Hello 👋, Just came across this project, and saw the app being advertised as open source, like on this page where it's advertised as "100% open source". Looking at the app repo though, the licensing...
Hello everyone,
I’ve been using Standard Notes on the recommendation of Privacy Guides since the beginning of this year, I believe, and it has truly been a fantastic experience. It serves my purpose perfectly, is truly cross-platform, open source, and lightweight. It was a real find, and I couldn’t be happier to have it installed. However, it seems that they are planning to change the licensing to one that restricts companies from abusing their code (which makes sense), but I wanted to know if this goes against the guidelines in terms of considering it recommendable.
I don’t really understand licenses, so correct me if I’m wrong, but with this change if the project becomes private, a fork couldn’t be created for all users who want to continue having the software format but not the backend… Is that correct?
If they push AGPL, then the code is still open, it’s just explicitly copyleft. Any GPL license imposes serious restrictions on what the end user can do. AGPL further restricts what end users can do. Copyleft is similar but different from open source. Basically all they’re doing is leaving the code open to view but preventing anyone from money off of it.
Honestly for people like yourself this is exactly what you want for privacy software. Copyleft with commercial restrictions is basically the whole FSF vibe. This is much ado about nothing; previously the code was unlicensed on GitHub which is much more restrictive than AGPL.
My understanding is that they are only applying AGPL to the current version and going forward all versions will no longer be AGPL. However if they have accepted contributions that were not covered by an agreement to transfer copyright, this is illegal without obtaining explicit approval from all contributors.
Copyleft with commercial restrictions is basically the whole FSF vibe.
No, I don’t think you understand the free software movement at all. It has never been strictly noncommercial. Open source has never been a vow of poverty.
Honestly for people like yourself this is exactly what you want for privacy software. […] This is much ado about nothing; previously the code was unlicensed on GitHub which is much more restrictive than AGPL.
BY-NC-SA is considered non-free by everybody, including the Free Software Foundation, the Open Source Initiative, and even Creative Commons themselves.
“Can I apply a Creative Commons license to software?”
"We recommend against using Creative Commons licenses for software. Instead, we strongly encourage you to use one of the very good software licenses which are already available. We recommend considering licenses listed as free by the Free Software Foundation and listed as “open source” by the Open Source Initiative. "
“Unlike software-specific licenses, CC licenses do not contain specific terms about the distribution of source code, which is often important to ensuring the free reuse and modifiability of software. Many software licenses also address patent rights, which are important to software but may not be applicable to other copyrightable works. Additionally, our licenses are currently not compatible with the major software licenses, so it would be difficult to integrate CC-licensed work with other free software. Existing software licenses were designed specifically for use with software and offer a similar set of rights to the Creative Commons licenses.”
~I’m not sure why you brought up the CC license; unlicensed GitHub repos do not use that and, generally, it’s understood that CC licenses cover documentation only for the reasons you cited.~
I think you and I fundamentally disagree about the point of FSF. Open source is not a vow of poverty, you’re right; copyleft damn near is. Open source is an umbrella that covers both open and copyleft licenses. For the average business that wants to keep closed source code, copyleft modules are poison. I’ve handled the compliance process for both SMB and enterprise companies. Unless you’re someone like Red Hat, copyleft is basically noncommercial. AGPL, SSPL, and BSL are joke licenses that also present the exact same problems as copyleft albeit much worse for businesses to pick up. If you couldn’t tell, I don’t like copyleft code because I don’t think it’s okay to place restrictions on code beyond the basic litigation coverage things like the Apache 2.0 offer.
~As for what SN is doing, my read of that was the code would be AGPL moving forward. My understanding is that you don’t need contributor approval to apply it (depending on the original license; in the case of the unlicensed code they have full power) but you do need contributor approval to remove it. If you’re right and they’re going to drop it after applying it, they’re opening themselves up to litigation should someone choose to pursue it.~
Edit: just looked at the repo; they replaced the root AGPL with the CC license instead of, say, linking the CC license for docs and leaving AGPL in place. The individual packages don’t have licenses and the root code (eg scripts) don’t have one either. Ignore what I said about SN; they did everything wrong and it’s stressful to look at.
Thank you for raising this. My subscription was up for renewal next year, and I think I’ll look elsewhere now.
The only reason I chose to support S Notes in the first place is they were the best designed FOSS notes app at the time, and 4 years later they have plenty of competition in that space fortunately. Honestly I expected better from them, they say all the right things but I guess the greed just got too much for them.
Trilium looks pretty interesting but not like a great direct replacement. One major feature gap is the lack of custom editor plugins, which is essential for me.
Another app I’ve seen recommended as an alternative is Joplin. I don’t use it myself, but it does have custom plugins, including for custom editors. So for anyone who finds the lack of a mobile app or custom editors to be a deal-breaker, Joplin’s likely worth checking out.
It’s been a few years but Joplin always felt clunky to me, and sync was extremely slow. I’m not sure if it even had plugin support when I tried it last.
Trilium does actually have plugin support it’s just not as discoverable imo. You can create backend scripts and also frontend scripts that could act like a new editor.
Having looked at it a bit more, even if it doesn’t end up replacing Standard Notes for me, it still looks promising, particularly given the ease of self hosting it. Self hosted it looks like it could be useful for shared notes, too, even though that doesn’t seem to be its intended use case.
A big part of the appeal for me is that Standard Notes already had a bunch of editors and that it was easy to create my own - they provide a starter app and you can just use React and/or any web libraries of your choice. I’ve looked through the Trilium docs and while they’re not as good, they’re probably good enough.
Another big difference is that Standard Notes also sandboxes its editors, such that they only have access to the current note. It looks like Trilium’s executable JS code notes lack a similar feature. Then again, that also has a positive side effect of meaning plugin devs have a lot more power and flexibility in terms of what they build.
In terms of privacy, nothing would change, it’s still the same as ever so I think the recommendation can absolutely stay up, even proprietary apps are suggested on Privacy Guides.
In terms of software freedom, this is a terrible change and I really dislike projects moving to source-available models, in this case, as the other commenters said there, I don’t even think it’s legal, unless every contributor has signed a CLA in the past.
I feel for not wanting to be explioted by corporate, but they could have gone the dual licensing path and instead chose to restrict everyone’s freedom, even us users. Now that doesn’t mean forks can’t be made I believe, it’s just that anyone who does that, won’t ever be able to sell the service which could be unsustainable since they made the server CC-BY-NC-SA, that’s a big turn off for those who want to host that
Even if it were true (it is not: there are techniques like static analysis, intercepting client-server communication, etc., that can confirm application behavior), how is having “zero expectations of privacy with closed source apps as you cannot independently verify what they [sic] app is doing” relevant when the source is available?
Why do you say their actions were illegal? In every repository of theirs that I looked through (just app (formerly web), server, self-hosted, mobile, and desktop), the contributors on every single PR that had been merged was from someone in the org. Unless there are some other contributions that I’m unaware of, their license change was completely legal.
There are tons of community created plugins, e.g., for editors (heck, I created and maintain one) but the licenses on those haven’t been changed and aren’t impacted. For any plugin that’s bundled with SN, an AGPL license can be a problem, and I didn’t check the contributions on their plugins, so maybe there’s an issue there and that’s what you’re saying is illegal? If those are still licensed as AGPL my understanding is that’s still legally allowed when they’re doing it, so long as there are no community contributors.
Personally I don’t understand how moving away from AGPL could accomplish their goals - AGPL already prevents another company from forking their server, changing the code, and not distributing those changes to their users… is the concern that some major companies are doing that and charging for it or using it internally? But regardless, being source available instead of FOSS doesn’t impact privacy expectations.
In fact, the way SN handles this is much better than the way Signal does, even though Signal uses a FOSS license. With Signal, development takes place in a private repository and it is later (sometimes as much as a year later) merged to the public one. My point is, the license isn’t the only thing that matters.
In terms of impact on contributions from the community - well, given that there haven’t been any, there won’t be an impact to the server or app repos. But I could see this impacting the willingness of the community to continue to build and maintain plugins.
Even if what they’re doing is legal, it still has a negative impact on the privacy community. F-droid no longer providing Standard Notes builds is going to cut off people from using this app’s updates going forward. It may end up being relegated to the IzzyOnDroid repo, but still not everyone uses that.
At least Signal provides a method outside of F-droid for automatic updates.
Good point. I’m not sure if IzzyOnDroid considers the CC license to be “free as in freedom” but even if they do, they allegedly have a 30 MB limit per application, and the most recent SN apk is just under 100 MB.
Signal’s approach is useful if the goal is to avoid being tracked by Google without losing out on the convenience of auto-upgrades, but it’s still bad in that they could theoretically introduce a client-side vulnerability that nobody external would have a chance to audit.
You can also use Standard Notes via the web app, which can be installed as a PWA. And even though it’s not FOSS anymore, the source is at least kept up to date.
Luckily for me, I saw this coming years ago and avoided this app.
I did too, but because I’m broke lol.
You can have zero expectations of privacy with closed source apps
That is true, but for the front end applications, if that is open source and has sound encryption then the server could even be proprietary, it won’t be able to break the encryption, so your data would be safe, maybe not so much for some metadata though. In this case the apps were changed to be all AGPL as I understand, so that should be ok.
Agree with all the rest, don’t like the maintainer’s attitude.
Edit: I was wrong, even the app is source available now (CC Noncommercial), not exactly good, but better than proprietary I guess
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !privacyguides@lemmy.one
In the digital age, protecting your personal information might seem like an impossible task. We’re here to help.
This is a community for sharing news about privacy, posting information about cool privacy tools and services, and getting advice about your privacy journey.
You can subscribe to this community from any Kbin or Lemmy instance:
Check out our website at privacyguides.org before asking your questions here. We’ve tried answering the common questions and recommendations there!
Want to get involved? The website is open-source on GitHub, and your help would be appreciated!
This community is the “official” Privacy Guides community on Lemmy, which can be verified here. Other “Privacy Guides” communities on other Lemmy servers are not moderated by this team or associated with the website.
Moderation Rules:
We prefer posting about open-source software whenever possible.
No soliciting engagement: Don’t ask for upvotes, follows, etc.
Surveys, Fundraising, and Petitions must be pre-approved by the mod team.
Be civil, no violence, hate speech. Assume people here are posting in good faith.
Don’t repost topics which have already been covered here.
News posts must be related to privacy and security, and your post title must match the article headline exactly. Do not editorialize titles, you can post your opinions in the post body or a comment.
Memes/images/video posts that could be summarized as text explanations should not be posted. Infographics and conference talks from reputable sources are acceptable.
No help vampires: This is not a tech support subreddit, don’t abuse our community’s willingness to help. Questions related to privacy, security or privacy/security related software and their configurations are acceptable.
No misinformation: Extraordinary claims must be matched with evidence.
Do not post about VPNs or cryptocurrencies which are not listed on privacyguides.org. See Rule 2 for info on adding new recommendations to the website.
General guides or software lists are not permitted. Original sources and research about specific topics are allowed as long as they are high quality and factual. We are not providing a platform for poorly-vetted, out-of-date or conflicting recommendations.
If they push AGPL, then the code is still open, it’s just explicitly copyleft. Any GPL license imposes serious restrictions on what the end user can do. AGPL further restricts what end users can do. Copyleft is similar but different from open source. Basically all they’re doing is leaving the code open to view but preventing anyone from money off of it.
Honestly for people like yourself this is exactly what you want for privacy software. Copyleft with commercial restrictions is basically the whole FSF vibe. This is much ado about nothing; previously the code was unlicensed on GitHub which is much more restrictive than AGPL.
My understanding is that they are only applying AGPL to the current version and going forward all versions will no longer be AGPL. However if they have accepted contributions that were not covered by an agreement to transfer copyright, this is illegal without obtaining explicit approval from all contributors.
No, I don’t think you understand the free software movement at all. It has never been strictly noncommercial. Open source has never been a vow of poverty.
BY-NC-SA is considered non-free by everybody, including the Free Software Foundation, the Open Source Initiative, and even Creative Commons themselves.
https://creativecommons.org/public-domain/freeworks/
https://www.gnu.org/licenses/license-list.html
https://opensource.org/licenses/
Furthermore, Creative Commons strongly warns against using these licenses for software for this very reason.
https://creativecommons.org/faq/#Can_I_use_a_Creative_Commons_license_for_software.3F
~I’m not sure why you brought up the CC license; unlicensed GitHub repos do not use that and, generally, it’s understood that CC licenses cover documentation only for the reasons you cited.~
I think you and I fundamentally disagree about the point of FSF. Open source is not a vow of poverty, you’re right; copyleft damn near is. Open source is an umbrella that covers both open and copyleft licenses. For the average business that wants to keep closed source code, copyleft modules are poison. I’ve handled the compliance process for both SMB and enterprise companies. Unless you’re someone like Red Hat, copyleft is basically noncommercial. AGPL, SSPL, and BSL are joke licenses that also present the exact same problems as copyleft albeit much worse for businesses to pick up. If you couldn’t tell, I don’t like copyleft code because I don’t think it’s okay to place restrictions on code beyond the basic litigation coverage things like the Apache 2.0 offer.
~As for what SN is doing, my read of that was the code would be AGPL moving forward. My understanding is that you don’t need contributor approval to apply it (depending on the original license; in the case of the unlicensed code they have full power) but you do need contributor approval to remove it. If you’re right and they’re going to drop it after applying it, they’re opening themselves up to litigation should someone choose to pursue it.~
Edit: just looked at the repo; they replaced the root AGPL with the CC license instead of, say, linking the CC license for docs and leaving AGPL in place. The individual packages don’t have licenses and the root code (eg scripts) don’t have one either. Ignore what I said about SN; they did everything wrong and it’s stressful to look at.
Thank you for raising this. My subscription was up for renewal next year, and I think I’ll look elsewhere now.
The only reason I chose to support S Notes in the first place is they were the best designed FOSS notes app at the time, and 4 years later they have plenty of competition in that space fortunately. Honestly I expected better from them, they say all the right things but I guess the greed just got too much for them.
Why?
The ~
change~ introduction sounds reasonableFor anyone looking for an alternative, I really like Trilium so far. It’s completely open source and the main dev and community seem great.
The performance is way better for me than SN. SN couldn’t handle a large number of notes very well when I tested it last.
The only downside imo is there’s no real mobile client, but the mobile web interface is still pretty good and usable.
Trilium looks pretty interesting but not like a great direct replacement. One major feature gap is the lack of custom editor plugins, which is essential for me.
Another app I’ve seen recommended as an alternative is Joplin. I don’t use it myself, but it does have custom plugins, including for custom editors. So for anyone who finds the lack of a mobile app or custom editors to be a deal-breaker, Joplin’s likely worth checking out.
It’s been a few years but Joplin always felt clunky to me, and sync was extremely slow. I’m not sure if it even had plugin support when I tried it last.
Trilium does actually have plugin support it’s just not as discoverable imo. You can create backend scripts and also frontend scripts that could act like a new editor.
There aren’t a ton of public ones, but check out https://github.com/Nriver/awesome-trilium for a few examples if you’re interested.
Oh cool! I’ll check those out.
Having looked at it a bit more, even if it doesn’t end up replacing Standard Notes for me, it still looks promising, particularly given the ease of self hosting it. Self hosted it looks like it could be useful for shared notes, too, even though that doesn’t seem to be its intended use case.
A big part of the appeal for me is that Standard Notes already had a bunch of editors and that it was easy to create my own - they provide a starter app and you can just use React and/or any web libraries of your choice. I’ve looked through the Trilium docs and while they’re not as good, they’re probably good enough.
Another big difference is that Standard Notes also sandboxes its editors, such that they only have access to the current note. It looks like Trilium’s executable JS code notes lack a similar feature. Then again, that also has a positive side effect of meaning plugin devs have a lot more power and flexibility in terms of what they build.
This is what F-droid says:
https://f-droid.org/en/packages/com.standardnotes/
In terms of privacy, nothing would change, it’s still the same as ever so I think the recommendation can absolutely stay up, even proprietary apps are suggested on Privacy Guides.
In terms of software freedom, this is a terrible change and I really dislike projects moving to source-available models, in this case, as the other commenters said there, I don’t even think it’s legal, unless every contributor has signed a CLA in the past.
I feel for not wanting to be explioted by corporate, but they could have gone the dual licensing path and instead chose to restrict everyone’s freedom, even us users. Now that doesn’t mean forks can’t be made I believe, it’s just that anyone who does that, won’t ever be able to sell the service which could be unsustainable since they made the server CC-BY-NC-SA, that’s a big turn off for those who want to host that
I just checked their Github and the app is CC-BY-NC-SA but the server is still GPL v3.
deleted by creator
Even if it were true (it is not: there are techniques like static analysis, intercepting client-server communication, etc., that can confirm application behavior), how is having “zero expectations of privacy with closed source apps as you cannot independently verify what they [sic] app is doing” relevant when the source is available?
Why do you say their actions were illegal? In every repository of theirs that I looked through (just app (formerly web), server, self-hosted, mobile, and desktop), the contributors on every single PR that had been merged was from someone in the org. Unless there are some other contributions that I’m unaware of, their license change was completely legal.
There are tons of community created plugins, e.g., for editors (heck, I created and maintain one) but the licenses on those haven’t been changed and aren’t impacted. For any plugin that’s bundled with SN, an AGPL license can be a problem, and I didn’t check the contributions on their plugins, so maybe there’s an issue there and that’s what you’re saying is illegal? If those are still licensed as AGPL my understanding is that’s still legally allowed when they’re doing it, so long as there are no community contributors.
Personally I don’t understand how moving away from AGPL could accomplish their goals - AGPL already prevents another company from forking their server, changing the code, and not distributing those changes to their users… is the concern that some major companies are doing that and charging for it or using it internally? But regardless, being source available instead of FOSS doesn’t impact privacy expectations.
In fact, the way SN handles this is much better than the way Signal does, even though Signal uses a FOSS license. With Signal, development takes place in a private repository and it is later (sometimes as much as a year later) merged to the public one. My point is, the license isn’t the only thing that matters.
In terms of impact on contributions from the community - well, given that there haven’t been any, there won’t be an impact to the server or app repos. But I could see this impacting the willingness of the community to continue to build and maintain plugins.
Even if what they’re doing is legal, it still has a negative impact on the privacy community. F-droid no longer providing Standard Notes builds is going to cut off people from using this app’s updates going forward. It may end up being relegated to the IzzyOnDroid repo, but still not everyone uses that.
At least Signal provides a method outside of F-droid for automatic updates.
Good point. I’m not sure if IzzyOnDroid considers the CC license to be “free as in freedom” but even if they do, they allegedly have a 30 MB limit per application, and the most recent SN apk is just under 100 MB.
Signal’s approach is useful if the goal is to avoid being tracked by Google without losing out on the convenience of auto-upgrades, but it’s still bad in that they could theoretically introduce a client-side vulnerability that nobody external would have a chance to audit.
You can also use Standard Notes via the web app, which can be installed as a PWA. And even though it’s not FOSS anymore, the source is at least kept up to date.
I did too, but because I’m broke lol.
That is true, but for the front end applications, if that is open source and has sound encryption then the server could even be proprietary, it won’t be able to break the encryption, so your data would be safe, maybe not so much for some metadata though.
In this case the apps were changed to be all AGPL as I understand, so that should be ok.Agree with all the rest, don’t like the maintainer’s attitude.
Edit: I was wrong, even the app is source available now (CC Noncommercial), not exactly good, but better than proprietary I guess