10 ms·

> It’s also worth remembering that Terraform itself is built on top of multiple open source libraries and an open source ecosystem. Without the volunteer work o

by pevey 3y ago

> It’s also worth remembering that Terraform itself is built on top of multiple open source libraries and an open source ecosystem. Without the volunteer work of hundreds of unpaid individuals, HashiCorp products would not be successful, there would be no ecosystem, and the company would not exist. Hear, hear! (edited, thx) EDIT: Also, if you are contributing to open source, read carefully before submitting that PR. Do not contribute to projects that make you agree to a CLA. It's becoming more and more common for projects to include one or two lines in the README and that's it. All your code are belong to us. I don't know if that would hold up, but why contribute your time and effort?

appleflaxen 3y ago
And, if those projects had been licensed using AGPL, then Hashicorp would not be able to relicense this without negotiating a non-GPL license for themselves, first. I don't understand why GPL gets so much hate on HN.
- afiori 3y ago
  deploying AGPL software is complicated
  - orthoxerox 3y ago
    Not really, just push the tarball with sources to nginx when you deploy a specific commit.
    - sitzkrieg 3y ago
      yea this is definitely user friendly and realistic
      - jen20 3y ago
        If you make modifications, and deploy them in a way accessible to a given user, the changes must be made available to that user. I fail to see what is unrealistic about that, or indeed user-unfriendly, unless you consider the user to be the developer and not the person on the other end of the wire.
      - post-it 3y ago
        Glad you agree.
    - arlcode 3y ago
      You don't even need to do that immediatly afaik. You can wait for the first person to request the source and do it then manually (or link to the nginx github). Most likely that will never happen for most people who deploy it. After all it's a pretty good price for what you are getting in exchange.
    - yencabulator 3y ago
      There are AGPL software vendors who think making HTTP requests to their AGPL software forces you to license the client as AGPL too.
  - eatonphil 3y ago
    Why do you say that? (Or to anyone, why do people think this?) I don't know anything about AGPL.
    - chii 3y ago
      It's not complicated, unless what you intend to do when deploying AGPL software is actually to try circumvent the license in some way; e.g., you would like some proprietary modifications to be added but still comply with the AGPL requirements.
      - JamesDeansSon 3y ago
        [flagged]
  - josephcsible 3y ago
    The AGPL's extra requirements only apply if you modify the program. If you don't, then deploying it is just as easy as deploying an MIT-licensed program.
    - afiori 3y ago
      I believe that the AGPL has the same boundaries as the GPL that is if you for example run a nodejs server using a single AGPL package in your node_modules then users should be able to download the source code of your entire node app.
      - josephcsible 3y ago
        But now you're talking about using an AGPL library in your own program, rather than deploying just an AGPL-licensed program.
        afiori 3y ago
        libraries are software
        josephcsible 3y ago
        Yes, but my point is there's a difference between "just deploy their software" and "combine their software with your software and deploy the result".
        afiori 3y ago
        I agree, but for example it is not obvious whether you can deploy mixed licenses with docker-compose.
        andrewl-hn 3y ago
        When you include an AGPL library your program becomes a derivative work, so the rest of your program becomes AGPL-licensed as well. The boundaries of what part of the system should or should not be included are vague, because *GPL licenses are written with C semantics in mind. So, while having a library directly in the same running process definitely makes you work a derivative, it's not clear if you the same is true if the library is a part of a different process and your program talks to it via an IPC, a filesystem, a database, an API, etc. Depending of the interpretation you may have toped-source just a tiny part of your program running on a server, or all server-side and client-side code and all supplemental scripts, tools, etc. needed for the system to run. So, it's legally ambiguous, and since no-one has legally tested the waters the interpretation of the license can be very different, but most people prefer to stay away from AGPL code altogether.
- fractalb 3y ago
  I definitely feel GPL has its own merits. It's time people recognize that.
  - pydry 3y ago
    They do. The merits are what make FAANG angry. They want the right to profit from your work without any corresponding obligations and GPLv3, AGPL, SSPL, BPL, etc. all deny them that right.
    - josephcsible 3y ago
      It's not really about profit. The GPL doesn't restrict that. It's about wanting to leech off of the FOSS community by turning other people's FOSS code into proprietary products. By the way, the SSPL isn't free or open source, so lumping it in with the GPL and AGPL like that could easily mislead people.
  - demizer 3y ago
    My personal open source contributions will only be GPL. Damn the torpedoes! I will only contribute to lesser licenses if I am getting paid by a corp, which I do, and of course that software cannot be GPL'd.
- bombcar 3y ago
  The variously GPLs have always received hate of different kinds, and time and time again it's proven why they have the clauses they do. Reminds me of the picture of the smug cat surrounded by knives. GPL is that cat.
  - ethbr0 3y ago
    People say lawyers are assholes, but they don't think about why lawyers are assholes. It's a lawyer's job to imagine the worst future outcomes and guard against them in the present. Everybody focuses on "It's crazy you put that clause in there that was never needed," but few folks appreciate "Thank god we included that clause just in case." Which isn't to opine there's a right or wrong, only multiple parties each negotiating (skillfully or poorly) in their own interests. If you're a developer and don't want your code to slide into corporate controlled ownership... well, there are licenses for that. https://github.com/readme/guides/open-source-licensing https://github.com/readme/guides/open-source-licensing https://arstechnica.com/gadgets/2020/02/how-to-choose-an-open-source-license/ https://arstechnica.com/gadgets/2020/02/how-to-choose-an-ope...
    - deleted 3y ago
      [deleted]
    - JohnFen 3y ago
      Yes. As a rough analogy that my lawyer told me early on, lawyers are like software engineers, and the law is like the operating system. A good lawyer writes robust "code" designed to deal with edge cases and unexpected conditions gracefully.
    - kjs3 3y ago
      I think every single one of my attorneys over the years has made it clear that if something is in the contract/license/etc, you absolutely have to assume it will be enforced, to the letter. No matter how stupid, no matter how unlikely. If it's written down, it was written down for a reason. One of the worst mistakes you can make in life is believing anyone who says things like "oh, that's just boilerplate...we'd never act on it" or "don't worry, we would never enforce that" or similar. That's someone who is deliberately setting you up to get screwed.
- redeeman 3y ago
  because people prefer not to pay back, GPL and AGPL has a cost that many consider to be limiting their ability to earn money based on it, so it gets hate. its really quite simple, you're no worse off than if there were no GPL/AGPL to begin with, so just dont use it if you dont agree. I personally am very concerned with the newer trends of going away from GPL, I think its gonna turn out bad for everyone
  - chii 3y ago
    Stallman's foresight has been eerily accurate - look at what google's web environment integrity proposal to say the least. It's time the OSS community stop making free software with a loose license such that control and ownership is taken from them, and for profit to be made without any give backs.
  - sneak 3y ago
    You don't need to "pay back" for a gift. The problem is entitlement and thinking that anyone owes you anything after you have given software away to the world. It's no longer yours, there is no "back".
    - redeeman 3y ago
      but its not a gift when its GPL, its distribution under certain terms, and to complain someone chooses GPL rather than BSD is not legit
- appplication 3y ago
  GPL gets hate because it’s a self-killing license. Sure, it’s great idealism, but it just creates an incentive for any corporate interests to create either a closed source offering or a better funded competing OSS offering that can be commercialized. If some software provides value, it will eventually be monetized in some form. It makes no sense for a corporation, whose entire existence is predicated on monetization, to see GPL software and say “I guess I’ll just stop charging for our products!” Instead, the completely predictable response is “this is valuable, but I can’t use it, so I’m going to make something like it that I can actually use”. Like it or not, you cannot “hide” value from capitalism. The machine will find and extract value wherever it can. GPL establishes unrealistic ideals for software that are inconsistent with the reality of how and where it is used.
  - chii 3y ago
    > it just creates an incentive for any corporate interests to create either a closed source offering or a better funded competing OSS offering that can be commercialized. what's wrong with that? If they produce their own version, then the world now has another piece of software, and this competition is going to make the ecosystem better imho. The only problem with lenient licenses is that they allow leeching. MIT, eclipse, and apache licenses, all are basically allow free commons which others leech off as much as possible. The corps may continue to contribute, but only because they see value they could extract more than what it costs them. I would say AGPL should be the _only_ license anyone contributing to OSS should pick. And if you own the project, make it dual licensed - a commercial offering, and AGPL. If said software is good, a commercial offering can be profit generating enough fund further development.
    - appplication 3y ago
      There’s nothing wrong with that, and there’s nothing wrong with people who want to build GPL software - do what you like, consistent with your ideals. This is really only in response to the perennial “why don’t more people use GPL” questions that seem to always pop up any time software licensing is discussed. It’s fine for some people, but there’s a reason corps tend to avoid it or have internal policies against using GPL software.
- spaceribs 3y ago
  Hacker news is a mix of venture capital and technologists, the AGPL3 is a wedge between those two groups needs and objectives.
  - dilyevsky 3y ago
    For agpl specifically I believe it’s due to muddy waters surrounding the “derivative work” clause. Some companies have traditionally bent the definition (eg insinuating that api calls result in larger application fall under combined work) and it’s never been tested in court so understandably the lawyers do the lawyer thing and tell you not to use it
    - spaceribs 3y ago
      Yeah, but even stepping back there, lawyers are paid to prevent companies from entering those muddy waters as a risk to their profits. Profit isn't a concern to someone who wishes to publish open source software, in fact you could say Open Source is an inherently socialist venture (your socializing the tools/means to do something). The AGPL3 makes it more difficult for others with probably more means to profit on that work, so it's a net benefit to the folks who actually write code (and a detriment to those who would wish to exploit it).
      - dilyevsky 3y ago
        Right so as long as food and shelter is not a concern AGPL is v good license!
        spaceribs 3y ago
        Yep! I'd say 95% of open source is subsidized by those thriving rather than surviving, having the education/equipment/access/free-time to deliver open source software is a product of privilege and abundance.
    - _cenw 3y ago
      Not only some companies - API calls being linking also seems to be the opinion of the FSF.
- adrr 3y ago
  Because most startups can’t use AGPL. I had to provide audits of our licenses of libraries we use in our code base to investors and attest we didn’t have AGPL code in our code/software in our stack. This was at an e-commerce company and not a company that directly monetized software. Companies are free to choose whatever license but it will limit who can use their software.
  - _xivi 3y ago
    > I had to provide audits of our licenses of libraries we use in our code base to investors and attest we didn’t have AGPL code in our code/software in our stack. A little off topic, but how are these audits usually done? I'd like to familiarize myself Not necessarily your specific case, if there's a resource online that'd be fine
    - adrr 3y ago
      We run a script that scans our source code and generates a manifest of all included libraries including license/copyright. Here's one of them: https://github.com/nexB/scancode-toolkit https://github.com/nexB/scancode-toolkit
      - pabs3 3y ago
        There are others, but scancode is probably the best one, their license database is truly huge. https://wiki.debian.org/CopyrightReviewTools https://wiki.debian.org/CopyrightReviewTools https://scancode-licensedb.aboutcode.org/ https://scancode-licensedb.aboutcode.org/
    - __jonas 3y ago
      Fossa built a business around this: https://fossa.com/ https://fossa.com/
    - nijave 3y ago
      The less automated version is a list of requirements to the effect "list all the OSS libraries you use and their licenses" are pushed down to each team and someone spends a day or 2 going through their code base. Usually that amounts to looking at a lock/dependency file and finding the software's license online. You can also run an audit against your artifact store/cache if you have one. JFrog Artifactory has built-in tools for auditing dependencies (and can act as a pull through cache) so you can run reports that way but it can be harder to tie dependencies to what's using them. Back when I worked at Chase, it was against company policy so use 3rd party dependencies that weren't in their internal components database. Part of getting something in the components database was establishing an owner, the license, and the version (basically a paperwork/approval process). In addition, part of the deploy process was running a vulnerability check against your dependencies using some proprietary enterprise software that tracked CVEs and could (somewhat...) parse what dependencies an application was using (ideally, automatically...).
- thayne 3y ago
  They were licensed under MPL, which would have also prevented a relicense like this without the CLA. And I don't think the MPL would even prevent them from selling their commercial products.
- kj4ips 3y ago
  With the CLA in place, it doesn't matter. All contributors already gave hashicorp a broad license for everything that they don't already own, so hashicorp has license to largely do whatever regardless of what license they use to offer it to others.
  - josephcsible 3y ago
    Only the code in HashiCorp's own code is covered by the CLAs, not the code in the third-party dependencies it has. If said dependencies used copyleft licenses like (A)GPL instead of pushover licenses like MIT, that would have prevented what HashiCorp did.
  - _msw_ 3y ago
    The CLA was put in place in December of 2018 [1]. Presumably contributions made before that were under inbound=outbound terms [2], meaning the contributing author licensed their exclusive rights under MPL 2.0, which is a file-based copyleft license. (see the chart at [3]). [1] https://www.hashicorp.com/blog/introducing-a-cla https://www.hashicorp.com/blog/introducing-a-cla [2] https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#6-contributions-under-repository-license https://docs.github.com/en/site-policy/github-terms/github-t... [3] https://en.wikipedia.org/wiki/License_compatibility#Compatibility_of_FOSS_licenses https://en.wikipedia.org/wiki/License_compatibility#Compatib...
- Xylakant 3y ago
  The projects license is of no concern at all here. Licenses do not bind the owner of the code. Hashicorp required a CLA before contributing, so they own the copyright. They can change the license at any time as they see fit.
nathanielks 3y ago
...quoted from the co-founders of a closed-source company running previously open-source software. Pot calling the kettle black. Their company wouldn't exist either, this is a ridiculous statement.
- pevey 3y ago
  Quite possibly a very fair point. I don't use Terraform or Spacelift or care at all about these particular companies. I DO care about open source, and I care about BSLs and CLAs and the dilution of what open source actually means. Legal or not, it feels like bait and switch. The CLAs supposedly make it legal. They have no place in truly open source projects unless at most it is to say a license is granted to the project in perpetuity under the same license as the project is licensed at the time of the PR.
  - echelon 3y ago
    If small infrastructure companies don't do this, companies like Amazon get to suck all of the air out of the room. They reap the profits and directly compete with the company doing all the work. At scale. This is the same for database companies like Redis and Elastic. Open source has become a weapon used by the giants. This isn't about OSS anymore. It's about the largest companies in our industry setting compensation and soaking up all the profits. I'd say an IC at one of these companies deserves more than an IC at Amazon and should see outsized reward. But that's not what's happening.
    - pevey 3y ago
      I get that there are pros and cons of different licenses, and reasonable people my disagree, but this is the first time that occurred to them? This far down the road? No one forced them to be open source. They did it for certain benefits. They would have gone nowhere in the early days with this new license, most likely. I can only see these moves as bait and switch. Encourage everyone to use it, allow and maybe even encourage companies to build offerings on top of it to help with traction/mindshare... and then oh btw we changed our mind. It may be their right, but I'm glad people are talking about the implications.
that_guy_iain 3y ago
HashiCorp is successful because it solved problems for enterprise companies who were willing to pay for support. To claim it solely exists because of open source is a falsehood. Companies that can’t make money don’t exist.
- jchw 3y ago
  If open source is so unimportant to the success of these companies, then why would they do it? This is an unsupported assertion at best. It's clear where Terraform et al. are now that they don't need to be open source (hence why they are switching off of open source licenses without fear) but what is not well-supported by any evidence is that it would've gone the same way if it had started as shared source or closed source.
  - echelon 3y ago
    Amazon is able to make use of open source and keep all the benefits private. By holding smaller companies to this OSS purity yardstick, we're allowing the Amazons of the world to clone them wholesale and reap all of the benefits. The world needs more small companies, not big ones. This is the right way for small companies to protect themselves.
    - thinkmassive 3y ago
      What about AGPL? That’s pure Free Software, and it would require Amazon to publish their changes or not offer the service. In reality they would probably choose the latter.
    - jchw 3y ago
      Apart from mirroring the sentiments of the neighboring comment regarding AGPL, that is not really the point. Companies are more than welcome to choose what things they want to open source or not open source, it's just that this stupid magic trick of "Now it's open, now it's not" is fooling people who choose software based on the ideals of open source software so that 1. foolish contributors can contribute to just another closed/shared source enterprise products for free, even if the work of outside contributors are small 2. they can ratchet up the ladder, going from attracting smaller players and open source companies all the way to enterprise customers, making you wonder if it was their plan all along, to just deceive you. I don't have the same complaints about many open source business models, because they do not involve deception. If you contribute to Gitlab CE, it is still properly open source even if it may benefit Gitlab EE customers. BSL is not an open source license though, so Terraform is no longer an open source project. Does that matter to enterprises? Nope. Does that matter to me? I think you know the answer to that. But it's yet another harsh lesson that you should never, ever sign a CLA outside of stuff you contribute as a result of your job. If you ever sign a CLA for work you're not being paid for, you're clearly getting scammed in slow motion. And if abusing the goodwill that comes with open source (or maybe came with, at this point, since now we all see where this is headed from here on out) is the only way for not every company to be Amazon, maybe there's some much larger problem going on there.
deleted 3y ago
[deleted]
michaelmior 3y ago
I have no problem with agreeing to a CLA. If I've decided to contribute to a project, it's because I think I can add value. If later, the project decides to relicense, I might not like the decision, but I wouldn't regret my past contributions. Even if you disagree with some of these points, it really depends on the CLA. Some CLAs allow the contributor to retain copyright and also restrict relicensing.
- CameronNemo 3y ago
  Sure, but the most common use case for a CLA is to allow a company to take your contributions and use them as proprietary software. Some aren't a terrible idea, but my instinct is to close the tab when I am asked to sign a CLA.
  - Terretta 3y ago
    Are you getting value from the product? Would you appreciate being able to tell their product manager you need a feature and see it shipped? Would you appreciate time with their engineering team suggesting how to implement the feature so it works for your use case? Would you value the feature working precisely as you need it to, with no misinterpretation? Then sign the CLA and value this vendor offers business-source as a shortcut for you and them to understand and ship your needs, when most vendors don't. It's a literal win win. (The only time not to sign is if you would prefer a competitor to the vendor, or want to compete yourself. Then go talk to that competitor instead, or make the first commit to your own repo.)
codexb 3y ago
CLA's are common on projects with corporate contributions because they prevent open source from being accused of stealing IP. You need to sign a CLA to contribute to linux for example, and there are separate CLA's for users and for companies.
- CameronNemo 3y ago
  Where are you getting this information? Linux has a DCO-requirement, but AFAIK there is no CLA. Signed-off-by: someone who has a recent commit in the kernel and did not sign a CLA.
mholt 3y ago
> Do not contribute to projects that make you agree to a CLA. There's nothing wrong with a CLA's existence, it just depends what it says. For example, the Caddy CLA [0] is borrowed from The Linux Foundation, and it basically says you either made the change originally, or have the rights to share the contribution, and that this goes into a public record and will be redistributed. [0]: https://cla-assistant.io/caddyserver/caddy https://cla-assistant.io/caddyserver/caddy
- CameronNemo 3y ago
  A DCO is a lot lighter than a full CLA.
spenczar5 3y ago
> Do not contribute to projects that make you agree to a CLA. So you think no one should contribute to the Linux Foundation’s projects? This is absurd. CLAs are not evil on their own, only their contents could be objectionable.
- rwmj 3y ago
  It would be more accurate to say copyright assignment is problematic, rather than CLAs in general, since as you say some CLAs are just about ensuring that you have permission (eg from your employer) to contribute to the project.
  - CameronNemo 3y ago
    You can do that with a DCO without needing to use a CLA. CLAs generally exist to give the company permission to relicense, including as proprietary.
comprev 3y ago
For some people having a PR accepted by $COMPANY is a great boost for their CV. Not everyone will be doing it for the love of building software.
nijave 3y ago
>but why contribute your time and effort? From a business context it can frequently be cheaper to fix OSS (or source-available software) than pay someone in-house to write something equivalent or pay for equivalent commercial software. If you're being paid by your employer to complete a task on company time, that task uses Terraform and you encounter a Terraform bug, it seems reasonable to create a fix for it. It gets even hairier when you consider a lot of commercial products push Terraform support (in house created providers) as a feature. I could be getting paid by Company A to implement and maintain software written by Company B where part of the implementation uses a reference architecture or install template written in Terraform. On the other hand, I'm more reluctant to use those sorts of tools/contribute on my own time.
jeffnappi 3y ago
This may be true, but as someone who contributed to a Terraform provider - HashiCorp did a vast amount of legwork to build impressive tooling and process to make contributing easy and get contributions merged quickly. No easy feat if you ask me. When I made contributions it was a matter of days before they were merged and released.

by pevey 3y ago

appleflaxen 3y ago

And, if those projects had been licensed using AGPL, then Hashicorp would not be able to relicense this without negotiating a non-GPL license for themselves, first. I don't understand why GPL gets so much hate on HN.

afiori 3y ago
deploying AGPL software is complicated
- orthoxerox 3y ago
  Not really, just push the tarball with sources to nginx when you deploy a specific commit.
  - sitzkrieg 3y ago
    yea this is definitely user friendly and realistic
    - jen20 3y ago
      If you make modifications, and deploy them in a way accessible to a given user, the changes must be made available to that user. I fail to see what is unrealistic about that, or indeed user-unfriendly, unless you consider the user to be the developer and not the person on the other end of the wire.
    - post-it 3y ago
      Glad you agree.
  - arlcode 3y ago
    You don't even need to do that immediatly afaik. You can wait for the first person to request the source and do it then manually (or link to the nginx github). Most likely that will never happen for most people who deploy it. After all it's a pretty good price for what you are getting in exchange.
  - yencabulator 3y ago
    There are AGPL software vendors who think making HTTP requests to their AGPL software forces you to license the client as AGPL too.
- eatonphil 3y ago
  Why do you say that? (Or to anyone, why do people think this?) I don't know anything about AGPL.
  - chii 3y ago
    It's not complicated, unless what you intend to do when deploying AGPL software is actually to try circumvent the license in some way; e.g., you would like some proprietary modifications to be added but still comply with the AGPL requirements.
    - JamesDeansSon 3y ago
      [flagged]
- josephcsible 3y ago
  The AGPL's extra requirements only apply if you modify the program. If you don't, then deploying it is just as easy as deploying an MIT-licensed program.
  - afiori 3y ago
    I believe that the AGPL has the same boundaries as the GPL that is if you for example run a nodejs server using a single AGPL package in your node_modules then users should be able to download the source code of your entire node app.
    - josephcsible 3y ago
      But now you're talking about using an AGPL library in your own program, rather than deploying just an AGPL-licensed program.
      - afiori 3y ago
        libraries are software
        josephcsible 3y ago
        Yes, but my point is there's a difference between "just deploy their software" and "combine their software with your software and deploy the result".
        afiori 3y ago
        I agree, but for example it is not obvious whether you can deploy mixed licenses with docker-compose.
      - andrewl-hn 3y ago
        When you include an AGPL library your program becomes a derivative work, so the rest of your program becomes AGPL-licensed as well. The boundaries of what part of the system should or should not be included are vague, because *GPL licenses are written with C semantics in mind. So, while having a library directly in the same running process definitely makes you work a derivative, it's not clear if you the same is true if the library is a part of a different process and your program talks to it via an IPC, a filesystem, a database, an API, etc. Depending of the interpretation you may have toped-source just a tiny part of your program running on a server, or all server-side and client-side code and all supplemental scripts, tools, etc. needed for the system to run. So, it's legally ambiguous, and since no-one has legally tested the waters the interpretation of the license can be very different, but most people prefer to stay away from AGPL code altogether.
fractalb 3y ago
I definitely feel GPL has its own merits. It's time people recognize that.
- pydry 3y ago
  They do. The merits are what make FAANG angry. They want the right to profit from your work without any corresponding obligations and GPLv3, AGPL, SSPL, BPL, etc. all deny them that right.
  - josephcsible 3y ago
    It's not really about profit. The GPL doesn't restrict that. It's about wanting to leech off of the FOSS community by turning other people's FOSS code into proprietary products. By the way, the SSPL isn't free or open source, so lumping it in with the GPL and AGPL like that could easily mislead people.
- demizer 3y ago
  My personal open source contributions will only be GPL. Damn the torpedoes! I will only contribute to lesser licenses if I am getting paid by a corp, which I do, and of course that software cannot be GPL'd.
bombcar 3y ago
The variously GPLs have always received hate of different kinds, and time and time again it's proven why they have the clauses they do. Reminds me of the picture of the smug cat surrounded by knives. GPL is that cat.
- ethbr0 3y ago
  People say lawyers are assholes, but they don't think about why lawyers are assholes. It's a lawyer's job to imagine the worst future outcomes and guard against them in the present. Everybody focuses on "It's crazy you put that clause in there that was never needed," but few folks appreciate "Thank god we included that clause just in case." Which isn't to opine there's a right or wrong, only multiple parties each negotiating (skillfully or poorly) in their own interests. If you're a developer and don't want your code to slide into corporate controlled ownership... well, there are licenses for that. https://github.com/readme/guides/open-source-licensing https://github.com/readme/guides/open-source-licensing https://arstechnica.com/gadgets/2020/02/how-to-choose-an-open-source-license/ https://arstechnica.com/gadgets/2020/02/how-to-choose-an-ope...
  - deleted 3y ago
    [deleted]
  - JohnFen 3y ago
    Yes. As a rough analogy that my lawyer told me early on, lawyers are like software engineers, and the law is like the operating system. A good lawyer writes robust "code" designed to deal with edge cases and unexpected conditions gracefully.
  - kjs3 3y ago
    I think every single one of my attorneys over the years has made it clear that if something is in the contract/license/etc, you absolutely have to assume it will be enforced, to the letter. No matter how stupid, no matter how unlikely. If it's written down, it was written down for a reason. One of the worst mistakes you can make in life is believing anyone who says things like "oh, that's just boilerplate...we'd never act on it" or "don't worry, we would never enforce that" or similar. That's someone who is deliberately setting you up to get screwed.
redeeman 3y ago
because people prefer not to pay back, GPL and AGPL has a cost that many consider to be limiting their ability to earn money based on it, so it gets hate. its really quite simple, you're no worse off than if there were no GPL/AGPL to begin with, so just dont use it if you dont agree. I personally am very concerned with the newer trends of going away from GPL, I think its gonna turn out bad for everyone
- chii 3y ago
  Stallman's foresight has been eerily accurate - look at what google's web environment integrity proposal to say the least. It's time the OSS community stop making free software with a loose license such that control and ownership is taken from them, and for profit to be made without any give backs.
- sneak 3y ago
  You don't need to "pay back" for a gift. The problem is entitlement and thinking that anyone owes you anything after you have given software away to the world. It's no longer yours, there is no "back".
  - redeeman 3y ago
    but its not a gift when its GPL, its distribution under certain terms, and to complain someone chooses GPL rather than BSD is not legit
appplication 3y ago
GPL gets hate because it’s a self-killing license. Sure, it’s great idealism, but it just creates an incentive for any corporate interests to create either a closed source offering or a better funded competing OSS offering that can be commercialized. If some software provides value, it will eventually be monetized in some form. It makes no sense for a corporation, whose entire existence is predicated on monetization, to see GPL software and say “I guess I’ll just stop charging for our products!” Instead, the completely predictable response is “this is valuable, but I can’t use it, so I’m going to make something like it that I can actually use”. Like it or not, you cannot “hide” value from capitalism. The machine will find and extract value wherever it can. GPL establishes unrealistic ideals for software that are inconsistent with the reality of how and where it is used.
- chii 3y ago
  > it just creates an incentive for any corporate interests to create either a closed source offering or a better funded competing OSS offering that can be commercialized. what's wrong with that? If they produce their own version, then the world now has another piece of software, and this competition is going to make the ecosystem better imho. The only problem with lenient licenses is that they allow leeching. MIT, eclipse, and apache licenses, all are basically allow free commons which others leech off as much as possible. The corps may continue to contribute, but only because they see value they could extract more than what it costs them. I would say AGPL should be the _only_ license anyone contributing to OSS should pick. And if you own the project, make it dual licensed - a commercial offering, and AGPL. If said software is good, a commercial offering can be profit generating enough fund further development.
  - appplication 3y ago
    There’s nothing wrong with that, and there’s nothing wrong with people who want to build GPL software - do what you like, consistent with your ideals. This is really only in response to the perennial “why don’t more people use GPL” questions that seem to always pop up any time software licensing is discussed. It’s fine for some people, but there’s a reason corps tend to avoid it or have internal policies against using GPL software.
spaceribs 3y ago
Hacker news is a mix of venture capital and technologists, the AGPL3 is a wedge between those two groups needs and objectives.
- dilyevsky 3y ago
  For agpl specifically I believe it’s due to muddy waters surrounding the “derivative work” clause. Some companies have traditionally bent the definition (eg insinuating that api calls result in larger application fall under combined work) and it’s never been tested in court so understandably the lawyers do the lawyer thing and tell you not to use it
  - spaceribs 3y ago
    Yeah, but even stepping back there, lawyers are paid to prevent companies from entering those muddy waters as a risk to their profits. Profit isn't a concern to someone who wishes to publish open source software, in fact you could say Open Source is an inherently socialist venture (your socializing the tools/means to do something). The AGPL3 makes it more difficult for others with probably more means to profit on that work, so it's a net benefit to the folks who actually write code (and a detriment to those who would wish to exploit it).
    - dilyevsky 3y ago
      Right so as long as food and shelter is not a concern AGPL is v good license!
      - spaceribs 3y ago
        Yep! I'd say 95% of open source is subsidized by those thriving rather than surviving, having the education/equipment/access/free-time to deliver open source software is a product of privilege and abundance.
  - _cenw 3y ago
    Not only some companies - API calls being linking also seems to be the opinion of the FSF.
adrr 3y ago
Because most startups can’t use AGPL. I had to provide audits of our licenses of libraries we use in our code base to investors and attest we didn’t have AGPL code in our code/software in our stack. This was at an e-commerce company and not a company that directly monetized software. Companies are free to choose whatever license but it will limit who can use their software.
- _xivi 3y ago
  > I had to provide audits of our licenses of libraries we use in our code base to investors and attest we didn’t have AGPL code in our code/software in our stack. A little off topic, but how are these audits usually done? I'd like to familiarize myself Not necessarily your specific case, if there's a resource online that'd be fine
  - adrr 3y ago
    We run a script that scans our source code and generates a manifest of all included libraries including license/copyright. Here's one of them: https://github.com/nexB/scancode-toolkit https://github.com/nexB/scancode-toolkit
    - pabs3 3y ago
      There are others, but scancode is probably the best one, their license database is truly huge. https://wiki.debian.org/CopyrightReviewTools https://wiki.debian.org/CopyrightReviewTools https://scancode-licensedb.aboutcode.org/ https://scancode-licensedb.aboutcode.org/
  - __jonas 3y ago
    Fossa built a business around this: https://fossa.com/ https://fossa.com/
  - nijave 3y ago
    The less automated version is a list of requirements to the effect "list all the OSS libraries you use and their licenses" are pushed down to each team and someone spends a day or 2 going through their code base. Usually that amounts to looking at a lock/dependency file and finding the software's license online. You can also run an audit against your artifact store/cache if you have one. JFrog Artifactory has built-in tools for auditing dependencies (and can act as a pull through cache) so you can run reports that way but it can be harder to tie dependencies to what's using them. Back when I worked at Chase, it was against company policy so use 3rd party dependencies that weren't in their internal components database. Part of getting something in the components database was establishing an owner, the license, and the version (basically a paperwork/approval process). In addition, part of the deploy process was running a vulnerability check against your dependencies using some proprietary enterprise software that tracked CVEs and could (somewhat...) parse what dependencies an application was using (ideally, automatically...).
thayne 3y ago
They were licensed under MPL, which would have also prevented a relicense like this without the CLA. And I don't think the MPL would even prevent them from selling their commercial products.
kj4ips 3y ago
With the CLA in place, it doesn't matter. All contributors already gave hashicorp a broad license for everything that they don't already own, so hashicorp has license to largely do whatever regardless of what license they use to offer it to others.
- josephcsible 3y ago
  Only the code in HashiCorp's own code is covered by the CLAs, not the code in the third-party dependencies it has. If said dependencies used copyleft licenses like (A)GPL instead of pushover licenses like MIT, that would have prevented what HashiCorp did.
- _msw_ 3y ago
  The CLA was put in place in December of 2018 [1]. Presumably contributions made before that were under inbound=outbound terms [2], meaning the contributing author licensed their exclusive rights under MPL 2.0, which is a file-based copyleft license. (see the chart at [3]). [1] https://www.hashicorp.com/blog/introducing-a-cla https://www.hashicorp.com/blog/introducing-a-cla [2] https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#6-contributions-under-repository-license https://docs.github.com/en/site-policy/github-terms/github-t... [3] https://en.wikipedia.org/wiki/License_compatibility#Compatibility_of_FOSS_licenses https://en.wikipedia.org/wiki/License_compatibility#Compatib...
Xylakant 3y ago
The projects license is of no concern at all here. Licenses do not bind the owner of the code. Hashicorp required a CLA before contributing, so they own the copyright. They can change the license at any time as they see fit.

nathanielks 3y ago

...quoted from the co-founders of a closed-source company running previously open-source software. Pot calling the kettle black. Their company wouldn't exist either, this is a ridiculous statement.

pevey 3y ago
Quite possibly a very fair point. I don't use Terraform or Spacelift or care at all about these particular companies. I DO care about open source, and I care about BSLs and CLAs and the dilution of what open source actually means. Legal or not, it feels like bait and switch. The CLAs supposedly make it legal. They have no place in truly open source projects unless at most it is to say a license is granted to the project in perpetuity under the same license as the project is licensed at the time of the PR.
- echelon 3y ago
  If small infrastructure companies don't do this, companies like Amazon get to suck all of the air out of the room. They reap the profits and directly compete with the company doing all the work. At scale. This is the same for database companies like Redis and Elastic. Open source has become a weapon used by the giants. This isn't about OSS anymore. It's about the largest companies in our industry setting compensation and soaking up all the profits. I'd say an IC at one of these companies deserves more than an IC at Amazon and should see outsized reward. But that's not what's happening.
  - pevey 3y ago
    I get that there are pros and cons of different licenses, and reasonable people my disagree, but this is the first time that occurred to them? This far down the road? No one forced them to be open source. They did it for certain benefits. They would have gone nowhere in the early days with this new license, most likely. I can only see these moves as bait and switch. Encourage everyone to use it, allow and maybe even encourage companies to build offerings on top of it to help with traction/mindshare... and then oh btw we changed our mind. It may be their right, but I'm glad people are talking about the implications.

that_guy_iain 3y ago

HashiCorp is successful because it solved problems for enterprise companies who were willing to pay for support. To claim it solely exists because of open source is a falsehood. Companies that can’t make money don’t exist.

jchw 3y ago
If open source is so unimportant to the success of these companies, then why would they do it? This is an unsupported assertion at best. It's clear where Terraform et al. are now that they don't need to be open source (hence why they are switching off of open source licenses without fear) but what is not well-supported by any evidence is that it would've gone the same way if it had started as shared source or closed source.
- echelon 3y ago
  Amazon is able to make use of open source and keep all the benefits private. By holding smaller companies to this OSS purity yardstick, we're allowing the Amazons of the world to clone them wholesale and reap all of the benefits. The world needs more small companies, not big ones. This is the right way for small companies to protect themselves.
  - thinkmassive 3y ago
    What about AGPL? That’s pure Free Software, and it would require Amazon to publish their changes or not offer the service. In reality they would probably choose the latter.
  - jchw 3y ago
    Apart from mirroring the sentiments of the neighboring comment regarding AGPL, that is not really the point. Companies are more than welcome to choose what things they want to open source or not open source, it's just that this stupid magic trick of "Now it's open, now it's not" is fooling people who choose software based on the ideals of open source software so that 1. foolish contributors can contribute to just another closed/shared source enterprise products for free, even if the work of outside contributors are small 2. they can ratchet up the ladder, going from attracting smaller players and open source companies all the way to enterprise customers, making you wonder if it was their plan all along, to just deceive you. I don't have the same complaints about many open source business models, because they do not involve deception. If you contribute to Gitlab CE, it is still properly open source even if it may benefit Gitlab EE customers. BSL is not an open source license though, so Terraform is no longer an open source project. Does that matter to enterprises? Nope. Does that matter to me? I think you know the answer to that. But it's yet another harsh lesson that you should never, ever sign a CLA outside of stuff you contribute as a result of your job. If you ever sign a CLA for work you're not being paid for, you're clearly getting scammed in slow motion. And if abusing the goodwill that comes with open source (or maybe came with, at this point, since now we all see where this is headed from here on out) is the only way for not every company to be Amazon, maybe there's some much larger problem going on there.

deleted 3y ago

[deleted]

michaelmior 3y ago

I have no problem with agreeing to a CLA. If I've decided to contribute to a project, it's because I think I can add value. If later, the project decides to relicense, I might not like the decision, but I wouldn't regret my past contributions. Even if you disagree with some of these points, it really depends on the CLA. Some CLAs allow the contributor to retain copyright and also restrict relicensing.

CameronNemo 3y ago
Sure, but the most common use case for a CLA is to allow a company to take your contributions and use them as proprietary software. Some aren't a terrible idea, but my instinct is to close the tab when I am asked to sign a CLA.
- Terretta 3y ago
  Are you getting value from the product? Would you appreciate being able to tell their product manager you need a feature and see it shipped? Would you appreciate time with their engineering team suggesting how to implement the feature so it works for your use case? Would you value the feature working precisely as you need it to, with no misinterpretation? Then sign the CLA and value this vendor offers business-source as a shortcut for you and them to understand and ship your needs, when most vendors don't. It's a literal win win. (The only time not to sign is if you would prefer a competitor to the vendor, or want to compete yourself. Then go talk to that competitor instead, or make the first commit to your own repo.)

codexb 3y ago

CLA's are common on projects with corporate contributions because they prevent open source from being accused of stealing IP. You need to sign a CLA to contribute to linux for example, and there are separate CLA's for users and for companies.

CameronNemo 3y ago
Where are you getting this information? Linux has a DCO-requirement, but AFAIK there is no CLA. Signed-off-by: someone who has a recent commit in the kernel and did not sign a CLA.

mholt 3y ago

> Do not contribute to projects that make you agree to a CLA. There's nothing wrong with a CLA's existence, it just depends what it says. For example, the Caddy CLA [0] is borrowed from The Linux Foundation, and it basically says you either made the change originally, or have the rights to share the contribution, and that this goes into a public record and will be redistributed. [0]: https://cla-assistant.io/caddyserver/caddy https://cla-assistant.io/caddyserver/caddy

CameronNemo 3y ago
A DCO is a lot lighter than a full CLA.

spenczar5 3y ago

> Do not contribute to projects that make you agree to a CLA. So you think no one should contribute to the Linux Foundation’s projects? This is absurd. CLAs are not evil on their own, only their contents could be objectionable.

rwmj 3y ago
It would be more accurate to say copyright assignment is problematic, rather than CLAs in general, since as you say some CLAs are just about ensuring that you have permission (eg from your employer) to contribute to the project.
- CameronNemo 3y ago
  You can do that with a DCO without needing to use a CLA. CLAs generally exist to give the company permission to relicense, including as proprietary.

comprev 3y ago

For some people having a PR accepted by $COMPANY is a great boost for their CV. Not everyone will be doing it for the love of building software.

nijave 3y ago

>but why contribute your time and effort? From a business context it can frequently be cheaper to fix OSS (or source-available software) than pay someone in-house to write something equivalent or pay for equivalent commercial software. If you're being paid by your employer to complete a task on company time, that task uses Terraform and you encounter a Terraform bug, it seems reasonable to create a fix for it. It gets even hairier when you consider a lot of commercial products push Terraform support (in house created providers) as a feature. I could be getting paid by Company A to implement and maintain software written by Company B where part of the implementation uses a reference architecture or install template written in Terraform. On the other hand, I'm more reluctant to use those sorts of tools/contribute on my own time.

jeffnappi 3y ago

This may be true, but as someone who contributed to a Terraform provider - HashiCorp did a vast amount of legwork to build impressive tooling and process to make contributing easy and get contributions merged quickly. No easy feat if you ask me. When I made contributions it was a matter of days before they were merged and released.