I run a website that showcases the best open-source companies. Recently, I've added a new feature that filters self-hosted tools and presents them in a searchable format. Although there are other options available, like Awesome-Selfhosted, I found it difficult to find what I needed there, so I decided to display the information in a more digestible format.
One thing I would like to see is a way to distinguish which apps do Real™ Open Source vs fakie open source. For example, I see Joplin on there saying "Your secure, open-source note-taking companion". I guess that's technically true at this point in time, but they also force contributors to sign a CLA so they have the option to pull the rug later on. (Something which does happen.)
They even say so explicitly:
This is necessary so that if we ever want to change the license again we are able to do so
The Free Software Foundation requires "CLAs" as well. I have no fear that they're going to rug-pull. I don't think we can use that as the indicator. IMO, it's even a good idea to have a CLA so that's no conflict that the project owns the code.
The warning for me is if the project is run by a company, especially a VC-backed company. Joplin isn't, so I would be comfortable using it (although I don't).
only the copyright holder or someone having assignment of the copyright can enforce the license. If there are multiple authors of a copyrighted work, successful enforcement depends on having the cooperation of all authors.
So it seems like the FSF does this in order to be able to enforce GPL. Buuut, these guys really gotta be the exception. I feel like the probability of the FSF selling out and going full corporate evil is pretty low...
a good idea to have a CLA so that’s no conflict that the project owns the code.
That's exactly the problem though. The project owning the code, instead of the contributors owning the code.
I don't think the type of license matters too much if you have to sign a CLA, since the company can just change it whenever they want. For example, you can be AGPL today (Joplin) and then not AGPL tomorrow.
How would you determine if a thing is true open source, or capitalism masquerading as open source like you've described, if you were to just stumble onto a software randomly and wanted to check?
For the specific case I'm talking about (CLAs), I check if the project (on GitHub or wherever) requires signing a CLA to contribute. In Joplin's case, they do:
Basically, with a CLA they can change the license at any time to whatever they want. If they want to go closed source tomorrow they can with zero trouble. Without a CLA, they would need approval from everyone who has contributed to the project to do a license change, giving the project proper open source protections.
This needs to be made more visible on github, like a little tag near all the share data under about. But I guess the only way that would work was people self reporting their CLA's. And not sure how keen microsoft would be on a consumer protection change