4 ms·

> By using an SSPL project in your code, you are agreeing that if you provide an online service using that code then you will release not only that code but als

> By using an SSPL project in your code, you are agreeing that if you provide an online service using that code then you will release not only that code but also the code for every supporting piece of software, all under the SSPL. It’s not a stretch to interpret the wording of the license as requiring users of the SSPL’d software therefore to release the code for everything straight down to the bare metal This seems to be an issue of people not being able to figure out what the license actually would imply if challenged in court. I think this is a fair argument, at that point, even a full on proprietary license where you ha e to pay to use ElasticSearch and Kibanna might be seems as less risky by business lawyers. Now, I'm not a lawyer, but this makes me wonder how is "law" supposed to handle scenarios like this? Is law at a point that even reading the license terms that you agree with isn't good enough to know what you're agreeing too? Isn't law supposed to be about agreeing to things ahead of time so there is no surprises? So what's failing here?

slimsag 6y ago
I think there is a breakdown between how lawyers (and, perhaps courts - but none of this is really tried in court so that remains to be seen) interpret what software engineers mean when they say things because there is a lot of nuance to capture. One can imagine the client going to their lawyers and spending a hefty amount of money for them to produce the SSPL license in a good spirit, but coming out with something like this which is ambiguous and weighted in favor of the SSPL provider (Elasticsearch, etc.) because when there is ambiguity lawyers tend to prefer ambiguity in favor of their client, not the other party.
tinco 6y ago
She's saying it's not a stretch to interpret it in such a way. So there wouldn't be any surprises. This is the paragraph he's talking about: > “Service Source Code” means the Corresponding Source for the Program or the modified version, and the Corresponding Source for all programs that you use to make the Program or modified version available as a service, including, without limitation, management software, user interfaces, application program interfaces, automation software, monitoring software, backup software, storage software and hosting software, all such that a user could run an instance of the service using the Service Source Code you make available. IANAL, but I agree with the assessment that this means all the way to the bare metal. If you're running te Elastic on Windows or some other proprietary OS, this will be a problem for you. In any case, that's not the problematic part of the SSPL, everyone runs on open source infrastructure anyway. The real problematic part is this paragraph: > If you make the functionality of the Program or a modified version available to third parties as a service, you must make the Service Source Code available via network download to everyone at no charge, under the terms of this License. Making the functionality of the Program or modified version available to third parties as a service includes, without limitation, enabling third parties to interact with the functionality of the Program or modified version remotely through a computer network, offering a service the value of which entirely or primarily derives from the value of the Program or modified version, or offering a service that accomplishes for users the primary purpose of the Program or modified version. This one needs a judge to set the boundaries. The last sentence is long and a bit complex, but the vague part is this: "offering a service the value of which entirely or primarily derives from the value of the Program or modified version". A charitable reading suggests the intent is to target only those services that offer no value but the value of Elastic itself. For example if you run a website that let's a user sort through a bunch of documents that are stored in Elastic, then the "primary" value probably lies in the documents that you have gathered for your users. But the line is not so clear when the user supplies the documents as well. I'm pretty sure in that last case there is no way a judge would not conclude the primary value is that of Elastic. So yeah, that's a business risk, is your business just a clever packaging of Elastic, or is Elastic just the icing on the value you're delivering to your customers? Would a judge agree with that assessment? Better have your expensive IT staff explain that to your expensive lawyer team.
- vmbrasseur 6y ago
  He is not a he. He is a she.
  - tinco 6y ago
    Ah my apologies.
- didibus 6y ago
  That does seem a little concerning. You're right, it seems that there can be a debate on the case where you are a SaaS, for someone to say that the value of your SaaS is all in its use of ElasticSearch, in which case you'd need to release all your code publicly and open source, so basically make your entire SaaS open source as well under SSPL. So it seems like a copyleft license in some way, where usage of Elastic could result in you having to publish your source under SSPL as well. But it's extreme in that it's not just your changes to the ElasticSearch source, but your entire stack. Honestly, I feel maybe ElasticSearch just doesn't want proprietary companies using it anymore. Either those need to use their ElasticSearch managed service or the Amazon one, or they need to themselves become an SSPL open source solution.

slimsag 6y ago

I think there is a breakdown between how lawyers (and, perhaps courts - but none of this is really tried in court so that remains to be seen) interpret what software engineers mean when they say things because there is a lot of nuance to capture. One can imagine the client going to their lawyers and spending a hefty amount of money for them to produce the SSPL license in a good spirit, but coming out with something like this which is ambiguous and weighted in favor of the SSPL provider (Elasticsearch, etc.) because when there is ambiguity lawyers tend to prefer ambiguity in favor of their client, not the other party.

tinco 6y ago

She's saying it's not a stretch to interpret it in such a way. So there wouldn't be any surprises. This is the paragraph he's talking about: > “Service Source Code” means the Corresponding Source for the Program or the modified version, and the Corresponding Source for all programs that you use to make the Program or modified version available as a service, including, without limitation, management software, user interfaces, application program interfaces, automation software, monitoring software, backup software, storage software and hosting software, all such that a user could run an instance of the service using the Service Source Code you make available. IANAL, but I agree with the assessment that this means all the way to the bare metal. If you're running te Elastic on Windows or some other proprietary OS, this will be a problem for you. In any case, that's not the problematic part of the SSPL, everyone runs on open source infrastructure anyway. The real problematic part is this paragraph: > If you make the functionality of the Program or a modified version available to third parties as a service, you must make the Service Source Code available via network download to everyone at no charge, under the terms of this License. Making the functionality of the Program or modified version available to third parties as a service includes, without limitation, enabling third parties to interact with the functionality of the Program or modified version remotely through a computer network, offering a service the value of which entirely or primarily derives from the value of the Program or modified version, or offering a service that accomplishes for users the primary purpose of the Program or modified version. This one needs a judge to set the boundaries. The last sentence is long and a bit complex, but the vague part is this: "offering a service the value of which entirely or primarily derives from the value of the Program or modified version". A charitable reading suggests the intent is to target only those services that offer no value but the value of Elastic itself. For example if you run a website that let's a user sort through a bunch of documents that are stored in Elastic, then the "primary" value probably lies in the documents that you have gathered for your users. But the line is not so clear when the user supplies the documents as well. I'm pretty sure in that last case there is no way a judge would not conclude the primary value is that of Elastic. So yeah, that's a business risk, is your business just a clever packaging of Elastic, or is Elastic just the icing on the value you're delivering to your customers? Would a judge agree with that assessment? Better have your expensive IT staff explain that to your expensive lawyer team.

vmbrasseur 6y ago
He is not a he. He is a she.
- tinco 6y ago
  Ah my apologies.
didibus 6y ago
That does seem a little concerning. You're right, it seems that there can be a debate on the case where you are a SaaS, for someone to say that the value of your SaaS is all in its use of ElasticSearch, in which case you'd need to release all your code publicly and open source, so basically make your entire SaaS open source as well under SSPL. So it seems like a copyleft license in some way, where usage of Elastic could result in you having to publish your source under SSPL as well. But it's extreme in that it's not just your changes to the ElasticSearch source, but your entire stack. Honestly, I feel maybe ElasticSearch just doesn't want proprietary companies using it anymore. Either those need to use their ElasticSearch managed service or the Amazon one, or they need to themselves become an SSPL open source solution.