How can I tell if a particular distribution of the Discourse client is free software?

[RGJ (Richard - Communiteq)]

@JacobK1

the CLA may allow for proprietary versions

But those come “on top” of the open source version, so the mere existence of a CLA will not make Discourse non-free.

@Jagster

Discourse is open source, so using it is free. Hosting, by own or using CDCK, will cost.

This is not about free as in money but free as in ‘there is a non restrictive license’. What is Free Software? - GNU Project - Free Software Foundation

@NateDhaliwal

open-source software will be free

That is not necessarily true. Again: this is about free as in liberty, not in price. There are open source projects that have licenses that are too restrictive to be seen as free software per the FSF definition. Examples are MongoDB and ElasticSearch.

@JacobK1

I want to avoid running nonfree software. The main reason is that I think I should have control over the software that runs on my computer

Running free software does not imply that you have control over it.

@JacobK1

it’s relatively easy to avoid running nonfree software on the internet if you don’t use programs that automatically download and run arbitrary code from untrusted parties

So it seems you’re mixing up ‘trusted’ and ‘free’. When a server administrator builds discourse, the build process downloads all kinds of packages from NPM. Can those always be trusted? (History has learned us that this is not the case - example and another).

@JacobK1

so I guess the instances have not modified Discourse itself (though they may have added plugins).

You “guess” A server administrator can make modifications without changing the commit hash. And a plugin can inject Javascript code as well.

@JacobK1

this, combined with the version information is enough to use arbitrary Discourse distributions while avoiding running nonfree software

I hate to break it to you, but that is untrue.

This is not about free or non-free or open source or closed source, but about trust.

If you visit a Discourse instance, you will have to trust

• the server administrator(s)
• everyone with commit access on the Discourse github org
• everyone with commit access on plugin repositories
• everyone at github
• the entire NPM software chain
• everyone with commit access to any NPM repository that is being used
• everyone with control over your browser software
• the company that supplied the SSL certificate and the trust chain

Which will be a few thousand people at least?

@JacobK1

So it seems like most third party distributions (based on my small sample size of 3) stay pretty close to mainline Discourse, but then now this makes it look like this distribution contains plugins that would not be part most distributions. Do you know where I would find the licensed source code for all of those? Would they be in the main repository?

Plugins and theme components can be found in separate repositories.
Not all plugins are open source (e.g. discourse-customer-flair-plugin isn’t AFAIK). So there you have it. You will have to cease using Meta Just kidding of course. My point is that there can be enough trust without everything being open source or libre.