How can I tell if a particular distribution of the Discourse client is free software?

[JacobK1 (Jacob)]

@HAWK

@HAWK

Everything that is part of the core product that we host (including Meta), with the exception I noted above, is free and open source.

Is there a separate repo with a license for the plugins that I didn’t find previously, like discourse-customer-flair-plugin? The JavaScript served to the browser has a link to a source map but no license as far as I can tell.

My understanding of “hosting/infra code” wouldn’t include client-side JavaScript; is that correct?

@RGJ

@RGJ

I think there is a lot of confusion between a distribution in the good old sense (here’s a github repo and feel free to do whatever you want) and a distribution in the more modern sense (here’s a website and it pushes Javascript to your browser). Additionally, there is confusion between Discourse https://github.com/discourse/discourse and Discourse-and-all-of-its-first-and-third-party plugins-and-theme-components-added-by-the-site-administrators.

I agree. I think I am confused about what the word “Discourse” actually applies to.

@RGJ

@JacobK1

Does that mean the listed commit hash would be incorrect if a server administrator made modifications and didn’t also change the listed commit hash? I thought updating software would change the commit hash automatically, and I (incorrectly?) assumed the listed commit hash would be updated automatically.

It’s a commit hash so if modifications are made after pulling it from the repo and before committing it then you already have such a situation. That doesn’t need to be a malicious act, it will also happen if security patches are applied (which is typically done before committing them in a public branch). Now in general security patches are not client side but they might introduce some updated client-side code.

Ah, okay, so I guess there wouldn’t really be a good way to tell then.

@RGJ

@JacobK1

In many cases, people collaborating on software might read some of each others’ commits, so I don’t have to trust all authors individually.

Was the iOS SSL Flaw Deliberate? - Schneier on Security

Good point, someone could try to hide a flaw like this. But it seems easier to mitigate that problem by auditing third-party code than by trusting every single person who ever modified the code upstream, though probably neither approach would be practical to do completely.

@RGJ

@JacobK1

So, would the only way to avoid nonfree software while using Discourse be to package a Discourse client as a browser extension or Haketilo package or something similar?

It would be a way, I’m not sure if it’s the only way. If you do this, you would need to update it on an almost-daily basis to avoid breaking stuff.

Yes, although it’s possible that most updates could be handled automatically.

@RGJ

Even though this entire topic is an interesting legal discussion, it all seems a bit detached from reality.

I suppose that is mostly true in this case.