4 ms·

I get that a project want to sell licenses - but as a sibling comment states, Caddy appears to no longer be Free software, breaking freedom 1 (modify), 3 (distr

by e12e 9y ago

I get that a project want to sell licenses - but as a sibling comment states, Caddy appears to no longer be Free software, breaking freedom 1 (modify), 3 (distribute modified copies). [ed: it appears I misunderstood, only the binaries are under eula - so Caddy is in the (somewhat) unique position of distributing non-free binaries and Free source code. Kind of like a gpled iOS program I guess.] In addition, I'd consider this a (small) security vulnerability: the presence of the ad header effectively screams Caddy to fingerprinting tools. There's a reason apache and friends have a "prod" header config/setting. [ed: seems a bit cruel to force the most resourceresource-limited users to advertise details about their stack; presumably those that know enough to compile themselves might also have more resources to keep up to date on security issues etc]

deftnerd 9y ago
Synergy, the app that allows a computer to share its mouse and keyboard over the network to other computers, did a more aggressive move a few years ago. It's still technically GPL because you can compile it yourself, but they charge $20 for a binary license and to enable certain features. I have similar concerns. I practice good security but I also enjoy security through obscurity. I prefer to prevent my users from knowing what web server is serving their content. Now unless I start compiling from scratch, everyone will know I use Caddy and I don't like that. Alternative is to run Caddy behind HAProxy or Nginx or something similar that can strip those headers out. I think it's time to just rebuild and use Nginx again and try to get QUIC and automatic LetsEncrypt working.
- tempay 9y ago
  > Alternative is to run Caddy behind HAProxy or Nginx or something similar that can strip those headers out. The EULA specifically states that this isn't permitted.

by e12e 9y ago

deftnerd 9y ago

Synergy, the app that allows a computer to share its mouse and keyboard over the network to other computers, did a more aggressive move a few years ago. It's still technically GPL because you can compile it yourself, but they charge $20 for a binary license and to enable certain features. I have similar concerns. I practice good security but I also enjoy security through obscurity. I prefer to prevent my users from knowing what web server is serving their content. Now unless I start compiling from scratch, everyone will know I use Caddy and I don't like that. Alternative is to run Caddy behind HAProxy or Nginx or something similar that can strip those headers out. I think it's time to just rebuild and use Nginx again and try to get QUIC and automatic LetsEncrypt working.

tempay 9y ago
> Alternative is to run Caddy behind HAProxy or Nginx or something similar that can strip those headers out. The EULA specifically states that this isn't permitted.