Open WebUI changed license from BSD-3 to Open WebUI license with CLA(docs.openwebui.com)
docs.openwebui.com
Open WebUI changed license from BSD-3 to Open WebUI license with CLA
https://docs.openwebui.com/license/
59 comments
I think CLA signing is fine if the projects is owned by a reputable organization (Apache, FSF, whatever).
If the project is controlled by a commercial entity, you just have to understand it will likely change in a way you disagree with.
If the project is controlled by a commercial entity, you just have to understand it will likely change in a way you disagree with.
A CLA is all about changing the terms of the deal after the deal. It's hard to imagine a scenario in which that can be legitimate.
The scenario is that the world in which those terms were written changed.
E.g. the original GPL or Apache licenses did not consider patents, DRM or Tivoization, but the modern versions do.
I think it's legitimate for a project to say "we think we should address these issues but we didn't think of them" and update their license.
I'm not saying this is always the case, but it's the reason I think it's ok to sign a CLA for an organization you trust: it's _likely_ you'd also trust their choice to change a license.
E.g. the original GPL or Apache licenses did not consider patents, DRM or Tivoization, but the modern versions do.
I think it's legitimate for a project to say "we think we should address these issues but we didn't think of them" and update their license.
I'm not saying this is always the case, but it's the reason I think it's ok to sign a CLA for an organization you trust: it's _likely_ you'd also trust their choice to change a license.
OpenWebUI has always had commercial inclinations. You can tell by the way they're promoting their website for plugins. As long as I can still use the free version it's fine by me. But not sure if I'd pay for it. It's just a web interface really. If it would become paid I'd just move to another one.
> Like, imagine if Firefox shipped with an attribution requirement that prohibited removing the trademarked Mozilla branding.
Icefox anyone?
Icefox anyone?
I am skeptical that this change meets the Open Source definition. I can understand that they want to experiment with something new, but the OSD includes a non discrimination clause, you cannot restrict or grant different rights in an open source license to different groups. What they should do instead is dual license, with a license that a acheives their goals for the general populace, plus special licenses for specifc groups that allow them to do things the open source license doesnt. I'm not a fan of CLAs like that, but they are requiring a CLA anyway.
Why does this keep happening? Do people not understand the implications choosing an open source license.in the first place? There are a million licenses, in fact you can just make your own one up! But when you choose a class of license the specifically allows commercial exploitation... you don't get to act wronged when it happens.
Two key reasons, they don't understand the implications, and many developers are cheapskates nowadays, they wouldn't have survived in old days until 2000's, where we paid for everything, or pirated it.
Somehow it feels great to be paid, to pay others for the tools, like in every other profession, not so much.
Somehow it feels great to be paid, to pay others for the tools, like in every other profession, not so much.
There was a lot of tools available for free in the the 90's. Both the BSDs and Linux existed.
Yes but the quality difference was bigger. And there were big gaps, eg until OpenOffice there was no decent alternative for MS Office. Most SDKs and IDEs cost money too (like the big visual studio still does)
The license is still open source. There's only a branding requirement added. Not much unlike "you must retain this notice" in other open-source licenses, like the Apache license.
I frankly find LGPL more useful in cases like that, but it apparently does not work for some parties. Open-source + commercial licensing also looks like a good balance between keeping the community-developed code accessible to everyone, while allowing the parties who don't want to share to pay for the privilege.
I frankly find LGPL more useful in cases like that, but it apparently does not work for some parties. Open-source + commercial licensing also looks like a good balance between keeping the community-developed code accessible to everyone, while allowing the parties who don't want to share to pay for the privilege.
That is my approach as well, downstream should get as much as they are willing to give upstream.
Nothing, then get nothing as well.
Pay the work of others, than freely charge as much as they feel like.
On my repos, the only stuff I have with ROCm licenses are forks from projects where the decision was not mine to begin with.
As time has proven, shareware and trials is a much better model if one intends to make a living from software, without having it lock behind SaaS walls, or hardware.
Even street performers got their work tools from somewhere and unless they were going around the scrap yard, it wasn't at zero cost most likely.
Nothing, then get nothing as well.
Pay the work of others, than freely charge as much as they feel like.
On my repos, the only stuff I have with ROCm licenses are forks from projects where the decision was not mine to begin with.
As time has proven, shareware and trials is a much better model if one intends to make a living from software, without having it lock behind SaaS walls, or hardware.
Even street performers got their work tools from somewhere and unless they were going around the scrap yard, it wasn't at zero cost most likely.
I think there's some selection bias. In my experience many folks that work on open source projects tend to lean more altruistic and good natured - so understanding the license doesn't mean expecting exploitation.
Its deliberate, use a permissive/pushover license to get adoption, then rugpull once you have the userbase who are relying on you, then bathe your VCs in cash.
You can't make such a claim without any backing. While undoubtedly it's the case for some, I strongly doubt everyone does it on purpose. It's just that orgs mature with time and realise their original naiveté.
Do you have any proof of that? Hell, are OpenWebUI even receiving VC funding?
Do you have any proof of that? Hell, are OpenWebUI even receiving VC funding?
I was not referring to Open WebUI, but the general situation of license rugpulls, which is what I assumed the person I replied to was talking about.
> we started seeing a pattern we couldn’t ignore: bad actors taking our work, stripping the branding, selling it as their own, and giving nothing back. That’s not open source—that’s exploitation.
That is Open Source, and “Open Source” has always been the corpo-friendly version of “Free Software”. It's very funny to see so many people pointing out “This doesn't meet the Open Source Definition!!!!” like there's any reason to care. OSI themselves will tell you that “open source” as we know it was a product of AOLTimeWarner's desire to get people to work for them for free: https://opensource.org/history
“The [February 3rd, 1998] conferees believed the pragmatic, business-case grounds that had motivated Netscape to release their code illustrated a valuable way to engage with potential software users and developers, and convince them to create and improve source code by participating in an engaged community. The conferees also believed that it would be useful to have a single label that identified this approach and distinguished it from the philosophically- and politically-focused label ‘free software.’”
I want philosophically-focused software that puts the rights of human-persons above the desires of corporate-persons. Fuck “Open Source” lol
That is Open Source, and “Open Source” has always been the corpo-friendly version of “Free Software”. It's very funny to see so many people pointing out “This doesn't meet the Open Source Definition!!!!” like there's any reason to care. OSI themselves will tell you that “open source” as we know it was a product of AOLTimeWarner's desire to get people to work for them for free: https://opensource.org/history
“The [February 3rd, 1998] conferees believed the pragmatic, business-case grounds that had motivated Netscape to release their code illustrated a valuable way to engage with potential software users and developers, and convince them to create and improve source code by participating in an engaged community. The conferees also believed that it would be useful to have a single label that identified this approach and distinguished it from the philosophically- and politically-focused label ‘free software.’”
I want philosophically-focused software that puts the rights of human-persons above the desires of corporate-persons. Fuck “Open Source” lol
The list of "we used the MIT license and now super regret people are using it exactly as intended" grows and grows. It's wild how (A)GPL took such a bad rap, which it's (seemingly?) exactly what projects like this wanted.
What really is the moat of openwebui? I have seen at least 4 - 5 react UIs with similar functionality (chat, RAG, document library).
Not sure about the moat, it's mostly a SvelteKit web app with extra utils after all. But it has a rather unique combination of advanced features (RAG integrations, workspaces[1], pipelines[2], code execution[3], MCP integration[4], etc.) and a user-friendly "production grade" interface. I've built a dependency for OWUI using many of these advanced features, and now I'm trying to figure out where to migrate with no obvious alternatives.
My only gripe with the project was the (exorbitant) size of the docker containers, especially for cases where you need a tool with no local models, just a gateway to third-party APIs. Now another and more serious one has been added.
[1] https://docs.openwebui.com/features/workspace/
[2] https://docs.openwebui.com/pipelines/
[3] https://docs.openwebui.com/features/code-execution/
[4] https://docs.openwebui.com/openapi-servers/mcp
My only gripe with the project was the (exorbitant) size of the docker containers, especially for cases where you need a tool with no local models, just a gateway to third-party APIs. Now another and more serious one has been added.
[1] https://docs.openwebui.com/features/workspace/
[2] https://docs.openwebui.com/pipelines/
[3] https://docs.openwebui.com/features/code-execution/
[4] https://docs.openwebui.com/openapi-servers/mcp
It's RAG never worked for me tbh. I thought it was simply because I didn't have Gpu.
I tried it once, and I couldn't run RAG without the GPU either (only using external APIs). Considering that they pull all the heavy deps even with the local compute flags disabled, I assume this is just a poorly supported case. Which is really unfortunate.
I think it's just the most popular, most full-y featured OSS project.
Based on history, I don't think changing from a permissive OSS license will allow it to remain the most popular, most full-y featured project, especially in a world of competitors (plenty of which have venture funding).
Based on history, I don't think changing from a permissive OSS license will allow it to remain the most popular, most full-y featured project, especially in a world of competitors (plenty of which have venture funding).
Curious.. which 'bring your own keys' -style competitors have venture funding?
Is HuggingFace venture funded? Because they have an Apache 2.0 licensed competitor (but it's not very active at a glance).
MSTY is the first one that comes to mind though. And if you're willing to stretch your idea of "what competes with OpenWebUI" I know half a dozen startups that let you pass in some set of keys and "build a multi-agent system" in a GUI usually alongside some pared down chat windows.
MSTY is the first one that comes to mind though. And if you're willing to stretch your idea of "what competes with OpenWebUI" I know half a dozen startups that let you pass in some set of keys and "build a multi-agent system" in a GUI usually alongside some pared down chat windows.
> I know half a dozen startups that let you pass in some set of keys and "build a multi-agent system"
Could you give names of those startups?
And yeah, Hugging Face is very much venture funded -- they had a modest 4.5b valuation in the last round.. (I just didn't know they had some competing product).
Could you give names of those startups?
And yeah, Hugging Face is very much venture funded -- they had a modest 4.5b valuation in the last round.. (I just didn't know they had some competing product).
Lobechat comes to mind.
Thanks. Do you have a source/reference for the venture funding? (Perplexity searched 101 sites and concluded that it didn't find any public information about funding)
Yep. This "little addition" to the license will likely make it non Open Source according to standard definition. It reminds me "Commons Clause" which Redis tried to add to its license years ago... and later pulled back.
I understand OpenWebUI team pain and perhaps not everything they do, they should do as Open Source
In my opinion you should think about Open Source as fundamental science - if you discover Gravity, people are going to use it and often not giving you any credit.
I understand OpenWebUI team pain and perhaps not everything they do, they should do as Open Source
In my opinion you should think about Open Source as fundamental science - if you discover Gravity, people are going to use it and often not giving you any credit.
> But with Open WebUI’s rapid growth and success, we started seeing a pattern we couldn’t ignore: bad actors taking our work, stripping the branding, selling it as their own, and giving nothing back.
I recently wrote a blog post on software licensing and this more or less feels like the reasoning behind some of the source available licenses like SSPL or the Elastic License.
What sometimes ends up happening is that forks are created (see Redis and Elasticsearch for examples) due to the community being quite upset and that can make it worse for the original project that was trying to protect itself from typically hyperscalers but sometimes just actors that aren’t aligned with the project's goals (that give nothing back and profit themselves).
If you never intend to make money from a project, license it permissively, like MIT or BSD or Apache 2.0 or similar licenses.
If you'd like to make money from the project at some point, consider dual licensing: AGPL or even something like SSPL, alongside commercial licenses for people with different requirements (commercial, proprietary software etc.), maybe with waivers for stuff like companies smaller than X employees or Y global revenue per year.
I recently wrote a blog post on software licensing and this more or less feels like the reasoning behind some of the source available licenses like SSPL or the Elastic License.
What sometimes ends up happening is that forks are created (see Redis and Elasticsearch for examples) due to the community being quite upset and that can make it worse for the original project that was trying to protect itself from typically hyperscalers but sometimes just actors that aren’t aligned with the project's goals (that give nothing back and profit themselves).
If you never intend to make money from a project, license it permissively, like MIT or BSD or Apache 2.0 or similar licenses.
If you'd like to make money from the project at some point, consider dual licensing: AGPL or even something like SSPL, alongside commercial licenses for people with different requirements (commercial, proprietary software etc.), maybe with waivers for stuff like companies smaller than X employees or Y global revenue per year.
I note that the GPL does not require publishing the source code, only distributing it to users of the binary code.
You're right, but it's equivalent to publishing because all users can have the source code AND can then distribute it freely once at least one user has it.
There are some potential scenarios where they aren't necessarily equivalent:
Your users don't know what source code is.
Your users don't bother to look at what they downloaded to find the code therein.
Your users aren't developers and they don't know any devs, so having the source isn't useful to them, so even if they see the code they won't redistribute.
Your users find the code a competitive advantage and don't want to spread that around. Its also too expensive for most organisations to obtain the code too.
You deliver binary and source, but then disincentivise redistribution by cutting off access to something else, like updates. This is what grsecurity and RedHat do. There was one leak of grsec, but that quickly became obsolete.
Your users don't know what source code is.
Your users don't bother to look at what they downloaded to find the code therein.
Your users aren't developers and they don't know any devs, so having the source isn't useful to them, so even if they see the code they won't redistribute.
Your users find the code a competitive advantage and don't want to spread that around. Its also too expensive for most organisations to obtain the code too.
You deliver binary and source, but then disincentivise redistribution by cutting off access to something else, like updates. This is what grsecurity and RedHat do. There was one leak of grsec, but that quickly became obsolete.
Thanks for the note! To be honest, I didn’t link/submit the post myself, because it’s far too casual and like a stream of consciousness for the most part.
That said, aside from helping with writer’s block, I guess the distilled conclusions are more or less the ones in my comment above: permissive licenses for non-commercial stuff, dual licensing if you intend to make money.
That said, aside from helping with writer’s block, I guess the distilled conclusions are more or less the ones in my comment above: permissive licenses for non-commercial stuff, dual licensing if you intend to make money.
They swapped out MIT [0] for BSD-3 just five months ago, which doesn’t seem to have been announced at all. Nixpkgs still has the 0.6.5 release as MIT, and 0.6.6 is in the AUR as MIT as well.
I wanted to be on the dev’s side here. CLA’s can be reasonable and I’ve happily let others convert my GPL code to them before. But reading the Open WebUI developer’s blog [1] makes it evident this isn’t really about the community — as he says, “It’s just me” and what he wants that matters for Open WebUI.
[0]: https://github.com/open-webui/open-webui/pull/8468/files [1]: https://jryng.com/thoughts/my-purpose
I wanted to be on the dev’s side here. CLA’s can be reasonable and I’ve happily let others convert my GPL code to them before. But reading the Open WebUI developer’s blog [1] makes it evident this isn’t really about the community — as he says, “It’s just me” and what he wants that matters for Open WebUI.
[0]: https://github.com/open-webui/open-webui/pull/8468/files [1]: https://jryng.com/thoughts/my-purpose
Do you have any recommendations for self-hosted, truly open-source, "ChatGPT"-style interfaces (e.g., a UI for chat, RAG, image generation, etc.)?
I use Open WebUI a lot, but it's lacking in a few aspects (UI, huge Docker images), and its focus on commercialization does not motivate me to contribute.
I use Open WebUI a lot, but it's lacking in a few aspects (UI, huge Docker images), and its focus on commercialization does not motivate me to contribute.
They cannot just relicense the work of all of their public contributors without them agreeing in writing. This is completely illegitimate. (They don't seem to require signing any contributor agreement.)
Have you come by your certainty that they have not asked because you were a contributor?
Asked and answered but for the sake of discourse, what is the best model/structure for open source projects? Every OSS project that reaches critical mass seems to believe changing the license to something source-available is the only option. Is it or isn’t it? Why or why not? Does it make sense to go with a different OSS license? If it does, which license would you recommend, and in what case(s)?
>Every OSS project that reaches critical mass seems to believe changing the license to something source-available is the only option.
Far from, these projects are the exceptions not the norm imo. Even the ones that grow past hobbyist torch-passing. Usually the impetus for changing license involves a business who finds themselves in charge of very well-used projects that, despite their popularity, isn't all that lucrative to be the ward of.
So, I think there are better models than using permissive OSS as the license for the first few years of a project and then switching it out from underneath contributors/users.
From a purely business perspective, it seems silly to acquire a customer base who wants _free_ and agree to provide it, then rug pull them - and expect the inertia from the initial goodwill can carry the business for more than a few years. I've seen dozens of software businesses and projects die this way at this point, so I'm not surprised, even if the juice is only temporary it's seems well worth the squeeze for enough of these entities.
Far from, these projects are the exceptions not the norm imo. Even the ones that grow past hobbyist torch-passing. Usually the impetus for changing license involves a business who finds themselves in charge of very well-used projects that, despite their popularity, isn't all that lucrative to be the ward of.
So, I think there are better models than using permissive OSS as the license for the first few years of a project and then switching it out from underneath contributors/users.
From a purely business perspective, it seems silly to acquire a customer base who wants _free_ and agree to provide it, then rug pull them - and expect the inertia from the initial goodwill can carry the business for more than a few years. I've seen dozens of software businesses and projects die this way at this point, so I'm not surprised, even if the juice is only temporary it's seems well worth the squeeze for enough of these entities.
Do you mean funding model? I agree with the Ladybird developers, the best model is to accept donations and other no-strings-attached funding.
https://www.youtube.com/watch?v=9YM7pDMLvr4
https://www.youtube.com/watch?v=9YM7pDMLvr4
Moreso the structure of an OSS project, which includes the funding model. The license choice is arguably one of the most important decisions yet people seem to get bitten by it quite often in my view.
Depends on your goals, but I would say the default should be AGPLv3 without CLA, funded by donations and maybe sponsorship and other no-strings-attached sources, with the money going into a non-profit foundation, and the trademarks, domains and other assets owned by the foundation, and the copyrights owned by individual contributors.
https://vadosware.io/post/the-future-of-free-and-open-source...
https://vadosware.io/post/the-future-of-free-and-open-source...
Except that isn't sustainable as a business, try to get a mortgage with such model.
Hence I much rather go for dual license approach.
Hence I much rather go for dual license approach.
Dual licence.
Downstream should be under the same conditions they are willing to support upstream.
Downstream should be under the same conditions they are willing to support upstream.
How does keeping the branding in place reduce misleading customers? Won't it look even more like Open WebUI supports the forked product?
They address that, for forks you have to make it clear that it is a fork of Open WebUI.
The LICENSE[0] doesn't say that. That's merely Open WebUI's interpretation of their own license. Now, a judge would probably consider that estoppel, but you don't want to rely on that.
Using the license on its own, you effectively are saying:
- Don't use our branding to endorse your fork
- Don't remove our branding from your fork
The only way to satisfy both of these is to not fork.
[0] https://raw.githubusercontent.com/open-webui/open-webui/refs...
Also, they forgot to reformat the new clauses for 80 column text, which makes the license unreadable on the normal GitHub viewer.
Using the license on its own, you effectively are saying:
- Don't use our branding to endorse your fork
- Don't remove our branding from your fork
The only way to satisfy both of these is to not fork.
[0] https://raw.githubusercontent.com/open-webui/open-webui/refs...
Also, they forgot to reformat the new clauses for 80 column text, which makes the license unreadable on the normal GitHub viewer.
Ugh, that's a real mess - they've clearly just invented their own clauses and tacked them on to the end of the previous 3 clause BSD license.
Technically, they're allowed to do that - the BSD-3 license is itself public domain - but it's usually a pretty bad idea. Have the new clauses been written by a copyright lawyer, or at least been vetted by one?
The fact that this is Open WebUI's second license change this year should be a red flag for anyone considering contributing to or relying on their software.
Technically, they're allowed to do that - the BSD-3 license is itself public domain - but it's usually a pretty bad idea. Have the new clauses been written by a copyright lawyer, or at least been vetted by one?
The fact that this is Open WebUI's second license change this year should be a red flag for anyone considering contributing to or relying on their software.
The forks will begin at the previous version though without having the branding requirements. Forking before the new version is what happens all the time.
So did they find out they made a mistake going with the BSD license, and correct it to be more in line with their original intentions?
Many here are responding as if they are making some moral u-turn, or calling them out for not being FOSS license cognisati from the very start.
And I get it. Most are not just 'rebranding and shipping'. You incorporated this into your own system as a frontend to your own specialized AI solution, and now you feel rugpulled.
I guess the true FOSS solution would be fork and backport changes. But that would mean someone steps up as the maintainer if this community of users wants to keep sharing the costs.
While not an easy option for all usecases, some could also bite the bullet and switch to LibreChat wich is MIT licensed.
Many here are responding as if they are making some moral u-turn, or calling them out for not being FOSS license cognisati from the very start.
And I get it. Most are not just 'rebranding and shipping'. You incorporated this into your own system as a frontend to your own specialized AI solution, and now you feel rugpulled.
I guess the true FOSS solution would be fork and backport changes. But that would mean someone steps up as the maintainer if this community of users wants to keep sharing the costs.
While not an easy option for all usecases, some could also bite the bullet and switch to LibreChat wich is MIT licensed.
here's a hard fork, who is with me? https://github.com/AI3clauseBSD/claused-webai
As we've seen this countless times, it still has the same problems:
> taking our work, [...] and giving nothing back
That's the BSD license for you. Following is a lot of FUD about what you can or cannot do, and what is open-source at all.
> the new branding clause [...] incentivizes individuals and organizations to actively contribute back
Not anymore with a CLA. I understand that they want money, but it never works by semi-closing open-source projects. It doesn't seem to be a famous project but I still expect the usual small forks while the real projects contributions slowing down because of the CLA.
> taking our work, [...] and giving nothing back
That's the BSD license for you. Following is a lot of FUD about what you can or cannot do, and what is open-source at all.
> the new branding clause [...] incentivizes individuals and organizations to actively contribute back
Not anymore with a CLA. I understand that they want money, but it never works by semi-closing open-source projects. It doesn't seem to be a famous project but I still expect the usual small forks while the real projects contributions slowing down because of the CLA.
Non-GPL software is so annoying.
Wait, they want Iceweasel branded as Firefox, not the other way around?
In this particular case, it's not as bad as that, as Open WebUI is merely introducing a more onerous version of the BSD advertising clause. BSD 4-clause was considered a FOSS license but, in practice, demanding specific forms of attribution was incredibly problematic, especially in projects with multiple contributors. The attribution clauses in Creative Commons licenses are similarly if not more problematic; to the point where there is a cottage industry of copyleft trolls abusing pre-4.0 licenses as a way to rugpull people and coerce them into massive settlements.
Furthermore, the way this specific attribution requirement is written sounds like a possible future trademark landmine. Like, imagine if Firefox shipped with an attribution requirement that prohibited removing the trademarked Mozilla branding. That would effectively make the project non-FOSS because anyone who wants to use their FOSS rights is in a catch-22. Either you violate copyright and remove the trademarks, or you violate trademark by using your rights under the license in a way that violates trademark policy.
I'm also particularly not fond of the plan to demand CLAs and sell white-label licenses; my personal opinion is that you should almost never sign a CLA for a FOSS contribution. At the very least CLA signers should be getting paid a revenue share of the white-label licensing revenue.