Hi folks I am a little unclear on the
# avo-2
s
Hi folks, I am a little unclear on the community license restrictions for commercial use: 1. Am I allowed to mount Avo more than once in the same app, under different routes, with different configuration each? 2. Am I allowed to strip away mentions of Avo from the UI? 3. Am I allowed to monkeypatch Avo with my own custom functionality? 4. Does community edition phone home to avohq on the server-side and/or client-side? (And if yes, am I allowed to disable that?)
Turns out I accidentally created a new discord account, while I already had one. Will delete this one, and come back with the existing one.
f
Ok, I'm on the proper account now.
Additional questions about Pro license: 5. Am I allowed to completely remove mentions of Avo from UI? 6. Can I completely disable phoning home in Pro? 7. Am I allowed to monkeypatch Avo with my own custom functionality? We are in a highly regulated, firewalled environment, and phoning home will not work here.
l
Hey Max. Adrian here, the author of Avo
1. yes, you are allowed to mount Avo more than once in the same app on more than one route. If you're thinking about a separate configuration as in
app/avo/some_module/resources|actions|filters
and
app/avo/other_module/resources|actions|filters
, that isn't available right now
you can, however show/hide anything in the UI (resources, actions, fields, etc.) for different user roles using policies and the authorization feature. that's highly customizable and we've seend folks support advanced multi-level tenancy scenarios
2. yes. you can do that. some mentions will still remain in the DOM as
data
attributes and HTML comments, but those should not be visible in the UI
3. yes for the most parts, but we advise against it. You might loose features and have things broken on updates. We have planty of ways to extend Avo and if suggested and contributed, we'll add them. we add news ways to customize it everyday
4. all editions have the phone-home functionality. no, you are not allowed to disable it
that might even brake some features if that's disabled
we have the business license which provides you with a telemetry-free version
that's close to five figures yearly depending on what you need
5. covered on point 2.
6. covered on point 4.
7. covered on point 3
so yeah, I understand you run in a highly regulated environemnt. that's a very special case which requires special permissions and a higher level of support. we provide that to other customers in the business license. we can hop on a call next week to discuss more
let me know if I can answer any more questions
f
@lemon-wall-20836 Very helpful, highly appreciated. Two clarifications: 1. If we are not allowed to disable phoning home in the community edition, then it's still somewhat restrictive, right? We'd have to be careful not to alter this part of the behavior. Just confirming that this is intentional. 2. As far as mounting with different config under different modules: I know it's not available, but if I was to monkeypatch that in, would I be allowed to do that under community license? (I'm asking, because it would let us build our own authorization solution, without using Pro.)
l
1. I wouldn't say it's restrictive. you can still build anything you'd like with it
it seems a bit weird for a gem, but when you compare it to one of those cloud solutions which monitor every click, page presence and more, it's quite open
the telemetry helps us figure out how many apps use Avo out there. if we didn't have that, Avo probably wouldn't be here
2. yes. from a technical standpoint you can mount it under a different route
regarding building your own authorization, I can't stop you. I've seen other going down that route and figuring out that buying is cheaper than building
Avo seems like a thing that one might build "over the weekend", but it's really more complex than that
that's another reason why companies pay for the Pro version. to support it's further development
we're all witnessing what's happening with free open-source software and how the maintainers struggle to find funding and keep working on the things they are passionate about all while helping others and teams save thousands if not even hundreds of thousands of dollars in the process
f
I agree about cost vs time, been doing this for quite a while. On this particular project we will unfortunately not be able to use Avo. I loved how quickly I could build a prototype on my local machine, but we will have to go with a custom solution instead. > compare it to one of those cloud solutions which monitor every click Every vendor that receives any data from us must be vetted, and have a valid SOC2 process. In addition to that, it's very different to have my activity tracked on a website, vs. having 3rd party telemetry running on our servers, integrated into our codebase. I'd strongly recommend to remove telemetry, and trust customers more. Nobody (who matters) wants to build a legitimate business on stolen software. It's too easy to lose everything in a law suit. That's why people like me go an extra mile to ask clarifying questions. And those who want to steal — they would do it regardless. My core feedback is: you built an amazing piece of software that is incredibly well engineered, easy to use, greatly documented, and a huge time saver. Which is why it really hurts that the license is worded poorly/confusingly (seems like without lawyer consultation?), that we must accept telemetry in our codebase, depend on 3rd party servers uptime (no recourse in case of disasters, maintainers going missing), and be forced to have a backdoor. Those are gigantic red flags that make it irresponsible for me to recommend Avo in any workplace. This isn't about the money (we don't mind paying). However, right now I would worry about entering into any significant deal (i.e. 5 figures) because, while your engineering is rock solid, the license and governance quite honestly don't inspire confidence. I worry about committing $$$ to a vendor, where decisions like forced telemetry in a paid software library, and unclear licensing terms are deemed acceptable. It honestly seems like you need to figure some things out. I hope you do, because your product deserves it.
l
Ouf. Pretty harsh!
Thanks for the feedback.
While the license.md has been written by me from different sources, I had my lawyer vet it.
He did make all our terms, privacy policy, CLA, and other documents though. Not sure of you checked those out
But I do appreciate the feedback.
It’s not easy building a business
f
I don't mean any disrespect, I guess I'm channeling some disappointment because of how much I appreciate what you've built. That's why it feels bad. I think more time should be spent on making the license very clear.
l
Anything in particular?
I mean, the license specifies you are not allowed to tamper witth the locense checking mechanism
BTW, I’m taking this feedback as valuble feedback.
f
For example, on your website you mention white labeling as an enterprise feature, but according to this thread, it's ok to remove Avo branding in community license. And I guess ok to remove it in Pro as well? Or not? That bit wasn't 100% clear.
l
Again, the optional telemetry is on the table
Yeah. Granted!
Noted☝️
f
A lot of Avo features that are only available in higher tiers can be monkeypatched in with custom code. However, because they are also available in higher tiers, I feel that I would be violating something that's currently not spelled out in the license.
Things like double-mounting, etc.
l
The double mounting is not specified anywhere, but I see your point
All of the things that are in paid tiers can be built and patched, but nobody’s going to tell you that when you sign up for their product
f
Yeah, when license leaves things unclear/ambiguous, they are automatically not allowed.
l
I get your point, but you can still ask
No license is 100% complete
Not for a product like this one
Even for simpler products
f
It does need more detail. There are 2 kinds of licenses: the ones that give full freedoms except specific restrictions, and custom commercial licenses that need to be very detailed and exhaustive.
l
Even highly popular open source licenses have blind spots. (GPL and AGPL too)
I know. But would you like me to focus on licensing or on development? 😅
We all have limited time and budget
Some orgs more than others
f
Personally? It's your call, but I think right now Avo needs more of this administrative stuff, not additional development.
l
Do you know a guy (or a gal)?😅
f
We have lawyers that we work with in fintech, I can ask for recommendations.
But telemetry's gotta go. Seriously. It's a showstopper. Can't really stress it enough. You will sell more Avo and get more profits if you remove it.
I'm no fortune teller, but somehow pretty sure about this prediction.
l
I know. I’m on the same page but kinda hooked to see that usage meter everyday
f
Keep it on the front-end only. Have an easy setting that can be set to false to disable it entirely.
That would allow you to see some initial usage from most people.
l
Yeah. I thought about front end. Why would that be better from your perspective?
f
Couple of reasons: 1. Server resources and server network calls are a sensitive topic. 2. Front-end only guarantees that no functionality is being inhibited. 3. It looks a thousand times better optically that you left a tracking pixel in a default layout, than you have a backend module dedicated to tracking customers.
l
that makes sense
ok. so if we implement that change and update the license, is Avo back as a possible technical solution for your use-case?
I guess this is the "$1M question"
f
I would love to use it. It works incredibly well. I've built many projects over my career, and don't plan on stopping yet. Whether it's this one or the next one, it will definitely become the go-to solution for fast admin UIs.
So yes.
l
so the Business license is still on the table with the telemetry off?
f
No, sorry, the 5 figure deal is not on the table right now. We are building a new product, so it doesn't make sense yet.
l
yeah, that's what I was talking about
no worries. let me know when you're ready
f
I was making a more general statement, that it didn't feel right in the current state, even if we were okay to pay that. You definitely got the software part down, wish you the best. In the mean time I'm going to have to go back to vanilla rails and tabler.io. 😬
l
Haha. Just think about Avo when you do that 😛
Thnks for you feedback
It’s much appreciated
I’ll start inplementing it in the following weeks