SugarCRM 6 Released, But Is It Open Source?

darthcamaro writes "SugarCRM markets itself as a professional open source company and this week released version 6 of its Sugar platform. But the main new feature is a new user interface that isn't available to users of the community version — it's only available to paying users. No they don't claim to be open core either, they claim it's all open source, even if you have to pay for it. '"Open source doesn't mean free and was never really meant to mean free," Martin Schneider, senior director of communications at SugarCRM, said. "Open source runs through everything we do, it enables us to be transparent and gives customers more power. We are an open source company and it's why we're better than proprietary companies."'"

Comments

He's right

[iplayfast]

There's nothing about open source that means no cost.

Re:He's right

[shaitand]

If there were it wouldn't be open source. Anything that would prevent this would prevent you from modifying and distributing your modified version. That is the core of open source and without that ability a license isn't open source.

Re:He's right

[NNKK]

Have you tried actually reading the first criteria of the open source definition?

http://opensource.org/docs/osd

Re:He's right

[snowgirl]

Section 1 only requires that redistribution rights be granted to people when made a part of an aggregate work from multiple sources.

This means you are not guaranteed the right to just copy the code out to anyone and everyone... without created an aggregate work.

Re:He's right

[shaitand]

When did I deny section 1? I just said it isn't the relevant section.

Change the title and you'd fall under section 3, package it alongside the source to any of the required libraries and you'd fall under section 1.

Any way you slice it, there is no license that could in any practical manner prevent free redistribution and still be open source let alone free software.

Re:He's right

[h4rm0ny]

Has anyone here actually read the article (I know, stupid assumption). SugarCRM has a dual licence. There's a "Community Edition" and a "Professional Edition" (also an Enterprise Edition, but that's not different from Professional - it's just the support offers sort of thing as far as I recall).

Now the Professional Version is obviously not "closed source" because it's a great sprawling PHP application so they have to give you the source. But that doesn't make it "Free Software". It requires a licence on a per user basis. In contrast, the Community Version is what we call "Badgeware". You can download it free, you can deploy it free with whatever users you like and you're free to make and distribute plugins and such for it. But you can't remove the SugarCRM logo and weblink for example. (In fact, there are some amusing little attempts to prevent people from doing that in the code, e.g. the legal notice that comes up if you alter the SugarCRM image doesn't appear as text in the files, but encoded as base64).

Anyway, there's an open sourcish community around the Community Edition that write tools for it. But, IMO, the whole thing doesn't feel very open sourcey. What it comes down to is not an issue of programming, so much as it comes down to business needs. SugarCRM has a system of "modules" - pluggable business entities such as Contacts, Product Lists, Accounts, etc. The great big difference between the Community and Professional versions is that the Professional version comes with additional modules. And for most businesses (I would say), they're modules that you really need. There are various other bits and pieces like the Professional Edition supports workflows whereas the Community Edition does not.

What it comes down to, is that SugarCRM has a community edition which serves as a good bit of PR, a hook to get in new users and a source of occasional free bug-fixes. But most serious businesses - the ones who actually are potential customers - will end up needing the features of the non-Free Professional Edition. There are attempts to replicate some of what the Professional Edition does in the Community one, but from what I've seen they don't really compare and of course the company itself isn't helping much because primarily they want people to buy the Professional Edition to get those features. Their forums are also littered with unanswered technical questions. If you're a paying customer and you file a support request with them, you get fixes (in my limited experience with them), but if you're a Community type asking questions on the forums, you take your chances. It would also be pretty difficult to make any substantial changes to the code base because you're always tailing the Professional Edition which SugarCRM control. So if you write a wonderful new thing for it (the do-it-yourself Open Source way), expect there to be a good chance that it will be incompatible shortly.

I actually quite like the model of a free version of software and then a paid-for pro version with extra coolness. It's a model that works well. But when you combine that with Open Source, it becomes a little more dubious (maybe) because there's the possibility that you use the name of Open Source but create a system where in practice, people can't meaningfully participate and it's primarily a hook into the paid version. This is where I feel SugarCRM are. I have no doubt that there are people using the Community Edition for business purposes, but I think what I describe is the bird's eye view of the situation.

Re:He's right

[Richard_at_work]

That's *an* open source definition, not *the* open source definition.

Re:He's right

[Eivind]

http://opensource.org/docs/osd

Requirement #1 is "Free Redistribution", i.e. that you have the freedom to, without limitation, redistribute the software.

Would you like ketchup with that ?

Re:He's right

[harlows_monkeys]

That's nice. However, there are other sections besides section 1. They aren't there just to help with the feng shui of the site.

Re:He's right

[Chrisq]

http://opensource.org/docs/osd

Requirement #1 is "Free Redistribution", i.e. that you have the freedom to, without limitation, redistribute the software.

Would you like ketchup with that ?

Only in an aggregate work. Not as an individual work... which I believe the original objection was about.

OK so I package it with a picture of your mum sucking my dick

Re:He's right

[tapanitarvainen]

No. It used to be fairly common to sell software with source code, with explicit restriction that it may not be redistributed: source was only provided for in-house use. That is certainly not open source.

I remember those days, believe it or not. :)

So do I (yeah, I'm old). Did you really use the term "open source" then? I'm sure I didn't, the vendors certainly didn't, actually I'm pretty sure I never heard the term back then.

Of course I may have missed someone using it, but it certainly wasn't a common term.

As far as I can tell, the very term was invented as a generic term for freely redistributable source - as a substitute for "free software", which had too heavy political and philosophical connotations.

Seriously, if you want to refer to software that is both open source and includes the right to distribute and modify, call it "Free Software" like the FSF, or "Libre" software. It's nice, unambiguous, is an existing term and doesn't confuse half the software world which is still filled with people like me who recall Open Source meaning only that the source code is available.

Can you point out any references to "Open Source" that predate the current common meaning (that includes free redistributability)?

Re:He's right

[icebraining]

You can't do neither, because you need a key for each copy of the paid version - you pay by the user. It's not OSI approved in any way, it's just a marketing abuse, imho.

Re:He's right

[hey!]

I actually installed the community edition of SugarCRM a few years ago. My take on it is that it's got the right problem (a big, big, big part of creating a great piece of software), but that the system design and implementation is painfully amateurish. The database schema was an incoherent joke, the code meandering, verbose and inarticulate. There's no reason for code (even PHP) to be that bad.

Obviously a huge amount of work went into the thing. The kind of work you do when you've got a poorly thought out system and real customers to satisfy. The thing about that kind of work is that if you hack away at a system long enough *in response to customer needs*, eventually it will fill those needs fairly well. Being badly engineered doesn't preclude providing value to users. We certainly found it useful, but whenever I had to fix a bug or tweak something, I was constantly amazed that the system worked at all.

Now we all know there are two schools of thought about software development: the incrementalist (make the software work even if it is ugly) and the purist (make it elegant even if you have to rewrite it). The reason these two schools persist is that they are both right in different situations. There are times you have to live with less than elegant, and times when you have to bite the bullet and do major rewrites. I think most successful programmers balance these impulses, tidying up and refactoring as they fix bugs and meet customer's needs. The sign of a skillful programmer is that the more he works on a body of code, the simpler and more elegant it becomes. But when you have a gawdawful mess like SugarCRM, it makes no sense to invest anything more than occasional trivial effort unless you're willing to commit to a complete fork. You'd have to do major refactoring unless you were willing to spend all your time hacking your way through cruft, and the SugarCRM folks probably wouldn't because they actually understand all that unnecessary complexity.

Overall I'd say that SugarCRM is a useful, but mediocre piece of software. If you can live with its limitations, it is an asset, particularly in a small business where you have to introduce management to the novel concept of CRM before getting them to part with money. SugarCRM is not much of an asset to F/OSS, because it's not likely to attract many talented contributors to the core system, yet discourages them from developing competing solutions because it is "good enough" for not-too-demanding users.

Well..

[ak_hepcat]

Sure, if it's open source, then one paying customer can take the source and fork it back out to everybody else for gratis.

That's what open source means.

Trying to disguise commercially licensed software as open source is setting yourself up for failure.

Re:Well..

[ducomputergeek]

Depends, things like PA-DSS and HIPPA suddenly can throw a monkey wrench into things. We forked an opensource project with the goal of getting it PA-DSS certified so we could use it to continue processing credit cards after July 1st of this year. We've done the audit and now just waiting for the paperwork to go through to get it listed as "certified" software. However, only versions signed and distributed by our organization is certified. Like SugarCRM, we only give out the code to customers who are paying for support contracts.

They are free to download the code and they could even compile and use the code in house and be okay under PCI-DSS. However the monkey wrench comes if they decided to compile the application and then distribute their version to other parties. Technically those 3rd parties would not be able to use the software to process credit cards since the version would not be "PA-DSS certified". And while the software would still be functional, if you used the uncertified version to process credit cards, then one could lose their merchant account. And processing credit cards is a MAJOR feature of the product and too risky for a lot of businesses to consider using it without that certification.

So while one could have all the source code, the source code without the "PA-DSS Certification" certificate doesn't do folks much good in practice.

Magento is doing something similar. Only their "Enterprise" version is PA-DSS certified. The Community Edition is not. And I suspect we're going to start to see more of this as time goes forward. I'm not saying it will be impossible to do it, but it is extremely hard. PA-DSS certification requires a lot of documentation and about $25k up front to pay for auditing, the PCI-SSC, and the best part is the validation is only good for 3 years. That's either a lot of community donations or someone bank rolling the operation.

Open source

[Eric Smith]

They only give the source to paying customers. But do they prevent those paying customers from redistributing the source? If not, then it really is open source. Nothing about open source requires that owner of the code give it out to everyone, but if there are restrictions on redistribution, it's not open source.

Re:Open source

[jamesh]

"open source" is one of those terms made up of two words who's meaning appears to be redefinable to suit the needs of any given agenda. That's why terms like 'GPL' and 'BSD' are more useful as they define what the terms of the 'openness" are. On slashdot "open source" and "GPL" are mostly synonymous but not necessarily in some industries.

but if there are restrictions on redistribution, it's not open source.

Well even GPL fails at that. It places the restriction that if you distribute the binary then you must make the source available too. That's kind of the opposite kind of restriction to what you were saying but it's still a restriction in that it limits your freedom to do what you want with the code, but only in as far as you can't deny others the freedom you were granted, which is widely considered to be a good restriction.

Even Microsoft open their source to various organisations (academic mostly). I think they don't ever refer to it as "open source" though but "shared source" instead, so I guess they are off the hook.

Re:Open source

[snowgirl]

A bit of poking around indicates that the community edition is released under GPL v3 and the paid edition is released under this variation of the Mozilla PL. Someone want to dig through it and work it out?

*reads reads reads*

Section 2.1, and Section 2.2 pretty much say you can distribute the original code with or without modification indiscriminately. ... So... yeah, one should be able to simply buy it once and then "fork" it from the original and provide it free.

Use "gratis" not "free"

[El_Muerte_TDS]

Can we please stop using "free" when we mean "gratis". You know, when something doesn't cost anything. "free" is too ambiguous.

This has bothered me for a while...

[Anonymous Coward]

Strong advocates of "open source" always talk about how having access to the source is a kind of freedom, and that's true. Personally, I would prefer if all software that I purchased came with the source code (and the means to rebuild it) - because this gives me the freedom to fix bugs or make enhancements myself (and also to pay someone else to do it, i.e. to avoid vendor lock-in). It's an important freedom to have, **but** it's a big jump to then say that not only should I have the freedom to see and modify the source, but I should be able to share the whole source - even the parts I didn't write myself - with anyone I want to, without permission from or kickbacks to the original author(s). That is certainly nice, but it's not a "freedom" so much as it is a privilege.

Is the source "open" just because I have access to it along with the software...? I say it is. If I can also give it away to others then it's also "free", but that would be in the as-in-beer sense, not the as-in-speech sense.

The main reason I often prefer "open source" software is because I, personally, get access to the source code - not because it's free in cost, but not either because everyone else "in the wild" can get it too.

Want open source?

[kimvette]

Check out vtiger

SugarCRM has been guilty of decepting customers with their "open source" claims in the past. They originally released under a modified Mozilla public license (the Sugar Public License), with requirements that derivatives remove any and all SugarCRM branding. A few enterprising folks forked it to form vtiger, which supposedly led to SugarCRM threatening to file suit for actually exercising their rights outlined under the license, and the CEO publicly lambasting the vtiger folks for actually taking SugarCRM up on their offer extended by the original SPL.

http://forums.vtiger.com/viewtopic.php?t=11
http://blog.tmcnet.com/blog/rich-tehrani/crm/sugarcrm-vs-vtiger.html
http://developers.slashdot.org/comments.pl?sid=188554&cid=15541264
http://www.zdnet.com/blog/open-source/is-sugarcrm-open-source/867

I've posted previously about sugar vs. vtiger before:
http://slashdot.org/comments.pl?sid=223770&cid=18118754 (which drew out anti-F/OSS zealots and folks who didn't bother to read the licenses fully and obviously did not compare it to the previous SPL as it was originally written and released)

Now, the SugarCRM folks may have updated their licensing to remove the restrictions about moving to the free/community edition after having used the "enterprise" edition but honestly those folks were so scummy when they threw a fit after folks actually exercised their rights to create a derivative project that I can't be bothered to check.

Does vtiger functionality stack up well against SugarCRM's enterprise version? Not exactly. However, reverse is also true; vtiger offers some bells and whistles you don't get with Sugar - but in any event, vtiger does not use a license to try to restrict using your own data in another product.

Don't get me wrong: SugarCRM is a pretty good product, but I don't like to use products made by companies which engage in deceptive practices, even when some of the product editions may be "free."

Re:Want open source?

[bigsteve@dstc]

Here's an excerpt from the current Evaluation License, copied from the SugarCRM website.

Licensee shall not bifurcate the source code for any SugarCRM open source licensed products into a separately maintained source code repository so that development done on the original code requires manual work to be transferred to the forked software or so that the forked software starts to have features not present in the original software.

That smells of "not open source" to me.

Commercial software WITH source code

[Rsriram]

Many commercial software developers provide their software along with the source code. But they do not qualify as "open source". If there is a restriction on forking the source code or maintaining it yourself, it is not open source.

"Open Source" Software is different from "Source Available" software.