8

Many projects, e.g. GitLab, BitWarden, EasyRedmine, use open source software licenses. Their code is publicly available, and the services can be self-hosted. Of course they can charge users for providing the infrastructure and hosting the cloud service.

In the following I'll use BitWarden as an example.

BitWarden also charges users for self-hosting such a service, although with client and server code being open source, it can (at least partially) be hosted on-premise for free, and people do it.

The (A)GPL parts of the software seem to be sufficient for some users, so the non-cost-free parts rather seem to provide advanced features for enterprises.

As defined here, it is not allowed to charge royalties for the software under approved open source licenses such as GPL and AGPL, and BitWarden complies with that by publishing some modules (CommCore, Sso) with a different license.

How does that license model work in practice/technically?

The code under those non-cost-free folders Sso and CommCore seems still to be provided with sources. How can BitWarden prevent a company from running it for free if the code is available?

  • if there is a license check in the provided source code, imho it could just be removed (*).Is BitWarden relying on users being honest (i.e. it's a business model based on trust, or on disproportionate costs for self-hosting)?
  • or is there a way to enforce the usage of a license by some technical means (even if sources are available)?

(*) I have no intentions of doing so, this is just for the sake of understanding the business model and technology. It may be illegal to remove a license check if the code is published is under BitWarden license.

2
  • Can you say what "… the services can be self-hosted… they can charge users for providing the infrastructure and hosting the cloud service" has to do with licencing, with or without open sources? Feb 16, 2022 at 22:43
  • Nothing legal. It's about technical "enforcement" and how open source business models work in practice. I could also have asked in "software engineering".
    – radix
    Feb 17, 2022 at 7:45

2 Answers 2

11

How does that license model work in practice/technically?

Generally, pretty well. Given a company that produces a free-software product which they will also host for a charge (ie, SaaS), users have options.

Yes, the end-user could download the code, install it on a server, and so service their user base. This requires a fair amount of sysadmin expertise, which isn't free. The server must be provisioned and hosted, backups must be arranged, the server OS must be kept in-patch, and periodically version upgrades will be required. If the server is physical, someone will need to tend to the hardware, too. Monitoring will need to be arranged.

None of this is free; companies that don't have the in-house skills for this, or who for some other legitimate reason don't want to do it in-house, will be happy to pay the SaaS provider to do all this for them. There are economies of scale, here, too; if my company is the author of FooWiki, I can probably host a few thousand instances of it for significantly less than a few thousand times the cost of all the above, and these savings can be passed on to end-users.

But the availability of the code provides an essential backstop against lock-in: if the SaaS provider is taken over by GraspingCorp, and the prices go up by a factor of eight, I as the end-user can simply re-evaluate my cost model, conclude that self-hosting is now the better option for me, exfiltrate my data, and host it all myself.

The users have freedom and options, and the provider has a revenue stream. To my mind, it's one of the better corporate models for free software.

I think your question also touches on the licensing legalities of the Open-Core model, but an analysis of that can be complex, depending on whether the distributor is the sole rightsholder, the degree of integration between the AGPLed parts and other parts, the terms of acceptance of any third-party contributions to the code, and other factors, so I don't propose to do that here. Removal of licence checks from free software is completely lawful, though.

9
  • So I understand there are no technical protections against -- illegally -- using e.g. BitWarden's fully-blown enterprise server? (if so, maybe add an explicit sentence to the answer). Companies that have the resources to host it on-premise of course typically wouldn't do that, be it due to good manners or caution of an angry employee revealing it. The costs for password managers feel inappropriately high to me, though. It may absolutely be worth it, but intuitively I think 5-8 USD per user per month is quite a lot. May be a misjudgement on my side.
    – radix
    Feb 16, 2022 at 10:39
  • 1
    @radix I have no idea about the technical protections against that, nor indeed the licence conditions, in this codebase - but if it's under a free licence, you may (if you can) remove any such technical protections. As for the cost, if that's the program you've decided you want to run, you may need to compare it with the $100k+ annual costs of a staff sysadmin.
    – MadHatter
    Feb 16, 2022 at 11:01
  • 1
    @MadHatter, some portions of the code (Sso and CommCore) are under a non-free license. Presumably, the license check code is in that portion of the product. Feb 16, 2022 at 12:51
  • 4
    @radix, the license doesn't give you the freedoms associated with an open-source license and in that sense it is not free. That is what is commonly meant here when people call a license non-free. Feb 16, 2022 at 15:20
  • 1
    @radix open, perhaps, but not on-topic for this site. Could I ask that this discussion go no further in this comments field?
    – MadHatter
    Feb 16, 2022 at 22:38
-1

BitWarden's staff members answered the question after I've put it on their community forum.

In case of BitWarden (and I assume other companies/projects do the same), there are no technical countermeasures, and the business mode works because

social and legal constructs keep those large-scale malicious attempts at bay, and without measurable impact on the business model.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.