Open source licenses and royalties

Question

Many projects, e.g. GitLab, BitWarden, EasyRedmine, use open source software licenses. Their code is publicly available, and the services can be self-hosted. Of course they can charge users for providing the infrastructure and hosting the cloud service.

In the following I'll use BitWarden as an example.

BitWarden also charges users for self-hosting such a service, although with client and server code being open source, it can (at least partially) be hosted on-premise for free, and people do it.

The (A)GPL parts of the software seem to be sufficient for some users, so the non-cost-free parts rather seem to provide advanced features for enterprises.

As defined here, it is not allowed to charge royalties for the software under approved open source licenses such as GPL and AGPL, and BitWarden complies with that by publishing some modules (CommCore, Sso) with a different license.

How does that license model work in practice/technically?

The code under those non-cost-free folders Sso and CommCore seems still to be provided with sources. How can BitWarden prevent a company from running it for free if the code is available?

• if there is a license check in the provided source code, imho it could just be removed (*).Is BitWarden relying on users being honest (i.e. it's a business model based on trust, or on disproportionate costs for self-hosting)?
• or is there a way to enforce the usage of a license by some technical means (even if sources are available)?

(*) I have no intentions of doing so, this is just for the sake of understanding the business model and technology. It may be illegal to remove a license check if the code is published is under BitWarden license.

Answer 1

How does that license model work in practice/technically?

Generally, pretty well. Given a company that produces a free-software product which they will also host for a charge (ie, SaaS), users have options.

Yes, the end-user could download the code, install it on a server, and so service their user base. This requires a fair amount of sysadmin expertise, which isn't free. The server must be provisioned and hosted, backups must be arranged, the server OS must be kept in-patch, and periodically version upgrades will be required. If the server is physical, someone will need to tend to the hardware, too. Monitoring will need to be arranged.

None of this is free; companies that don't have the in-house skills for this, or who for some other legitimate reason don't want to do it in-house, will be happy to pay the SaaS provider to do all this for them. There are economies of scale, here, too; if my company is the author of FooWiki, I can probably host a few thousand instances of it for significantly less than a few thousand times the cost of all the above, and these savings can be passed on to end-users.

But the availability of the code provides an essential backstop against lock-in: if the SaaS provider is taken over by GraspingCorp, and the prices go up by a factor of eight, I as the end-user can simply re-evaluate my cost model, conclude that self-hosting is now the better option for me, exfiltrate my data, and host it all myself.

The users have freedom and options, and the provider has a revenue stream. To my mind, it's one of the better corporate models for free software.

I think your question also touches on the licensing legalities of the Open-Core model, but an analysis of that can be complex, depending on whether the distributor is the sole rightsholder, the degree of integration between the AGPLed parts and other parts, the terms of acceptance of any third-party contributions to the code, and other factors, so I don't propose to do that here. Removal of licence checks from free software is completely lawful, though.

Answer 2

BitWarden's staff members answered the question after I've put it on their community forum.

In case of BitWarden (and I assume other companies/projects do the same), there are no technical countermeasures, and the business mode works because

social and legal constructs keep those large-scale malicious attempts at bay, and without measurable impact on the business model.