I’m creating a website where trust is a big issue, I want to prove by making it open source I actually do what I claim.
Question 1. If I make my source code open, how can I prove the actual website runs on this code?
But I also have a dilemma, it is a commercial project and I don’t want others to run off with it and claim it theirs. So I think I need a correct license.
Question 2. What license is best for me? Currently I’m thinking about GPL v3.
7
Question 1:
You can’t. Your server is a black box. Nobody can see what code it is really running. Even when you configure your webserver to make the src-directory accessible to the public, you have no way to prove that it’s really the src-directory used by the website and not a mock-directory you set up for the public.
Question 2:
The GPL only requires to relicense code under the same license when someone receives the program in code- or binary form. That means you can run a website on modified GPL code and don’t have to disclose any of your modifications at the server-sided components, because you aren’t giving them to anyone. You only give people the HTML output of your program, and the output of a GPL program isn’t subject to the GPL.
But there is also the Affero General Public License (AGPL) which adds a new clause to the standard GNU GPL: It demands to give the sourcecode to “users interacting with it remotely through a computer network”, which means anyone who visits the website. However, remember answer to question 1.
In case you want to publish your sourcecode but you only want this for reference purpose and don’t want anyone to use it for anything, Open Source isn’t the word you are looking for. What you mean is “shared source”, which means that you publish the sourcecode, but do so under “all rights reserved” conditions, which forbids people to use it for their own purpose.
The point of publishing your web site code is that people don’t have to trust you. If you publish your code as open source, then in theory they would be able to run your code privately on their web server and not rely on you. Of course this usually requires users of a certain minimum technical competence, or you would need to allow others to run your code on behalf of third parties (eg. WordPress follows this model).
If there are trust issues between you and your users, then you may want to think at a higher level. Provide some way for people to verify that the instructions they give you have actually been carried out. For example, see End-to-end auditable voting systems for an example of this sort of thing.
You cannot prove that your server is running the code you have released. Therefor you also cannot prove that someone else is running the code you have released so you will have a difficult time stopping your competitors no matter what license you use.
The point of open source is that 3rd parties can deploy your code for their own purposes and then relay bug fixes and additional features back into the original project. Releasing the source code and declaring it open source will not magically make your system bugfree or secure if no one bothers looking at the code.
In a nut shell, releasing the source code but not letting anyone else use it is not what open source is about.