XF 2.0 | There needs to be better management of copyright notices from addons

[rafass]

God bless all developers that don't use copyrights on paid or free addons.
In most of cases that's addons don't have good quality (free copyrighted addons)
If the addons is really good, in almost all cases the addon have a reasonable price or even is free and don't have copyright.
The best addons of Xenforo don't have copyrights.

 

[Sheldon]

The best addons of Xenforo don't have copyrights.

That is simply not true, and merely your personal opinion.

Its a shame too, cause you are certainly missing out on some of the best add-ons available.

 

[RichardGaspa]

I don't believe third party add-on 'copyrights' provide any benefit to anyone.

They're just spammy links as far as I'm concerned.
The people who use your forum couldn't care less who developed which add-on, they are there for the content, not the software it runs on.

Which is why I didn't add a copyright to mine.
Not having one and not forcing people to pay to remove it has worked out fine for me.

Amen, Hallelujah, You're the man. You hit the nail right on the head. Not one of my members know what an add-on is or what XenForo is for that matter. The only users that do are the admins from other boards that might log in from time to time.

 

[RobinHood]

I'm pretty sure there was another good thread from the first year or two of XF that had some very good points related to this, but I can't find it now. The copyright notices aren't meant for members, it's for the few fellow admins that want to know what powers that site, for them the links are potentially incredibly useful.

I like the idea of having a single 'Built with' link in the footer, linking to copyright galore on a dedicated page. Potentially whatever the add on dev wants, but much richer, actually useful info.

Each add on could have a short entry

• The add on title
• What it does, a short description
• What pages on the site it relates to so a visitor can try it out (eg. this addon powers the gallery)
• Backlink with where to buy it and find out more info

That would get rid of all the copyright crap from the home page or any other page, apart from the XF copyright, and have a nice dedicated page for the curious fellow admins that want to find out more about the back end of that particular XF site.

The add on authors get more space to work with than a single link to a shop home page that may have dozens or hundreds of things for sale, and visiting admins can better understand about all the add ons being used without having to decipher what 'Some add ons by Waindigo' means.

If the admin doesn't want all that info being available to the public then they can pay the author to remove the copyright.

The people interested in finding out more about the addons win as they get more info about what each add on does and where to buy it, the add on authors win as they potentially get more copyright removal payments as a result of better exposure, and the site admins and users win as all the copyright clutter is relegated to single page, making for a much cleaner experience everywhere else on the site.

 

[Paul B]

I'm pretty sure there was another good thread from the first year or two of XF that had some very good points related to this, but I can't find it now.

This?

https://xenforo.com/community/threads/powered-by-page.6301/

 

[StarArmy]

The more we can reduce duplicate content, including copyright notices, the better.

 

[vbresults]

Suggestion: a core copyright system that decides the location, separator and formatting of the copyright links for XenForo and it's add-ons/themes.

Then, add it as a rule to the RM that all end-user visible copyrights, if they exist, must be placed using this system, and no other.

I don't think staff can allocate resources to measuring compliance, but they can encourage admins to report these resources at which point a countdown starts.

Instead of leaving implementation to each developer on a case by case basis, you would have two uneditable phrases in the resource:

{resource_type}_{addon/theme_id}_copyright_title

and

{resource_type}/{addon/theme_id}_copyright_link

Then, this system neatly composes all the copyrights, in one location, and does things like adding rel="nofollow" and target="_blank".

Also, it could rely on a footer element regex and be inserted dynamically instead of being removable by template. Interested in thoughts on all this.

Ping @Mike

 

[W.D]

I feel backlinks in addons are a pain. I refuse to buy addons that cost money and have forced backlinks with paid removal.

The only time I'll allow a link is if it's a theme designer take Russ/Steve and Mike/ThemeHouse as examples.

Many addon makers I feel take te piss, excuse the langauge but that's honestly how I feel.

I hate to name names but the one I find most annoying is DragonByte products. Not only do they add one link they add three! I understand devs need to make money but to stick 3 links into an addon is just wrong in my opinion. I also just noticed that the DragonByte addon backlinks expose the installed addons. If there was an exploit for one it would make a hackers life a million times more easy. It's as easy as typing "vbecommerce.php?do=productdetails&productids" into google.

You should NEVER expose script information if you can help it. Not just with The DragonByte addons but with all. Wordpress would be an example that does it wrong.

Back on topic..

Some of these devs also charge monthly fee's to use and then charge outrageous amounts to remove a link. If it was a free addon then sure that's fine but to pay say $50 for an addon only to be charged another $50+ is just wong.


Not every site is run by a company, Not every site can afford hundreds for addons.

If XenForo 2 was to force management of links I feel it would be a smart move. Right now it is a mess.

I hate to go offtopic.. again, but I also feel addons / styles should only be allowed to be sold on XenForo.com itself, I've seen 2 addon makers recently get hacked which opens any customers of those sites to attack here. I know it would mean more costs for XenForo but at the end of the day it would make things more easy. An another example as to why this should happen is some devs don't use https which is now needed on all sites. I've seen 2 invalid SSL's this week alone and found another expired.

 

[HWS]

Some of these devs also charge monthly fee's to use and then charge outrageous amounts to remove a link. If it was a free addon then sure that's fine but to pay say $50 for an addon only to be charged another $50+ is just wong.

Would it be more convenient for you if such developers would charge $100 for the add-on and would give you an optional discount of $50 if you display a backlink?

 

[digitalpoint]

In the end I doubt most addon makers make less than minimum wage coding and supporting their addons. There isn't an economy to support it. So some go the option of getting paid $3/hour to be a programmer with some links thrown in to th the mix. Personally I'd never make an addon I didn't need myself. And even then maybe 10% of those are even worth the effort to release to others. There just very little viable economic model to do so. People want everything for free basically. There needs to be more volunteer brewmasters imo and less volunteer programmers.

Bottom line is it's all supply and demand... if you want an addon bad enough to pay whatever the developers charge for it (and/or put up with their links), do it. Otherwise don't. {shrug}

 

[W.D]

Would it be more convenient for you if such developers would charge $100 for the add-on and would give you an optional discount of $50 if you display a backlink?

I would rather have no backlinks. I hate sites with hundreds of links in the footers plus it is insecure. The first thing I look for when getting an addon here is if there's a backlink. If it has one I don't buy/use. Half the time the backlinks break views. It's a mess and spammy in a way in my eyes. I like my layouts clean and with my links only.

Also, for dev's charging $50+ to remove a link look at PixelExit/etc, They only charge $25 which is a fair amount. A price equal to the cost of the addon is pretty fair. Charging more if not double is wrong. Then it goes back to my spammy links comment when some dev's slap multiple links in.

Yes, I get a developer has to make money but I'd rather pay $20 more for an addon with no links then one that costs $20 and has multiple.

There's also the fact displaying a backlink makes it more easy to detect what scripts you're running which is a security risk. If you care about your sites you'll display the minimum amount of information possible.

Sorry DigitalPoint but I'll use one of your addons as an example, I know the addons made display a backlink, I simply google "Search Engine by Digital Point" and I've got 270,000 results that means I've got over 100 targets if I was a hacker and if this addon had an exploit it's christmas day. (It doesn't but it's an example.)

Looking at page 1 on google alone for "Search Engine by Digital Point" I've got 6 websites, That's a total of 184,805 users between those sites. Seeing as hackers can pay 50p per user that's easy money.

How do you think vBulletin get's hacked so easy? The hackers simply search the information displayed in the site footer. Backlinks are a security risk and a mess.

Even if I was paid $50 to display the link in my footer I wouldn't. What's the point of buying an addon when the backlink removal costs more then the addon? If the addon cost slightly more and had no backlink I'd likely buy. If the addon was free and the removal link was $50 that's fine.

End of the day it makes your sites look a mess and it makes the site more easy to attack for anybody wishing harm. Why do you think XenForo doesn't display a version number?

 

[rainmotorsports]

How do you think vBulletin get's hacked so easy? The hackers simply search the information displayed in the site footer. Backlinks are a security risk and a mess.

Back when we were on vBulletin we had 3 backlinks and I am pretty sure intrusion after intrusion none of those were the entry points. If you don't properly configure your web server its easy to poke and see which addons you have. I actually just checked ours earlier and the method of library protection we were using (just jumped to nginx a week ago) wasn't actually correct. Fixed it now.

End of the day it makes your sites look a mess and it makes the site more easy to attack for anybody wishing harm. Why do you think XenForo doesn't display a version number?

It's a good practice not to but the copyright date gives notice to outdated versions. It's against the license to change it either. You have sites like IGN that is probably still using a heavily modified 1.3. Then again branding free solves that.

 

[digitalpoint]

Sorry DigitalPoint but I'll use one of your addons as an example, I know the addons made display a backlink, I simply google "Search Engine by Digital Point" and I've got 270,000 results that means I've got over 100 targets if I was a hacker and if this addon had an exploit it's christmas day. (It doesn't but it's an example.)

Looking at page 1 on google alone for "Search Engine by Digital Point" I've got 6 websites, That's a total of 184,805 users between those sites. Seeing as hackers can pay 50p per user that's easy money.

How do you think vBulletin get's hacked so easy? The hackers simply search the information displayed in the site footer. Backlinks are a security risk and a mess.

I think you are confusing correlation and causation. vBulletin has exploits and is searchable via Google does not mean other things searchable via Google are.

I'm pretty sure vBulletin gets hacked so easily because they have poor developers building it to begin with. And as far as using Google search to find what a site has installed, only the worst hackers would need that. I can tell you the exact version any installation of vBulletin has with or without branding. Not even just the major version, but the specific version. Let's say for example I wanted to know vBulletin installations at exactly version 5.1.2 that have been running it in the last 90 days... it's a simple query

mysql> SELECT domain FROM misc_data WHERE name = 'vbulletin_version' AND value = 512 AND date > (UNIX_TIMESTAMP() - 86400 * 90) ORDER BY domain;
+--------------------+
| domain             |
+--------------------+
| afiliadosninja.com |
| aicel.it           |
| ausph.com          |
| kyokushin4life.com |
| xedap.org          |
+--------------------+
5 rows in set (0.00 sec)

Even if I was paid $50 to display the link in my footer I wouldn't. What's the point of buying an addon when the backlink removal costs more then the addon? If the addon cost slightly more and had no backlink I'd likely buy. If the addon was free and the removal link was $50 that's fine.

If the goal of addon developers was to maximize installations, of course they are going to do it differently. It's fairly common for attribution removal to cost more than the product itself (XenForo branding removal is $250 on a $140 product for example).

In the case of my search addon you used above, the less people that use it the better as far as I'm concerned. I make no money from it and it just takes support time. The only reason I make it available because it's borderline a *must have* for larger sites. The required attribution absolutely is intended as an annoyance factor to have a barrier of entry so not everyone uses it. The addon is free with an optional $100 branding removal fee. The other option would be to make it $100 with no branding, at which point you are kind of mean by blocking people who *need* it, but can't afford it.

And for the sites that actually need it, even a cost of $1,000 for it would be realistic (I'd have paid $5,000 for a license for it if someone else made it... it would have saved me time developing something that allows our site to function at scale).

End of the day it makes your sites look a mess and it makes the site more easy to attack for anybody wishing harm. Why do you think XenForo doesn't display a version number?

Well, as you are probably aware, the best solution is also the cheapest and requires the least work (none). Simply don't use addons that don't bring enough value to you that warrants whatever their branding removal cost is. Not all addons are for everyone.

I can't speak for other addon developers, but for myself, some of my addons (like the search one you referenced), the attribution link has the sole intent of being an annoying barrier of entry so less people use it. Less people using it means less support/work on my end, but also giving people the option that actually DO need it (but have no money) a way to use it.

 

[rainmotorsports]

I'm pretty sure vBulletin gets hacked so easily because they have poor developers building it to begin with. And as far as using Google search to find what a site has installed, only the worst hackers would need that. I can tell you the exact version any installation of vBulletin has with or without branding. Not even just the major version, but the specific version. Let's say for example I wanted to know vBulletin installations at exactly version 5.1.2 that have been running it in the last 90 days... it's a simple query

mysql> SELECT domain FROM misc_data WHERE name = 'vbulletin_version' AND value = 512 AND date > (UNIX_TIMESTAMP() - 86400 * 90) ORDER BY domain;
+--------------------+
| domain             |
+--------------------+
| afiliadosninja.com |
| aicel.it           |
| ausph.com          |
| kyokushin4life.com |
| xedap.org          |
+--------------------+
5 rows in set (0.00 sec)

Could you have atleast used an example that didn't have branding? Back in 3.x and 4.x even if the version number was not showing it was always commented in the source which I thought was a bit...

 

[digitalpoint]

Could you have atleast used an example that didn't have branding? Back in 3.x and 4.x even if the version number was not showing it was always commented in the source which I thought was a bit...

Sure... freewebhostingdir.com, no branding or the string "vbulletin" on the page. Running vBulletin 5.2.5.

Frameworks (like vBulletin or XenForo) tend to use the same cookies, have the same JS objects, etc. You can search for those if you know where to look:

https://tools.digitalpoint.com/cookie-search?domain=freewebhostingdir.com

For example, I know the site listed on your profile here was using vBulletin up until about the end of 2013 by the cookies it set back then. And now it's XenForo. https://tools.digitalpoint.com/cookie-search?domain=tbgclan.com

Anyway... off topic. Point is that if you know what you are doing, you don't need a search engine to find sites running a specific framework/version and visible branding is no protection at all.

 

[rainmotorsports]

Sure... freewebhostingdir.com, no branding or the string "vbulletin" on the page. Running vBulletin 5.2.5.

Frameworks (like vBulletin or XenForo) tend to use the same cookies, have the same JS objects, etc. You can search for those if you know where to look:

https://tools.digitalpoint.com/cookie-search?domain=freewebhostingdir.com

Site redirects to forum.hosting now but I will assume this is still accurate.

<script type="text/javascript">
  
        window.vBulletin = window.vBulletin || {};
  
        vBulletin.version = '5.2.5';
</script>

They still stick it right in the source. WHY lol.

I would assume by now people are using drive by mechanism to scrape pages for easy targets. I could be wrong but having a framework as you say or even have a certain plugin is often going to leave a tell tail sign behind.

I personally wouldn't fret over a linkback most of the time.

 

[Donny]

One of the most frustrating aspects of trying to put together a nice looking site with neatly presented information is the way that different addon developers add their copyright notices in random places. I remember it was really frustrating on vB and it's no different in Xenforo.

I think with XF 2.0 there's an opportunity to fix this. There should be a section provided in the footer called credits (or whatever) where addon developers can put their copyright notices.

This will make life easier for style developers, webmasters and addon makers. Also it makes more sense because addon developers will be getting their copyright into the right place for site users to see it.

I've added an image below to give an idea of what I mean...


View attachment 99293

+1

I do tend to just move them to where I want them though. I also sometimes remove the actual link if it's not stipulated that it needs to stay. And if there's more than one link and they stipulate keep the link, I keep the one link. If they got in touch and asked me to remove it because of that, I'd be fine with that. I never buy copyright removal. I do sometimes buy the Pro versions of add-ons if they come with extra features. If an add on requires monthly fees for support or whatever, they're a no-no. And if they want me to sign up to their forum / website to get it, that's often a no-no.

Just my 2p.

As above with DragonByte too.

 

[Robust]

Yes, I get a developer has to make money but I'd rather pay $20 more for an addon with no links then one that costs $20 and has multiple.

That's your opinion. Most have the opposite opinion. The add-on doesn't change, irrelevant of how much you pay for it or how many copyrights it has. You use the example of "not everyone is a company" and that not everyone makes money, then you say that. For a non-profit, they'd rather pay $20 and have the add-on with some text on the bottom of each page, than pay $40 for the same exact product with the text removed.

At the end of the day, it makes add-ons more accessible. People who want to pay more money can do so with the branding removed, but it allows people with a smaller budget to receive the add-on as well. The net profit for the developer evens out as a result.

It's also important to note that, arguably, forums are dying out. The market is very rough and developers dedicating full efforts to XenForo or any forum software, still, are taking a big risk. It's not a market with large potential and is not very economic. Due to that and relatively low competition (each add-on doesn't have an infinite number of competitors, like in your average market) developers are able to offer a poorer service and charge more if they want to.

As far as the OP goes, it would make sense for developers to keep copyright notices in one place but you were aware of there being a notice somewhere in the add-on and are fully able to ask the developer where it is. It doesn't make sense for XenForo to impose regulations on things like that.

 

[Robust]

+1

I do tend to just move them to where I want them though. I also sometimes remove the actual link if it's not stipulated that it needs to stay. And if there's more than one link and they stipulate keep the link, I keep the one link. If they got in touch and asked me to remove it because of that, I'd be fine with that. I never buy copyright removal. I do sometimes buy the Pro versions of add-ons if they come with extra features. If an add on requires monthly fees for support or whatever, they're a no-no. And if they want me to sign up to their forum / website to get it, that's often a no-no.

Just my 2p.

As above with DragonByte too.

So you remove or alter copyright notices from developers without paying them, for both free and paid add-ons? So you break the terms of your license agreement?

Support is continued over a period of time. You pay more for warranty for your home appliances, you pay continued costs for support within software, hardware, leasing, and throughout all aspects of life. It costs money to keep giving support, so after a period of time you're expected to fund that, an initial period often comes with your license.

And of course you have to sign up to a website to make your payment and get an add-on. By law, we're expected to ask you to provide certain information for taxation and record-keeping purposes, not to mention it also helps tailor a better experience for you, the customer. You sign up when you buy Windows, or buy a product from Amazon, or want to buy advertising within Google's network, or when you want to order some furniture or some clothes from Ted Baker. And if you mean free add-ons, well, the developer is really doing you a favour, a few moments of your precious time to sign up isn't much to ask for.

I don't know how you can expect sympathy when you have none for the time of developers and openly admit to breaking license agreements, depriving developers of money that you'd be expected to pay as per a legal agreement you agree to when downloading or using the product.

 

[Donny]

So you remove or alter copyright notices from developers without paying them, for both free and paid add-ons? So you break the terms of your license agreement?

Support is continued over a period of time. You pay more for warranty for your home appliances, you pay continued costs for support within software, hardware, leasing, and throughout all aspects of life. It costs money to keep giving support, so after a period of time you're expected to fund that, an initial period often comes with your license.

And of course you have to sign up to a website to make your payment and get an add-on. By law, we're expected to ask you to provide certain information for taxation and record-keeping purposes, not to mention it also helps tailor a better experience for you, the customer. You sign up when you buy Windows, or buy a product from Amazon, or want to buy advertising within Google's network, or when you want to order some furniture or some clothes from Ted Baker. And if you mean free add-ons, well, the developer is really doing you a favour, a few moments of your precious time to sign up isn't much to ask for.

I don't know how you can expect sympathy when you have none for the time of developers and openly admit to breaking license agreements, depriving developers of money that you'd be expected to pay as per a legal agreement you agree to when downloading or using the product.

I aim to keep within their terms. If they stipulate the Copyright text and links need to stay, they stay. If they don't, I edit them. But they always have their actual copyright text in place. And I'll move them to be inkeeping with my design. I even don't mind AndyB's sitewide footer text for the mass email weekly digest, when it doesn't even actually particularly involve design or functionality.

I also own lots of Copyright content, and I spend a long time making sure that my terms are not just a simple on-liner.

I'm 99.9% certain I'm inkeeping with what add-on developers stipulate with their small paragraph of text.