4 ms·

Great blog post - thanks for writing it. I've had the same experience with people asking for an MIT license on dependabot-core (the public repo that holds the c

Great blog post - thanks for writing it. I've had the same experience with people asking for an MIT license on dependabot-core (the public repo that holds the core logic for my SaaS business, but which has no license and a comment saying those who wish to use it for commercial gain should contact me instead). I already give the product away for free to open source projects and anyone using it in a personal capacity, but for a small number of people that's not enough. Free software is a wonderful thing - it's fantastic that our community shares its work so widely and generously. It is not, however, the only, or the best, model for creating innovation at all times. I'm able to work full time on Dependabot because by providing it as SaaS I can pay myself a wage and by owning the codebase I can protect myself from a larger player copying my work. There's no doubt in my mind that enabling me to work on the product full time is a better outcome for the world than a license that would let others distribute and profit from it.

mherrmann 8y ago
I very much agree, especially on your point that the world is better for you being able to work on your product.
tomjen3 8y ago
As a general point, please put a license on your contributions if you put them on github. Don't much care what it is, and I don't mind paying, but don't make me do a song and dance to see what your price is. Especially if you are already giving it away to open source projects -- my bet is most people who see "call me" as a clause will move on, even people you are actually trilled to help. AGPLv3 would be a decent suggestion, but even your own license wouldn't be bad either.
- greysteil 8y ago
  Totally agree on licenses and transparent pricing in general, but I think you've missed the context here. If a commercial entity wants to add the core functionality of my product to their offering then there's definitely going to have to be a negotiation first. AGPLv3 wouldn't be appropriate, as the commercial entity's code being open source isn't a material consideration for me. (The license text I was referring to is here: https://github.com/dependabot/dependabot-core#license https://github.com/dependabot/dependabot-core#license. I could hire a lawyer and put a proper, proprietary license on the repo but I'm bootstrapped and don't think it's necessary.)
bachmeier 8y ago
> by owning the codebase I can protect myself from a larger player copying my work I find this statement confusing. In what sense do you not "own" your codebase if you release it under the GPL? And if the software is released under the GPL, large players have no advantage, because they have to release all of the changes they make to your code if they're using it to compete against you. What you're saying is that restricting and hiding your codebase allows you to make more money. And there's nothing wrong with that, but it's not right to spread falsehoods about free software licenses.
- greysteil 8y ago
  That's not what I'm saying, and I don't think I'm spreading any falsehoods about free software licenses here. Building a business is about distribution as well as product. My product is pretty good, but my distribution, compared to a large player with an existing user base, is woeful. If I licensed under GPL I would be giving explicit legal permission to any big player (who was open source) to take my product for free, and compete with me solely on distribution. Licensing my product in the above way wouldn't be good for me financially, and as a result would decrease my likelihood of working full time on Dependabot. Worse still, it would disproportionally decrease my returns from working on the product, as opposed to distribution. Thanks to copyright law we don't need to hide our codebases in order to charge for our work. That's a great thing, and there should be acceptance of code that is developed in public but without a permissive license. It's a perfectly rational decision, and creators shouldn't be put under pressure to give their development work away for free instead.
  - ttoinou 8y ago
    Thanks to copyright law we don't need to hide our codebases in order to charge for our work. I don't understand that part ?
    - greysteil 8y ago
      Before patents, copyright law, and all that, secrecy was the only way to stop people copying your stuff. That was kinda crappy, and people went to great lengths to obfuscate their IP, expending lots of effort on something that had no benefit for their customers / the world. Intellectual property law changed that - it made it possible for people to openly disclose their inventions whilst maintaining control of them (normally with some conditions). It was a really, really good thing for society, as it dramatically increased the returns to "thinking work". I can probably dig out a link if you're interested.
progval 8y ago
> We have been unable to find a license that accurately fits Dependabot's needs (suggestions are welcome) How about dual-licensing as CC-BY-ND (using the bot as-is, even for profit) and CC-BY-NC (making modifications, but not for profit)?

mherrmann 8y ago

I very much agree, especially on your point that the world is better for you being able to work on your product.

tomjen3 8y ago

As a general point, please put a license on your contributions if you put them on github. Don't much care what it is, and I don't mind paying, but don't make me do a song and dance to see what your price is. Especially if you are already giving it away to open source projects -- my bet is most people who see "call me" as a clause will move on, even people you are actually trilled to help. AGPLv3 would be a decent suggestion, but even your own license wouldn't be bad either.

greysteil 8y ago
Totally agree on licenses and transparent pricing in general, but I think you've missed the context here. If a commercial entity wants to add the core functionality of my product to their offering then there's definitely going to have to be a negotiation first. AGPLv3 wouldn't be appropriate, as the commercial entity's code being open source isn't a material consideration for me. (The license text I was referring to is here: https://github.com/dependabot/dependabot-core#license https://github.com/dependabot/dependabot-core#license. I could hire a lawyer and put a proper, proprietary license on the repo but I'm bootstrapped and don't think it's necessary.)

bachmeier 8y ago

> by owning the codebase I can protect myself from a larger player copying my work I find this statement confusing. In what sense do you not "own" your codebase if you release it under the GPL? And if the software is released under the GPL, large players have no advantage, because they have to release all of the changes they make to your code if they're using it to compete against you. What you're saying is that restricting and hiding your codebase allows you to make more money. And there's nothing wrong with that, but it's not right to spread falsehoods about free software licenses.

greysteil 8y ago
That's not what I'm saying, and I don't think I'm spreading any falsehoods about free software licenses here. Building a business is about distribution as well as product. My product is pretty good, but my distribution, compared to a large player with an existing user base, is woeful. If I licensed under GPL I would be giving explicit legal permission to any big player (who was open source) to take my product for free, and compete with me solely on distribution. Licensing my product in the above way wouldn't be good for me financially, and as a result would decrease my likelihood of working full time on Dependabot. Worse still, it would disproportionally decrease my returns from working on the product, as opposed to distribution. Thanks to copyright law we don't need to hide our codebases in order to charge for our work. That's a great thing, and there should be acceptance of code that is developed in public but without a permissive license. It's a perfectly rational decision, and creators shouldn't be put under pressure to give their development work away for free instead.
- ttoinou 8y ago
  Thanks to copyright law we don't need to hide our codebases in order to charge for our work. I don't understand that part ?
  - greysteil 8y ago
    Before patents, copyright law, and all that, secrecy was the only way to stop people copying your stuff. That was kinda crappy, and people went to great lengths to obfuscate their IP, expending lots of effort on something that had no benefit for their customers / the world. Intellectual property law changed that - it made it possible for people to openly disclose their inventions whilst maintaining control of them (normally with some conditions). It was a really, really good thing for society, as it dramatically increased the returns to "thinking work". I can probably dig out a link if you're interested.

progval 8y ago

> We have been unable to find a license that accurately fits Dependabot's needs (suggestions are welcome) How about dual-licensing as CC-BY-ND (using the bot as-is, even for profit) and CC-BY-NC (making modifications, but not for profit)?