9 ms·

Here’s the initial AWS response to the license change that they made in 2018, which I helped write. At the time we didn’t think a new license made sense, as AGP

Here’s the initial AWS response to the license change that they made in 2018, which I helped write. At the time we didn’t think a new license made sense, as AGPL is sufficient to block AWS from using the code, but the core of the issue was that AWS wanted to contribute security features to the open source project and Elastic wanted to keep security as an enterprise feature, so rejected all the approaches AWS made at the time. https://aws.amazon.com/blogs/opensource/keeping-open-source-open-open-distro-for-elasticsearch/ https://aws.amazon.com/blogs/opensource/keeping-open-source-...

_pdp_ 2y ago
Unfortunately many companies charge extra for security where security should be the default. Truth to be told there some some situations where extra security costs could be justified but there are not many if charge is necessary it should be considered as a temporary measure. My $0.02.
- thelittleone 2y ago
  Including the recent trend of access to SOC2 reports requiring an "Enterprise" tier subscription.
  - deleted 2y ago
    [deleted]
  - YetAnotherNick 2y ago
    In fact I like the change. This allows them to make almost everything free of charge to individual/small companies, but could fund it from revenue of larger organization, who generally don't have problem paying.
    - lsaferite 2y ago
      And what of small companies that need things like SOC2 reports from vendors? If you want to work with large companies, being SOC certified makes it easier. Part of that is ensuring your vendors are also compliant with good standards and that's best done with SOC reports.
      - YetAnotherNick 2y ago
        Getting SOC 2 compliance alone takes ~10k USD apart from vendor reports. Yes they may be small with employee count, but when I said small I just meant someone running something for small set of users for free or close to free. Not someone working with other enterprises.
        lsaferite 2y ago
        My point is that even small companies may need SOC reports from their vendors but still not be able to financially support enterprise level plans with every one of them. By being supportive of hiding those reports behind enterprise level contracts you are effectively supporting pricing those companies out and potentially making them unable to work with larger clients.
        YetAnotherNick 2y ago
        SOC reports are only needed for SOC compliance and compliance costs 10k USD. It depends on the subscription cost, but if the company could afford the compliance they could afford extra 100 USD/month. No one expects small companies to pay few 1000 dollars per month. Although few companies have minimum ticket size for enterprise clients and that is a bad thing IMO.
    - ensignavenger 2y ago
      I don't mind them requiring a paid tier to get the detailed compliance level reports, but requiring the most uber expensive "call us" plan is probably too much for many smaller companies that might still benefit from easier SOC2 complaince.
  - julesvr 2y ago
    I have the same problem at the moment with Supabase. We're a startup trying to get ISO 27001 certified and need to upload Supabase's SOC2 report to Vanta, but we can't because we're on the Pro tier and they don't give access to that, even after emailing them. It's ridiculous.
    - _pdp_ 2y ago
      It is even more ridiculous because it costs them nothing to issue an extra copy of this pdf report. They need to certify anyway because their enterprise customers will demand it.
    - christinac 2y ago
      (I work at/started Vanta. Email support@vanta.com and they should be able to give you guidance and help out. If that doesn't work, email me -- christina at vanta)
  - eknkc 2y ago
    We got a SOC2 cert in our bootstrapped small saas company. Then we hid the report behind Enterprise subscriptions because it takes too much time, effort and money to obtain and maintain it. We did not get certified because we wanted it, we did because the enterprise scale customers forced us to. Due to their internal bureaucracy.
  - FireBeyond 2y ago
    Or worse, "SSO" as an Enterprise feature. You're a 2-3 person startup, you set up GSuite, you want to set things up right, oh, "$Call us" for a tier with SSO. Nope, I guess disparate users for now. Not the worst in the world to be clear, but an entirely arbitrary gate, in my experience.
    - d0gsg0w00f 2y ago
      Yeah, the SSO gates are common and borderline criminal. "The only way you can use our software is insecurely"
      - thelittleone 2y ago
        I have long held that view also, although the post below about the cost of supporting SSO was interesting. Unlike withholding SOC2 reports which cost nothing to incremental to give to your lowest tier, SSO may increase the cost of support. I wonder how it would go offering SSO as an addon to entry level tiers that covers the incremental support cost. https://news.ycombinator.com/item?id=41304228 https://news.ycombinator.com/item?id=41304228 This SSO cost post is also interesting: https://news.ycombinator.com/item?id=40752518 https://news.ycombinator.com/item?id=40752518
  - deleted 2y ago
    [deleted]
- originalvichy 2y ago
  I think it's fair to say most security is built-in by your average developer. However, the security side of things needs efforts from a far smaller pool of experts that can make your tool as secure as is possible. I don't imagine it is as cheap to find feature developers as well as security experts or security developers. Practically speaking, cheaping out on security might cost you the reputation of the app, so doing it well will be expensive but worth it, but might never be worth it if you offer everything by default but in the end only a fraction of your customer base uses the features.
- willcipriano 2y ago
  [flagged]
  - batch12 2y ago
    Software should be secure by default. No defense of honor is necessary. > This line of thinking has lead to many foreign wars of choice, where we send young men to die and our nation recieved nothing in exchange. "It was the right thing to do" is uttered by those who did nothing I am not able to find any references to the war of regression or the battle of cve-2021-44228, so I'll have to call nonsense on this one.
    - willcipriano 2y ago
      Why? What was paid that now this is owed?
      - batch12 2y ago
        We've become too accepting of trivial bugs and logic issues that could have been identified through proper quality controls.
        willcipriano 2y ago
        You should protest. Demand your money back.
        deleted 2y ago
        [deleted]
  - nijave 2y ago
    Security is a basic non functional requirement for all software.
    - willcipriano 2y ago
      Then don't use it? It's non-functional right? I don't get where the complaints come in. Side note: Security in these discussions is often something more like "It works with my single sign on system" or "It lets me check this box on my audit form". Security doesn't only have to happen at the app layer and it's completely doable to isolate any software in a way that is is secure despite itself. So it's less security and more convenient security that is being demanded for free most often by people who offer nothing for free themselves. The entitlement is really extreme.
- cduzz 2y ago
  I'm not sure what you mean by "security" in this context. Identity management, role based access control, useful audit logs; all "enterprise" features, probably are very expensive to implement, and make for obvious "up-charge" product segmentation. I suspect there's some combination of "the community doesn't add useful implementations of these features" and "we can't possibly risk our reputation based on some community contribution" and "we can use this to segment our product to sell to some and give it away to some." This set of features seems to always get put in the "enterprise, only for licensed / supported customers" and it stinks.... I can understand why, though, and none of these are strictly speaking "security" as much as "compliance"
  - fieldcny 2y ago
    Using your yardstick, we wouldn’t have any open source software, everything costs time to implement, that’s the point of open source, we donate time to the collective community. All those security features are not enterprise specific, they are rudimentary for any modern open source product
    - cduzz 2y ago
      I'm saying that companies that opensource their products tend to distinguish "enterprise" and non-enterprise based on things like RBAC and audit mechanisms, neither of which is "security" as much as "compliance". The original license owner, if a commercial enterprise trying to sell the product alongside the "open" version, has less incentive to accept those features from the community as it would reduce their sales of the enterprise version of the same thing, and may not align with their long-term product roadmap. In open source, the team managing a codebase isn't under any obligation to accept contributions the community and you are welcome to fork the project, if you like.
      - ang_cire 2y ago
        RBAC is absolutely a practical security control, even for non-commercial users. Least necessary privilege is not a checkbox, it will 100% save your butt in a breach by limiting blast radius.
perryizgr8 2y ago
I don't know if this was part of the issues but adding authentication to Elastic APIs and Kibana is so confusing and complicated that it is almost impossible to do unless you go for a managed solution. I'm sure that one factor alone motivates a lot of users to buy the service instead of hosting their own using the available source.
- skywhopper 2y ago
  Yeah, this is an underrated aspect of all the managed hosting options out there. If vendors made it easy to deploy their code, folks would be far more willing to run it themselves. But just rolling out a simple production-ready cluster of most software is a nightmare of complexity. (Note that while open-source software is often not great at this, proprietary software is often just as bad or worse. This is not a side-effect of open-source. It's a failure of prioritization of the operator experience.)
weinzierl 2y ago
"as AGPL is sufficient to block AWS from using the code" I have taken this position in another thread a while ago, but the responses seemed to indicate that this is not a clearly cut situation at all. If it was, what is the point of the "source-available" licenses in the first place? I mean, the idea that they were invented to cut out AWS is pretty prevalent, no?
- _cenw 2y ago
  There's enough legal uncertainty about API calls being considered linking that it keeps coming up. Minio are probably at the forefront of claiming this somewhat implicitly while referring you to your lawyer (or their pricing page, preferably) when asked about how they understand the AGPL. FSF/GNU have an example of an AGPL proxy becoming compliant by serving it a page with the offer to download source code on the first request, pretty far off from reality if you ask me. That's also the big other issue, AGPL is unclear about conveyance over a network. Does a header work? Does a link to the source repo work or do you need to offer hard copies? What do you do if the "networking" is a highly specific protocol that simply can't make that offer over the wire? I much prefer the clarity of intent of the EUPL.
  - kikoreis 2y ago
    Nah, the AGPL is pretty clear (and way clearer than the GPL and LGPL due to combined/derived work fuzziness). The issue with it isn't anything to do with the mechanism of the license itself, because it is pretty clear what the criteria are (and offering an API over the network definitively constitutes Remote Network Interaction) and how you can fulfill the source distribution. The real issue is that the AGPLv3 doesn't preclude a third party from commercializing the software (whether modified or not).
    - _cenw 2y ago
      The problem with Minio is how many layers of indirection "interacting with an API" consitutes. If I write a webapp that uses Minio in the background, Minio has stated that their belief is that your webapp is subject to the viral part of the AGPL.
redwood 2y ago
Out of curiosity, did you pursue a rev share model with Elastic (Co) for your Elastic managed service? I guess that's not something thay can be discussed openly but recognizing you probably had 10x their revenue in the managed service and another 10x their revenue in compute behind the OSS, I wonder if there could have been a proactive happy middle ground found years ago. I suppose that they might not have accepted something that was too small percent wise and hence might have preferred to go head to head no matter where that might have gone. My real sense for why they've struggled to out maneuver is their lack of execution on their managed service (9 years in market, still minority of their revenue); while you had a head start and I'm sure that's what they point to as preventing execution, if they had really focused there they might be more like Confluent in terms of being considered the well regarded SaaS leader in their segment. But I do think it'd be a good look for AWS to proactively help these companies. I didn't think the approach taken with Grafana Labs was right... that looked more like a Faustian bargain to an outside observer (e.g. we'll cut you down at your knees and directly compete but offer you their more expensive version on our paper. It looked incredibly humiliating).
- sanderjd 2y ago
  > But I do think it'd be a good look for AWS to proactively help these companies. But how much value does "a good look" have to AWS?
  - redwood 2y ago
    Depends on who sits in the antitrust seat. It's pretty incredible to realize the one who does today wrote this a few years ago: https://www.yalelawjournal.org/pdf/e.710.Khan.805_zuvfyyeh.pdf https://www.yalelawjournal.org/pdf/e.710.Khan.805_zuvfyyeh.p...
    - sanderjd 2y ago
      I'm fairly skeptical that Amazon would seek out a "good look" like the one here, solely in hopes that it will save them from antitrust scrutiny.
  - 2y ago
chihwei 2y ago
But why couldn't you or AWS donate/pay to Elastic for what they created to get those features in? I understand the security features you mentioned is very necessary, but Elastic will lose revenue because of this, and they are not a trillion dollars cap tech giant like AWS to support the project for free.
pabs3 2y ago
AWS could easily comply with the AGPL, why is AWS blocked from providing services using software licensed under the AGPL?

_pdp_ 2y ago

Unfortunately many companies charge extra for security where security should be the default. Truth to be told there some some situations where extra security costs could be justified but there are not many if charge is necessary it should be considered as a temporary measure. My $0.02.

thelittleone 2y ago
Including the recent trend of access to SOC2 reports requiring an "Enterprise" tier subscription.
- deleted 2y ago
  [deleted]
- YetAnotherNick 2y ago
  In fact I like the change. This allows them to make almost everything free of charge to individual/small companies, but could fund it from revenue of larger organization, who generally don't have problem paying.
  - lsaferite 2y ago
    And what of small companies that need things like SOC2 reports from vendors? If you want to work with large companies, being SOC certified makes it easier. Part of that is ensuring your vendors are also compliant with good standards and that's best done with SOC reports.
    - YetAnotherNick 2y ago
      Getting SOC 2 compliance alone takes ~10k USD apart from vendor reports. Yes they may be small with employee count, but when I said small I just meant someone running something for small set of users for free or close to free. Not someone working with other enterprises.
      - lsaferite 2y ago
        My point is that even small companies may need SOC reports from their vendors but still not be able to financially support enterprise level plans with every one of them. By being supportive of hiding those reports behind enterprise level contracts you are effectively supporting pricing those companies out and potentially making them unable to work with larger clients.
        YetAnotherNick 2y ago
        SOC reports are only needed for SOC compliance and compliance costs 10k USD. It depends on the subscription cost, but if the company could afford the compliance they could afford extra 100 USD/month. No one expects small companies to pay few 1000 dollars per month. Although few companies have minimum ticket size for enterprise clients and that is a bad thing IMO.
  - ensignavenger 2y ago
    I don't mind them requiring a paid tier to get the detailed compliance level reports, but requiring the most uber expensive "call us" plan is probably too much for many smaller companies that might still benefit from easier SOC2 complaince.
- julesvr 2y ago
  I have the same problem at the moment with Supabase. We're a startup trying to get ISO 27001 certified and need to upload Supabase's SOC2 report to Vanta, but we can't because we're on the Pro tier and they don't give access to that, even after emailing them. It's ridiculous.
  - _pdp_ 2y ago
    It is even more ridiculous because it costs them nothing to issue an extra copy of this pdf report. They need to certify anyway because their enterprise customers will demand it.
  - christinac 2y ago
    (I work at/started Vanta. Email support@vanta.com and they should be able to give you guidance and help out. If that doesn't work, email me -- christina at vanta)
- eknkc 2y ago
  We got a SOC2 cert in our bootstrapped small saas company. Then we hid the report behind Enterprise subscriptions because it takes too much time, effort and money to obtain and maintain it. We did not get certified because we wanted it, we did because the enterprise scale customers forced us to. Due to their internal bureaucracy.
- FireBeyond 2y ago
  Or worse, "SSO" as an Enterprise feature. You're a 2-3 person startup, you set up GSuite, you want to set things up right, oh, "$Call us" for a tier with SSO. Nope, I guess disparate users for now. Not the worst in the world to be clear, but an entirely arbitrary gate, in my experience.
  - d0gsg0w00f 2y ago
    Yeah, the SSO gates are common and borderline criminal. "The only way you can use our software is insecurely"
    - thelittleone 2y ago
      I have long held that view also, although the post below about the cost of supporting SSO was interesting. Unlike withholding SOC2 reports which cost nothing to incremental to give to your lowest tier, SSO may increase the cost of support. I wonder how it would go offering SSO as an addon to entry level tiers that covers the incremental support cost. https://news.ycombinator.com/item?id=41304228 https://news.ycombinator.com/item?id=41304228 This SSO cost post is also interesting: https://news.ycombinator.com/item?id=40752518 https://news.ycombinator.com/item?id=40752518
- deleted 2y ago
  [deleted]
originalvichy 2y ago
I think it's fair to say most security is built-in by your average developer. However, the security side of things needs efforts from a far smaller pool of experts that can make your tool as secure as is possible. I don't imagine it is as cheap to find feature developers as well as security experts or security developers. Practically speaking, cheaping out on security might cost you the reputation of the app, so doing it well will be expensive but worth it, but might never be worth it if you offer everything by default but in the end only a fraction of your customer base uses the features.
willcipriano 2y ago
[flagged]
- batch12 2y ago
  Software should be secure by default. No defense of honor is necessary. > This line of thinking has lead to many foreign wars of choice, where we send young men to die and our nation recieved nothing in exchange. "It was the right thing to do" is uttered by those who did nothing I am not able to find any references to the war of regression or the battle of cve-2021-44228, so I'll have to call nonsense on this one.
  - willcipriano 2y ago
    Why? What was paid that now this is owed?
    - batch12 2y ago
      We've become too accepting of trivial bugs and logic issues that could have been identified through proper quality controls.
      - willcipriano 2y ago
        You should protest. Demand your money back.
        deleted 2y ago
        [deleted]
- nijave 2y ago
  Security is a basic non functional requirement for all software.
  - willcipriano 2y ago
    Then don't use it? It's non-functional right? I don't get where the complaints come in. Side note: Security in these discussions is often something more like "It works with my single sign on system" or "It lets me check this box on my audit form". Security doesn't only have to happen at the app layer and it's completely doable to isolate any software in a way that is is secure despite itself. So it's less security and more convenient security that is being demanded for free most often by people who offer nothing for free themselves. The entitlement is really extreme.
cduzz 2y ago
I'm not sure what you mean by "security" in this context. Identity management, role based access control, useful audit logs; all "enterprise" features, probably are very expensive to implement, and make for obvious "up-charge" product segmentation. I suspect there's some combination of "the community doesn't add useful implementations of these features" and "we can't possibly risk our reputation based on some community contribution" and "we can use this to segment our product to sell to some and give it away to some." This set of features seems to always get put in the "enterprise, only for licensed / supported customers" and it stinks.... I can understand why, though, and none of these are strictly speaking "security" as much as "compliance"
- fieldcny 2y ago
  Using your yardstick, we wouldn’t have any open source software, everything costs time to implement, that’s the point of open source, we donate time to the collective community. All those security features are not enterprise specific, they are rudimentary for any modern open source product
  - cduzz 2y ago
    I'm saying that companies that opensource their products tend to distinguish "enterprise" and non-enterprise based on things like RBAC and audit mechanisms, neither of which is "security" as much as "compliance". The original license owner, if a commercial enterprise trying to sell the product alongside the "open" version, has less incentive to accept those features from the community as it would reduce their sales of the enterprise version of the same thing, and may not align with their long-term product roadmap. In open source, the team managing a codebase isn't under any obligation to accept contributions the community and you are welcome to fork the project, if you like.
    - ang_cire 2y ago
      RBAC is absolutely a practical security control, even for non-commercial users. Least necessary privilege is not a checkbox, it will 100% save your butt in a breach by limiting blast radius.

perryizgr8 2y ago

I don't know if this was part of the issues but adding authentication to Elastic APIs and Kibana is so confusing and complicated that it is almost impossible to do unless you go for a managed solution. I'm sure that one factor alone motivates a lot of users to buy the service instead of hosting their own using the available source.

skywhopper 2y ago
Yeah, this is an underrated aspect of all the managed hosting options out there. If vendors made it easy to deploy their code, folks would be far more willing to run it themselves. But just rolling out a simple production-ready cluster of most software is a nightmare of complexity. (Note that while open-source software is often not great at this, proprietary software is often just as bad or worse. This is not a side-effect of open-source. It's a failure of prioritization of the operator experience.)

weinzierl 2y ago

"as AGPL is sufficient to block AWS from using the code" I have taken this position in another thread a while ago, but the responses seemed to indicate that this is not a clearly cut situation at all. If it was, what is the point of the "source-available" licenses in the first place? I mean, the idea that they were invented to cut out AWS is pretty prevalent, no?

_cenw 2y ago
There's enough legal uncertainty about API calls being considered linking that it keeps coming up. Minio are probably at the forefront of claiming this somewhat implicitly while referring you to your lawyer (or their pricing page, preferably) when asked about how they understand the AGPL. FSF/GNU have an example of an AGPL proxy becoming compliant by serving it a page with the offer to download source code on the first request, pretty far off from reality if you ask me. That's also the big other issue, AGPL is unclear about conveyance over a network. Does a header work? Does a link to the source repo work or do you need to offer hard copies? What do you do if the "networking" is a highly specific protocol that simply can't make that offer over the wire? I much prefer the clarity of intent of the EUPL.
- kikoreis 2y ago
  Nah, the AGPL is pretty clear (and way clearer than the GPL and LGPL due to combined/derived work fuzziness). The issue with it isn't anything to do with the mechanism of the license itself, because it is pretty clear what the criteria are (and offering an API over the network definitively constitutes Remote Network Interaction) and how you can fulfill the source distribution. The real issue is that the AGPLv3 doesn't preclude a third party from commercializing the software (whether modified or not).
  - _cenw 2y ago
    The problem with Minio is how many layers of indirection "interacting with an API" consitutes. If I write a webapp that uses Minio in the background, Minio has stated that their belief is that your webapp is subject to the viral part of the AGPL.

redwood 2y ago

Out of curiosity, did you pursue a rev share model with Elastic (Co) for your Elastic managed service? I guess that's not something thay can be discussed openly but recognizing you probably had 10x their revenue in the managed service and another 10x their revenue in compute behind the OSS, I wonder if there could have been a proactive happy middle ground found years ago. I suppose that they might not have accepted something that was too small percent wise and hence might have preferred to go head to head no matter where that might have gone. My real sense for why they've struggled to out maneuver is their lack of execution on their managed service (9 years in market, still minority of their revenue); while you had a head start and I'm sure that's what they point to as preventing execution, if they had really focused there they might be more like Confluent in terms of being considered the well regarded SaaS leader in their segment. But I do think it'd be a good look for AWS to proactively help these companies. I didn't think the approach taken with Grafana Labs was right... that looked more like a Faustian bargain to an outside observer (e.g. we'll cut you down at your knees and directly compete but offer you their more expensive version on our paper. It looked incredibly humiliating).

sanderjd 2y ago
> But I do think it'd be a good look for AWS to proactively help these companies. But how much value does "a good look" have to AWS?
- redwood 2y ago
  Depends on who sits in the antitrust seat. It's pretty incredible to realize the one who does today wrote this a few years ago: https://www.yalelawjournal.org/pdf/e.710.Khan.805_zuvfyyeh.pdf https://www.yalelawjournal.org/pdf/e.710.Khan.805_zuvfyyeh.p...
  - sanderjd 2y ago
    I'm fairly skeptical that Amazon would seek out a "good look" like the one here, solely in hopes that it will save them from antitrust scrutiny.
- 2y ago

chihwei 2y ago

But why couldn't you or AWS donate/pay to Elastic for what they created to get those features in? I understand the security features you mentioned is very necessary, but Elastic will lose revenue because of this, and they are not a trillion dollars cap tech giant like AWS to support the project for free.

pabs3 2y ago

AWS could easily comply with the AGPL, why is AWS blocked from providing services using software licensed under the AGPL?