Clarification on project's license and open source state

[ssddanbrown]

Hello 👋,

Just came across this project, and saw the app being advertised as open source, like on this page where it's advertised as "100% open source".
Looking at the app repo though, the licensing is a bit confusing, with the following stated:

This repository houses multiple packages, each with a different license.
To get a list of packages in this repository, run yarn workspace:list.
Packages which do not have a LICENSE file do not have explicit open-source licensing, nor any redistribution rights granted.

As far as I could tell, only three of the packages (desktop, mobile and web) have LICENSE files included within. Some of the others state a license in their package.json file but I'm not sure that counts based upon the above.
At a quick glance, it looks like those AGPL packages can require code/modules from the non-licensed packages.
Based upon this info, I have the following queries:

• Is the application still actually open source or is that left-over wording from before license changes?
• Can the apps be built from AGPL (or compatible) code alone or do they require non-compatible/proprietary code?

[moughxyz]

Thanks for raising this. After looking into it more, it seems our intention of allowing AGPL on our high level clients cannot pair with dependencies those clients rely on which aren’t AGPL compatible. So in fact our implementation of the licensing was not fully adherent to the specification.

Looking at how other related companies handle licensing:

• Proton: open source clients but closed source servers
• Skiff: public source clients (Creative Commons, non-commercial license) and closed source servers
• Notion/Obsidian: fully closed source
• Bitwarden: open source clients and server with some commercial dependencies
• 1Password: fully closed source

It seems that the current licensing state of our products when interpreted through the strict presence or absence of license files, is a public source client with open sourced server.

Our interest in open code historically has been related to transparency and individual freedoms. I don't have a hard time professing that I have no particular interest in enriching other for-profit corporations with our toils. In fact, having richer companies than us who use our server in a large commercial setting contribute back monetarily would be a great boon for us.

I'd like to take this opportunity to evaluate our present circumstances and future direction a bit more. In the meantime, I'll do two things:

1. We'll honor our word having used the term "open source"—though admittedly, not as much as I thought. We haven't been overly reliant on that term in our marketing, preferring to focus on the aspects of the product people have sought more in our experience. As such, I'll upload AGPL licenses for every package in our app repo, granting that license to that version of our codebase.
2. I'll then create another commit that changes these licenses to a top level Creative Commons license focusing on individual freedoms but not commercial ones, while also replacing the sparse instances of open-source in our copy with wording that focuses more on open code visibility and personal freedoms.
   1. I'll expect our servers to take on this new non-commercial license in the near future.

Happy to hear any feedback, particularly from those who specifically cherish open-source as in AGPL-licensed rather than the seemingly mainstream misinterpretation of open-source to mean “code which is open to the public to see”—a definition which we would never waver from.

[Atemu]

As I'm sure you're aware, relicensing AGPL to an incompatible license such as the unfree CC BY-NC-SA 4.0 requires explicit approval of all copyright holders.

Could you point me to the record where every copyright holder whose contributions are part of the affected packages has given their (ideally written) explicit consent to doing that?

[ssddanbrown]

Thanks for looking into this, and providing a response!

cannot pair with dependencies those clients rely on which aren’t AGPL compatible

Out of interest, what dependencies/licenses are those? The AGPL can work with most other open source licensed dependencies. Or were they non-open source dependencies themselves?

I don't have a hard time professing that I have no particular interest in enriching other for-profit corporations with our toils. In fact, having richer companies than us who use our server in a large commercial setting contribute back monetarily would be a great boon for us.

I can respect totally respect that. But at the end of the day it's putting your business interests first (which if fine) over the freedoms of users and therefore just not open source.

I'll then create another commit that changes these licenses to a top level Creative Commons license

I'm not sure how this fits your project, but technically, I think you'd need to have permission from all other contributors to change the license, for previously AGPL code, contributed externally, where the license is being changed here. That is unless contributors signed a CLA of some kind to hand over rights. Again, not too sure on your contribution process or the extent of external contributions to the relevant portion of code.

In regards to the license choice, Creative commons do advise against using their licenses for software. Something like the commons clause sounds like it may suit your intent.

Thanks again for listening and making changes.

[licaon-kter]

:( https://gitlab.com/fdroid/fdroiddata/-/commit/ee585f7f512e78518556c66f44dbb398a5db2475

[archerships]

Well, it's disappointing to learn of this license change. I bought a 5 year subscription, in part, because I valued your apparent commitment to open source software. Open source software is important to me because--although I've been generally happy with Standard Notes so far--companies change, management changes, and I don't want to be forced to rely on a single vendor.

You explain this clearly in your FAQ:

"This tactic, known in economics as vender lock-in or consumer lock-in, is a way for technology companies to make it difficult for you to stop using their services.

Free and open-source software avoids locking-in consumers and instead provides them with several valuable rights:"

https://standardnotes.com/knowledge/5/what-is-free-and-open-source-software

At least some of your web copy is still claiming it is open source, BTW:

"Yes, the source code for the Standard Notes application and server are 100% open "

https://standardnotes.com/help/46/is-the-standard-notes-source-code-public

I think the phrasing you want is "source available":

https://en.wikipedia.org/wiki/Source-available_software

[peakjcw]

This is illegal unless every contributor has signed a CLA. You need explicit approval. It's the law. You're going to have to go back to the stuffed shirt who wanted this and tell him he doesn't get his way. Or do you intend to break the law?

[JulianWgs]

I am a subscriber for over 4 years and this license situation is reason for me to consider my subscription.

My note taking software should be free (as is freedom of speech) and open source. I believe that this was the case for Standard Notes.

May be you could give companies other incentives to support Standard Notes, either with money or contributions:

• Give them access to the security mailing list or give them additional heads-up about existing issues. This is the working model of the Linux kernel. Only if you contribute you get access to these mailing lists and vendors (like Red Hat) are very interested in that.
• Give them consulting.
• Find out why they chose to self host. Usually self hosting something as a company is more expensive.

If companies don't want to pay they will not start to pay, because you are trying to get them to. They will either switch or privately fork. Btw how many large companies taking advantage of the code are there?

[holzi-x]

I am disappointed at this point. If you decide to go for somehow closed source servers or clients, be aware that at least I will consider whether this is still my note takeing SW.
Open Source was one of the top reasons for me to chose SN and to even pay for it for a long time now. I would like to continue this, but only if you keep your promise.

[codenyte]

I was actually thinking about subscribing, but now, because of this, I stopped using Standard Notes entirely. Notesnook is awesome, in my opinion, it's even better than Standard Notes. And it's all open source.

[user8446]

#3196 (comment) are the same reason why I use and pay for SN as well

[moughxyz]

The license change has been reverted back to AGPLv3. As mentioned in Discord channels, the change away from AGPL in the first place was always a difficult one that didn’t rest easy on my conscience. It was motivated by the fear that a more capitalized company could take our work and launch a competing product that would theoretically stand to put us out of business—an uneasy thought to sleep with!

I’m by no means an open-source licensing expert and continue to learn the intricacies on a daily basis, and this was certainly an enlightening experience.

As to what guarantees I can provide that this won’t happen again, I can’t. Ultimately, I’m just a person. These decisions are made by me and me alone. We’re a small company, and sometimes decisions are made based on the environment and emotions of the time. However, it definitely wasn’t fair for us to have gained the community’s goodwill of being open source for many years, and to have switched out for practically no good reason other than abstract fear. This is crystal clear now.

What I can say from a technical standpoint is that licenses are based on the source code repository. When a commit such as the one made here applies the AGPL license to the repository, it means that that version of the source code forever retains that license. If the license were removed in the future, only future versions of the code would be affected.

I’ll have a lot more to say on this on Discord but thought I’d post a quick announcement here. If you have questions or concerns you’d like to share, please join us there.

[spiralbee]

Please create a matrix room for Standard Notes and maybe bridge it with that discord group. I'm sure most of us who cares about free software philosophies aren't comfortable using Discord. I will never enter on Discord myself.

[Atemu]

Thank you so much for reconsidering your stance and clarifying the license across the whole project!

it means that that version of the source code forever retains that license. If the license were removed in the future, only future versions of the code would be affected.

Please note that this isn't entirely true. The AGPL requires you to distribute future derivative works under the AGPL aswell. You cannot, for example, withhold modified source code while distributing binaries or (in the case of the AGPL) offering the software as a service over the network; turning the project proprietary still requires explicit consent of 3rd party contributors.

[moughxyz]

Please create a matrix room for Standard Notes and maybe bridge it with that discord group

Not intimately familiar with Matrix tbh. Say more about "bridging" :) Is that a technical feature, or just saying to somehow have the two coexist?

[codenyte]

Is that a technical feature, or just saying to somehow have the two coexist?

https://matrix.org/ecosystem/bridges/