7 ms·

Nutanix Objects violates MinIO’s open source license

425 points by gaul 4y ago

chris_wot 4y ago
Nutanix makes a big song and dance about their ethics. https://www.nutanix.com/viewer?type=pdf&path=/content/dam/nutanix/documents/company/doc-nutanix-code-of-business-conduct-and-ethics.pdf https://www.nutanix.com/viewer?type=pdf&path=/content/dam/nu... Looks like it's just there for show.
- garettmd 4y ago
  I mean, to be fair, having a Code of [Conduct|Ethics] is table-stakes for any company smaller than a small startup. This is far from a song and dance, but just checking off a box.
  - chris_wot 4y ago
    They seem to do a lot of box-ticking.
deleted 4y ago
[deleted]
oigursh 4y ago
Open and shut case. Disappointing that the Nutanix engineers care so little about their peers.
- sithadmin 4y ago
  If you think this is bad, you should see how their sales and marketing departments behave.
- tut-urut-utut 4y ago
  Please don't blame engineers on every single issue. The engineer may not even know there's an issue here. They may be assured by their boss or legal department that they are in the clear. They may not even think about such mundane things like licensing and stuff, that's what they have higher ups for. If someone is to blame, then it's the company leadership and legal department. As much as we want to make us engineers more important than we are, we are not decision makers. Blame should be put where it belongs.
  - bregma 4y ago
    "I was just following orders" is not considered a legitimate excuse. The engineers have agency and should be considered a "reasonable person".
    - Aeolun 4y ago
      As soon as doing morally questionable things becomes illegal I think you’ll find that a lot more people are willing to take a stand.
  - phphphphp 4y ago
    Software engineers are in a position of great privilege: if we can’t hold ourselves to account, what are we doing? Almost any software engineer put in a difficult position can get up and walk into another job — “it’s not my decision” is not an acceptable excuse for (almost any) software engineer. Blame lies with those who are complicit by choice, just as much as those who are directing the behaviour.
  - dvfjsdhgfv 4y ago
    > They may not even think about such mundane things like licensing and stuff, that's what they have higher ups for. Oh, come on. Engineers these days are not stupid. While I agree that their boss could plainly lie to them that he bought a commercial license, it was more like, "What will we use for the underlying storage?" "Maybe MiniIO, they're S3-compatible and efficient." "Fine. Can we use their code, though?" "Sure, it's open source, and we are a *aaS business, so no problem." I saw this kind of thinking before.
  - pid-1 4y ago
    > They may not even think about such mundane things like licensing and stuff Imagine a medical doctor or civil engineer claiming that knowing the laws of their professions is "mudane". That's why no one takes programers seriously. > we are not decision makers. You totally can decide to not work on stuff you are not comfortable with. It's not like there's a shortage of software engineering jobs.
    - 4y ago
bradwood 4y ago
They use a load of other FOSS software under the hood too, not least of which libvirt/KVM. I wonder how many other licences they're violating this way.
- lsbehe 4y ago
  libvirt uses LGPL and the KVM/linux kernel uses GPL. Both are fine to keep to yourself if you run it on your own machine and only expose it over the network. MinIO uses AGPL which explicitly includes network usage so Nutanix is forced to provide all patches and associated code.
  - mbreese 4y ago
    Recent versions of MinIO use AGPL. Much of what they talk about here are issues with Apache licensed code. (The switch happened in April 2021). https://github.com/minio/minio/commits/master/LICENSE https://github.com/minio/minio/commits/master/LICENSE This really seems like Nutanix just didn’t include the MinIO NOTICES file in their OSS disclosures for some reason. Something so minor should have been an easy oversight to fix. Without actually testing out Nutanix, it’s hard to know if they are actually violating this part of the Apache license. MinIO isn’t included in their “open source packages we use” webpage, but that’s not where the NOTICES message would need to be included. Either way, it’s odd that things escalated like this. The newer AGPL versions of MinIO would offer its own licensing challenge for Nutanix (which is part of the reason for the switch to AGPL). But that’s not even what MinIO is focusing on in their post. MinIO also don’t show the version of their software that they claim Nutanix is using. And it’s very possible that Nutanix froze the minio version in April 2021 (quite likely the case).
  - kaladin-jasnah 4y ago
    Nutanix distributes their AHV hypervisor to clients so the GPL would apply, I think.
- AtlasBarfed 4y ago
  Wasn't nutanix using cassandra "modified" for some SAN product almost 10 years ago?
jarym 4y ago
Kudos for MinIO team for spending THREE YEARS trying to resolve this. Shame that they had to resort to a public naming and shaming but sometimes corporate entities are tone deaf. Now this is exposed the next question is if Nutanix Objects is just a MinIO wrapper then what value are they even proving here?
- bayesian_horse 4y ago
  That also means Nutanix is pretty sure they are covered, legally.
  - cpach 4y ago
    I don’t follow. What case would they have to not follow the AGPL…?
    - mbreese 4y ago
      Who said this is the AGPL version of MinIO? It was only a little over a year ago that they changed from Apache to AGPL. MinIO wrote that they only suspected an AGPL violation. Most their accusation was focused on the Apache license. There would still need to be an acknowledgment from the NOTICES file, but that’s it.
      - deleted 4y ago
        [deleted]
    - bayesian_horse 4y ago
      I don't know. But they have been thoroughly informed of the issue and have not acted. Thus I conclude they most likely feel they don't need to act.
stevewatson301 4y ago
You'd think Nutanix would have the brains to change the names of the deployed binaries, which brings up an interesting question. How do you detect license violation if the violator has replaced the brand name across the codebase?
- pabs3 4y ago
  Patterns of strings, function names, other symbols and the entire call graph usually show up in the compiled binary, unless they apply some sort of obfuscator to the process.
- corobo 4y ago
  I'd imagine without further obfuscation a visual diff would be quite telling in that situation
- vlovich123 4y ago
  Alternate interpretation: Nutanix is fully compliant with the terms of Apache 2 and refused to be extorted into paying MinIO money. The press release is high on FUD (can’t revoke an irrevocable license, no evidence presented they have deployed the AGPLv3 version) and low on details why it took them three years to issue a press release when an injunction would have been granted pretty quick if Nutanix were truly in violation of the Apache license. I don’t claim to know the details but I do know a little bit the rights under Apache2 and (unless my understanding is incorrect) MinIO’s claims are baffling.
  - deleted 4y ago
    [deleted]
pabs3 4y ago
Will revoking their license stop Nutanix from using MinIO or will they have to go to court to get them to stop? I don't see any mention of a lawsuit in the post.
- firstSpeaker 4y ago
  Same question here, what would be the next step.
- omginternets 4y ago
  My intuition is that they're escalating progressively. Threats and lawsuits, as a general rule, make it more difficult to reach an amicable resolution. I'm inclined to interpret MinIO's response as a mature and prudent one.
- Jolter 4y ago
  First, revoke the license. That means they are no longer permitted to redistribute the code. If they then continue to redistribute it, they are committing a copyright violation. That’s when there is cause for a lawsuit.
  - ticviking 4y ago
    More than that, they've been given notice, and are willfully distributing it. There's all kinds of specific legal teeth for that behavior.
    - Jolter 4y ago
      It wouldn’t really be a (useful) revocation of the license if they were not legally notified.
  - bayesian_horse 4y ago
    They aren't redistributing it at all, only using it.
    - 4y ago
henvic 4y ago
Any recommendations on MinIO forks or open-source alternatives with more welcoming licenses? They changed their license from Apache recently. https://en.wikipedia.org/wiki/MinIO#Re-licensing https://en.wikipedia.org/wiki/MinIO#Re-licensing
- dikei 4y ago
  There are quite a few Storage projects out there with a S3-compatible API storage, that can be used in place of Minio such as Ceph, Openstack Swift, SeaweedFS, etc.. Of course, they all differ in subtle ways, so you have to try for yourself.
  - acatton 4y ago
    The CNCF maintains a list of closed and opensource container-friendly storage backends: https://landscape.cncf.io/card-mode?category=cloud-native-storage&grouping=category https://landscape.cncf.io/card-mode?category=cloud-native-st...
  - neverartful 4y ago
    No one in their right mind would attempt to use Ceph in place of MinIO. Yes, Ceph can provide S3 compliant object storage via the RadosGW, but the effort and footprint is not worth it for MinIO use cases. On the other hand, OpenStack Swift's all-in-one (typically used by developers) could easily be a replacement of MinIO.
    - monkius90s 4y ago
      I admit personal bias, but that's no longer the only way to deploy Ceph object storage these days. (And full-blown Ceph is rather good when you in fact require resilience and very large scale.)
- acatton 4y ago
  How is the AGPL not welcoming?[1] [1] https://drewdevault.com/2020/07/27/Anti-AGPL-propaganda.html https://drewdevault.com/2020/07/27/Anti-AGPL-propaganda.html
dvfjsdhgfv 4y ago
I wonder why these folks keep doing this. Do they believe nobody will find out? Or that even if they find out, they won't have to pay much so they factor it in? It's really hard to imagine for me.
KronisLV 4y ago
Sometimes it's pretty cut and dry, just people using open source without attribution and hoping that nobody will find out. But why? MinIO is licensed under AGPL (the current versions, at least): https://github.com/minio/minio/blob/master/LICENSE https://github.com/minio/minio/blob/master/LICENSE It effectively mandates that the modified version needs to be made available: https://en.wikipedia.org/wiki/GNU_Affero_General_Public_License https://en.wikipedia.org/wiki/GNU_Affero_General_Public_Lice... The GNU Affero General Public License is a modified version of the ordinary GNU GPL version 3. It has one added requirement: if you run a modified program on a server and let other users communicate with it there, your server must also allow them to download the source code corresponding to the modified version running there. So the logical first question is: why pick software that is using AGPL? Did the engineers/managers just not care? Did they miss it? I know for a fact that there are many out there who couldn't care less about licenses and compliance. Maybe companies haven't been strong armed into caring about licensing as much as they have been in regards to GDPR, for example? Secondly, why should the modified version remain a "secret"? Would competition suddenly spring up? Or maybe the project contains tight coupling to the rest of the platform, which could be considered a security risk? Why isn't open sourcing a modified version something that would take a few hours anyways, since then none of this would be an issue? (disclaimer: I discuss SSPL below because I find it interesting; apologies for the tangent) Honestly, the state of software licensing sometimes puzzles me. For example, MongoDB switched over to SSPL altogether: https://www.mongodb.com/community/licensing https://www.mongodb.com/community/licensing If you make the functionality of the Program or a modified version available to third parties as a service, you must make the Service Source Code available via network download to everyone at no charge, under the terms of this License. ... Seems like that applies to even patches: https://github.com/mongodb/mongo https://github.com/mongodb/mongo MongoDB is free and the source is available. Versions released prior to October 16, 2018 are published under the AGPL. All versions released after October 16, 2018, including patch fixes for prior versions, are published under the Server Side Public License (SSPL) v1. See individual files for details. DigitalOcean, for example, proudly advertises managed MongoDB as a service: https://www.digitalocean.com/products/managed-databases-mongodb https://www.digitalocean.com/products/managed-databases-mong... And yet, to the best of my understanding, the entirety of the DigitalOcean platform isn't open source (even though many projects are): https://github.com/orgs/digitalocean/repositories https://github.com/orgs/digitalocean/repositories Or even anything that might have something to do with MongoDB in particular: https://github.com/orgs/digitalocean/repositories?q=mongo&type=all&language=&sort= https://github.com/orgs/digitalocean/repositories?q=mongo&ty... It just feels like one of those "rules for thee, not for me" situations, since it wouldn't be feasible for small companies to compete with them. Edit: someone mentioned them probably running the enterprise version which is probably the explanation for this! That said, the thought experiment of building a company (including all systems) as 100% open source is really interesting, whether such a thing would be feasible if people stopped caring about "guarding" their IP and whatnot.
js4ever 4y ago
MinIO is a fantastic tech and they seemed to be really patient to resolve this issue (waiting 3 years before doing actions). I'll continue to use them and recommend them everywhere I work. They really deserve respect... And to be paid for their hard work.
- throwauua 4y ago
  I'd like to hear Nutanix side of this story before sliding with one party. Awaiting for blog post from them :P Until then here is my spicy story: - In 2019: Minio Sales contacted Nutanix (like this user mentioned https://news.ycombinator.com/item?id=32152645 https://news.ycombinator.com/item?id=32152645) hoping for a nice big cheque. - 2019-2021: Nutanix cites Apache-2 license and refused to pay. - 2021: Minio changed its license to AGPL (probably few others like Nutanix) - 2021: Nutanix knows this and refuses to use AGPL version with their product. - 2022: Discussion went on for another year and nothing came out from Nutanix. - Now: Minio decided to publicly shame the company.
  - deleted 4y ago
    [deleted]
  - throwoutway 4y ago
    Do you work for Nutanix? Why the brand new account for this? And then referencing another throwaway user that says they work there
  - flatsix 4y ago
    I worked on Objects at Nutanix for the last ~12 months. Nutanix had originally used the API server in MinIO to translate between the S3 REST API and internal RPCs. MinIO's claim on this blog post that "Nutanix Objects is built around MinIO object storage" is a gross exaggeration. By the time I joined in June 2021, MinIO was deprecated and we were using an in-house S3 REST API server. I am skeptical that any of the APGL code was distributed because we just weren't using it around the time that MinIO changed from Apache to AGPL.
  - variant 4y ago
debarshri 4y ago
Around 2019, a lot of kubernetes distributions started popping up. They often bundle various open source solutions into one platform/PaaS and sell it to the end users. I wonder, - What are the consequences for these companies? - Do they share revenue with the open source projects? - Can they simply distribute these services without any consequences? - If not, When and How does a small open source project org enforce track and their license?
- ghaff 4y ago
  Note that projects in the cloud native space are mostly Apache-licensed. (For example, the CNCF only approves other licenses on an exception basis I believe.) In that case, so long as attributions/trademarks are honored (which oddly seems to not have been the case here), projects licensed in that way can be freely used with Kubernetes without other restrictions.
  - debarshri 4y ago
    Could you elaborate what free distribution mean? Often these platforms have enterprise license. Does that mean it is not free?
    - bad416f1f5a2 4y ago
      > Often these platforms have enterprise license. Does that mean it is not free? There’s way too much nuance to give a clear answer without something being wrong. Give an example?
      - debarshri 4y ago
        For instance, let say there is a platform xyz platform that is an abstraction on rancher to deploy kubernetes, that also deploys the grafana, prometheus, loki, cilium etc. But now, the owners of platform xyz says it is 5k a month for enterprise license of this abstraction. But users may or may not realise that they are using all the tools I have listed. Does that mean, the owners of the platform to have to pay the other platforms? Another question is, can anyone just decide to offer commercial version of any opensource project? Is there any kind of license that protects the interest of opensource developers.
btdmaster 4y ago
Can you revoke an Apache-2.0 copyright license? The terms say irrevocable, though it stipulates respecting the terms and conditions: "2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form."
- vlovich123 4y ago
  Apache also doesn’t require you to share source code. Just because a company publishes their code under an OSS license doesn’t automatically make them the good guys and unless there’s some critical context it seems like pure FUD. Afaik Apache only requires you to maintain the copyright when distributing in source form (ie you don’t need to mention the license in binary form) but I’m not a lawyer and maybe misread. The license is certainly irrevocable and patent indemnifying provided you don’t violate it. You can’t both try to engender good will by releasing your code as OSS and then simultaneously going after someone who would seem to be complying with the terms with FUD. To see the FUD most clearly: > and we believe they may also be in violation of the GNU AGPL v3 versions of MinIO If that were the case you’d actually be in a court of law enforcing the license rather than trying to sway any kind of public opinion. This almost certainly stems from their switch to AGPLv3 to ensure that cloud providers can’t use it as part of their own offering. That’s fair but also provides context on motivation.
  - btdmaster 4y ago
    > The license is certainly irrevocable and patent indemnifying provided you don’t violate it. That's essentially what I find contentious, is whether "subject to the terms and conditions of this license" it is irrevocable or it is irrevocable irrespective of whether the terms of the license are being violated. With its phrasing I assumed it's the latter.
    - vlovich123 4y ago
bastardoperator 4y ago
I'm shocked anyone would buy something from Nutanix.
- robinsoh 4y ago
  > I'm shocked anyone would buy something from Nutanix. Why? The alternative competitors like VMware are better? I'm not up to date on the details but perhaps you may want to elaborate. Thanks. http://techrights.org/2020/04/28/openwashing-vmware-after-gpl-abuses/ http://techrights.org/2020/04/28/openwashing-vmware-after-gp... https://sfconservancy.org/copyleft-compliance/vmware-lawsuit-faq.html https://sfconservancy.org/copyleft-compliance/vmware-lawsuit...
  - dpedu 4y ago
    > VMware Announces Plans to Remove Non-complying Code, Hellwig Decides Not to Appeal
- nisegami 4y ago
  We apparently use it at work, which is all I needed to know to determine that it's awful.
dna_polymerase 4y ago
For those wondering what Nutanix is and does: Nutanix is an app that teaches you how to be a castrato and preserve a high pitched singing voice. https://www.youtube.com/watch?v=iGQfzl1KZmM https://www.youtube.com/watch?v=iGQfzl1KZmM
manictothemax 4y ago
Nutanix Objects does not use minio in the core data path. The presence of a binary in a kubernetes pod doesn't necessarily mean that the binary is being used or the fact that nutanix objects is nothing but a wrapper over minio. Earlier implementations did use minio purely as a S3 protocol adapter, i.e a protocol translator from S3 API to Nutanix internal storage protocol. This was something that was publicly acknowledged : https://blocksandfiles.com/2019/11/07/nutanix-objects-storage-service/ https://blocksandfiles.com/2019/11/07/nutanix-objects-storag... However, in later releases they seemed to have replaced the minio based protocol adapter to something that they developed in-house in C++ and have no longer using minio in their protocol stack.
- GK1981 4y ago
  ROFL if you see block and files as the official disclosure fron Nutanix is a great testament of how that company is run :) Try getting their OSD file and see if MinIO is listed :)
- jonhohle 4y ago
  Whether they use it or not is irrelevant if they are distributing it.
  - mbreese 4y ago
    It would make it easier to remove though… which makes it even more odd that it is still there even after the three years of notice.
  - manictothemax 4y ago
    Seems like an oversight that the binary got shipped with the pods
    - jaywalk 4y ago
      It could have been an oversight initially. But three years later? Impossible to claim ignorance now.
    - deleted 4y ago
throwaway48423 4y ago
our organization was using Minio as an external S3 replacement and had contacted their sales once. When a decision was made to not go for the paid plan, we were legally threatened saying that we cannot even make remote calls to a AGPL software.
- kevingadd 4y ago
  That's kind of the point of the AGPL
  - throwaway48423 4y ago
    For a system that is a providing an object storage service how else are you going to use it? We had started using it when it was Apache2 and then we got stuck. Might as well just make it into a paid product/service and not play the open source card and earn creds from community.
    - ajayyy 4y ago
      If you are naking open source software, you can use minio for free, otherwise you have to pay them money. If it was proprietary, that would not be the case You also are free to study and learn from the code
throwauua 4y ago
Strange. You spent THREE YEARS in discussion with Nutanix and still say > we believe they may also be in violation of the GNU AGPL v3 versions of MinIO. `may also be`? you are not even 100% sure whether they are using your AGPL v3 version? I have no clue, what the heck you were discussing for 3 years. Moving from Apache-2.0 to AGPLv3 is a clear trap for those who use Minio as part of their commercial offering. With AGPLV3 one need to "disclose your source code" where as its not required with Apache-2. If you started your "Open source" project with AGPL it is a different thing but to start the project under Apache-2 and few years later introducing AGPLv3 is kind of lame and unethical, IMHO. https://github.com/minio/minio/discussions/12156 https://github.com/minio/minio/discussions/12156

425 points by gaul 4y ago

Nutanix makes a big song and dance about their ethics. https://www.nutanix.com/viewer?type=pdf&path=/content/dam/nutanix/documents/company/doc-nutanix-code-of-business-conduct-and-ethics.pdf https://www.nutanix.com/viewer?type=pdf&path=/content/dam/nu... Looks like it's just there for show.

garettmd 4y ago
I mean, to be fair, having a Code of [Conduct|Ethics] is table-stakes for any company smaller than a small startup. This is far from a song and dance, but just checking off a box.
- chris_wot 4y ago
  They seem to do a lot of box-ticking.

deleted 4y ago

[deleted]

oigursh 4y ago

Open and shut case. Disappointing that the Nutanix engineers care so little about their peers.

sithadmin 4y ago
If you think this is bad, you should see how their sales and marketing departments behave.
tut-urut-utut 4y ago
Please don't blame engineers on every single issue. The engineer may not even know there's an issue here. They may be assured by their boss or legal department that they are in the clear. They may not even think about such mundane things like licensing and stuff, that's what they have higher ups for. If someone is to blame, then it's the company leadership and legal department. As much as we want to make us engineers more important than we are, we are not decision makers. Blame should be put where it belongs.
- bregma 4y ago
  "I was just following orders" is not considered a legitimate excuse. The engineers have agency and should be considered a "reasonable person".
  - Aeolun 4y ago
    As soon as doing morally questionable things becomes illegal I think you’ll find that a lot more people are willing to take a stand.
- phphphphp 4y ago
  Software engineers are in a position of great privilege: if we can’t hold ourselves to account, what are we doing? Almost any software engineer put in a difficult position can get up and walk into another job — “it’s not my decision” is not an acceptable excuse for (almost any) software engineer. Blame lies with those who are complicit by choice, just as much as those who are directing the behaviour.
- dvfjsdhgfv 4y ago
  > They may not even think about such mundane things like licensing and stuff, that's what they have higher ups for. Oh, come on. Engineers these days are not stupid. While I agree that their boss could plainly lie to them that he bought a commercial license, it was more like, "What will we use for the underlying storage?" "Maybe MiniIO, they're S3-compatible and efficient." "Fine. Can we use their code, though?" "Sure, it's open source, and we are a *aaS business, so no problem." I saw this kind of thinking before.
- pid-1 4y ago
  > They may not even think about such mundane things like licensing and stuff Imagine a medical doctor or civil engineer claiming that knowing the laws of their professions is "mudane". That's why no one takes programers seriously. > we are not decision makers. You totally can decide to not work on stuff you are not comfortable with. It's not like there's a shortage of software engineering jobs.
  - 4y ago

bradwood 4y ago

They use a load of other FOSS software under the hood too, not least of which libvirt/KVM. I wonder how many other licences they're violating this way.

lsbehe 4y ago
libvirt uses LGPL and the KVM/linux kernel uses GPL. Both are fine to keep to yourself if you run it on your own machine and only expose it over the network. MinIO uses AGPL which explicitly includes network usage so Nutanix is forced to provide all patches and associated code.
- mbreese 4y ago
  Recent versions of MinIO use AGPL. Much of what they talk about here are issues with Apache licensed code. (The switch happened in April 2021). https://github.com/minio/minio/commits/master/LICENSE https://github.com/minio/minio/commits/master/LICENSE This really seems like Nutanix just didn’t include the MinIO NOTICES file in their OSS disclosures for some reason. Something so minor should have been an easy oversight to fix. Without actually testing out Nutanix, it’s hard to know if they are actually violating this part of the Apache license. MinIO isn’t included in their “open source packages we use” webpage, but that’s not where the NOTICES message would need to be included. Either way, it’s odd that things escalated like this. The newer AGPL versions of MinIO would offer its own licensing challenge for Nutanix (which is part of the reason for the switch to AGPL). But that’s not even what MinIO is focusing on in their post. MinIO also don’t show the version of their software that they claim Nutanix is using. And it’s very possible that Nutanix froze the minio version in April 2021 (quite likely the case).
- kaladin-jasnah 4y ago
  Nutanix distributes their AHV hypervisor to clients so the GPL would apply, I think.
AtlasBarfed 4y ago
Wasn't nutanix using cassandra "modified" for some SAN product almost 10 years ago?

jarym 4y ago

Kudos for MinIO team for spending THREE YEARS trying to resolve this. Shame that they had to resort to a public naming and shaming but sometimes corporate entities are tone deaf. Now this is exposed the next question is if Nutanix Objects is just a MinIO wrapper then what value are they even proving here?

bayesian_horse 4y ago
That also means Nutanix is pretty sure they are covered, legally.
- cpach 4y ago
  I don’t follow. What case would they have to not follow the AGPL…?
  - mbreese 4y ago
    Who said this is the AGPL version of MinIO? It was only a little over a year ago that they changed from Apache to AGPL. MinIO wrote that they only suspected an AGPL violation. Most their accusation was focused on the Apache license. There would still need to be an acknowledgment from the NOTICES file, but that’s it.
    - deleted 4y ago
      [deleted]
  - bayesian_horse 4y ago
    I don't know. But they have been thoroughly informed of the issue and have not acted. Thus I conclude they most likely feel they don't need to act.

stevewatson301 4y ago

You'd think Nutanix would have the brains to change the names of the deployed binaries, which brings up an interesting question. How do you detect license violation if the violator has replaced the brand name across the codebase?

pabs3 4y ago
Patterns of strings, function names, other symbols and the entire call graph usually show up in the compiled binary, unless they apply some sort of obfuscator to the process.
corobo 4y ago
I'd imagine without further obfuscation a visual diff would be quite telling in that situation
vlovich123 4y ago
Alternate interpretation: Nutanix is fully compliant with the terms of Apache 2 and refused to be extorted into paying MinIO money. The press release is high on FUD (can’t revoke an irrevocable license, no evidence presented they have deployed the AGPLv3 version) and low on details why it took them three years to issue a press release when an injunction would have been granted pretty quick if Nutanix were truly in violation of the Apache license. I don’t claim to know the details but I do know a little bit the rights under Apache2 and (unless my understanding is incorrect) MinIO’s claims are baffling.
- deleted 4y ago
  [deleted]

pabs3 4y ago

Will revoking their license stop Nutanix from using MinIO or will they have to go to court to get them to stop? I don't see any mention of a lawsuit in the post.

firstSpeaker 4y ago
Same question here, what would be the next step.
omginternets 4y ago
My intuition is that they're escalating progressively. Threats and lawsuits, as a general rule, make it more difficult to reach an amicable resolution. I'm inclined to interpret MinIO's response as a mature and prudent one.
Jolter 4y ago
First, revoke the license. That means they are no longer permitted to redistribute the code. If they then continue to redistribute it, they are committing a copyright violation. That’s when there is cause for a lawsuit.
- ticviking 4y ago
  More than that, they've been given notice, and are willfully distributing it. There's all kinds of specific legal teeth for that behavior.
  - Jolter 4y ago
    It wouldn’t really be a (useful) revocation of the license if they were not legally notified.
- bayesian_horse 4y ago
  They aren't redistributing it at all, only using it.
  - 4y ago

henvic 4y ago

Any recommendations on MinIO forks or open-source alternatives with more welcoming licenses? They changed their license from Apache recently. https://en.wikipedia.org/wiki/MinIO#Re-licensing https://en.wikipedia.org/wiki/MinIO#Re-licensing

dikei 4y ago
There are quite a few Storage projects out there with a S3-compatible API storage, that can be used in place of Minio such as Ceph, Openstack Swift, SeaweedFS, etc.. Of course, they all differ in subtle ways, so you have to try for yourself.
- acatton 4y ago
  The CNCF maintains a list of closed and opensource container-friendly storage backends: https://landscape.cncf.io/card-mode?category=cloud-native-storage&grouping=category https://landscape.cncf.io/card-mode?category=cloud-native-st...
- neverartful 4y ago
  No one in their right mind would attempt to use Ceph in place of MinIO. Yes, Ceph can provide S3 compliant object storage via the RadosGW, but the effort and footprint is not worth it for MinIO use cases. On the other hand, OpenStack Swift's all-in-one (typically used by developers) could easily be a replacement of MinIO.
  - monkius90s 4y ago
    I admit personal bias, but that's no longer the only way to deploy Ceph object storage these days. (And full-blown Ceph is rather good when you in fact require resilience and very large scale.)
acatton 4y ago
How is the AGPL not welcoming?[1] [1] https://drewdevault.com/2020/07/27/Anti-AGPL-propaganda.html https://drewdevault.com/2020/07/27/Anti-AGPL-propaganda.html

dvfjsdhgfv 4y ago

I wonder why these folks keep doing this. Do they believe nobody will find out? Or that even if they find out, they won't have to pay much so they factor it in? It's really hard to imagine for me.

KronisLV 4y ago

Sometimes it's pretty cut and dry, just people using open source without attribution and hoping that nobody will find out. But why? MinIO is licensed under AGPL (the current versions, at least): https://github.com/minio/minio/blob/master/LICENSE https://github.com/minio/minio/blob/master/LICENSE It effectively mandates that the modified version needs to be made available: https://en.wikipedia.org/wiki/GNU_Affero_General_Public_License https://en.wikipedia.org/wiki/GNU_Affero_General_Public_Lice... The GNU Affero General Public License is a modified version of the ordinary GNU GPL version 3. It has one added requirement: if you run a modified program on a server and let other users communicate with it there, your server must also allow them to download the source code corresponding to the modified version running there. So the logical first question is: why pick software that is using AGPL? Did the engineers/managers just not care? Did they miss it? I know for a fact that there are many out there who couldn't care less about licenses and compliance. Maybe companies haven't been strong armed into caring about licensing as much as they have been in regards to GDPR, for example? Secondly, why should the modified version remain a "secret"? Would competition suddenly spring up? Or maybe the project contains tight coupling to the rest of the platform, which could be considered a security risk? Why isn't open sourcing a modified version something that would take a few hours anyways, since then none of this would be an issue? (disclaimer: I discuss SSPL below because I find it interesting; apologies for the tangent) Honestly, the state of software licensing sometimes puzzles me. For example, MongoDB switched over to SSPL altogether: https://www.mongodb.com/community/licensing https://www.mongodb.com/community/licensing If you make the functionality of the Program or a modified version available to third parties as a service, you must make the Service Source Code available via network download to everyone at no charge, under the terms of this License. ... Seems like that applies to even patches: https://github.com/mongodb/mongo https://github.com/mongodb/mongo MongoDB is free and the source is available. Versions released prior to October 16, 2018 are published under the AGPL. All versions released after October 16, 2018, including patch fixes for prior versions, are published under the Server Side Public License (SSPL) v1. See individual files for details. DigitalOcean, for example, proudly advertises managed MongoDB as a service: https://www.digitalocean.com/products/managed-databases-mongodb https://www.digitalocean.com/products/managed-databases-mong... And yet, to the best of my understanding, the entirety of the DigitalOcean platform isn't open source (even though many projects are): https://github.com/orgs/digitalocean/repositories https://github.com/orgs/digitalocean/repositories Or even anything that might have something to do with MongoDB in particular: https://github.com/orgs/digitalocean/repositories?q=mongo&type=all&language=&sort= https://github.com/orgs/digitalocean/repositories?q=mongo&ty... It just feels like one of those "rules for thee, not for me" situations, since it wouldn't be feasible for small companies to compete with them. Edit: someone mentioned them probably running the enterprise version which is probably the explanation for this! That said, the thought experiment of building a company (including all systems) as 100% open source is really interesting, whether such a thing would be feasible if people stopped caring about "guarding" their IP and whatnot.

js4ever 4y ago

MinIO is a fantastic tech and they seemed to be really patient to resolve this issue (waiting 3 years before doing actions). I'll continue to use them and recommend them everywhere I work. They really deserve respect... And to be paid for their hard work.

throwauua 4y ago
I'd like to hear Nutanix side of this story before sliding with one party. Awaiting for blog post from them :P Until then here is my spicy story: - In 2019: Minio Sales contacted Nutanix (like this user mentioned https://news.ycombinator.com/item?id=32152645 https://news.ycombinator.com/item?id=32152645) hoping for a nice big cheque. - 2019-2021: Nutanix cites Apache-2 license and refused to pay. - 2021: Minio changed its license to AGPL (probably few others like Nutanix) - 2021: Nutanix knows this and refuses to use AGPL version with their product. - 2022: Discussion went on for another year and nothing came out from Nutanix. - Now: Minio decided to publicly shame the company.
- deleted 4y ago
  [deleted]
- throwoutway 4y ago
  Do you work for Nutanix? Why the brand new account for this? And then referencing another throwaway user that says they work there
- flatsix 4y ago
  I worked on Objects at Nutanix for the last ~12 months. Nutanix had originally used the API server in MinIO to translate between the S3 REST API and internal RPCs. MinIO's claim on this blog post that "Nutanix Objects is built around MinIO object storage" is a gross exaggeration. By the time I joined in June 2021, MinIO was deprecated and we were using an in-house S3 REST API server. I am skeptical that any of the APGL code was distributed because we just weren't using it around the time that MinIO changed from Apache to AGPL.
- variant 4y ago

debarshri 4y ago

Around 2019, a lot of kubernetes distributions started popping up. They often bundle various open source solutions into one platform/PaaS and sell it to the end users. I wonder, - What are the consequences for these companies? - Do they share revenue with the open source projects? - Can they simply distribute these services without any consequences? - If not, When and How does a small open source project org enforce track and their license?

ghaff 4y ago
Note that projects in the cloud native space are mostly Apache-licensed. (For example, the CNCF only approves other licenses on an exception basis I believe.) In that case, so long as attributions/trademarks are honored (which oddly seems to not have been the case here), projects licensed in that way can be freely used with Kubernetes without other restrictions.
- debarshri 4y ago
  Could you elaborate what free distribution mean? Often these platforms have enterprise license. Does that mean it is not free?
  - bad416f1f5a2 4y ago
    > Often these platforms have enterprise license. Does that mean it is not free? There’s way too much nuance to give a clear answer without something being wrong. Give an example?
    - debarshri 4y ago
      For instance, let say there is a platform xyz platform that is an abstraction on rancher to deploy kubernetes, that also deploys the grafana, prometheus, loki, cilium etc. But now, the owners of platform xyz says it is 5k a month for enterprise license of this abstraction. But users may or may not realise that they are using all the tools I have listed. Does that mean, the owners of the platform to have to pay the other platforms? Another question is, can anyone just decide to offer commercial version of any opensource project? Is there any kind of license that protects the interest of opensource developers.

btdmaster 4y ago

Can you revoke an Apache-2.0 copyright license? The terms say irrevocable, though it stipulates respecting the terms and conditions: "2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form."

vlovich123 4y ago
Apache also doesn’t require you to share source code. Just because a company publishes their code under an OSS license doesn’t automatically make them the good guys and unless there’s some critical context it seems like pure FUD. Afaik Apache only requires you to maintain the copyright when distributing in source form (ie you don’t need to mention the license in binary form) but I’m not a lawyer and maybe misread. The license is certainly irrevocable and patent indemnifying provided you don’t violate it. You can’t both try to engender good will by releasing your code as OSS and then simultaneously going after someone who would seem to be complying with the terms with FUD. To see the FUD most clearly: > and we believe they may also be in violation of the GNU AGPL v3 versions of MinIO If that were the case you’d actually be in a court of law enforcing the license rather than trying to sway any kind of public opinion. This almost certainly stems from their switch to AGPLv3 to ensure that cloud providers can’t use it as part of their own offering. That’s fair but also provides context on motivation.
- btdmaster 4y ago
  > The license is certainly irrevocable and patent indemnifying provided you don’t violate it. That's essentially what I find contentious, is whether "subject to the terms and conditions of this license" it is irrevocable or it is irrevocable irrespective of whether the terms of the license are being violated. With its phrasing I assumed it's the latter.
  - vlovich123 4y ago

bastardoperator 4y ago

I'm shocked anyone would buy something from Nutanix.

robinsoh 4y ago
> I'm shocked anyone would buy something from Nutanix. Why? The alternative competitors like VMware are better? I'm not up to date on the details but perhaps you may want to elaborate. Thanks. http://techrights.org/2020/04/28/openwashing-vmware-after-gpl-abuses/ http://techrights.org/2020/04/28/openwashing-vmware-after-gp... https://sfconservancy.org/copyleft-compliance/vmware-lawsuit-faq.html https://sfconservancy.org/copyleft-compliance/vmware-lawsuit...
- dpedu 4y ago
  > VMware Announces Plans to Remove Non-complying Code, Hellwig Decides Not to Appeal
nisegami 4y ago
We apparently use it at work, which is all I needed to know to determine that it's awful.

dna_polymerase 4y ago

For those wondering what Nutanix is and does: Nutanix is an app that teaches you how to be a castrato and preserve a high pitched singing voice. https://www.youtube.com/watch?v=iGQfzl1KZmM https://www.youtube.com/watch?v=iGQfzl1KZmM

manictothemax 4y ago

Nutanix Objects does not use minio in the core data path. The presence of a binary in a kubernetes pod doesn't necessarily mean that the binary is being used or the fact that nutanix objects is nothing but a wrapper over minio. Earlier implementations did use minio purely as a S3 protocol adapter, i.e a protocol translator from S3 API to Nutanix internal storage protocol. This was something that was publicly acknowledged : https://blocksandfiles.com/2019/11/07/nutanix-objects-storage-service/ https://blocksandfiles.com/2019/11/07/nutanix-objects-storag... However, in later releases they seemed to have replaced the minio based protocol adapter to something that they developed in-house in C++ and have no longer using minio in their protocol stack.

GK1981 4y ago
ROFL if you see block and files as the official disclosure fron Nutanix is a great testament of how that company is run :) Try getting their OSD file and see if MinIO is listed :)
jonhohle 4y ago
Whether they use it or not is irrelevant if they are distributing it.
- mbreese 4y ago
  It would make it easier to remove though… which makes it even more odd that it is still there even after the three years of notice.
- manictothemax 4y ago
  Seems like an oversight that the binary got shipped with the pods
  - jaywalk 4y ago
    It could have been an oversight initially. But three years later? Impossible to claim ignorance now.
  - deleted 4y ago

throwaway48423 4y ago

our organization was using Minio as an external S3 replacement and had contacted their sales once. When a decision was made to not go for the paid plan, we were legally threatened saying that we cannot even make remote calls to a AGPL software.

kevingadd 4y ago
That's kind of the point of the AGPL
- throwaway48423 4y ago
  For a system that is a providing an object storage service how else are you going to use it? We had started using it when it was Apache2 and then we got stuck. Might as well just make it into a paid product/service and not play the open source card and earn creds from community.
  - ajayyy 4y ago
    If you are naking open source software, you can use minio for free, otherwise you have to pay them money. If it was proprietary, that would not be the case You also are free to study and learn from the code

throwauua 4y ago

Strange. You spent THREE YEARS in discussion with Nutanix and still say > we believe they may also be in violation of the GNU AGPL v3 versions of MinIO. `may also be`? you are not even 100% sure whether they are using your AGPL v3 version? I have no clue, what the heck you were discussing for 3 years. Moving from Apache-2.0 to AGPLv3 is a clear trap for those who use Minio as part of their commercial offering. With AGPLV3 one need to "disclose your source code" where as its not required with Apache-2. If you started your "Open source" project with AGPL it is a different thing but to start the project under Apache-2 and few years later introducing AGPLv3 is kind of lame and unethical, IMHO. https://github.com/minio/minio/discussions/12156 https://github.com/minio/minio/discussions/12156