Show HN: Curenote, a health community for solving health problems - <AUTHOR> http://curenote.com I created Curenote, a social way for people to get help with their health problems.
Others who may have experienced the same health problem can offer their knowledge and advice on what they did to cure their ailment or illness.
People can offer their advice and support on topics such as cancer/diabetes, sexual health, drugs & alcohol, violence, diet & fitness and many more.
Please let me know what you think. Your honest feedback is much appreciated. Thanks! <comment><USER2> While I'm the first one to point out that Western medical doctors do not know everything, this is going too far in the opposite direction. Crowdsourcing your health without any credentials behind the answers? Sounds really sketchy to me...

<comment><AUTHOR> I will address your concern. How do we know the validity of an answer if we don't know if the person giving the answers is a doctor?

That's a valid question. But that question basically assumes that only doctors have the answers. While doctors are certainly smart and know their stuff, that doesn't mean that other people who have experienced similar health situations are inept and unable to offer any value.

There are many cases where other people, who are not doctors, have helped others through the sharing of health information and personal experience.

Here is one notable case: [http://today.msnbc.msn.com/id/43757155/ns/today- today_health...](http://today.msnbc.msn.com/id/43757155/ns/today- today_health/t/how-facebook-saved-my-sons-life/)

Curenote is NOT a substitute for seeing your doctor. But there are some cases where you may not need to go to the doctor where a simple remedy offered by others can help. There are cases where you might need to go to a doctor and other people can give you the support you need to help you.

<comment><USER3> I for one believe you have a very good point.

In fact it's always saddened me that experiences with different health issues isn't shared between doctors.

Until that is solved (and that will take a very very long time) you could potentially provide something of great value.

</comment></comment></comment><comment><USER4> What does this provide over the thousands of hits I'll get on Google for searching, I dunno, "swelling on neck" or "adhd medication choices for children"? Usually accompanied by forum posts of people sharing their experiences and what have you.

<comment><AUTHOR> I think this offers three things that googling up information doesn't.

#1 It's much more than just reading facts about an ailment. You're asking a health question about your personal situation and getting other peoples help, whether it's through their own experience, knowledge or whatever it may be. In some ways its even more reliable because you have other people to verify what worked for them and what didn't. You don't get that type of raw, personal information from referencing facts on a sheet of paper.

#2 You're not only getting raw information, but you get it targeted to your specific situation because you can ask questions. This means you can share different details and nuances about your situation and get answers that are directly related to that. Some people may have a paraticular health question and will resaearch online for hours and just find information that's not really targeted to their unique situation. Curenote lets you ask a specific question and get targeted answers.

#3 There are other health forums out there, but Curenote is designed to be easier to use and read, while looking beautiful and elegant. A lot of forums are badly designed with text that's hard to read, littered with ads all around, spam comments and hard to use navigations. Curenote strives to do better. It also only focuses on the key health topics that most people are inundated with everyday. These aren't just topics that affect the elderly, but teenagers and young adults as well.

<comment><USER5> I have a few problems with this answer (and perhaps your site itself):

Firstly, pretty much by definition, every situation will be unique. Factors that you may deem insignificant and not worthy of mentioning may be crucial in diagnosing a condition. A trained doctor should be aware of these factors, and ask pertinent questions to consider these factors. People unaware of such confounding factors may just pattern-match on the information you have provided, and come to an erroneous conclusion.

The "facts referenced on a sheet of paper" are (ideally) distilled from well- designed studies appropriately carried out (double-blinding, suitable controls, adequate statistical power, etc). This is arguably better than the "raw, personal information" which represents a single datum, with no control whatsoever. Granted, studies may not exist for a large range of conditions, or may be performed poorly, etc. I would still be wary of testimonials by unqualified people, however.

Secondly, which is something of a rehashing of the first point, the people asking the questions may not know enough to ask the right questions. I've heard this commonly referred to in the CS world as an "XY problem"[1]. Paraphrased, "You've concluded your problem is X, and you want to know a treatment, Y. Instead of asking about X, you ask about Y".

This may involve providing incomplete medical history to answer a question, or not have access to various diagnostic equipment, etc.

Thirdly, how does it "[focus] on the key health topics"? It looks something not dissimilar to a stackexchange site, perhaps without the editing/metacommenting/badges, etc. I assume some moderation will be in place to select these key health topics, and perhaps eliminate the spam? The main forms of communication (towards answering a posed question) appear to be adding answers, or voting up others. I'm not sure that's a suitable model for health issues - you're either going to end up with people upvoting things that they can (however vaguely) relate to, or adding additional answers to espouse their personal pet theory, adding noise to the discussion. I'd therefore look to the SE sites for ideas, such as communal editing, etc, but I think a score/badge related system is inappropriate for this subject.

Finally, I'm not sure of the legal situation, but I can certainly imagine that actual medical professionals would avoid answering questions, due to concerns about liability and professional ethics issues. Much the same occurs around law-related topics (disclaimers abound: IANAL, IAN __Y __L, etc). Without that countering opinion, I fear it may drift into placebos, rainbows and unicorns territory. I couldn't say for certain that will be the case, but the first question I looked at, the answer pointed to a thread on "earthclinic", with a huge number of people suggesting various vitamins, supplements with little or no justification for their use.

I realise this post is excessively negative, but I am deeply dubious of the value of "crowdsourcing" for situations in which lives may be at risk, and people could waste time waiting for answers, instead of going to the doctor or emergency room.

Perhaps the most useful way I think it could be used is as a sanity-check for actual diagnoses or treatments. "My doctor thinks I have X, and has prescribed Y, but there is no sign of improvement, any other ideas?".

Even then, I think it's fairly common practice to ask your doctor to refer you for a professional second opinion, which would probably be more useful. Then again, a fresh and distinct pair of eyes could pick up something a hurried, "treat as the most common case first" doctor might miss, as indicated by your facebook/autoimmune link upthread.

[1] <http://www.perlmonks.org/index.pl?node_id=542341>

<comment><AUTHOR> I think you're taking the site for what it isn't instead for what it is. Curenote is not a replacement for seeing your doctor. It's a way of getting supplementary health advice from other people who may have experienced similar situations. This doesn't mean you have to follow their advice. You should always think about what they're suggesting to see if it makes sense to follow. A lot of people have a lot of health knowledge they can share. This is way for them to do just that.</comment></comment></comment></comment>


Ask HN: App screenshot on business card? - <AUTHOR> I want to put part of screenshot from our app on a business card. This would not be a personal card, but one to pass out to people so they get the idea of the app and then (hopefully) download it.<p>Has anyone done this and if so how was the response? Did it spur questions about the app?  Do you think a screen shot is good enough quality to put on a business card? <comment><USER2> A screenshot likely doesn't tell people anything valuable about the app - it's not visually appealing, details would be infeasibly small on a business card, and a screenshot is impossible to search. As soon as you change the look of your app, all of your existing business cards suddenly have negative value.

Also, you're paying more for higher quality printing, and most people you give these cards too to will wind up forgetting about them or throwing them away. Maybe, instead of a screenshot, consider hiring someone to create a simple infographic better suited to the format, that could communicate the concept more clearly, and look good on less expensive stock.

<comment><AUTHOR> Thanks for your impute. Looking at the iPhone 5s screen, it is just a tad bigger than a standard biz card. I was thinking of showing about half of a screenshot expanded just a little.

I agree that graphic would be better. I just wanted something I could pass out for next two weeks while I workout a better way to present the app on the card. It would be better to personally talk to everyone but for some events that would not be possible.

</comment></comment><comment><USER3> Are business cards even relevant in this day and age?

Even so, if you've got to the point of exchanging business cards with somebody, wouldn't your amazing app already have been discussed?

<comment><AUTHOR> Well your name fits you well...

Yes it would be better just to tell people about the app. But for next few weeks I will be at events that the best shot I will be able to do is pass them out to people as they walk by.</comment></comment>


Ask HN: Did Google buy Trello? - <AUTHOR>

This is showing up in my google apps listing:<p>https://s3.amazonaws.com/uploads.hipchat.com/62821/434623/CcO7r0gB7olrtif/Screen%20Shot%202015-04-02%20at%2010.59.05%20AM.png <comment><USER2> The top category is from Google and the bottom is from Marketplace.

<comment><AUTHOR> Confusing UI, that makes sense I suppose. But why is the logo using Google's colors?

<comment><USER3> Or Microsoft's colors for that matter.</comment></comment></comment>


Pai: Twitter Is Bigger Threat to Open Net Than ISPs - <AUTHOR> http://www.broadcastingcable.com/news/washington/pai-twitter-bigger-threat-open-net-isps/170316 <comment><USER2> What a stupid point of view, because the entire point of net neutrality (title 2 or otherwise) is to ensure that it's possible for twitter et al to be overthrown by an upstart who gets a level playing field wrt Internet traffic.

If Pai gets his way, ISPs will be in a great position to cement Twitter and Facebook's monopoly with preferential treatment and free subsidized internet plans.

I guess this shows the true plan: make the big ISPs happy, and solve the problem of "net neutrality" instead by adding more government regulation into the picture to regulate the market of internet applications. Truly the worst of both worlds.

<comment><USER3> Net Neutrality doesn't "ensure that it's possible for twitter et al to be overthrown by an upstart who gets a level playing field wrt Internet traffic." Twitter/FB/Google don't need ISP's to build barriers to entry, they already have networks effects.

At best it takes away a rather unlikely method of reducing competition for twitter.

IMO, its more likely the ISP's try to extort cash from the web monopolies than accept cash to quash their competitors.

If Twitter really paid ISP's to block competitive services they'd get anti- trust sued into oblivion.

<comment><USER4> It's not paying to block competitors... It forcing a company to pay for their users traffic to not be throttled by the ISP.

</comment></comment></comment><comment><USER5> He spoke for an extended period, and this was one argument among many. Arguably, when Pai was speaking about Twitter, he was talking _not_ about the net neutrality issue, but about threats to free speech on the web. (That is, he was making a response to arguments from net-neutrality advocates that net- neut enables a freer and more open forum for political debate on the web.)

To be honest, if I look back at my last 20 years on the internet, I have seen more colorable censorship from the Reddits/Googles/Twitters of the world than from the various satellite cos, ISPs, telcos, quagmiric microwave relay companies, and mobile phone networks I've used to get _on_ the internet.

Disclosure: I am on bd of Lincoln Network, which put together the event in D.C. where Pai spoke.

<comment><USER6> This is precisely what rubs me the wrong way about the current pitches for net neutrality and why you won't see the right budge anytime soon. NN is being painted as a censorship issue by the biggest censorship-happy organizations in SV. To date, the only threats to consumers have come in the form of possible throttling and not outright blocking of certain speech. The only precedent I know of regarding censorship of the net has been at the hands of Twitter, Google and Youtube, Reddit, and Facebook, who are happily deleting all the political content they feel like at the moment whether it's illegal activity being discussed or not.

As my peer below stated, Comcast was caught disrupting P2P traffic which I hope gets addressed, but that's not how NN it's being sold and sensationalized today.

Edit: Clarifications

<comment><USER7> Except each of those companies has competition. Voat and Gab, among others, were born out of the idea that Reddit and Twitter were being unfair. And one had the ability to join one of those alternative platforms, even while still remaining a user of the original, without friction, largely because of having a neutral net. If we get ISPs offering "social media packages", what do you think the odds that Voat, Gab, or even Mastodon will be included?

If you believe that what Reddit and Twitter are doing is wrong, then why on earth would a reasonable solution be to extend the ability to do more of that to actors that one cannot reasonably avoid? I have a grand total of 1 ISP to choose from. The vast, vast majority of Americans have 1 or 2 to choose from. If NN is revoked, and Cox (my ISP) decides they're going to act like Twitter, then I have exactly no recourse. Why do you believe that is the way to go?

<comment><USER6> I whole-heartedly agree that ISP's shouldn't be outright blocking anything. I'm Pro-Net Neutrality Net-whatever to keep the pipes open and unfettered by greedy corporations.

I'm just pointing out the sheer hypocrisy of the recent campaigns talking about censorship as a possibility when the right has been getting attacked/censored by every big SV company in recent years. Now they're crying about possibility when they're engaged in the very act themselves. I guess they're right, they would know, so yeah i'm pro-NN.

<comment><USER7> I disagree. If I unleash a horde of spambots on this site, posting spam, and they get removed, am I being censored? If I constantly use slurs and other insults at other users, and I get my account banned because of it, am I being censored?

<comment><USER8> Yes, in both cases.

Censorship is a problem in certain cases (government, especially viewpoint- based censorship, for instance), but not in all cases.

</comment></comment></comment></comment></comment></comment><comment><USER9> So his argument is, "Edge providers censor content in a biased manner, and that's bad. Therefore broadband providers should be allowed to censor content." It's a non sequitur. If the ability of large edge providers to selectively censor content is a problem, it stands to reason that allowing broadband providers the same privilege would be an even bigger problem. And that's completely ignoring the fact that he's making his usual false claim of equivalence between edge providers and broadband providers.

</comment><comment><USER10> whataboutism.

we need more competition between ISPs _and_ more ISPs to select from (I have 1 with speeds that would allow me to successfully work remotely on Long Island NY).

I cannot see any other way for the consumer to win in any situation.

in regards to twitter, I agree they all have issues including recently the censorship in Romania [0] -- that is a _separate_ issue that also needs to be dealt with.

[0] [https://news.ycombinator.com/item?id=15790687](https://news.ycombinator.com/item?id=15790687)

edit - added links typos

<comment><USER11> Have you ever wondered why you don't have ISP competition in Long Island? If you live in Brookhaven, for example, it's because Verizon already started to build fiber and then the county refused to give it a franchise. But companies will build fiber if you let them. We already have FiOS where I live, and gigabit cable. Comcast recently extended its Metro-E network to a nearby business park, and as a result also started offering 2-gigabit fiber to surrounding residential areas for $150/month. Thanks to a loophole (you don't need a county franchise if you don't offer TV), they can build it out incrementally based on demand.

Companies want to build fiber. It's municipalities that are holding things up by lashing fiber build-outs to their social justice initiatives. Stockholm built its fiber network with no public money, neighborhood by neighborhood based on the business case, taking 18 years to cover 90% of the city. New York City, in contrast, demanded Verizon wire up 100% of the city in just 5 years.

</comment></comment><comment><USER12> ISPs are a threat to net neutrality. Large social networks are a threat to society in _others_ ways (censoring, monitoring, "bubbles", no rights what so ever).

I hate his guts, but while his interpretation of the Twitter problem is wrong (its not about net neutrality/open web), considering Twitter to be a problem in a general sense is _not_ wrong.

</comment><comment><USER13> Net Neutrality is a necessary good and ISP content throttling is certainly part of the problem. That said, he makes an extremely valid point here. If the argument is that a few key monopoly-like players dictate what content we can access then the major online advertising companies are just as much a part of the problem as throttling ISPs.

<comment><USER7> He doesn't make a valid point, though. He makes a completely orthogonal point. If you believe his point, that what Twitter is doing is bad, then how can you justify expanding the ability to do that to other, unavoidable actors? If I don't like what Twitter is doing, I can choose to instead go to Gab or Mastodon or even just start my own blog. If Cox decides to get in on the censoring game, and I don't like what they're doing, I can't do a thing about it.

<comment><USER14> > If Cox decides to get in on the censoring game, and I don't like what > they're doing, I can't do a thing about it.

Agree, that's the main issue. If you could choose between 3 ISPs then the one with less censorship and throttling would win and others would be "squashed" by the market. There would be no need for net neutrality rules. But in some areas there is just one provider so nothing can be done. And it's not a new thing, it's been years for the market to grow and develop, but it hasn't.

> If Cox decides to get in on the censoring game, and I don't like what > they're doing, I can't do a thing about it.

It's a good point, however practically they have no financial incentive to censor based on content. Yeah if could one day, so you're at their mercy, but so far their censorship has been around extorting higher fees either from you or from services you connect to (Netflix, Google, Facebook etc). Verizon for example throttled my Youtube and Netflix even as I was paying a premium for high tier "FiOS" or whatever it was called package.

Google, Twitter, Facebook on the other has been engaged in a more dangerous censorship. We saw the story yesterday about FB squashing posts from Romanian protest organizers. So in that respect it is closer to the classic silencing and squashing of free speech.

Calling them out and taking a jab at them doesn't seem terrible. It won't save net neutrality at this point but if it forced or embarrassed those companies to reduce their censorship it seems worth it.

</comment></comment></comment><comment><USER15> "Twitter Is Bigger Threat to Open Net Than ISPs"

So he admits ISPs are a threat?

</comment><comment><USER16> I don't appreciate the direction the nn discussion has gone. To me the core and fundamental principal of innovation and growth is connectivity - pure, raw, naked and unfettered access to an open network. I am and always have been able to choose any "edge" provider or network service or content I desire, always. This is not true with regards to simple connectivity. These two things are being improperly (nefariously, imo) tied together much like the access and content mergers - these two things simply do not belong together - access is not content is not access. I do recognize and understand the broader discussion around content and services when it pertains to inordinate impact, influence or control via overly influential and controlling services - services which, for the most part, we can still all choose whether or not to use whenever we want.

The only true and immediate threats I can currently perceive are coming from those controlling the gates to access. We've been robbed of the basic premise of title II protections for a vital communications service because we allowed the topic of discussion to change. "Network Neutrality" was never a good hook and now it has enabled the loss of focus on the core problem that is ISP service in this country. Twitter content? No so much.

</comment><comment><USER17> It's a conflation of two separate issues.

If you have open network access then you have access to alternative providers that will host people that may be banned or restricted on Twitter (see GNU Social and Mastodon).

If you have ISPs regulating what you can and cannot access then you don't even have that choice - you get the worst of both worlds - Twitter acts as a gatekeeper and your ISP acts as a gatekeeper on top of that.

<comment><USER18> It is a conflation and if Pai doesn't get this, then he has no business having the job he has.

I think he does get it though and this is a tactic that might work for him.

I think it's worth making a distinction over regulating the internet vs regulating ISPs. The internet should be unregulated but ISPs should be regulated. ISPs provide a telecom service while companies like Twitter provide an information service. They aren't the same thing at all and we shouldn't let telecom companies pick the winning info service companies.

</comment></comment><comment><USER19> Red herring. Twitter will never have the power to throttle competing websites. This is completely unrelated.

</comment><comment><USER20> Almost all the Ajit Pai stories these days appear to be Astroturfing. They are cleverly manipulating the masses of voting population, which doesn't think like most folks here at HN, into believing that this is a great thing for them.

Astroturf and manipulation of media messages | Sharyl Attkisson | TEDx University of Nevada => [https://www.youtube.com/watch?v=-bYAQ- ZZtEU](https://www.youtube.com/watch?v=-bYAQ-ZZtEU)

</comment><comment><AUTHOR> I don't like his argument.

I think we should regulate ISPS,DNS providers, Social media, and other parts of the Internet Ecosystem to be neutral.

Though I agree full with Pai's statement:

"what I know is not the right answer is that a cabal of ten tech executives with names like Matthew, Mark, Jack, . . . Jeff are the ones choosing what content goes online and what content doesn't go online."

I don't like this will be used probably successfully as a wedge to destroy net neutrality.

<comment><USER21> No, instead it should be a cabal of ten tech executives with names like Brian, Lowell, Marcelo, Thomas, and John - you know the good ol' boys who have made Pai rich and have jobs lined up for him as soon as he retires from the FCC. Those silly new-age-tech guys don't understand how the game works, and think that the constitution has any place in our "Democracy".

<comment><USER22> > Those silly new-age-tech guys don't understand how the game works, and think > that the constitution has any place in our "Democracy".

What part of Pai's actions go against the constitution? Unilateral actions by the executive can also unilaterally be undone by the executive.

More durable change rests with congress or the courts.

<comment><USER21> >Amendment I. Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the government for a redress of grievances.

If ISPs are allowed to put up a tollway preventing or slowing my access to the press - at their own discretion, that is absolutely a violation of the constitution.

</comment></comment></comment></comment><comment><USER23> So, I can have any kind of water in my house, but Pai wants to control whether I have crushed ice or cubes?

</comment><comment><USER7> The thing I ultimately don't get, and that makes this entire argument disingenuous, is that, if you believe that what Twitter is doing is wrong, then why on earth would you decide that you want to enable more actors, especially ones that people cannot avoid, to be able to do that?

</comment><comment><USER24> This guy is twisting arguments to spew a talking point favorable to his agenda

</comment><comment><USER25> This logic is so flawed, it's a bit scary he has the platform to voice it.</comment>


Announcing Caddy Commercial Licenses - <AUTHOR> https://caddyserver.com/blog/accouncing-caddy-commercial-licenses.html <comment><USER3> > As of version 0.10.9, Caddy emits an HTTP response header, Caddy-Sponsors, > which is similar to the Server header that Caddy already has, except that > this one credits our sponsors who make it possible to keep Caddy free for > personal use. This header cannot be removed by the Caddyfile, and its > presence is required by the non-commercial EULA. This requirement is waived > by the commercial license, so the header is not present in those binaries.

Really not a fan of this, guess I'll be compiling my own builds from now on.

Don't get me wrong, I think charging for commercial licenses (which come with proper support) is a good business model, but my personal site shouldn't suddenly become an advertising outlet. The fact that the headers aren't seen by most non-technical users is moot.

I find this practice pretty obnoxious to the point of looking at NGINX Plus for commercial use instead.

Edit: Here's my fork [https://github.com/WedgeServer/wedge](https://github.com/WedgeServer/wedge)

Second edit: Accusation of trademark violation within an hour of the fork, classy! [https://github.com/WedgeServer/wedge/issues/2](https://github.com/WedgeServer/wedge/issues/2)

<comment><USER4> Thanks for your feedback. I'd like to know more.

> The fact that the headers aren't seen by most non-technical users is moot.

Why's that? (And even among your technical visitors, how many of them actually inspect the response headers?)

> I find this practice pretty obnoxious to the point of looking at NGINX Plus > for commercial use instead.

It's good to know that price isn't the bottleneck, then. Does it make any difference to know that commercially-licensed Caddy builds don't have that header?

<comment><USER5> > And even among your technical visitors, how many of them actually inspect > the response headers?

I find that a bit disingenuous. You can't both include annoying headers _and_ argue that they aren't annoying anyone because nobody will see them. If nobody will see them, why add them in the first place?

<comment><USER6> To give commercial users an incentive to pay for the open source software they use. Can you name an open source project that does not offer extended features for commercial versions and that sells? Because I can't

<comment><USER7> There's a difference between "extended features for commercial versions" and "adware". Usually the open source version includes core features that solve a basic set of problems, and the commercial versions add additional features to solve other and/or larger problems. At no point is there an explicit crippling of the open source.

What's particularly frustrating is the burying of the lede here. The summary of the page intentionally omits the fact that you can build from source and use it in commercial contexts. And the section discussing the Apache license is factually incorrect: "Remember that building Caddy from source is still subject to the Apache 2.0 license which requires attribution and stating changes." \-- that is only true if you are selling on-prem software that ships with the program. If you are using it in the normal course of your SaaS, no attribution is required.

<comment><USER5> Exactly. I would have no issue if paid usage was for things big companies are more likely to need, e.g. support, high-performance features, etc, like nginx does, but this is egregious.

</comment></comment></comment></comment></comment></comment><comment><USER8> I said further below that this makes Caddy nonfree, but I was corrected - <USER2> can still build Caddy from source, remove the bullshit, and distribute your changes and compiled binaries under Apache 2.0.

However, after examining the website more I feel the need to write another comment expressing how poorly this is being handled. The website is very misleading - on the download page, it now asks you to pick a license, and says that the "Personal" version is for only personal use and you need to pay for the commercial version. There's no indication until you click through to the full pricing page that the open source version even exists. On that page, you have the same personal/commercial breakdown, also stating that the personal version is strictly for non-commercial use, but with a sidebar mentioning open source. It assumes you understand the Apache 2.0 license and makes no attempt to clarify that businesses can use the open source version.

The authors are also wasting no time in going after forks[1] to complain about trademark infringement, so if you want to distribute your own patched Caddy builds you can expect to hear from their lawyers. Absolutely devoid of class.

This is a really obnoxious change. I was thinking about switching from Nginx to Caddy but this news is nailing that door shut.

[1] [https://github.com/WedgeServer/wedge/issues/2](https://github.com/WedgeServer/wedge/issues/2)

<comment><USER9> > The authors are also wasting no time in going after forks[1] to complain > about trademark infringement, so if you want to distribute your own patched > Caddy builds you can expect to hear from their lawyers. Absolutely devoid of > class.

This in particular doesn't seem fair. Trademark really requires trademark holders to make active efforts to preserve their trademarks as soon as they're aware of potential breaches, or they invite risk. And this is a simple request in the fork's issues page - no lawyers are involved yet, as far as I can tell.

<comment><USER8> There's not even a registered trademark, as they stated. And simply distributing a modified version of an open source project under that project's name is absolutely fine and pushing against it is definitely in bad faith.

>And this is a simple request in the fork's issues page - no lawyers are involved yet, as far as I can tell.

Well, what do you think their next step is if they refuse?

<comment><USER10> Unfortunately the "distributing a modified version of an open source project under that project's name" can be problematic from a trademark perspective. This has come up many times before in other projects and led Debian to not use trademarked project names for software. If you are not familiar with the discussions, just search for "IceWeasel".

<comment><USER8> You're right, I hadn't thought of that. I still think going after a fork within minutes of its establishment for trademark infringement is in very bad faith, though.

<comment><USER11> And I think this is the crux of the issue with the trademark threats. They're going after these forks that haven't yet had enough time to signal intent to violate trademark, however pending it may be. You can say that they're just protecting their mark and that's fine and valid, but to do it within minutes of repo creation gives the uneasy feeling of them "dancing a mace in the air" to remind people who's the big guys on the block.

</comment></comment></comment></comment></comment></comment><comment><USER12> @mholt is being exceedingly generous to the whingers on this thread, on top of the generosity he's shown in writing Caddy to start with.

It's not 2005 any more, Sun Microsystems is long gone. You won't raise any money from a business model that gives away your best work or selling support contracts alone.

Caddy is a real innovation, and brings web server defaults bang up to date - it makes loads of complex configuration easy. It's already distributed in the finest tradition of free software - a liberal source code license with no restrictions. You can do what you want with it.

Like GNU in the 80s and OpenBSD in the 90s, Matt is _selling_ the most convenient package and yeah - if that's the one you used and relied on for your infrastructure, you've got to pay, and not very much.

Matt has clearly worked hard at making that payment support as much as possible in terms of convenient corporate deployment. I really hope that works out well, and am glad it's a business model that supports Free software without any compromises.

<comment><USER13> What I think is interesting, is the licensing model is basically reverse whaling

The bigger the company is, the more likely they are to go with just building Caddy themselves instead of paying for it. So, the only people who _need_ to run the commercial binaries are the situations where the licensing costs actually matter.

Maybe I'm underestimating the size of the demographic they're targeting, but it seems to me that the only market for Caddy is a fairly small niche of people who are unwilling/unable to run NGINX or set up their own build process.

<comment><USER14> I disagree.

Big companies are where they're going to buy the licenses because in those companies time is often more kmportnant than budget so you just buy stuff.

Another reason is that as soon as other teams become involved you get comments like "this bug is yours because you self compiled this thing", or "we have to buy the vendors version", etc etc. It's not logical and is basically arse covering. Buying the vendor version is an easy way to shoot down a whole category of stupid internal politics.

<comment><USER15> > Big companies are where they're going to buy the licenses because in those > companies time is often more kmportnant than budget so you just buy stuff.

It doesn't work quite like that. Unless you're friend with the guy who decides who the checks are signed to, or you are already an established brand or your product provides a value so big it's a no-brainer, nobody in a big company will invest in your solution. If the company can get your product for free it will.

Caddy is trying to cash in on a product that is young, that has everything to prove, while at the same time pissing off the people it relies on to acquire an "audience", the users of the open source version, it never ends well.

The right way to do it is, to leave the open source version as it is, without any license change, while creating a new product,closed source, suited for enterprise.

> "this bug is yours because you self compiled this thing",

never heard anything like that in my life.

> Buying the vendor version is an easy way to shoot down a whole category of > stupid internal politics.

If you have the power to do so at your business by all means. Buying into a commercial product also require a crazy amount of politics as well, especially if it's a recurring payment PER month PER instance at a minimum of $50, so more than the price of a basic VM on Amazon.

<comment><USER16> > never heard anything like that in my life.

Just yesterday I was whipping a team because they built their own version of Apache (for dubious reasons) and broke the patch management system.

To quote myself "why the fuck didn't you use the distribution packaged version?? Now go and fix that right now, it is your problem"

I think it pretty much covers the case.

<comment><USER15> Yes, and you don't have to pay to use a packaged distribution of Apache free of adware.

> I think it pretty much covers the case.

I think it pretty much doesnt.

<comment><USER16> What adware? In which packages? What kind of payment are you talking about? Redhat?

Have you ever maintained a bunch (100 to a few thousand) machines where everyone builds his stuff from scratch according to their under the shower visions ? I have and now I will hit the ones who step one nanometer outside the only true and god provided package, that is straight from the distribution.

And yes - it does cover the case of you NEVER seeing that. Now you have seen.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> Well, I guess I'm moving switching from Caddy to NGINX then.

I like Caddy, it's been great, but I have no interest in paying for support, and I'm certainly not going to pay to remove a HTTP header.

Yes, I could spend time setting everything up to build custom versions of Caddy without the header, but it'll be quicker and easier to switch to NGINX.

Whilst I really appreciate all the work that has gone into Caddy, I am extremely annoyed that it's now going to cost me at least an afternoon to move away from.

If you're an existing Caddy user and don't want to (or can't) pay, your options are either don't upgrade, server ads for Caddys sponsors, or spend a significant amount of time configuring your own build process/switching to something else.

I can't help but feel this move is going to be bad for Caddys adoption.

<comment><USER4> Caddy is still open source, Apache licensed. You can certainly build from source as long as you give attribution and state your changes.

<comment><USER17> Matt, I really do appreciate the work you and others have put into Caddy - it's a fantastic piece of software which has served me well for the past year and a bit.

Having said that, this change has put me in a position where I have to invest either time or money into a solution for a problem which I didn't have yesterday, and switching to NGINX seems like the path least likely to cause issues in the future.

Having to build my own version of Caddy for every update is a cost I'm not willing to pay. Since I'm being forced to invest in something, it may as well be NGINX, and I suspect I'm not alone in this.

<comment><USER18> I don't think a small nudge to actually pay for the thing that benefits you, or have a small note somewhere that you're _not_ paying for it that someone might--gasp!--see, is as big a deal as the histrionics throughout this thread suggest. You don't have a problem because there's an HTTP header, you have a problem because this makes you feel uncomfortable and you want to hide it, and that strikes me as a very different thing.

You can also pay-the-man. That's an option, too. Personally, if I "really [did] appreciate the work [mholt] and others have put into Caddy," I'd be doing that long before I go switch web server stacks, because wow that's not a lot of money if I'm doing anything where I actually care about a HTTP header, but I prioritize not freeloading where I can so that's probably "just a worldview thing".

<comment><USER17> Or perhaps I'm a student with no income trying to write a thesis at the same time as bootstrap a startup, and can't afford to spend $100/month on a reverse proxy? The new EULA states I'm not allowed to use the personal build, so I have little choice in that matter.

Your "worldview" doesn't seem to extend past the end of your own nose.

<comment><USER19> you are a student and you are using something for FREE and you are also at the same time worried about extra stuff in the headers?

what is your startup going to do to generate money if you perpetuate the belief that no one should pay for anything?

<comment><USER17> The startup has extremely limited resources, it's a bootstrap, as I explained. The licence prohibits us from using the personal licence, and there is a time cost involved in building and maintaining our own version. $1200 a year is not good value for us when NGINX will do the job for free.

I never claimed that no one should pay for anything, and I wish the people working on Caddy the best of luck. I think it's a fantastic piece of software and, as I have said several times, I am very grateful for the effort that has been put into making the project what it is.

However the change means that I have to act or be left with an out-of-date internet facing server. If you cannot see why I am annoyed at being given no choice but to spend time or money on solution because Caddy has introduced a new commercial licence, then I will not convince you of anything.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> Congratulations on the launch, and good luck finding a sustainable means of funding Caddy. It's a uniquely ergonomic webserver.

That said, the unalterable Caddy-Sponsors HTTP header _feels bad,_ and cheapens my overall impression of Caddy as a quality product. Now, instead of paying for a license to gain access to enterprise features or support, I'm _paying to remove ads._ From my webserver. Which now has a custom license that I have to read, remember, and figure out how to comply with.

I give up. I'm an individual running 8 little caddy containers on a $5/mo VPS. The cognitive load simply isn't worth it, and I hope you'll reconsider. Otherwise, it's back to cobbling things together with nginx and haproxy. :(

<comment><USER9> > That said, the unalterable Caddy-Sponsors HTTP header feels bad, and > cheapens my overall impression of Caddy as a quality product.

Hit the nail on the head. There's lots of reasons why this is a non-problem, intellectually speaking, but none of the arguments for this remove the bad taste in my mouth, emotionally speaking. The other news doesn't bother me, but the header... disappoints me.

</comment></comment><comment><USER21> To everyone saying that Caddy made it simple for automated LE; I agree, but also, it's not that difficult to setup with NGINX:

Edit /var/nginx/ssl_common.conf

      ssl_certificate /etc/letsencrypt/live/<site>/fullchain.pem;
      ssl_certificate_key /etc/letsencrypt/live/<site>/privkey.pem;

      location ^~ /.well-known/acme-challenge/ {
            default_type "text/plain";
            allow all;
            root /var/www/example;
            auth_basic off;
      }

Edit crontab, add:

      30 2 * * 1 /bin/certbot -a webroot --webroot-path=/var/www/example renew --renew-hook "systemctl restart nginx"

Make the cert

      mkdir -p /var/www/example
      certbot certonly --webroot -w /var/www/example/ -d www.example.com

In your NGINX HTTPS server blocks add:

      include ssl_common.conf

That should be it...

<comment><USER22> Small improvement, but `reload` should do this while gracefully terminating connections:

[https://www.guyrutenberg.com/2017/01/01/lets-encrypt- reload-...](https://www.guyrutenberg.com/2017/01/01/lets-encrypt-reload-nginx- after-renewing-certificates/)

[http://nginx.org/en/docs/beginners_guide.html](http://nginx.org/en/docs/beginners_guide.html)

Basically `reload` should have the external appearance of 0 downtime.

<comment><USER21> Thanks.

</comment></comment></comment><comment><USER23> _Beginning today, all official Caddy binaries come with an End User License Agreement (EULA) that designates them either for Personal (non-commercial) or Commercial use. To be clear, this EULA applies only to Caddy binaries you download; it does not apply to the source code. Caddy is still open source, and the source code is under the same Apache 2.0 license._

Thanks for keeping it open source. I'm very interested in how this business model will work, glad to see people trying different approaches.

<comment><USER24> Since you could pull yesterday's version:

OpenOffice -> LibreOffice

Gnome -> Mate

Caddy -> ?

<comment><USER25> Wedge.

[https://github.com/WedgeServer/wedge](https://github.com/WedgeServer/wedge)

</comment></comment></comment><comment><USER5> I've been trying to get Caddy more widely deployed at work, and this move is going to alienate commercial customers (at least us) even more than Caddy already does.

Not only do they not have repositories, essentially doubling the effort to keep machines up to date (we have to have one process to upgrade _everything else_ , and one process to upgrade _just Caddy_ ), but now we can't even download precompiled binaries to deploy on the servers without paying.

I could have put up with Caddy not being as mature as nginx for some low- volume deployments, and barely put up with the lack of debs, but having to compile my own binaries across the company isn't worth the integrated TLS certs.

<comment><USER4> > Not only do they not have repositories, essentially doubling the effort to > keep machines up to date (we have to have one process to upgrade everything > else, and one process to upgrade just Caddy)

Cory's working on this, actually. If we can get it working, we should be able to offer official Caddy packages to all our customers, customized just how they need it to be, so your 'apt upgrade' could upgrade Caddy as well, with just the plugins you want.

> _I could have put up with Caddy not being as mature as nginx for some low- > volume deployments, and barely put up with the lack of debs, but having to > compile my own binaries across the company isn 't worth the integrated TLS > certs._

Until we have official apt repos, you're welcome to use getcaddy.com which automates builds and installations of Caddy. True, it's not "apt install" but it's pretty close, until we can get apt repos and others available.

<comment><USER5> > it's not "apt install" but it's pretty close

It's not close, though, it's very far. With apt, I know things are going to go in their proper place, and are going to get cleaned up afterwards (not to mention the biggest benefit, automatic updates).

With a shell script, I don't know what sort of stuff it puts where on my filesystem, and I can't automate the installation easily. My preferred order of installation procedures is: "apt", "manual", and "random shell script" is a distant last, to the point where I sometimes won't try software if the installation procedure isn't sane.

<comment><USER26> My thoughts exactly. And I am afraid we are moving even further away from packages with this move..

<comment><USER5> Yeah... What I don't understand is why nginx doesn't have built-in LetsEncrypt cert fetching yet.

<comment><USER27> After this I would bet they have it before very long.

<comment><USER28> You assume that they care about Caddy and that the 9 lines of how to get LE for nginx is something they think it's hard to do for anyone that can't follow these instructions: [https://gist.github.com/cecilemuller/a26737699a7e70a7093d4dc...](https://gist.github.com/cecilemuller/a26737699a7e70a7093d4dc115915de8) or use: [https://github.com/certbot/certbot](https://github.com/certbot/certbot)

</comment></comment></comment></comment></comment></comment></comment><comment><USER29> I completely understand this direction, and really appreciate the work mholt and team has put into Caddy, but I'm disappointed at the same time. I looked forward to spinning up my dumb ideas tied with commerce using Caddy (on a 0 budget).

I've been a Caddy evangelist ever since discovering the powers (auto HTTPS, git webhooks, simple config, etc.), I had plans to write blogs about simple sites for simple ideas that can generate money - but nothing that would allow me to swing $100/mo.

I understand that I can compile the source and remain compliant, however, part of the charm was the simplicity once paired with docker for rapid dev/deployment.

Does anyone know if there's significant pain in maintaining a docker image that compiles source code like Caddy on rebuild?

<comment><USER30> I couldn't agree more. The terms seem overly restrictive.

Let's hope that they don't "go after" anyone who's not compliant and that this is silently a scheme to force bigger companies into compliance and let the rest of us fly under the radar.

As-is, I would owe Caddy $300/month - none of my side projects can sustain that, so I'll be switching back to nginx and some LE cronjobs.

<comment><USER5> Yeah, I have a bunch of side projects that collectively make ~$2/mo. Good thing I didn't replace nginx with Caddy on that server.

</comment></comment></comment><comment><USER31> > We now require declaring a license when requesting a download: > > [https://caddyserver.com/download/<os>/<arch>?license=persona...](https://caddyserver.com/download/<os>/<arch>?license=personal) > > The value for the license variable can be either personal or commercial. > > … > We require the license parameter because we feel it's important for the > license to be deliberate, not assumed. To ease the transition into this, > though, we'll allow the current syntax (no license parameter) to work for at > least 30 more days, and a personal license will be assumed.

I think this warning should be more prominent. Lot's of CI builds would mysteriously fail after 30+ days.

<comment><USER4> I'll work on that. But the error message is very clear, so if any error reporting is enabled, it'll be pretty obvious what to do, at least.

The fact that people were relying on volunteer-supported infrastructure for their CI builds is a little unnerving to me, hence the move to commercial support.

<comment><USER32> Why not upload them to GitHub?

<comment><USER33> Exactly, building and pushing to GitHub is a set-and-forget process. Besides, it already needs to be done for paying customers now so what kind of work is that saving Caddy? I don't understand.

EDIT: Additionally, it's an error to think that non-paying customers are not contributing. It's actually a pretty basic misunderstanding for an open source company. Users are contributing with bug reports, small fixes, testing, marketing, etc. It amazes me we still see this feeling in 2017. I dare all companies with open source projects to actually close them and replace non- paying customers with QA teams, more developers, more infrastructure, etc. Make sure to increase your budgets and raise your prices accordingly.

<comment><USER32> Answering my own question: it is now my understanding that caddy relies on a custom build system to generate custom builds on the fly for its plugins. Publishing all combinations on GH wouldn't make much sense given the combination explosion for any new plugin.

<comment><USER33> That's excellent. Most people don't seem to use plugins so a default build is enough for them. Those who need it have a business need now and can either setup their own build system or pay Caddy for that. Value is generated as opposed to being subtracted (from the current status quo).

<comment><USER4> More than 50% of Caddy downloads have at least one plugin. 1 and 2 plugins are the most common of those that have at least one.

<comment><USER33> That's impressive and a sizable customer base. I hope it works for you, Caddy is impressive and more competition is always good.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER34> Came back to this thread during lunch, and a few things I'm seeing have me more worried about Caddy than I originally was. Originally it just seemed like a very minor misstep, but now it seems more likely to be the start of something worse.

Can I ask - what exactly is Light Code Labs? The page really doesn't say much. It almost seems like some 3rd year Computer Engineering student at BYU came along and talked Matt Holt into creating a business of Caddy? I can't see anything about business expertise, and in the wedge fork trademark issue the other co-founder just responded that he was "part owner of Light Code Labs" and nothing about development. On the site it just says this person "recently got into web development...[and] wants technology to be more intuitive for people to use".

It might just be my dislike of fluffy BS, but it seems like red flags to me.

<comment><USER35> It's me, the other guy. That bio is pretty old, but it was accurate at the time. Caddy required a legal entity a few years ago for several reasons, so we went with "Light Code Labs". LCL owns Caddy and is the legal entity through which we do business. mholt was (and still is) very concerned about making Caddy sustainable. I am also concerned about this, since I knew that mholt wasn't going to maintain the project for free forever. So he invited me to join him and help with logistical things (money/taxes, trademarks, etc.), along with some technical things (currently working on an API for Caddy, as well as implementing apt-get with the build server). mholt is his own person, and I am not in a position to coerce him into doing things he doesn't want to.

</comment></comment><comment><USER36> Not being able to use the release binaries (even from github) for commercial purposes is a bummer but if this is the price to pay for having caddy available as open source, then it is fair.

What I am afraid of, is that this friction to start with caddy (because $50 per month is way too much for most use cases) will affect its user base and as a consequence the participation in development. Of course mholt and the team behind caddy are the people who love it the most and care about its future the most, so I trust they will keep pushing forward.

For people who find it difficult to build caddy from source, here is an example, provided you have Go installed and configured:

      go get github.com/mholt/caddy
      go get github.com/caddyserver/builds

      cd "$GOPATH/src/github.com/mholt/caddy/caddy"

      # Enable cors, prometheus plugins.
      cat <<EOF>caddymain/plugins.go
      package caddymain

      import (
              _ "github.com/captncraig/cors/caddy"
              _ "github.com/miekg/caddy-prometheus"
      )
      EOF

      go get -u -v -f ... || echo "Updated dependencies"
      go run build.go

_Edit: updated with the latest build procedure_

<comment><USER9> To compile without the `Caddy-Sponsors` header, include this line before the plugin comment:

        sed -ie '/Header().Set("Caddy-Sponsors/d' ../caddyhttp/httpserver/server.go

<comment><USER36> Thanks, although I personally will keep it. When I was maintaining web servers as a living I used to add a custom header here and there, so I see no harm in the practice.

</comment></comment></comment><comment><USER37> Key Quote: _To be clear, this EULA applies only to Caddy binaries you download; it does not apply to the source code. Caddy is still open source, and the source code is under the same Apache 2.0 license._

Doesn't this mean that you can simply compile Caddy from source, and avoid having to pay for commercial use? Most Caddy users are likely going be comfortable with compiling stuff, so what benefits does paying bring besides private plugin hosting?

<comment><USER4> You're right, you can build from source under the Apache license. Keeping the project truly open source is really important to us, because the community is such a great part of using Caddy.

Commercial licenses would only cost hundreds of thousands of dollars per year if your organization has at least 160 instances in use. Keep in mind that modifying the source is required to plug in any plugins, which people tend not to want to bother with.

We're also looking into adding more features for our customers.

<comment> nevi-me I pay $149 a month for a server, I was using Nginx + nghttp2 (for gRPC), until last month when I switched to Caddy (LE benefits).

I'm not familiar with Go, so I can't modify source to get the plugins I like.

I read the announcement page, and can't find what the cost is, but it doesn't matter. My work doesn't count as non-x, because I want to someday make an extra income from it.

I've found Caddy to be a cool and interesting project, but guess I'll be switching Nginx back on soon enough :(

<comment><USER4> The Caddy source code is Apache licensed, so if you build from source, you're good to go. That's the point: we know there are many projects that are just a little side income here and there, so you should be able to build your own Caddy binary from source and use it.

The pricing is on our pricing page: [https://caddyserver.com/pricing](https://caddyserver.com/pricing)

If your commercial venture isn't profitable yet, we will try to help you bootstrap. Just email us, firstname.lastname@example.com and we'll see what we can do.

<comment><USER5> > if you build from source, you're good to go.

That's a pretty big if. The one time I had to compile the server from source (to help you test a bugfix), I had the Go toolchain installed (which not everyone does) and I still couldn't figure out how to compile with some of the plugins I wanted. I gave up after 30 minutes of not getting anywhere, IIRC.

I think this move has lost you a lot of goodwill from people.

<comment><USER38> >a pretty big if. The one time I had to compile the server from source...couldn't figure out how to compile with some of the plugins

And there's the rub: even for as smart as lots of HN readers are (and, likely, as most Caddy users are), why are you _forcing_ folks to do something that isn't standard? Why force people to go about awkward, ugly manual steps to avoid something that didn't even exist a few hours ago?

</comment></comment></comment></comment></comment></comment><comment><USER39> > If you use Caddy for personal, academic, or non-profit purposes, not much is > different. Caddy-Sponsors HTTP Header

> If you use or distribute official Caddy binaries at work, or as part of a > product/service, you will need a commercial license

If I have some personal project which I want to incorporate I need to worry about the license.

Oh, time to switch back to NGINX. Thanks for automated HTTPS while it lasted.

<comment><USER9> This is incorrect, or at least only half-true.

Caddy is still Apache 2.0 licensed. You can use it for free for commercial purposes. You just can't use the build server at caddyserver.com to download a precompiled Caddy with plugins. Instead, you can download the source, compile it with plugins yourself, then distribute your own binary amongst all your hosts.

<comment><USER39> Yeah, I guess you're right. But then again setting up NGINX with auto SSL would be easier so what's the point.

Personally for me Caddy is (was) good because of how easy it is to set it up.

<comment><USER9> I'm not sure I agree with you there.

The most popular Docker image for Caddy, for example, should soon (if it's not already) be compiled from source, rather than from the build server. That means it will remain free to use, and I personally don't have to make a single change.

If this has impacted you negatively to the point where setting up nginx is an easier option, well - that's the beauty of choice!

<comment><USER27> But the software in that image will still be written by untrustworthy adware developers. _That_ is the issue.

</comment></comment></comment></comment></comment><comment><USER40> This is all great, I hope this turns into a viable business. But I am just not sure about the approach here.

Maybe this is a good moment for someone to finally fork Caddy, remove the Sponsors header, and distribute proper RPMs and DEBs.

Then those of us who want to use a truly open source project with no strings attached (special conditions re binaries, EULA, etc.) have nothing to worry about.

<comment><USER41> I've been praying for proper distribution channels for installs. For a project that is all about simplicity in setup, the installation is such a hassle. Manually creating startup entries, directories, process users, horrible.

<comment><USER4> One of the things we're hoping to offer soon are official distro packages that can be customized with the plugins you want/need.

<comment><USER41> Thanks Matt, this is DESPERATELY needed for any reasonably sized rollouts(and even my own single personal rollout). Admins don't want to be manually installing software on machines like we're back in the days of compiling everything from source.

Can we at least get the base package sorted before? I really don't need custom with any plugins.

</comment></comment></comment></comment><comment><USER42> > If you use Caddy for personal, academic, or non-profit purposes, not much is > different. Just a new response header that gives tribute to our sponsors.

So now there will be ads even in the HTTP headers.

Coming soon, ads in the tcp headers ...

</comment><comment><USER43> caddyserver.com emits those headers if you want to see them in action: [https://urlscan.io/result/8093833b-8ac7-4d18-8f20-a02373f577...](https://urlscan.io/result/8093833b-8ac7-4d18-8f20-a02373f577a1#transactions) Go to the first transaction, click the show button and click "Show headers". Right now it says:

      caddy-sponsors - This free web server is made possible by its sponsors: Minio, Uptime Robot, and Sourcegraph

Personal opinion: I've never understood the appeal of Caddy except for the builtin Let's Encrypt / TLS automagic support. nginx is very powerful and at the same time pretty easy to configure, and I think they split the features between the Open Source and commercial version pretty reasonably.

<comment><USER15> It has a few bells and whistle and there is some work behind it, no question. HOWEVER, the fact that it relies entirely on go std lib net/http|http2 package implementations personally doesn't make it very useful if your developing your application in Go directly. Caddy team didn't code all that network layer, like Nginx or Apache teams did. You don't need Caddy to add let's encrypt to your Go application.

</comment></comment><comment><USER44> Just when you thought you knew what's going on.

The author has claimed that prices will _rise_ after an "introductory period":

[https://mobile.twitter.com/mholt6/status/908007933115375616](https://mobile.twitter.com/mholt6/status/908007933115375616)

</comment><comment><USER44> Copied comment from the other HN thread:

$50 dollars a MONTH PER INSTANCE for a piece of software that wouldn't even start a few months ago because LetsEncrypt was down.

I get that software takes time and people need to eat, but holy shit on a stick.

Edit: Oh, and I forgot the part where it also doesn't handle FQDN's properly either.

Previous discussion, from when LE was down for a day [https://news.ycombinator.com/item?id=14375022](https://news.ycombinator.com/item?id=14375022)

<comment><USER9> I think your outburst might be rooted in a misunderstanding.

As stated in a few other places in this thread, the software remains 100% free, including for commercial purposes.

In order to make use of the build server at caddyserver.com, you need to have either a personal or commercial license. The build server provides precompiled binaries with your customized selection of plugins included.

The use of the build server is in no way necessary for the deployment of Caddy in any circumstance.

<comment><USER44> I understand that the source is available.

My surprise is that you think anyone will pay $50 per month per instance forever, for a build service they might use only once, and that still requires them to actually do all the work to install it and run it as a service.

</comment></comment></comment><comment><USER33> If Caddy had focused on providing commercial support to companeis that need it, this would have been a good day.

As it is, they are adding artificial roadblocks for open source users while providing minimal benefits to commercial users.

Someone didn't think this through or is out of touch with how to make money with open source.

</comment><comment><USER45> Just wanted to add that we've experimented with Caddy awhile back and, while it didn't suit our needs at the time, the first impression was a good one and I've since kept the project in the back of my mind.

However, the responses from the Caddy folks here and at [https://github.com/WedgeServer/wedge/issues/2](https://github.com/WedgeServer/wedge/issues/2) have been abysmal and without a clear change in course I'd feel embarrassed to recommend it to colleagues.

It's not even about the licenses, as others have said, this is just bad form.

<comment><USER46> I feel like I'm taking crazy pills: the caddy folks come across fine in that issue. In fact everyone does, except for the person who thinks everyone working at a company are on the list of contributors of a github project.

</comment></comment><comment><USER47> Caddy is OK, easy to setup on a personal machine, but nginx's performance trumped it completely in our testing. Particularly when requesting large numbers of files concurrently.

I genuinely don't know why a business would use Caddy over nginx, especially given the new commercial licensing scheme. nginx really isn't that hard to setup.

<comment><USER48> Running Caddy is literally copying a binary and your site over and setting up the systemd config. LetsEncrypt works automagically out of the box.

<comment><USER49> > LetsEncrypt works automagically out of the box

Provided you let Caddy manage all the certs and/or permit dynamic dns updates on that host. Went through this last night and it's underdocumented when you want to handle it yourself with TXT records and explicit cert/key.

</comment></comment></comment><comment><USER20> My first thought upon finding out that Caddy's source was still under an open source license was "can that change, too?"

As far as I can tell, the answer is "not unilaterally," as I don't see any requirements for copyright assignment in the contributing guidelines [https://github.com/mholt/caddy/blob/master/.github/CONTRIBUT...](https://github.com/mholt/caddy/blob/master/.github/CONTRIBUTING.md), nor in merged pull requests.

</comment><comment><USER50> Didn't Caddy got like $50.000 from Mozilla to work on the open source version?

Is Mozilla OK with this? Maybe Mozilla should give money on free software projects that plan on remaining free instead next time...

[https://blog.mozilla.org/blog/2016/06/22/mozilla- awards-3850...](https://blog.mozilla.org/blog/2016/06/22/mozilla- awards-385000-to-open-source-projects-as-part-of-moss-mission-partners- program/)

</comment><comment><USER51> I don't know why people are freaking out about this so much. It's one header.

Also, it's been made painfully clear that the source code is not covered by the EULA and is still licensed under Apache 2.0, so if you build from source yourself you can use it without any change, just like before this announcement.

It's not like this is some ungodly C project where you need to gather all your dependencies together and debug the build process when it doesn't work on your machine. The project is written in Go and has no external dependencies so building from source is literally just:

      - Install Go if you don't have it already
      - Run `go get -u github.com/mholt/caddy/caddy`
      - cd to $GOPATH/src/github.com/mholt/caddy/caddy
      - Run `go install`
      - Use the resulting caddy.exe file for free like you always have done

If you don't like the Caddy-Sponsors header then you can just edit the `github.com/mholt/caddy/caddyhttp/header/header.go` file and comment out the lines:

      if name == "Caddy-Sponsors" || name == "-Caddy-Sponsors" {
          // see EULA
          continue
      }

Then build the project, except now you can remove the sponsor header with `-Caddy-Sponsors` in your Caddyfile. If you need a plugin then just download the plugin you want from github and import it before building: [https://github.com/mholt/caddy/wiki/Extending- Caddy](https://github.com/mholt/caddy/wiki/Extending-Caddy)

@mholt has made the entire process so unbelievably easy that the whole process takes literally minutes...

</comment><comment><USER52> i personally like how one of the first contact bits from caddy to a fork of it is a thinly veiled legal threat: [https://github.com/WedgeServer/wedge/issues/2](https://github.com/WedgeServer/wedge/issues/2)

</comment><comment><USER53> I always find it funny when the announcement of a new, pay for software, especially a web server leads to 503. Especially when it looks like an HTML page.

<comment><USER4> I misconfigured the machine; just raised the file descriptor limit and we should be good now.

</comment></comment><comment><USER54> 1\. I applaud this effort.

2\. Ive been researching sustainable funding models for open source. Will the maintainers be blogging about the progress and results? Would be useful to learn about what they discover.

<comment><USER55> i've been trying to come up with a license that captures enough of the freedoms of open source to protect the user while allowing for a non-zero cost. my license is below - it's not open source, but if you're willing to consider licenses that are liberal but not OS, i'd love to hear your comments

[http://db4j.org/pupl/PUPL](http://db4j.org/pupl/PUPL)

<comment><USER54> Thanks for posting. Ill check it out. :)

</comment></comment></comment><comment><USER56> Site is currently down.

We've talked at length about the time saving things Caddy may do for you, but crashing under the weight of a static page is not a good advertisement.

Edit: it's back, but damage done, I think.

<comment><USER20> The 503 error page was, itself, served by Caddy. Or at least it matched the default Caddy error pages, so those parts were evidently working just fine. :)

</comment></comment><comment><USER57> homepage 503 [https://dl.dropboxusercontent.com/s/phh5xebd1jqj27l/2017-09-...](https://dl.dropboxusercontent.com/s/phh5xebd1jqj27l/2017-09-13%20at%208.41%20PM.png)

<comment><USER4> Ugh, I forgot to raise the file descriptor limit when I re-provisioned the site. Leave it to me to blunder that. :)

</comment></comment><comment><USER55> as a developer that's also struggling with finding a balance between the good things that open source helps guarantee and a viable business plan, i'm intrigued by this discussion

the approach that caddy has taken appears to be a bit of good cop / bad cop. they're maintaining, at least for now, the apache license but they're also using trademark threats to prevent forks (i believe in violation of the github TOS)

the approach that i'm hoping to take is quite different. i'm interested in any feedback (my software is a database engine that in some ways is more convenient than existing dbms for java developers, but similar to caddy in that many good alternatives exist and are free)

[https://github.com/db4j/pupl](https://github.com/db4j/pupl) [http://db4j.org/pupl/PUPL](http://db4j.org/pupl/PUPL)

\- you can freely copy, modify and distribute the software

\- non-production use is free, as is production use on up to 10 cores

\- prices are predictable and non-discriminatory

how would you feel about using software (in the infrastructure space) under this license ?

</comment><comment><USER58> > 1/4 price of comparable servers

Which servers?

<comment><USER59> Wondering the same thing... nginx has a commercial option, but does not force you to use it if your using it in a business environment... iis is only available on windows server, and that costs about 600 quid for a standard license. That's a one off cost... so... it might be quarter of the cost of enterprise (3k give or take) but over the life time of the box, it would end up being more...

<comment><USER9> Caddy's new commercial licensing, like nginx, is completely optional as the actual source license continues to be Apache 2.0.

For any business running their own web servers, compiling Caddy themselves instead of utilizing the build server at caddyserver.com is a trivial step that also gives them greater control over the binary they end up using anyway.

<comment><USER59> Yea, but in the case of nginx, their binaries are Free full stop... it's only extras or support that need license...

</comment></comment></comment></comment><comment><USER60> Obligatory link to Richard Stallman on "free vs open":

[https://www.gnu.org/philosophy/open-source-misses-the- point....](https://www.gnu.org/philosophy/open-source-misses-the- point.en.html)

</comment><comment><USER61> This was a fascinating thread of a product I would possibly have used but now won't...

</comment><comment><USER62> Hi Matt! I've been using and advocating for Caddy for a while now, but I have to say this is a huge put-off.

Don't get me wrong here, I'm in full support of a commercial version... but as you can see from the feedback here, this kind of thing is really frowned upon in the personal / OSS space for a variety of reasons.

I encourage you to re-consider added headers. Perhaps look at a more heavy handed download process such as the "Pay as you want" system used by ElementaryOS's download page ([https://elementary.io/](https://elementary.io/)).

<comment><USER4> Thanks for your comments. I think that this thread can be added to the bucket of all the others that reveal the unhealthy expectation in the FOSS community, and I'm not convinced that the "variety of reasons" are compelling.

It's regrettable that our announcement today is so controversial. As much as a donation model is easy and safe, it is not a business plan. (We tried it.)

<comment><USER27> "the unhealthy expectation in the FOSS community"

Nobody is "expecting" you to make good software, we're just saying that now that you've turned a formally mostly decent piece of software into adware with an untrustworthy author there's no reason to not just use better software. Software that doesn't molest your traffic. I wish you luck with your business but don't know why anybody would pay for software written by you two ever again.

<comment><USER63> You don't think you're being a little melodramatic here? We're talking about a change to a _Server header_. Nginx doesn't let you remove their server header either, and _their_ business model is to restrict access to important functionality on nginx now. Do you think that's a morally better approach?

<comment><USER27> We're talking about adware modifying traffic to pester you into licensing. The nginx model of selling additional features is in fact much better.

<comment><USER63> It only advertises to people hitting your site with curl or looking at the HTTP headers, so basically sysops guys curious about what your stack is. Actual end users will almost never see it. So what?

We switched to OpenResty lately for our nginx bundle and it changes the nginx Server header to OpenResty, and I cared so little I didn't even bother to put a sed command in our install script to change it. It could say Diet Pepsi Uh Huh It's The One.. who cares? Maybe I'm going to do that with the next update just to make a point. The only reason anybody would even notice is because I told them about it.

FOSS is in serious trouble right now because the funding model is in shambles, and the only way we get anything good funded now is if the megacorps decide to fund something. We need to find better ways for the little guys to put food on their tables, or we're doomed as a community. We tried direct payments to FOSS devs, and that went up in flames. These guys came up with a clever and unintrusive way to advertise (really just to show sponsors, which isn't really even advertising) to tech people, and instead of being supportive of a novel way to fund their project everybody screams bloody murder at them.

If the FOSS community wants to continue to exist as a venue for quality software, the first step it needs to take is to stop chewing its own arms off. Please have a perspective here and understand that these developers are just trying to make a living, just like all of us are. The only thing worse than starving to death making something free for other people is doing it while they sit there and hate you for trying to figure out how to put food on the table. All the quality people will leave FOSS forever, and we'll be stuck with a bunch of random unmaintained garbage and bizarro overengineered UI crap Facebook wants to publish to status compete with Google's bizarro overengineered UI crap, and we'll all be worse off for it.

<comment><USER27> > It only advertises to people hitting your site with curl or looking at the > HTTP headers, so basically sysops guys curious about what your stack is. > Actual end users will almost never see it. So what?

Injecting any data into network traffic is unacceptable.

> Please have a perspective here and understand that these developers are just > trying to make a living, just like all of us are.

Sure. I also work on an open source project for a living. But modifying network traffic should not be an accepted form of DRM IMO. I fully support a pricing model. If this change hadn't prompted me to rip out Caddy and replace with nginx I would have paid the Caddy team instead of paying nginx which I do now.

They have the right to do it, but it was a foolish mistake if their goal is to get and retain customers.

</comment></comment></comment></comment></comment></comment></comment><comment><USER64> Can projects (for example, Arch Linux) legally create and distribute binaries compiled from source that's modified to remove the header? That's unclear to me.

</comment><comment><USER27> I fully understand commercial licensing, and would willingly pay for it, but I am certainly not paying for software that thinks it's reasonable to inject headers into requests as a form of licensing control.

I've been using Caddy as my default web server for a long time but this is prompting me to switch everything over to nginx. I'm seriously bummed this is the route Matt has taken things. What a shockingly awful surprise to wake up to.

</comment><comment><USER65> I'm excited that Caddy has taken steps to ensure its long term survival. Sad people can't be bothered to pay for software they like.

<comment><USER50> > Sad people can't be bothered to pay for software they like

They got $50.000 from Mozilla, AKA free software foundations financing commercial software with grants, but what is your opinion on this Mr Burke?

</comment></comment><comment><USER66> What are the key differences between Caddy and Centminmod? I would like to know the comparative speeds, use cases and disadvantages if any.

Also congrats to you Holt for taking this bold step to sustain development. Quite recently WangGuard became a victim of freebies and the nonreciprocal donation from users. I hope this endeavor pays off

</comment><comment><USER67> @mholt It does not matter if Caddy is open source or proprietary. Showing advertisements in the HTTP response header field is an annoyance. Please remove "Minio" from the header.

I am also sad about how the opensource version of Caddy project no longer has a website and being ignored. -ab

</comment><comment><USER68> Matt's response [https://caddy.community/t/the-realities-of-being-a-foss- main...](https://caddy.community/t/the-realities-of-being-a-foss- maintainer/2728/)

<comment><USER38> Yep - where he goes into insulting more-or-less everyone who has criticized him and the project

</comment></comment><comment><USER69> Everything is getting expensive.

</comment><comment><USER19> Such amazing hostility.

Open source developers NEVER owe users anything. Never.

Stop being so entitled.

<comment><USER70> I'd agree with you except this is a bait and switch. They're allowed to do it, but it's rude. 30 days is also minimal notice.</comment></comment>


The value of UI consistency ('different is hard') - <AUTHOR> http://billhiggins.us/weblog/2007/04/20/the-value-of-ui-consistency/ <comment><USER2> Yep, different "makes you think": <http://www.squeezedbooks.com/book/show/9/dont-make-me-think-a-common-sense- approach-to-web-usability-2nd-edition>

(I sure wish these comments were markdown enabled...)</comment>


John Searle: Consciousness in Artificial Intelligence (2015) [video] - <AUTHOR> https://www.youtube.com/watch?v=rHKwIYsPXLg#t=50s <comment> bra-ket The AI book by the "Yale guys" he mentioned is likely "Scripts, plans, goals and understanding" by Schank & Abelson</comment>


Are We Slim Yet - <AUTHOR> http://areweslimyet.com

<comment><USER2> I get "Error Could not download manifest data from server Exception: undefined".

<comment><AUTHOR> Please check it in Firefox browser

<comment><USER2> I am using Firefox 4.0.1 on Windows XP Pro; however, it seems to be working now.</comment></comment></comment>


Show HN: Squawk – Push-to-Talk for Teams - <AUTHOR> https://www.squawk.to <comment><USER2> The download links are throwing 404's</comment>


Whether Ethereum is a security - <AUTHOR> https://prestonbyrne.com/2018/04/23/on-ethereum-security/ <comment><USER2> Summary of argument:

\- Some claim that Ether is not a security because it is decentralized and therefore not a "common enterprise" by the Howey test, but the author disagrees with this specific argument because he thinks it's centralized.

\- Author believes that a "horizontal commonality" of interested Ether participants can constitute a common enterprise.

\- Author believes that that GitHub and commit rights are quite centralized.

\- Author speculates that the shape of the Ether pre-sale curve signifies very few participants because it strongly resembles a power curve.

<comment><USER3> I'm not sure I understand the horizontal commonality argument. It sounds like the author is claiming that a technology (e.g. a computer program) is not decentralized if a large portion of the users of the technology use the same implementation of that technology (e.g. use the same exact implementation of the computer program). In other words, if a group of users all run the same Ethereum client software, then it sounds like the author is considering then centralized by definition, regardless of the reasons each user decided to use that computer program, the fact that they chose the _same_ implementation means that technology is centralized. If I'm understanding that correctly, then I find that argument bizarre.

<comment><USER4> > In other words, if a group of users all run the same Ethereum client > software, then it sounds like the author is considering then centralized by > definition, regardless of the reasons each user decided to use that computer > program, the fact that they chose the same implementation means that > technology is centralized.

Seems logical to me. The motives of the individual users have created an outcome of centralization because they all use the same program to do the same thing.

<comment><USER3> Doesn't that effectively mean that no decentralized network system/protocol can possibly exist according to this definition? Of course users have an incentive to be able to communicate with one another.

</comment></comment></comment></comment><comment><USER5> Those 2 charts the author cites describe different things: the Ethereum chart shows _cumulative_ amount of BTC raised over time, while the Swarm chart shows BTC raised per block.

Furthermore, the author's argument that observing a power law distribution is an argument in favor of the Ethereum pre-sale being participated in by "one or very few hands" shows that his understanding of basic statistical concepts is lacking.

Observing a power law distribution is an argument in favor of many, many participants. This is what we see in nature when looking normally distributed variables among large populations.

Stick to law, Preston.

<comment><AUTHOR> You must not remember how small the Ethereum universe was in 2014. If you think that curve is the outcome of an organic market process, there's a bridge in Brooklyn I'd like to sell you.

<comment><USER5> I was actively involved in the Bitcoin ecosystem when the ETH pre-sale launched. I'd argue that the majority of pre-sale participants were BTC holders. That group was not small in 2014.

Also, look at [https://en.wikipedia.org/wiki/Cumulative_distribution_functi...](https://en.wikipedia.org/wiki/Cumulative_distribution_function)

<comment><AUTHOR> All of the pre-sale participants were BTC holders because that is the only currency the Foundation accepted for presale Eth.

The question is how many of those BTC holders there are and whether presales/ICOs usually follow that pattern. Most don't, they use all their powder in the beginning (there's no Indian summer surge of donations towards the end of the sale). Even when they do it is not as pronounced as here. That's what makes the curve weird.

<comment><USER6> This is totally wrong: Since there was no "upper limit" on total cap of ether in the presale there was a significant incentive in waiting until the last minute to benefit from additional information (i.e. to know what percentage of ETH supply you were bidding on) and similarly to withhold bid info from competitors- This was partially offset by a gradual decline in ETH/USD exchange rate set by the presale terms.

It seems pretty clear that you haven't studied the mechanisms of these sorts of crypto auctions, since you are ignoring a lot of the underlying complexity and the many differences between different auctions in practice, or you have forgotten a lot of the intricacies of this particular auction. (which may have been a good or bad design in this case, both cases can be made.)

If you think it's common for actors in an auction system to "use all their powder in the beginning" unless there's a explicit reward for bidding late then you've clearly never been a victim of ebay bid sniping LOL

<comment><AUTHOR> I've updated the post to include a chart of the Tezos raise, which was both much larger than the Eth raise and I think illustrates my point rather well.

<comment><USER6> So I'll grant you that the differences in the smoothness in the ethereum vs tezos charts is interesting, but your argument is still unconvincing to me for two reasons: First of all, you're basically saying "The ethereum graph is so perfectly what you'd expect from an ideal auction that it can't possibly be ideal" which is the sort of argument that requires more convincing evidence. Secondly, the Tezos auction had many differences in the auction design from the ethereum auction, which could be a more mundane reason for differences in these curves.

...also, I feel like you still need to explain more explicitly why bidders making purchases in multiple lots is a nefarious thing- Does the argument just boil down to saying there were too many big fish, which means that ethereum may not be "decentralized" and therefore a security? If allowing arbitrary people to make their own purchasing decisions on an asset is not adequately decentralized, then it seems you've defined "decentralized" to the point where no asset could ever reach your threshold to fall under that definition.

<comment><AUTHOR> Well, it's either the ideal auction or it isn't. The question is how likely is it that a coin auction running for two weeks would produce a curve like that. I can't find any others in crypto so far, though I am open to being proven wrong if someone can show these are common and rule out promoter action as being the cause.

Making purchasers in multiple lots isn't nefarious at all, it just disguises how many purchasers there are, which is a relevant consideration for the _Howey_ analysis. If (arguendo) 85% of the tokens are in the hands of 1 person, that would militate against a finding that Ethereum is like Bitcoin and lacks the necessary degree of organization to constitute a scheme in which any one person shoulders personal civil or criminal liability.

If, again for sake of argument, they find that the largest hodler only holds 1% of the tokens, then that tends to make it more difficult to identify a central promoter and parallel investors (think: LPs without a partnership deed) which is usually required to bring enforcement.

I'm not making normative claims here, just saying that those three factors (common fund, repo, likely centralization of Ether holdings in few hands) tends to suggest the scheme is in the "regulated" bucket rather than the "unregulated" bucket.

<comment><USER7> The sale lasted for 42 days.

> The price of ether is initially set to a discounted price of 2000 ETH per > BTC, and will stay this way for 14 days before linearly declining to a final > rate of 1337 ETH per BTC. The sale will last 42 days, concluding at 23:59 > Zug time September 2

[https://blog.ethereum.org/2014/07/22/launching-the-ether- sal...](https://blog.ethereum.org/2014/07/22/launching-the-ether-sale/)

How much of it did you graph?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Kickstarter campaigns follow a similar pattern to the ethereum graph shown in the article. It's not because of a malicious user who wants to secretly own all the kickstarters. It's because time-limited crowdfunding campaigns tend to attract the most donations at the beginning (when enthusiasm/press is high) and towards end of the campaign (when FOMO is high).

Also the author should really state in the article that the swarm graph is not cumulative.

<comment><AUTHOR> Duly corrected.

<comment><USER8> Nice. I think your point comes across much more clearly now. The eth presale graph is much smoother than all the others.

Could the smoothness be partially explained by the fact that one could only use btc in the eth presale, whereas later token sales accepted eth and btc?

<comment><AUTHOR> Thanks!

Possibly, I don't know. The point of the post really was to show that the pre- sale process was amenable to a more forensic/scientific analysis than anything else.

</comment></comment></comment></comment><comment><USER6> Near as I can tell, the Howey precedent is for a type of asset so vastly different from a cryptocurrency such as bitcoin/ethereum that it is pretty much completely at the discretion of regulators as to whether they consider it to be a "security".

I know it would be nice to live in a world where judges can use an objective reading of the law/constitution to decide for certain in one way or another on such a fact, and that it would be nice to live in a world where lawyers like Preston could therefore make a reliable prediction from their expertise as to how courts will rule, but sadly in our world things don't work that way.

In an outlier situation like this, without strong precedents, regulators can make any decision they please and then create post-hoc rationales for defending their view.

(similarly, responses to this comment from either side will be easily able to make equally convincing absolutist arguments as to why bitcoin/ethereum are/aren't securities, given the vagueness in interpretation of precedents.)

<comment><AUTHOR> Well it's not the regulators who make the decision and set the precedents, it's the judges. Regulators are currently trying to figure out, to the extent existing precedents are inadequate, how to extend by analogy the existing precedents to the new circumstances in such a way as to convince a judge to extend the precedent. This is how a common law system is designed to work.

<comment><USER6> To be fair, It's totally reasonable that regulators/judges come come to the same conclusions that you make in your post, I just hold more cynical views as to how they arrive at those conclusions.

</comment></comment></comment><comment><USER9> For a discussion about certain Ethereum holders forming a common enterprise, I'm surprised to find no mention of the DAO fork [1]. "Management" undoing the DAO was, to me, a defining delineation of Ethereum from Bitcoin.

[1] [https://en.wikipedia.org/wiki/Ethereum#The_DAO_event](https://en.wikipedia.org/wiki/Ethereum#The_DAO_event)

<comment><USER10> I appreciate highlighting how centralized this blockchain is, but Bitcoin also benefits from centralized coordination. For example, in 2013, two developers and a mining pool operator successfully commandeered a fork away from the fork with majority hashpower [0]. The conclusion in the linked article is a pretty good summary of how we should look at this issue:

> In summary, we have a lot to learn from looking back at the fork. Bitcoin > had a really close call, and another bug might well lead to a different > outcome. Contrary to the view of the consensus protocol as fixed in stone by > Satoshi, it is under active human stewardship, and the quality of that > stewardship is essential to its security. [2] Centralized decision-making > saved the day here, and for the most part it's not in conflict with the > decentralized nature of the network itself. The human element becomes > crucial when the code fails or needs to adapt over time (e.g., the block > size debate). We should accept and embrace the need for a strong leadership > and governance structure instead of treating decentralization as a magic > bullet.

[0] [https://freedom-to-tinker.com/2015/07/28/analyzing- the-2013-...](https://freedom-to-tinker.com/2015/07/28/analyzing- the-2013-bitcoin-fork-centralized-decision-making-saved-the-day/)

</comment></comment><comment><USER11> Why does centralization of the holders have anything to do with whether Ethereum is a security or not?

There are four requirements for the Howey test: 1\. It is an investment of money 2\. There is an expectation of profits from the investment 3\. The investment of money is in a common enterprise 4\. Any profit comes from the efforts of a promoter or third party

Ethereum tokens are virtual commodities useful for purchasing computational services on the Ethereum network. The token's value increases as the value of the network increases...but this can only increase in part due to Ethereum holders themselves promoting and propagating the network and pluggable services into the ecosystem. By this point alone, number 4 is invalid. Another point is that Ethereum is forkable, which means that anyone is free to take the project in a different direction if they disagree with the governance or stewardship of ETH core devs. It has even undergone one major fork (ETC being a totally divergent blockchain at this point).

Even point #2 is debatable. There certainly are no expectation of profits in the classical sense with Ethereum. That someone is buying up limited supply in anticipation that demand will increase does not a security make. If that were the case, then dot com domains are securities, and all those savvy 90's speculators who snatched up desirable domain names are guilty.

<comment><AUTHOR> I agree it's all debatable. This post deals only with the "common enterprise" prong as that appears to be the prong of the test that Coin Center and others are trying to challenge most assertively.

Centralization of holders makes it look like a more traditional scheme with a central promoter.

<comment><USER11> Well, what do you think about the forkable nature of blockchain technology and how that relates to the definition of common enterprise? Which "common enterprise" are we talking about at this point, Ethereum Classic or Ethereum? The presale tokens apply to both of these forks after all. At this point, the two chains are completely divergent, run by different devs, and have completely different directions. Anyone is free to fork ETH and take it in a third direction if they like.

</comment></comment></comment><comment><USER12> > But the Ethereum pre-sale looks perfect – and that's what makes it worth > querying. "Donations" from Eth-heads around the world not only flowed into > the Ethereum Project's wallet in great quantities, but they flowed in with > the mathematical precision of a power function, 24 hours a day, 7 days a > week, for two weeks straight.

I went through holdings of top 5 ICOs on Ethereum. One of things struck me was that many of the ICOs had huge amount of cross holding. So, X was holding a lot of Y and Z coins, while Z was doing the same with other ICOs. The number of inter-connections was astounding.

So my opinion is that something is off with the ethereum ICO system. I know that sounds tinfoil hat wearing conspiracy and I don't have solid proof or graphs. But given the evidence of Ethereum's distribution it looks more likely.

<comment><USER13> Dotcom-style revenue swaps?

 _" Internet infrastructure companies were simply swapping equipment and putting it on their books as revenue. They essentially handed pieces of paper back and forth and called it money."_

[https://www.inc.com/niel-robertson/brilliant-failures/dot- co...](https://www.inc.com/niel-robertson/brilliant-failures/dot-com-mistake- silicon-valley-start-ups-still-make.html)

<comment><USER12> That was an illuminating read. I think the whole ICO system might be something similar.

</comment></comment></comment><comment><USER14> Is equity crowdfunding the killer app for Bitcoin?

<comment><USER15> I'm starting to think the killer app isn't just breaking the back on public security over-regulation (ie pulling an Uber by just disobeying it until they cave), the killer app might be governance in general. An algorithm to gain consensus, which is virtually the sole reason governing bodies exist

I just made an Ask HN to explore this topic more</comment></comment>