Caddy web server no longer completely open source | Hacker News Reader

Caddy web server no longer completely open source

github.com

3 pointsopenoi7 comments

In what way is it not open source? I don't get why that random question is supposed to be evidence of anything?

Parts, the modified Listener, has not been open sourced. Caddy's author was quick to deflect and squash any discussion about what else is held private.

The easiest answer would have been a "sure, here's the link". Instead the thread has been locked for being off-topic, yet the original issue and the question concern the same thing.

As someone who is working on Caddy, I can assure you that Caddy is still very much open source! mholt and I have been working on version 2 which has a lot of improvements over the first version of Caddy. It's not in a releasable state yet.

We are currently at a stage where we are getting feedback from the community on our current progress. If you want to be a part of that, feel free to reach out to one of us.

Caddy 2 is under internal development, and will be open source as per https://caddyserver.com/blog/announcing-caddy-1_0-caddy-2-ca... Ofc, the thread has been locked, because it is off-topic, the linked issue is about listeners, not the development of Caddy 2.

Open source is about transparency, which covertly tweaking the wording of a thread is not.

Yet since this issue got some more attention user "mholt" has changed the thread, now merely strongly claiming it were open source but not actually publishing or referring to the closed source portions, unable to confirm there were none and it were something innocuous like a backport from Go 1.13.

Nonetheless a use of force, him keeping the right to develop the discussion further to himself but denying the same to others.

Does Caddy run afould a LGPL? Is it about this? If you cannot bear sharing and the question "how did you solve this?", then don't claim to be an open source author.

Another reason why reproducible builds in open source are so important. The version of Caddy you can compile yourself is different from that you are offered as download. And there's nowhere a notice to be found about that intransparent move.

Caddy's build are reproducible as per https://github.com/golang/go/wiki/Modules. The downloader offers you to extend Caddy with plugins, and this will change the hash of the binary compared to a straight build from the source code. Keep in mind that Telemetry is enabled by default in the source code, unlike @ the downloader, this changes the hash too.

Reply on news.ycombinator.com