3 ms·

As someone who is involved in the ecosystem and maintains some open-source projects based on ElasticSearch, I am similarly curious about the move to not build u

by sidi 8y ago

As someone who is involved in the ecosystem and maintains some open-source projects based on ElasticSearch, I am similarly curious about the move to not build upon existing projects (there could be a good reason, but haven't heard it yet). Why wasn't ElastAlert used / built upon for alerting? https://github.com/yelp/elastalert https://github.com/yelp/elastalert Or why wasn't ElasticSearch SQL used / built upon for SQL? https://github.com/NLPchina/elasticsearch-sql https://github.com/NLPchina/elasticsearch-sql Or why wasn't SearchGuard used / built upon for Security? https://github.com/floragunncom/search-guard https://github.com/floragunncom/search-guard All of them have Apache 2.0 license.

ssgao 8y ago
For SearchGuard, only the basic auth is Apache 2.0. Anything practical you need to pay to use it.
- sagichmal 8y ago
  Why isn't AWS paying to use it, then? It's not like they don't have the money?
  - ssgao 8y ago
    there's no "they", there's only us. AWS paying to use it means we are paying to use it. Between that and a truly Apache 2.0 project, I think it's a no-brainer for everyone.
    - sagichmal 8y ago
      Why shouldn't you pay to use it, then? More generally: why should AWS get to leverage its near-monopolistic position in the SaaS market to perform essentially hostile takeovers of the software projects it packages and runs? Simply because they have the resources to do it?
      - e1ven 8y ago
        I'm very glad that they've done this. The code was open, and the company decided to close it for the new versions, so it forks. Forks are common when people don't like the corporate direction of an OSS project - It's a strength, not a weakness. Openoffice/Libreoffice, Hudson/Jenkins etc. Imagine if Linus said that the next version of Linux would be paid-only. Within 15 minutes there'd be a new librelinux repo that people could contribute to instead. Someone was going to make a new fork anyway - This is Amazon putting their money where their mouth is to fund and support that new fork.
        dhd415 8y ago
        To be clear, no Elasticsearch code or features that were OSS were closed. As new Elasticsearch features are developed, some of them are now released as OSS and others are released with a commercial license.
        anth_anm 8y ago
        Okay, are you glad that Amazon now owns Elasticsearch?
      - therealx 8y ago
        If ES didn't do the weird license change thing, we wouldn't be here. Either Amazon wouldn't have used it, or they'd be paying. Including non-com features in the default install was not a good way to play things. Would you feel the same if AWS built a drop in/api compatible system from scratch?
  - tragicpapercut 8y ago
    It's not just about AWS, other people need to use this as well. Why are security features a paid for addition? Why not make core features a paid for addition instead? I've always hated Elastic (the company) for this decision, please stop trying to give away free things that are not secure, and then charge for security.
  - _msw_ 8y ago
    I'd recommend browsing the code to find out more about the security module: https://github.com/opendistro-for-elasticsearch/security/blob/master/src/main/java/com/amazon/opendistroforelasticsearch/security/OpenDistroSecurityPlugin.java https://github.com/opendistro-for-elasticsearch/security/blo...
- termez442 8y ago
  From a look at the source code, Amazon has Apached 2.0 the entire Floragunn Searchguard codebase (including the commercial part)
edraferi 8y ago
> why wasn't ElasticSearch SQL used / built upon for SQL? According to the release blogpost [0], "SQL Support [...]is an improved version of the elasticsearch-sql plugin." Sounds like they are building on it, as you suggested. [0] https://aws.amazon.com/blogs/aws/new-open-distro-for-elastic.. https://aws.amazon.com/blogs/aws/new-open-distro-for-elastic....
stoke 8y ago
> Or why wasn't SearchGuard used / built upon for Security? https://github.com/floragunncom/search-guard https://github.com/floragunncom/search-guard Looks like it was. https://github.com/opendistro-for-elasticsearch/security-ssl/blob/master/NOTICE.txt https://github.com/opendistro-for-elasticsearch/security-ssl... floragunn GmbH Copyright 2015-2018 floragunn GmbH
unethical_ban 8y ago
Beyond the thoughtful ideas below, an official blog post would be cool for that. Specifically, Elastalert and ODfE Alerting are completely different.

by sidi 8y ago

ssgao 8y ago

For SearchGuard, only the basic auth is Apache 2.0. Anything practical you need to pay to use it.

sagichmal 8y ago
Why isn't AWS paying to use it, then? It's not like they don't have the money?
- ssgao 8y ago
  there's no "they", there's only us. AWS paying to use it means we are paying to use it. Between that and a truly Apache 2.0 project, I think it's a no-brainer for everyone.
  - sagichmal 8y ago
    Why shouldn't you pay to use it, then? More generally: why should AWS get to leverage its near-monopolistic position in the SaaS market to perform essentially hostile takeovers of the software projects it packages and runs? Simply because they have the resources to do it?
    - e1ven 8y ago
      I'm very glad that they've done this. The code was open, and the company decided to close it for the new versions, so it forks. Forks are common when people don't like the corporate direction of an OSS project - It's a strength, not a weakness. Openoffice/Libreoffice, Hudson/Jenkins etc. Imagine if Linus said that the next version of Linux would be paid-only. Within 15 minutes there'd be a new librelinux repo that people could contribute to instead. Someone was going to make a new fork anyway - This is Amazon putting their money where their mouth is to fund and support that new fork.
      - dhd415 8y ago
        To be clear, no Elasticsearch code or features that were OSS were closed. As new Elasticsearch features are developed, some of them are now released as OSS and others are released with a commercial license.
      - anth_anm 8y ago
        Okay, are you glad that Amazon now owns Elasticsearch?
    - therealx 8y ago
      If ES didn't do the weird license change thing, we wouldn't be here. Either Amazon wouldn't have used it, or they'd be paying. Including non-com features in the default install was not a good way to play things. Would you feel the same if AWS built a drop in/api compatible system from scratch?
- tragicpapercut 8y ago
  It's not just about AWS, other people need to use this as well. Why are security features a paid for addition? Why not make core features a paid for addition instead? I've always hated Elastic (the company) for this decision, please stop trying to give away free things that are not secure, and then charge for security.
- _msw_ 8y ago
  I'd recommend browsing the code to find out more about the security module: https://github.com/opendistro-for-elasticsearch/security/blob/master/src/main/java/com/amazon/opendistroforelasticsearch/security/OpenDistroSecurityPlugin.java https://github.com/opendistro-for-elasticsearch/security/blo...
termez442 8y ago
From a look at the source code, Amazon has Apached 2.0 the entire Floragunn Searchguard codebase (including the commercial part)

edraferi 8y ago

> why wasn't ElasticSearch SQL used / built upon for SQL? According to the release blogpost [0], "SQL Support [...]is an improved version of the elasticsearch-sql plugin." Sounds like they are building on it, as you suggested. [0] https://aws.amazon.com/blogs/aws/new-open-distro-for-elastic.. https://aws.amazon.com/blogs/aws/new-open-distro-for-elastic....

stoke 8y ago

> Or why wasn't SearchGuard used / built upon for Security? https://github.com/floragunncom/search-guard https://github.com/floragunncom/search-guard Looks like it was. https://github.com/opendistro-for-elasticsearch/security-ssl/blob/master/NOTICE.txt https://github.com/opendistro-for-elasticsearch/security-ssl... floragunn GmbH Copyright 2015-2018 floragunn GmbH

unethical_ban 8y ago

Beyond the thoughtful ideas below, an official blog post would be cool for that. Specifically, Elastalert and ODfE Alerting are completely different.