6 ms·

TFA explains why Elasticsearch switching to SSPL is indeed a cause for concern. Money quotes: > Basically, it’s a hostile proprietary license masquerading in o

TFA explains why Elasticsearch switching to SSPL is indeed a cause for concern. Money quotes: > Basically, it’s a hostile proprietary license masquerading in open source clothing. By using an SSPL project in your code, you are agreeing that if you provide an online service using that code then you will release not only that code but also the code for every supporting piece of software, all under the SSPL. > It’s not a stretch to interpret the wording of the license as requiring users of the SSPL’d software therefore to release the code for everything straight down to the bare metal. There are those who will point to the FAQ for the SSPL and claim that the license isn’t interpreted in that way because the FAQ says so. Unfortunately, when you agree to a license you are agreeing to the text of that license document and not to a FAQ. If the text of that license document is ambiguous, then so are your rights and responsibilities under that license... This ambiguity puts your organisation at risk. See also: http://dtrace.org/blogs/bmc/2018/12/14/open-source-confronts-its-midlife-crisis/ http://dtrace.org/blogs/bmc/2018/12/14/open-source-confronts...

Bombthecat 6y ago
Wait? Would even my devops pipeline fall under it? Or my monitoring? Deployment and management in kubernetes for example?
- ignoramous 6y ago
  SSPL is a malicious source-available license, if there ever was one: https://news.ycombinator.com/item?id=18301116 https://news.ycombinator.com/item?id=18301116 I reserve special hate for Commons Clause [0] too but SSPL is downright offensive. A reminder that F/OSS works very well for a lot of reasons [1]. The number one of which is if you want to commodize your product's complement [2][3]. Don't be a knob and F/OSS your core product if you plan to make billions or whatever. [0] https://news.ycombinator.com/item?id=17814386 https://news.ycombinator.com/item?id=17814386 [1] http://dtrace.org/blogs/bmc/2004/12/16/the-economics-of-software-redux/ http://dtrace.org/blogs/bmc/2004/12/16/the-economics-of-soft... [2] https://www.gwern.net/Complement https://www.gwern.net/Complement [3] https://www.joelonsoftware.com/2002/06/12/strategy-letter-v/ https://www.joelonsoftware.com/2002/06/12/strategy-letter-v/
  - ForHackernews 6y ago
    HN: "Hey, you're not using an FLOSS license!" Also HN: Don't be a knob and F/OSS your core product if you plan to make billions or whatever. They're doing exactly you want: picking a non-free license for their core product, and you're still mad at them.
    - ignoramous 6y ago
      Not upset because they choose SSPL but because: 1. Avarice: They rode the FOSS wave and gained industry mindshare for a conveniently long time. Now, after making (well deserved) millions on the back of it, they turn to an absurd license to basically say, fuck you, looser, I need my billions. 2. Hypocrisy: Spinning the whole thing as "doubling down on Open" with a source-available license. One must be so delusional to call out "naysayers" as spreading FUD about SSPL when the fact remains that SSPL is a landmine. 3. Short-termism: It is all fun and games till Elasticsearch is wealthy and healthy. Once some PE firm takes over when they get pushed into a corner, I can see them doing Oracle-esque law suites even if it isn't their current intention. If their core product was Elasticsearch, they could have SSPLd it from the start. I'd be curious to see where they'd have ended up then. I'd absolutely not have been upset in this scenario. The current scenario is what we are in, lets see how it pans out.
- catern 6y ago
  Yes. That's the intent, that if you have some code (such as your devops pipeline) which is used to provide some service to an end user, the end user is able to use/modify/redistribute that code to provide the same service without you being able to obstruct what they do.
- floatingatoll 6y ago
  No. None of the things you describe involve both providing service to third-parties and modifying SSPL-licensed ElasticSearch code. You are operating the code purely for your own benefit, and you are not patching SSPL-licensed code, and therefore nothing from this discussion is applicable to your described use case. (I'm not your lawyer, etc.)
- aravindputrevu 6y ago
  This change only applies if you are offering Elasticsearch and Kibana _directly_ as a service. It doesn't impact your devops pipeline or your monitoring workload(s). Link to FAQ: https://www.elastic.co/pricing/faq/licensing https://www.elastic.co/pricing/faq/licensing
- Qub3d 6y ago
  I would like to point out to anyone else perusing these comments the issue a lot of people are raising in the comments can be summed up in the two responses to the parent: https://news.ycombinator.com/item?id=25782849 https://news.ycombinator.com/item?id=25782849 https://news.ycombinator.com/item?id=25784581 https://news.ycombinator.com/item?id=25784581 The ambiguity is the problem. Yes, the FAQ/A Developer/A Company has said they really mean (A), but the license text, which is the legally binding part, is ambiguous. Even if a judge supports the freest reading of the license, you have to go through the time and resources to get in front of a judge. For FOSS, this means the majority of projects that run on a scattering of donations + developer free time are dead in the water the first time someone tries to hit them with a Cease and Desist or similar.
matthewowen 6y ago
How true is this, in practice? I hear software folks say this sort of thing somewhat frequently, but I haven't heard it from a _legal_ person. And my general sense and understanding is that although an FAQ style clarification is not _perfect_, it _does_ carry non-trivial weight. Judges are not totally capricious people making arbitrary decisions: the notion that in a dispute they would just cast aside one party's _clear and well documented intent_ to narrow the scope of the burden they place on another is... well, it doesn't seem all that credible to me. Of course by the time you get to that point in a legal dispute you're already in some trouble. But IDK, I'm just a software person speculating. Is there a legal person interested in giving their "not legal advice" perspective on this?
- ignoramous 6y ago
  I'd rather stick to the license text (than rely on mental gymnastics to justify any interpretation based on a FAQ) to be upheld in the Court of Law. Btw, note how MPLv2 FAQ page clearly points out that the FAQ doesn't give anyone a license to freely interpret the license itself: > ...while this FAQ is intended to be accurate and helpful, it is not the license, and may not cover important issues that affect you and your specific situation. As a result, reading the FAQ should not serve as a substitute for reading the license itself, or for seeking legal advice from a lawyer. https://www.mozilla.org/en-US/MPL/2.0/FAQ/ https://www.mozilla.org/en-US/MPL/2.0/FAQ/
- halbritt 6y ago
  In my experience, corporate lawyers don't really understand the distinction and will opt for the route of least risk, which generally entails a commercial relationship with the company. Unfortunately, neither Mongo nor Elastic really offer useful commercial relationships. That is, pay them a sum and be free to use the widely adopted open-source version of their thing. The overhead to those relationships for what they do offer is significant.
  - freeone3000 6y ago
    Mongo absolutely offers this. A company I worked for had a contract with them -- these terms are hugely expensive, to the point it was worth switching to the AWS version when we had no AWS services.
rudolph9 6y ago
Isn’t it a dual license, and the existing license isn’t going away?
- bigiain 6y ago
  It used to be Apache 2.0. You now get to choose between SSPL and "Elastic License".
- z77dj3kl 6y ago
  The current open-source Apache 2 license is being replaced by two proprietary, source-available licenses. Of course this only applies to future releases.
softwaredoug 6y ago
Here's the actual language from SSPL > If you make the functionality of the Program or a modified version available to third parties as a service... (license conditions apply) > “The Program” refers to any copyrightable work licensed under this License. IANAL, but that seems pretty cut and dry referring to making an Elasticsearch or Kibana service
- c2h5oh 6y ago
  Next sentence is > Making the functionality of the Program or modified version available to third parties as a service includes, without limitation, enabling third parties to interact with the functionality of the Program or modified version remotely through a computer network, offering a service the value of which entirely or primarily derives from the value of the Program or modified version. and IMO (IANAL) that would put some of the services that offer log ingestion / indexing / querying in legal gray area.
  - lmeyerov 6y ago
    There's quite a cottage industry of SIEMS that wrap ELK, so I'm curious how this'll shake out... I do empathize with the desire to safely open their code for all/most users and their attempt to use SSPL to do it. For Graphistry, we ended up going proprietary for our core GPU visual analytics and went open for more generic infra and client codes, e.g., launched one of the Apache Arrow languages and our popular Python/Jupyter lib. I'm still looking forward to the day we can open our core as well (all our $B/$T partners ask us to, and yet ;-)). Encouragingly, our users are increasingly preferring the marketplace + saas versions, so I remain optimistic about an SSPL-ish license. That 90%+ of ES users go with SSPL is promising!
- thayne 6y ago
  But there is also > Making the functionality of the Program or modified version available to third parties as a service includes, without limitation, enabling third parties to interact with the functionality of the Program or modified version remotely through a computer network, offering a service the value of which entirely or primarily derives from the value of the Program or modified version, or offering a service that accomplishes for users the primary purpose of the Program or modified version. From what I understand the big question is, where is the line on if value is derived primarily from "the Program", and what exactly constitutes modifying the program.

Bombthecat 6y ago

Wait? Would even my devops pipeline fall under it? Or my monitoring? Deployment and management in kubernetes for example?

ignoramous 6y ago
SSPL is a malicious source-available license, if there ever was one: https://news.ycombinator.com/item?id=18301116 https://news.ycombinator.com/item?id=18301116 I reserve special hate for Commons Clause [0] too but SSPL is downright offensive. A reminder that F/OSS works very well for a lot of reasons [1]. The number one of which is if you want to commodize your product's complement [2][3]. Don't be a knob and F/OSS your core product if you plan to make billions or whatever. [0] https://news.ycombinator.com/item?id=17814386 https://news.ycombinator.com/item?id=17814386 [1] http://dtrace.org/blogs/bmc/2004/12/16/the-economics-of-software-redux/ http://dtrace.org/blogs/bmc/2004/12/16/the-economics-of-soft... [2] https://www.gwern.net/Complement https://www.gwern.net/Complement [3] https://www.joelonsoftware.com/2002/06/12/strategy-letter-v/ https://www.joelonsoftware.com/2002/06/12/strategy-letter-v/
- ForHackernews 6y ago
  HN: "Hey, you're not using an FLOSS license!" Also HN: Don't be a knob and F/OSS your core product if you plan to make billions or whatever. They're doing exactly you want: picking a non-free license for their core product, and you're still mad at them.
  - ignoramous 6y ago
    Not upset because they choose SSPL but because: 1. Avarice: They rode the FOSS wave and gained industry mindshare for a conveniently long time. Now, after making (well deserved) millions on the back of it, they turn to an absurd license to basically say, fuck you, looser, I need my billions. 2. Hypocrisy: Spinning the whole thing as "doubling down on Open" with a source-available license. One must be so delusional to call out "naysayers" as spreading FUD about SSPL when the fact remains that SSPL is a landmine. 3. Short-termism: It is all fun and games till Elasticsearch is wealthy and healthy. Once some PE firm takes over when they get pushed into a corner, I can see them doing Oracle-esque law suites even if it isn't their current intention. If their core product was Elasticsearch, they could have SSPLd it from the start. I'd be curious to see where they'd have ended up then. I'd absolutely not have been upset in this scenario. The current scenario is what we are in, lets see how it pans out.
catern 6y ago
Yes. That's the intent, that if you have some code (such as your devops pipeline) which is used to provide some service to an end user, the end user is able to use/modify/redistribute that code to provide the same service without you being able to obstruct what they do.
floatingatoll 6y ago
No. None of the things you describe involve both providing service to third-parties and modifying SSPL-licensed ElasticSearch code. You are operating the code purely for your own benefit, and you are not patching SSPL-licensed code, and therefore nothing from this discussion is applicable to your described use case. (I'm not your lawyer, etc.)
aravindputrevu 6y ago
This change only applies if you are offering Elasticsearch and Kibana _directly_ as a service. It doesn't impact your devops pipeline or your monitoring workload(s). Link to FAQ: https://www.elastic.co/pricing/faq/licensing https://www.elastic.co/pricing/faq/licensing
Qub3d 6y ago
I would like to point out to anyone else perusing these comments the issue a lot of people are raising in the comments can be summed up in the two responses to the parent: https://news.ycombinator.com/item?id=25782849 https://news.ycombinator.com/item?id=25782849 https://news.ycombinator.com/item?id=25784581 https://news.ycombinator.com/item?id=25784581 The ambiguity is the problem. Yes, the FAQ/A Developer/A Company has said they really mean (A), but the license text, which is the legally binding part, is ambiguous. Even if a judge supports the freest reading of the license, you have to go through the time and resources to get in front of a judge. For FOSS, this means the majority of projects that run on a scattering of donations + developer free time are dead in the water the first time someone tries to hit them with a Cease and Desist or similar.

matthewowen 6y ago

How true is this, in practice? I hear software folks say this sort of thing somewhat frequently, but I haven't heard it from a _legal_ person. And my general sense and understanding is that although an FAQ style clarification is not _perfect_, it _does_ carry non-trivial weight. Judges are not totally capricious people making arbitrary decisions: the notion that in a dispute they would just cast aside one party's _clear and well documented intent_ to narrow the scope of the burden they place on another is... well, it doesn't seem all that credible to me. Of course by the time you get to that point in a legal dispute you're already in some trouble. But IDK, I'm just a software person speculating. Is there a legal person interested in giving their "not legal advice" perspective on this?

ignoramous 6y ago
I'd rather stick to the license text (than rely on mental gymnastics to justify any interpretation based on a FAQ) to be upheld in the Court of Law. Btw, note how MPLv2 FAQ page clearly points out that the FAQ doesn't give anyone a license to freely interpret the license itself: > ...while this FAQ is intended to be accurate and helpful, it is not the license, and may not cover important issues that affect you and your specific situation. As a result, reading the FAQ should not serve as a substitute for reading the license itself, or for seeking legal advice from a lawyer. https://www.mozilla.org/en-US/MPL/2.0/FAQ/ https://www.mozilla.org/en-US/MPL/2.0/FAQ/
halbritt 6y ago
In my experience, corporate lawyers don't really understand the distinction and will opt for the route of least risk, which generally entails a commercial relationship with the company. Unfortunately, neither Mongo nor Elastic really offer useful commercial relationships. That is, pay them a sum and be free to use the widely adopted open-source version of their thing. The overhead to those relationships for what they do offer is significant.
- freeone3000 6y ago
  Mongo absolutely offers this. A company I worked for had a contract with them -- these terms are hugely expensive, to the point it was worth switching to the AWS version when we had no AWS services.

rudolph9 6y ago

Isn’t it a dual license, and the existing license isn’t going away?

bigiain 6y ago
It used to be Apache 2.0. You now get to choose between SSPL and "Elastic License".
z77dj3kl 6y ago
The current open-source Apache 2 license is being replaced by two proprietary, source-available licenses. Of course this only applies to future releases.

softwaredoug 6y ago

Here's the actual language from SSPL > If you make the functionality of the Program or a modified version available to third parties as a service... (license conditions apply) > “The Program” refers to any copyrightable work licensed under this License. IANAL, but that seems pretty cut and dry referring to making an Elasticsearch or Kibana service

c2h5oh 6y ago
Next sentence is > Making the functionality of the Program or modified version available to third parties as a service includes, without limitation, enabling third parties to interact with the functionality of the Program or modified version remotely through a computer network, offering a service the value of which entirely or primarily derives from the value of the Program or modified version. and IMO (IANAL) that would put some of the services that offer log ingestion / indexing / querying in legal gray area.
- lmeyerov 6y ago
  There's quite a cottage industry of SIEMS that wrap ELK, so I'm curious how this'll shake out... I do empathize with the desire to safely open their code for all/most users and their attempt to use SSPL to do it. For Graphistry, we ended up going proprietary for our core GPU visual analytics and went open for more generic infra and client codes, e.g., launched one of the Apache Arrow languages and our popular Python/Jupyter lib. I'm still looking forward to the day we can open our core as well (all our $B/$T partners ask us to, and yet ;-)). Encouragingly, our users are increasingly preferring the marketplace + saas versions, so I remain optimistic about an SSPL-ish license. That 90%+ of ES users go with SSPL is promising!
thayne 6y ago
But there is also > Making the functionality of the Program or modified version available to third parties as a service includes, without limitation, enabling third parties to interact with the functionality of the Program or modified version remotely through a computer network, offering a service the value of which entirely or primarily derives from the value of the Program or modified version, or offering a service that accomplishes for users the primary purpose of the Program or modified version. From what I understand the big question is, where is the line on if value is derived primarily from "the Program", and what exactly constitutes modifying the program.