Page 1 of 2

Server key revocation?

PostPosted: Wed Mar 20, 2013 6:47 pm
by rtechie
I'll be blunt about my concern:

I switched to SubSonic from AudioGalaxy because AudioGalaxy was bought by DropBox and the service simply disappeared, orphaning everyone who paid good money for it. I was under the impression that SubSonic was "free as in beer". It is not. Critical features require a "donation". It's shareware/crippleware and should be labeled as such.

I'm impressed with SubSonic, but I'm terrified about the same thing happening. I'm more that willing to donate, but not for software locked with a key. What absolute guarantee do I have that you simply won't cut off access to my own server and lock me out of software I paid money for? How I do I know, without a shadow of a doubt, that you won't revoke my key?

I dug through the source code a bit and found this:

HttpGet method = new HttpGet("http://subsonic.org/backend/validateLicense.view" + "?email=" + StringUtil.urlEncode(email) +
"&date=" + date.getTime() + "&version=" + versionService.getLocalVersion());

So it looks like the server is going to the internet to validate the server license. So when (not IF, but WHEN) subsonic.org goes down, I'm totally screwed and can't use the software that I bought.

Basically, I want a version without the key or I want the ability to remove key checking myself. I'll happily pay for that. Otherwise, I'm going to be looking for another solution.

Re: Server key revocation?

PostPosted: Wed Mar 20, 2013 7:02 pm
by bushman4
The only thing that is checked on the internet is that the key was really issued before allowing you to register a vanity domain name. And if subsonic.org went down, the vanity domain names would too, so that is all that you would lose.

All other features that they key enables are checked locally when the key is checked against the email address entered (also locally). The code will easily show you how the two are compared if you'd like, and you can remove it yourself and compile yourself your own special version if you'd like.

But I am confident that the only thing that would be "locked out" if Sindre went belly up is the vanity domain names, which depend on his server anyway.

I'm not going to tell you how to disable the registration requirement, but I'm sure someone else could, and if you know anything about java programming it is trivial to do it yourself anyway.

BTW, I am of the firm opinion that the program itself as a stand alone web streamer is the base program. What you are paying for is nice, and might be what YOU intended the free portion to be used for, but it was not designed for that initially... it was a "stream through the web" program by design, and that is free...

But I'm not going to get in another holy war (which is what the last paragraph will cause... mark my word) about it. You can all have your own opinions. You know what they say opinions are like? I'll give you a guess... everyone has one and they all STINK! ;-)

Glenn

Re: Server key revocation?

PostPosted: Wed Mar 20, 2013 7:20 pm
by alphawave7
bushman4 wrote: And if subsonic.org went down, the vanity domain names would too, so that is all that you would lose.


Which I might add is solved by a static WAN IP, or a dyndns-type service...so never 'totally screwed'. :wink:

Re: Server key revocation?

PostPosted: Wed Mar 20, 2013 7:22 pm
by bushman4
Agreed. If someone is paying the fee just for the vanity domain name, they are silly.

Glenn

Re: Server key revocation?

PostPosted: Wed Mar 20, 2013 8:18 pm
by daneren2005
rtechie wrote:I'll be blunt about my concern:

I switched to SubSonic from AudioGalaxy because AudioGalaxy was bought by DropBox and the service simply disappeared, orphaning everyone who paid good money for it. I was under the impression that SubSonic was "free as in beer". It is not. Critical features require a "donation". It's shareware/crippleware and should be labeled as such.

I'm impressed with SubSonic, but I'm terrified about the same thing happening. I'm more that willing to donate, but not for software locked with a key. What absolute guarantee do I have that you simply won't cut off access to my own server and lock me out of software I paid money for? How I do I know, without a shadow of a doubt, that you won't revoke my key?

I dug through the source code a bit and found this:

HttpGet method = new HttpGet("http://subsonic.org/backend/validateLicense.view" + "?email=" + StringUtil.urlEncode(email) +
"&date=" + date.getTime() + "&version=" + versionService.getLocalVersion());

So it looks like the server is going to the internet to validate the server license. So when (not IF, but WHEN) subsonic.org goes down, I'm totally screwed and can't use the software that I bought.

Basically, I want a version without the key or I want the ability to remove key checking myself. I'll happily pay for that. Otherwise, I'm going to be looking for another solution.

The only real guarantee you have is the fact that is open source...

Re: Server key revocation?

PostPosted: Thu Mar 21, 2013 10:14 pm
by rtechie
bushman4 wrote:The only thing that is checked on the internet is that the key was really issued before allowing you to register a vanity domain name. And if subsonic.org went down, the vanity domain names would too, so that is all that you would lose.

Already using dyndns, so not a problem.

bushman4 wrote:All other features that they key enables are checked locally when the key is checked against the email address entered (also locally). The code will easily show you how the two are compared if you'd like, and you can remove it yourself and compile yourself your own special version if you'd like.

So what you're saying is, basically, that all the "key" is is a hash of the email address calculated locally. Correct?

bushman4 wrote:I'm not going to tell you how to disable the registration requirement, but I'm sure someone else could, and if you know anything about java programming it is trivial to do it yourself anyway.

Since I'm not much of a Java programmer I'm going to have to have someone look at the code to verify this and then figure out how to compile it in Visual Studio. If I'm going to bother to do that, I might as well just start making my own fork.

All of this strikes me as "bad form" if nothing else. If you're going to distribute your product as "free as in beer" and "open source", putting these constraints in seems misleading. This is closer to "open source shareware".

Hmmm... after doing a bit of research it looks like Ampache is truly free. Not much development, but that's not my primary concern. I could also go with Tonido, they have a "free" option so then at least I won't lose money when they turn it off.

Re: Server key revocation?

PostPosted: Thu Mar 21, 2013 10:28 pm
by hakko
Where is it claimed that it is "free as in beer"? I think it is just vaguely called "free" (which I interpret as "free as in freedom"). The only word that annoys me in the marketing is "donate" which is used all over the place.

If you won't bother looking for a fork with removed license, why not try running the official Subsonic server with your network cable unplugged or with a fake entry in your hosts file? Your server will still work, which should be proof enough that you can continue using it even if Sindre turns the backend off for good?

Re: Server key revocation?

PostPosted: Thu Mar 21, 2013 10:38 pm
by daneren2005
rtechie wrote:
bushman4 wrote:The only thing that is checked on the internet is that the key was really issued before allowing you to register a vanity domain name. And if subsonic.org went down, the vanity domain names would too, so that is all that you would lose.

Already using dyndns, so not a problem.

bushman4 wrote:All other features that they key enables are checked locally when the key is checked against the email address entered (also locally). The code will easily show you how the two are compared if you'd like, and you can remove it yourself and compile yourself your own special version if you'd like.

So what you're saying is, basically, that all the "key" is is a hash of the email address calculated locally. Correct?

bushman4 wrote:I'm not going to tell you how to disable the registration requirement, but I'm sure someone else could, and if you know anything about java programming it is trivial to do it yourself anyway.

Since I'm not much of a Java programmer I'm going to have to have someone look at the code to verify this and then figure out how to compile it in Visual Studio. If I'm going to bother to do that, I might as well just start making my own fork.

All of this strikes me as "bad form" if nothing else. If you're going to distribute your product as "free as in beer" and "open source", putting these constraints in seems misleading. This is closer to "open source shareware".

Hmmm... after doing a bit of research it looks like Ampache is truly free. Not much development, but that's not my primary concern. I could also go with Tonido, they have a "free" option so then at least I won't lose money when they turn it off.

There are about a dozen forks which do nothing but rip out the license code already. Really, I promise you if Sindre and all of his servers disappeared off the face of the planet right this second, it would not mean you can't use it anymore. Whether you will ever feel your donation to have been worthwhile is completely separate story. After reading these forums for close to a year, I would say unless you are absolutely happy with what you going to get right now, don't bother ;)

And yes, everyone has problems with Sindre's crappy labeling of shareware as completely free. Can you get around the restrictions by using an unofficial fork? Sure, but it is still not effortless as it is implied on the front page. Finally, ampache sucks balls from what I've seen, and Tonido doesn't really seem like it's even trying to fill the same usage model as Subsonic is. I didn't spend too much time looking into Tonido though, so YMMV.

Re: Server key revocation?

PostPosted: Fri Mar 22, 2013 4:05 pm
by rtechie
hakko wrote:Where is it claimed that it is "free as in beer"?

Technically speaking, "free as in beer" tends to refer to software that is free but NOT open source and "free as in freedom" refers to software that is BOTH "free as in beer" AND open source. This is sort of "open source shareware". My guess is that Sindre wanted to make something "free as in freedom" and also wanted donations, which is fine. It looks like he was annoyed that very few people were donating and so he put in a pay wall, without realizing the ethical implications of doing so with software that was already distributed as free and open source.

hakko wrote:If you won't bother looking for a fork with removed license,

I didn't want to do this. I appreciate the work Sindre did and want to donate, I just don't want to be orphaned like I was with AudioGalaxy. I didn't look at your fork because I thought it was just a mod/patch, not an actual fork (your descriptions are ambiguous) and it doesn't say explicitly that the license checking is removed. Since I use last.fm a lot, I'm probably going to switch to your fork AND donate.

hakko wrote:why not try running the official Subsonic server with your network cable unplugged or with a fake entry in your hosts file? Your server will still work, which should be proof enough that you can continue using it even if Sindre turns the backend off for good?

I have tried this and it DOES NOT work. You can't stream to a device, like a Android phone, without the key.

Re: Server key revocation?

PostPosted: Fri Mar 22, 2013 4:18 pm
by bushman4
rtechie wrote:I have tried this and it DOES NOT work. You can't stream to a device, like a Android phone, without the key.


Yes. You need a key entered to stream to a remote device without using the web interface.

Your original question was "will it work if Sindre goes away?" The answer is yes. Try this: unplug your internet connection from your router. Then try to access the subsonic server using your phone connected to your local wifi. Assuming it worked with the internet connection attached it will STILL work if the internet connection is disconnected.

Thereby proving that the connection will still work once (if) Sindre calls it quits.

Again, I am not going to get involved in the "free as in..." debate. I don't really care one way or the other.

Glenn

Re: Server key revocation?

PostPosted: Fri Mar 22, 2013 7:27 pm
by GJ51
Even if Sindre calls it quits Subsonic will still work fine. We might loose the vanity address redirection service but that's an easy work-around by just using direct externalip:port addressing or any other DNS service.

Sindre hasn't posted here since Dec 26th.

If he hasn't given up, he's certainly keeping whatever he's doing very close to the vest. His todo list hasn't been updated since long before the release of 4.7. I've seen one mention of 4.8 in the last 4 months that didn't have any significant detail.

Whatever his future plans are, he's not sharing them with us.

Besides - it's open source and there are a couple viable forks that look like they'll be around for some time to come.

Re: Server key revocation?

PostPosted: Fri Mar 22, 2013 8:26 pm
by daneren2005
Are you looking at the same repo that I am? I'm looking here and Sindre has most definitely been committing lately. In fact the last commit was just an hour ago. But don't get your hopes up. Every commit I have seen in the last 3 months has been in regards to his latest attempt to kill this project: adding a monthly subscription fee for a service that doesn't provide half the functionality of existing subscription based projects. Luckily it's still open source, so those of us who have already payed and are going to say no way can still have control of our own servers, but it is still going to severely deaden interest in this project.

Re: Server key revocation?

PostPosted: Fri Mar 22, 2013 9:20 pm
by mr_nobody
rtechie wrote:I just don't want to be orphaned like I was with AudioGalaxy.


The fundamental difference between the two is that AG was SaS and SS is open source code you run on your own server. As others have said, you will never be locked out of your own server.

Re: Server key revocation?

PostPosted: Sat Mar 23, 2013 3:28 am
by GJ51
daneren2005 wrote:Are you looking at the same repo that I am? I'm looking here and Sindre has most definitely been committing lately. In fact the last commit was just an hour ago. But don't get your hopes up. Every commit I have seen in the last 3 months has been in regards to his latest attempt to kill this project: adding a monthly subscription fee for a service that doesn't provide half the functionality of existing subscription based projects. Luckily it's still open source, so those of us who have already payed and are going to say no way can still have control of our own servers, but it is still going to severely deaden interest in this project.



Thanks for the update. The link on my desktop is apparently outdated.

EDIT: Agreed. It doesn't look like this will be much to my liking going forward. We're currently working on direct access using ipv6 to our network which will actually make Subsonic pretty much obsolete for us anyway. It's been a very fun project for us the past few years, but it appears to be headed in a direction I won't be following.

Re: Server key revocation?

PostPosted: Sat Mar 23, 2013 5:33 am
by alphawave7
Looks like everyone's 'fixation' with the definition of donation will finally get resolved. Phew! The good ole days are now gone, a fixed toll has been established, and folks are already ringing the 'funeral toll'.. predictable.

Free cupcakes were great-yes. He served us great cupcakes for free, requesting a donation was typical of well-intentioned responsibility...value-for-value...if you use and enjoy it, support it. Alas, frosting came along..we could now stream to our mobiles! Brilliance! Frosting costs more money (sugar and lard aren't cheap, like flour and baking powder), and once you go cupcake with frosting, you can't go back. Despite these realities, many feel entitled to free (as in anything) software ('I'm not paying until feature xyz (sprinkles) are added!!!' ), but those that feel this way aren't living in reality. Creating and maintaining anything worthwhile indeed has value, and those enjoying the cupcakes (I indulge every day) should respond in kind. There are other bakers in town, but if they are free, you might be the product...and you may be just fine with that. I've had other cupcakes, but I prefer these.