The license is not the README

The reel came past me this week. Five free repositories, it said. Put your own name on them. Sell them to small businesses. Fifteen hundred dollars to set up, two hundred a month after that.

It sounded good. Free software. Real customers. Money that arrives whether or not you work that month.

Then I did the boring thing and opened the license files.

Nobody reads this file

Every repository has one. It is usually sitting right there in the root folder, called LICENSE, in capital letters so you cannot miss it.

I have cloned hundreds of repositories. I have opened that file maybe ten times.

You look at the README. You look at the stars. You look at how recently someone pushed a commit. All of that tells you whether the code is any good. None of it tells you whether you are allowed to sell it.

One file tells you that. It takes about eight minutes to read.

What I found in the five

Dify is under a modified Apache 2.0. You can use it commercially, which sounds like a green light. But two sentences later it says you may not remove their logo or copyright from the console, and you may not run it as a multi-tenant service without written permission. Putting your own name on it is the exact thing it forbids.

NocoDB moved off the AGPL on the ninth of January this year. It is now under something called a Sustainable Use License. If you host it for a customer, or give external customers access to it, you need a commercial license. That is not a footnote. That is the whole business the reel was describing.

Plane and Listmonk are both AGPL v3. You can host them. You can charge for the work. But if you change the code and let people use it over a network, you owe those people your source code. Your improvements stop being private.

Pipecat is BSD 2-Clause. Genuinely permissive. Do what you like. One out of five.

The four kinds of license, in plain words

I had to look most of this up. If you already know it, skip ahead.

MIT and BSD. Do whatever you want. Sell it, rename it, keep your changes secret. Just leave the original copyright notice somewhere in the files. These are the friendliest licenses there are, and a lot of small libraries use them.

Apache 2.0. Same freedom, with two extras. The authors give you permission to use any patents involved, which matters more than it sounds. And if you change the files, you have to say which ones you changed.

GPL and AGPL. These are the ones with teeth. If you change the code and give it to someone, you have to give them your changed source too. The AGPL adds one word that changes everything: network. With the ordinary GPL, running modified code on your own server and letting people use it over the web does not count as giving it to them, so you keep your changes. The AGPL closes that door. Serve it over a network and you owe the source.

That is why so many hosted products avoid AGPL code entirely. It is not that the license is unfair. It is that it does precisely what it was written to do.

Source-available. The newest group, and the one that trips people up. You can read the code. You can usually run it for yourself. You cannot sell it as a service. Strictly speaking these are not open-source licenses at all, even though the code sits on GitHub looking exactly like everything else. NocoDB's new license lives here.

What this looks like with a real customer

Say a shop wants off Mailchimp. Their bill has crept up and they send four newsletters a month.

Listmonk does the job and it is free, so you install it on their server, point the domain, migrate the list, and charge for the day's work. That is completely fine. You sold your time and your knowledge, which were always yours to sell.

Now change one thing. You decide to host it yourself, for twelve shops, under your own brand, and you add a few features because the stock version does not do what Indian businesses need.

You have just crossed the line. It is AGPL. Those twelve shops are now entitled to the source code of your improved version, and so is anyone they pass it to. The thing you thought you were building a moat around is the thing you have to hand over.

Same software. Same developer. One decision apart.

I expected a trend. There isn't one.

I went in assuming I would find open source closing up. Companies get big, then pull the ladder up behind them.

There is some of that. It usually happens when a small team builds something good, a giant cloud provider starts hosting it, and the giant collects the money while the small team keeps paying the developers. MongoDB and Terraform both moved to restrictive licenses after exactly that.

But the numbers say the traffic runs both ways. Elastic and Redis both moved back to an open license this year, both to the AGPL. Source-available licenses are still rare and still not growing.

Which is worse, in a way. If licenses only ever tightened, you could assume the worst and be right. Instead they drift in both directions, quietly, and the terms you read eighteen months ago may not be the terms you are shipping under today.

Anybody who built a hosting business on NocoDB last year woke up in January needing a license they did not have. Nobody emails you about this. The file just changes.

Three questions, before you build anything on top

This is the whole checklist. It takes ten minutes.

Can I charge someone to host this for them? If the answer is no, every plan that involves a monthly fee is dead on arrival.

Can I put my own name on it? Some licenses let you sell the software but not strip the branding. Your client will see whose product it really is the first time they log in.

If I improve it, do I have to publish my improvements? This is the one that decides whether you are building an asset or a favour for your competitors.

Three questions. Five minutes each. I have watched people skip all three and then build for six months.

You can still make money here

None of this means open source is closed to you. It means you cannot pretend you own it.

Charging for your own work was always fine and still is. Setting it up. Wiring it into the three other systems the business already runs. Dragging ten years of records out of spreadsheets without losing a row. Picking up the phone at eleven at night when it breaks. Writing your own code on top of it. All of that is yours, nobody can take it, and small businesses genuinely need it.

What you cannot do is take someone else's product, paint over the name, and call it a thing you made.

Why I keep coming back to this

Because it is the same question underneath everything else I am trying to work out.

Selling work pays this month. Owning something pays later, and keeps paying. A reel that promises both at once — take this free thing, relabel it, collect rent forever — is promising the second while quietly describing the first. You would still be doing the work. You would just be doing it on top of an asset that belongs to someone else, under terms they can change in January without telling you.

That is not legal fine print. That is the whole question of what you are left holding at the end.

Forty minutes. Five files. It is the cheapest piece of homework in this trade and almost nobody does it, including me, until this week.