diggan 9y ago
  Hm, I don't think so (but I'm no expert) > The freedom to study how the program works, and change it so it does your computing as you wish (freedom 1). Access to the source code is a precondition for this. Even with or without the above statement, this freedom is not broken by Caddy. You are still allowed to download the source and remove the headers, just as before.
  - Sir_Cmpwn 9y ago
    >its presence is required by the non-commercial EULA This statement reads to me that you _cannot_ remove it. It also combines with freedom 3, if you can't distribute your modified version.
    - bpicolo 9y ago
      The EULA only applies to precompiled binaries
    - deleted 9y ago
      [deleted]
    - mholt 9y ago
      The EULA does not apply to the source code. The source code is Apache licensed.
  - joepie91_ 9y ago
rlonstein 9y ago
dists/EULA: 3. Restrictions 3.1 You SHALL NOT, and shall not allow any third party, to: (a) decompile, disassemble, or otherwise reverse engineer the Software or attempt to reconstruct or discover any source code, underlying ideas, algorithms, file formats or programming interfaces of the Software by any means whatsoever (except and only to the extent that applicable law prohibits or restricts reverse engineering restrictions); (b) distribute, sell, sublicense, rent, lease or use the Software for time sharing, hosting, service provider or like purposes, except as expressly permitted under this Agreement; (c) redistribute the Software or Modifications other than by including the Software or a portion thereof within your own product or service, which must have substantially different functionality than the Software or Modifications and must not allow any third party to use the Software or Modifications, or any portions thereof, without a proper license to account for its use; (d) redistribute the Software as part of an "appliance", "consumer device", or "virtual server"; (e) redistribute the Software on or to any machine which is not directly under your control or management; (f) remove any product identification, proprietary, copyright, or other notices contained in the Software; (g) modify any part of the Software, create a derivative work of any part of the Software (except as permitted in Section 4), or incorporate the Software, except to the extent expressly authorized in writing by the Company; (h) publicly disseminate performance information or analysis (including, without limitation, benchmarks) from any source relating to the Software; (i) utilize any equipment, device, software, or other means designed to circumvent or remove any form of copy protection in place by the Company in connection with the Software; (j) use the Software to develop a product which is similar to or competitive with any of the Company's product or service offerings; (k) share, distribute, or publish authorization codes, URLs, keys, or any other data provided by the Company that is intended exclusively for your account and not others, otherwise the Company reserves the right to terminate your Subscription without notice; (l) violate the Terms of Service as posted on the Company's website; {{- if eq .Type "personal"}} (m) use or distribute the Software commercially, including to, for, or within a company or for business purposes; (n) use or distribute the Software as any part of a formal or informal profitable venture, or as part of a product or service being sold either directly or indirectly; (o) block, hide, obscure, modify, or remove the promotional header field named "Caddy-Sponsors" (and any case variants) from HTTP responses; {{- end}}
e12e 9y ago
I get that a project want to sell licenses - but as a sibling comment states, Caddy appears to no longer be Free software, breaking freedom 1 (modify), 3 (distribute modified copies). [ed: it appears I misunderstood, only the binaries are under eula - so Caddy is in the (somewhat) unique position of distributing non-free binaries and Free source code. Kind of like a gpled iOS program I guess.] In addition, I'd consider this a (small) security vulnerability: the presence of the ad header effectively screams Caddy to fingerprinting tools. There's a reason apache and friends have a "prod" header config/setting. [ed: seems a bit cruel to force the most resourceresource-limited users to advertise details about their stack; presumably those that know enough to compile themselves might also have more resources to keep up to date on security issues etc]
- deftnerd 9y ago
  Synergy, the app that allows a computer to share its mouse and keyboard over the network to other computers, did a more aggressive move a few years ago. It's still technically GPL because you can compile it yourself, but they charge $20 for a binary license and to enable certain features. I have similar concerns. I practice good security but I also enjoy security through obscurity. I prefer to prevent my users from knowing what web server is serving their content. Now unless I start compiling from scratch, everyone will know I use Caddy and I don't like that. Alternative is to run Caddy behind HAProxy or Nginx or something similar that can strip those headers out. I think it's time to just rebuild and use Nginx again and try to get QUIC and automatic LetsEncrypt working.
  - tempay 9y ago
    > Alternative is to run Caddy behind HAProxy or Nginx or something similar that can strip those headers out. The EULA specifically states that this isn't permitted.
mozumder 9y ago
Try the H2O server: https://h2o.examp1e.net https://h2o.examp1e.net It's been working beautifully for me with full HTTP2 features, including server push. (NGINX doesn't have HTTP/2 server push for free users.)
kbenson 9y ago
> Second edit: Accusation of trademark violation within an hour of the fork, classy! https://github.com/WedgeServer/wedge/issues/2 https://github.com/WedgeServer/wedge/issues/2 This is just like Red Hat. He's put a lot of work into his product, whether free or not, so don't use trademarked name. CentOS has the same restrictions about not using Red Hat in their distribution. This is just like someone releasing a book for free, and getting mad at someone that decides to sell (or give it away) under the same name when they've trademarked the name. Don't do that. If you're going to copy it, change the name. Also, keep in mind a trademark is only good as long as you enforce it. If you don't enforce your trademark, it can be seen as (and argued in court as) having become a generic name, and you lose it.[1] 1: https://en.wikipedia.org/wiki/List_of_generic_and_genericized_trademarks#List_of_former_trademarks_that_have_been_genericized https://en.wikipedia.org/wiki/List_of_generic_and_genericize...
- nqzero 9y ago
  from the github (which hosts caddy source) faq: Note: If you publish your source code in a public repository on GitHub, according to the Terms of Service, other GitHub users have the right to view and fork your repository within the GitHub site. If you have already created a public repository and no longer want users to have access to it, you can make your repository private. When you convert a public repository to a private repository, existing forks or local copies created by other users will still exist. For more information, see "Making a public repository private."
  - kbenson 9y ago
    It's not about forking, it's about forking with the intent to compete (which this was, as it was advertised as an alternative here). In that respect, regardless of the Github.com terms of service says, federal trademark law is likely to supercede it.
- lol768 9y ago
  > This is just like Red Hat. He's put a lot of work into his product, whether free or not, so don't use trademarked name. Unfortunately when you fork a repository, it does copy the entire source tree. I can't type that fast, so there was a short period when the original README was still there.. there's also probably 400 other repositories on GitHub with the same problem. I knew this needed to be resolved, and it was within a timely manner. I'll also note Caddy is not a registered trademark. > Don't do that. If you're going to copy it, change the name. When I created the repository I deliberately chose a different name and deliberately opened up the issue tracker and created an issue to track the work in renaming e.g. the README references. I created this issue before the "you're violating our (unregistered) trademark!" issue was created. My intentions were good from the start, please don't talk to me as if that was not the case.
bactrian 9y ago
This is clearly a license enforcement measure. They're going to search for commercial sites sending this header and then hit them up for money. This is DRM.
nqzero 9y ago
i believe that when hosting source on github, you guarantee the right of others to fork the repository that right would seem to preclude forcing the forked version to change the name
- nqzero 9y ago
  i found the github faq that i remembered: Note: If you publish your source code in a public repository on GitHub, according to the Terms of Service, other GitHub users have the right to view and fork your repository within the GitHub site. If you have already created a public repository and no longer want users to have access to it, you can make your repository private. When you convert a public repository to a private repository, existing forks or local copies created by other users will still exist. For more information, see "Making a public repository private." https://help.github.com/articles/licensing-a-repository/ https://help.github.com/articles/licensing-a-repository/

by lol768 9y ago

UseStrict 9y ago

Wow, in the course of this HN thread I went from learning about Caddy, to deciding against using it. Definitely not cool to immediately threaten legal action almost instantly after forking. Definitely not cool to force a header. I'll be sticking with nginx.

callahad 9y ago
Which is frustrating, because Caddy is a great product, especially from a solo operator standpoint. Configuration is simple and the defaults are sane. The humans behind Caddy are nice people. And while this move has somewhat soured my opinion of the project, I'm not so much angry as I am... sad. I want to use Caddy. I am using Caddy. But I don't want to use this Caddy, at the moment.
- kuschku 9y ago
  Actually, the defaults are quite insane. For example: You might know that all domain names are in the root zone, named ".", so any domain actually is resolved to e.g. news.ycombinator.com. And if you enter the domain with the dot, it is the same DNS name, and should give you the same result. Apache does that, Nginx does that, Google’s cloud does that, Amazon’s cloud does that, all major sites do that... Caddy considers it irrelevant, and something users should add manually for all of their rules if they want it. Ignoring all the RFCs, because of personal ideals. https://github.com/mholt/caddy/issues/1632 https://github.com/mholt/caddy/issues/1632
Posibyte 9y ago
Exactly. I've heard raving reviews of how amazing Caddy is, but as I said earlier in this thread, the threat of filing trademark violations before even giving time for intent to be reasonably argued feels like a power play to scare the forks. It also makes their "We love Open Source!" claims feel much less genuine. I'm not excited about it as much anymore :\
llao 9y ago
It is worth revisiting the trademark-thread, the responses of everyone involved are level-headed and civil.

mholt 9y ago

Thanks for your feedback. I'd like to know more. > The fact that the headers aren't seen by most non-technical users is moot. Why's that? (And even among your technical visitors, how many of them actually inspect the response headers?) > I find this practice pretty obnoxious to the point of looking at NGINX Plus for commercial use instead. It's good to know that price isn't the bottleneck, then. Does it make any difference to know that commercially-licensed Caddy builds don't have that header?

StavrosK 9y ago
> And even among your technical visitors, how many of them actually inspect the response headers? I find that a bit disingenuous. You can't both include annoying headers and argue that they aren't annoying anyone because nobody will see them. If nobody will see them, why add them in the first place?
- andkenneth 9y ago
  I think the headers are there so they can see if commercial sites are using the personal version and get them to pony up.
  - nopzor 9y ago
    Wouldn't they already know who their customers are?
  - jayrox 9y ago
    commercial sites have the easy ability to go to https://github.com/mholt/caddy; https://github.com/mholt/caddy; download the source; remove the header from header.go and server.go; compile; run i'd venture to guess many build the binary themselves already. so they can add their own tweaks. how would anyone be able to prove a website is being ran by caddy if the server doesn't announce that it is caddy?
    - detaro 9y ago
      If you do build it yourself, you don't fall under the commercial license, so it's correct if those are not detected.

Sir_Cmpwn 9y ago

With that statement, Caddy is officially nonfree software. It breaks freedom 1. Edit: I have been corrected. For the record, I still think this is a braindead move from Caddy.

Karunamon 9y ago
..with regard to the distributed binaries only. The source code that you can compile yourself has no such restrictions and is still Apache 2.0. Dual licensing like this is common.
diggan 9y ago
Hm, I don't think so (but I'm no expert) > The freedom to study how the program works, and change it so it does your computing as you wish (freedom 1). Access to the source code is a precondition for this. Even with or without the above statement, this freedom is not broken by Caddy. You are still allowed to download the source and remove the headers, just as before.
- Sir_Cmpwn 9y ago
  >its presence is required by the non-commercial EULA This statement reads to me that you _cannot_ remove it. It also combines with freedom 3, if you can't distribute your modified version.
  - bpicolo 9y ago
    The EULA only applies to precompiled binaries
  - deleted 9y ago
    [deleted]
  - mholt 9y ago
    The EULA does not apply to the source code. The source code is Apache licensed.
- joepie91_ 9y ago

rlonstein 9y ago

dists/EULA: 3. Restrictions 3.1 You SHALL NOT, and shall not allow any third party, to: (a) decompile, disassemble, or otherwise reverse engineer the Software or attempt to reconstruct or discover any source code, underlying ideas, algorithms, file formats or programming interfaces of the Software by any means whatsoever (except and only to the extent that applicable law prohibits or restricts reverse engineering restrictions); (b) distribute, sell, sublicense, rent, lease or use the Software for time sharing, hosting, service provider or like purposes, except as expressly permitted under this Agreement; (c) redistribute the Software or Modifications other than by including the Software or a portion thereof within your own product or service, which must have substantially different functionality than the Software or Modifications and must not allow any third party to use the Software or Modifications, or any portions thereof, without a proper license to account for its use; (d) redistribute the Software as part of an "appliance", "consumer device", or "virtual server"; (e) redistribute the Software on or to any machine which is not directly under your control or management; (f) remove any product identification, proprietary, copyright, or other notices contained in the Software; (g) modify any part of the Software, create a derivative work of any part of the Software (except as permitted in Section 4), or incorporate the Software, except to the extent expressly authorized in writing by the Company; (h) publicly disseminate performance information or analysis (including, without limitation, benchmarks) from any source relating to the Software; (i) utilize any equipment, device, software, or other means designed to circumvent or remove any form of copy protection in place by the Company in connection with the Software; (j) use the Software to develop a product which is similar to or competitive with any of the Company's product or service offerings; (k) share, distribute, or publish authorization codes, URLs, keys, or any other data provided by the Company that is intended exclusively for your account and not others, otherwise the Company reserves the right to terminate your Subscription without notice; (l) violate the Terms of Service as posted on the Company's website; {{- if eq .Type "personal"}} (m) use or distribute the Software commercially, including to, for, or within a company or for business purposes; (n) use or distribute the Software as any part of a formal or informal profitable venture, or as part of a product or service being sold either directly or indirectly; (o) block, hide, obscure, modify, or remove the promotional header field named "Caddy-Sponsors" (and any case variants) from HTTP responses; {{- end}}

e12e 9y ago

I get that a project want to sell licenses - but as a sibling comment states, Caddy appears to no longer be Free software, breaking freedom 1 (modify), 3 (distribute modified copies). [ed: it appears I misunderstood, only the binaries are under eula - so Caddy is in the (somewhat) unique position of distributing non-free binaries and Free source code. Kind of like a gpled iOS program I guess.] In addition, I'd consider this a (small) security vulnerability: the presence of the ad header effectively screams Caddy to fingerprinting tools. There's a reason apache and friends have a "prod" header config/setting. [ed: seems a bit cruel to force the most resourceresource-limited users to advertise details about their stack; presumably those that know enough to compile themselves might also have more resources to keep up to date on security issues etc]

deftnerd 9y ago
Synergy, the app that allows a computer to share its mouse and keyboard over the network to other computers, did a more aggressive move a few years ago. It's still technically GPL because you can compile it yourself, but they charge $20 for a binary license and to enable certain features. I have similar concerns. I practice good security but I also enjoy security through obscurity. I prefer to prevent my users from knowing what web server is serving their content. Now unless I start compiling from scratch, everyone will know I use Caddy and I don't like that. Alternative is to run Caddy behind HAProxy or Nginx or something similar that can strip those headers out. I think it's time to just rebuild and use Nginx again and try to get QUIC and automatic LetsEncrypt working.
- tempay 9y ago
  > Alternative is to run Caddy behind HAProxy or Nginx or something similar that can strip those headers out. The EULA specifically states that this isn't permitted.

mozumder 9y ago

Try the H2O server: https://h2o.examp1e.net https://h2o.examp1e.net It's been working beautifully for me with full HTTP2 features, including server push. (NGINX doesn't have HTTP/2 server push for free users.)

kbenson 9y ago

> Second edit: Accusation of trademark violation within an hour of the fork, classy! https://github.com/WedgeServer/wedge/issues/2 https://github.com/WedgeServer/wedge/issues/2 This is just like Red Hat. He's put a lot of work into his product, whether free or not, so don't use trademarked name. CentOS has the same restrictions about not using Red Hat in their distribution. This is just like someone releasing a book for free, and getting mad at someone that decides to sell (or give it away) under the same name when they've trademarked the name. Don't do that. If you're going to copy it, change the name. Also, keep in mind a trademark is only good as long as you enforce it. If you don't enforce your trademark, it can be seen as (and argued in court as) having become a generic name, and you lose it.[1] 1: https://en.wikipedia.org/wiki/List_of_generic_and_genericized_trademarks#List_of_former_trademarks_that_have_been_genericized https://en.wikipedia.org/wiki/List_of_generic_and_genericize...

nqzero 9y ago
from the github (which hosts caddy source) faq: Note: If you publish your source code in a public repository on GitHub, according to the Terms of Service, other GitHub users have the right to view and fork your repository within the GitHub site. If you have already created a public repository and no longer want users to have access to it, you can make your repository private. When you convert a public repository to a private repository, existing forks or local copies created by other users will still exist. For more information, see "Making a public repository private."
- kbenson 9y ago
  It's not about forking, it's about forking with the intent to compete (which this was, as it was advertised as an alternative here). In that respect, regardless of the Github.com terms of service says, federal trademark law is likely to supercede it.
lol768 9y ago
> This is just like Red Hat. He's put a lot of work into his product, whether free or not, so don't use trademarked name. Unfortunately when you fork a repository, it does copy the entire source tree. I can't type that fast, so there was a short period when the original README was still there.. there's also probably 400 other repositories on GitHub with the same problem. I knew this needed to be resolved, and it was within a timely manner. I'll also note Caddy is not a registered trademark. > Don't do that. If you're going to copy it, change the name. When I created the repository I deliberately chose a different name and deliberately opened up the issue tracker and created an issue to track the work in renaming e.g. the README references. I created this issue before the "you're violating our (unregistered) trademark!" issue was created. My intentions were good from the start, please don't talk to me as if that was not the case.

bactrian 9y ago

This is clearly a license enforcement measure. They're going to search for commercial sites sending this header and then hit them up for money. This is DRM.

nqzero 9y ago

i believe that when hosting source on github, you guarantee the right of others to fork the repository that right would seem to preclude forcing the forked version to change the name

nqzero 9y ago
i found the github faq that i remembered: Note: If you publish your source code in a public repository on GitHub, according to the Terms of Service, other GitHub users have the right to view and fork your repository within the GitHub site. If you have already created a public repository and no longer want users to have access to it, you can make your repository private. When you convert a public repository to a private repository, existing forks or local copies created by other users will still exist. For more information, see "Making a public repository private." https://help.github.com/articles/licensing-a-repository/ https://help.github.com/articles/licensing-a-repository/