danielquinn@lemmy.ca 1 week ago
I didn’t understand what you meant by Joplin not being “fully FOSS”, so I went looking for the license. Is really quite strange. Basically they’ve used a “personal license” for some parts and the AGPL for the rest. That’s… annoying.
yyprum@lemmy.dbzer0.com 1 week ago
This is surprising… And completely unmanageable from a user’s point of view. In order to find what licenses it has I need to browse folder by folder in the code, instead of, you know, having a list of licenses and where they apply.
On a quick look I saw only two places with a special license, one is the example indicated by the developer of the server package which is an odd license that gives me pretty bad vibes for my lack of legal knowledge but probably is ok? It might even be reasonable, but what is the server package? Is that the server I self host? Or the server for paid Joplin? Then I found some other code that was an MIT license… But how deep do I need to go searching in the folder structure to find all licenses? This is irritating. I guess I gotta consider changing to something else then if only to be able to know what license I am using.
Also… What is the legal implications of using a software than upon any update might suddenly add a weird random license? Would that mean I am expected to keep checking all foldernevery time they change something?
timwa@lemmy.snowgoons.ro 1 week ago
find . -name LICENSE.md -printThere, arduous search complete.
I thought it was well known/understood that the server component was how Joplin pays their wages, and thus being under a different license is hardly a big shock; it’s entirely optional, and the fact they’re still sharing the source seems like a good thing rather than bad.
As for “they could just keep adding licenses!!!” Well, yeah, but so could any project. Apache could stick a proprietary license deep in a folder of
httpdtomorrow and unless you were looking, you’d never know. Even a GPL project could incorporate a proprietary licensed component tomorrow provided it wasn’t linked into the binary/was a separate piece of software - like, say, the server component of Joplin. You just trust that they won’t, and/or properly check changes whenever you pull a new release like you were supposed to be doing anyway for security (hahaha, ok, no you weren’t,) or trust that if they did pull shenanigans it would be ‘news’ and you would hear about it.That Joplin is open about it, and they retain the original licenses of FOSS they have incorporated instead of deleting/hiding the original license is a good thing. I wish more did it.