4 ms·

> it's no longer present in current Caddy but the bad taste still remains Adding a sponsor header is harmless (albeit useless IMO). For me that would be no rea

> it's no longer present in current Caddy but the bad taste still remains Adding a sponsor header is harmless (albeit useless IMO). For me that would be no reason to not choosing this software, and certainly no ground for having a 'bad taste'.

rekoil 3y ago
What purpose does it actually fulfil? Who is actually looking at individual HTTP requests like this? All it does is take up extra traffic... It's also a security risk if your web server is the only one doing it, as it is a way for an attacker to fingerprint the web server software in use. I understand and agree with melx's view here completely, even if I do feel Caddy's strengths outweigh it's weaknesses.
- user3939382 3y ago
  > Who is looking devs presumably
  - mholt 3y ago
    Which is exactly the audience we were targeting. I thought it was a good idea at the time. ¯\_(ツ)_/¯
    - user3939382 3y ago
      I think it’s a cool idea, though if it’s on by default, disabling it should be obvious like one of the first lines in the config file.
doublerabbit 3y ago
It is bad taste, unprofessional. Taints the pool with the vibe of "We can do this; we will do this and you schmucks can't do anything about it because it's in the EULA". Regardless to how harmless it is. It's still an unprofessional quality to implement such and then deny the ability to disable it. Same example as if when you honked your cars horn it tooted the car model. You'd be annoyed right? Sure, its harmless because how often do you use your car horn but you expect a car horn to horn not advertise the model your driving.
- Symbiote 3y ago
  I'm imagining a Tesla's horn chiming the Intel "dah dah ding ding" thing now. Let's hope Elon doesn't read this.
melx 3y ago
> Adding a sponsor header is harmless Harmless or not - I think it's worth looking past this point. Maybe the http header was a way for them to search the internet and find *commercial* sites that didn't pay for Caddy license? Not very pro behaviour.
- sergiosgc 3y ago
  Caddy is licensed under the Apache license, which allows for commercial use. No one is infringing by not paying for the commercial version.
  - melx 3y ago
    Well, we're in 2017 (read the thread I posted above), and in that year Caddy was distributing[0] the binary as licensed product. Apache licence applied to its source-code only (e.g. when you build the server from source - which only few people did). [0] https://web.archive.org/web/20180216153020/https://caddyserver.com/products/licenses https://web.archive.org/web/20180216153020/https://caddyserv...
    - sergiosgc 3y ago
      Thanks for the background. I didn't know it used to be like that. It's a funky licensing scheme if I ever saw one.

rekoil 3y ago

What purpose does it actually fulfil? Who is actually looking at individual HTTP requests like this? All it does is take up extra traffic... It's also a security risk if your web server is the only one doing it, as it is a way for an attacker to fingerprint the web server software in use. I understand and agree with melx's view here completely, even if I do feel Caddy's strengths outweigh it's weaknesses.

user3939382 3y ago
> Who is looking devs presumably
- mholt 3y ago
  Which is exactly the audience we were targeting. I thought it was a good idea at the time. ¯\_(ツ)_/¯
  - user3939382 3y ago
    I think it’s a cool idea, though if it’s on by default, disabling it should be obvious like one of the first lines in the config file.

doublerabbit 3y ago

It is bad taste, unprofessional. Taints the pool with the vibe of "We can do this; we will do this and you schmucks can't do anything about it because it's in the EULA". Regardless to how harmless it is. It's still an unprofessional quality to implement such and then deny the ability to disable it. Same example as if when you honked your cars horn it tooted the car model. You'd be annoyed right? Sure, its harmless because how often do you use your car horn but you expect a car horn to horn not advertise the model your driving.

Symbiote 3y ago
I'm imagining a Tesla's horn chiming the Intel "dah dah ding ding" thing now. Let's hope Elon doesn't read this.

melx 3y ago

> Adding a sponsor header is harmless Harmless or not - I think it's worth looking past this point. Maybe the http header was a way for them to search the internet and find *commercial* sites that didn't pay for Caddy license? Not very pro behaviour.

sergiosgc 3y ago
Caddy is licensed under the Apache license, which allows for commercial use. No one is infringing by not paying for the commercial version.
- melx 3y ago
  Well, we're in 2017 (read the thread I posted above), and in that year Caddy was distributing[0] the binary as licensed product. Apache licence applied to its source-code only (e.g. when you build the server from source - which only few people did). [0] https://web.archive.org/web/20180216153020/https://caddyserver.com/products/licenses https://web.archive.org/web/20180216153020/https://caddyserv...
  - sergiosgc 3y ago
    Thanks for the background. I didn't know it used to be like that. It's a funky licensing scheme if I ever saw one.