10 ms·

Doubling down on permissive licensing and the Elasticsearch lockdown

120 points by carlotasoto 6y ago

berkes 6y ago
> What is “not ok” is the fact that switching to a GPL based license forces projects depending on the code like CrateDB to use a fork since it kills the business model. If your business model cannot survive when a critical upstream piece of your infrastructure moves to GPL, you probably have a bad business model to begin with. They say: > We would never have chosen Elasticsearch in the first place, had it been licensed under the GPL as some of our customers (and many large enterprises do by default) banned GPL licensed software from their application stacks for legal risks. Which is completely new to me. There are numerous examples of software that has a successfull business model, and is GPL or GPL compatible. From WordPress to MySQL, and from ProtonMail to PostgreSQL (GPL compatible). Used in enterprise, and other large organisations, just fine. It sounds like they are making up excuses for not wanting to fully Open Source their code; which is fine. But don't blame upstream for your reluctance or inability to adhere to this.
- temp667 6y ago
  PostgreSQL is explicitly NOT GPL (it's basically a very permissive BSD / MIT style license). More here: https://www.postgresql.org/about/licence/ https://www.postgresql.org/about/licence/ See section and links for "Why not the GNU General Public License?" It's not GPL for some of the same reasons described here and enterprise does like it.
  - fartcannon 6y ago
    Hmm, I went to go find the 'why not GPL' section but they just say, 'because' and then link to their mailing lists.. but not (as far as I can see) to the relevant thread. Do you happen to know where it's located? Is there not an html version somewhere?
    - temp667 6y ago
      I think they got tired of having folks argue with them about the license. In short though - was developed at berkeley so released under a BSD license. The license has served them well (there are a lot of commercial entities supporting postgresql development, and lots of others with various forks). And finally, it would be hard to change at this point and they don't see a gain. A note - in contrast to Elastic, there is no one copyright holder with postgresql. So this makes it much hard to get a relicense to for example a situation where one commercial entity has a special right to the terms / relicensing power.
      - yjftsjthsd-h 6y ago
        That doesn't sound quite right: MIT/BSD licenses are GPL compatible; you could trivially release MIT code under the GPL. I believe that's what https://www.hyperbola.info/ https://www.hyperbola.info/ is doing, for example.
        temp667 6y ago
        It's compatible, but if Postgresql wanted to go harder copyleft and switch the license for future releases, they'd need to get pretty broad agreement, and that would be difficult, there are a lot of corps / enterprise players in the ecosystem, and things like (a)GPLv3 are often totally banned. Is GPLv3 software even allowed in the Apple iphone App Store? The Windows Phone app store?
    - munk-a 6y ago
      GPL is a big hammer you can use to force back contribution into the project and ensure that folks that use the software actually contribution to it continuing to be available and relevant - if Postgres has been able to sustain themselves for all these years with a more permissive license then why would they risk going GPL and scaring off a lot of their customers just to ensure that each customer that remains can be forced to back-contribute any innovations they make. (please note that GPL doesn't in actuality force anyone to back-contribute but in effect it tends to work that way - it actually puts a lot of responsibility on the original authors to re-acquire improved versions of the library but it does ensure that those improved versions are accessible in some manner)
- ArchOversight 6y ago
  > It sounds like they are making up excuses for not wanting to fully Open Source their code; which is fine. But don't blame upstream for your reluctance or inability to adhere to this. They are changing the license on ALL of their source code. How is this making up excuses? Second, I know plenty of companies where MySQL or Wordpress are not allowed to be used because they are GPL. PostgreSQL is NOT GPL and thus is allowed.
  - ForHackernews 6y ago
    > Second, I know plenty of companies where MySQL or Wordpress are not allowed to be used because they are GPL. The fact that some companies have incompetent legal teams isn't a good argument against the GPL. There's no reason you can't use Wordpress to back a commercial website.
    - derefr 6y ago
      It's not about "backing a commercial website"; it's about selling a solution for your own customers to use, where WordPress might be a component of that offered solution, customized into being something else (e.g. a control panel.) There are concerns that doing so, in the context of a monorepo, might infect your entire codebase — including the components that have nothing to do with the control-panel, and so never touch the Wordpress stuff — with GPL. Of course, you can architect code to get around that, e.g. building your shared architecture that the control-panel uses as a library, and then pulling that lib in from your isolated Wordpress control-panel codebase. But enterprises don't want to be forced into (possibly sub-optimal) architectures just because one component legally requires it. They'd rather just not use that component, so that their architecture can be totally determined by what's best for their development.
      - ForHackernews 6y ago
        Sure, okay, fine. I realize this is an ideological position (and not necessarily a popular one on this board) but that's the point of the GPL. If certain companies lose out because they're afraid to share, then they have no one to blame but themselves. The pitch is that the world of free software can, collectively, build better software for everyone sharing, than the proprietary islands who selfishly cut themselves off from that ocean.
- proddata 6y ago
  > If your business model cannot survive when a critical upstream piece of your infrastructure moves to GPL, you probably have a bad business model to begin with. To be clear CrateDB started out as OSS and we decide to stay OSS. Elasticsearch used the Apache License and so did CrateDB. All in the spirit of OSS. Elastic are however now the ones how decided, that their business model isn't viable anymore. > It sounds like they are making up excuses for not wanting to fully Open Source their code We do want to make it fully open source! Everything that was under a more restrictive License is going to be offered under Apache License.
  - berkes 6y ago
    Thanks for correcting me! > We do want to make it fully open source! This begs the question: isn't "a restrictive OSS licence" not less "fully open source" than a more permissive licence like GPL, MIT or BSD? If you are fully committed to OSS, why not go full-oss, instead of retaining control through a restrictive OSS licence? Is that really only because of some enterprises not liking GPL?
    - proddata 6y ago
      > This begs the question: isn't "a restrictive OSS licence" not less "fully open source" than a more permissive licence like GPL, MIT or BSD? We gonna change CrateDB fully to Apache License v2 ;) I would say that counts as a "more permissive" license. > Is that really only because of some enterprises not liking GPL? There are various reasons for the change. A big part is definitely also the spirit of many our contributors. We built CrateDB on open source software and also want to make the software available as open source. It also was planned for quite some time to be more open.
    - eeZah7Ux 6y ago
      > why not go full-oss, instead of retaining control through a restrictive OSS licence? The main point of copyleft is to pass down freedoms to use/modify/distribute all the way to the end user. Instead we got locked-down privacy-breaching smartphones, IoT devices, SaaS, where only the manufacturer benefits from OSS.
- e12e 6y ago
  > We would never have chosen Elasticsearch in the first place, had it been licensed under the GPL as some of our customers (and many large enterprises do by default) banned GPL licensed software from their application stacks for legal risks. So, they don't run Linux, don't use glibc? That can't be all that common? (I mean sure, there's the bsds.. But still..).
  - proddata 6y ago
    > So, they don't run Linux, don't use glibc? That can't be all that common? (I mean sure, there's the bsds.. But still..). We do run Linux :) But there is a difference between building on and building with.
  - dd_roger 6y ago
    The problem is not using a GPL software internally, but using it in a product that you'd want to sell and at this point be forced to opensource your entire product. Despite what some people like to pretend there's basically no scalable business model outside of SaaS that will make you any money selling GPL-licensed software so this situation is extremely undesireable.
- tracker1 6y ago
  MySQL is a poor example... for a while, their client library license was GPL and insisted that anything not using a commercial license needed to be GPL, which is one of the reasons I pushed against MySQL for a long time, one of a long list of reasons over the years.
- munk-a 6y ago
  > If your business model cannot survive when a critical upstream piece of your infrastructure moves to GPL, you probably have a bad business model to begin with. I think they appear to be surviving just fine - they are switching forks not shuttering their doors or even withdrawing ES compatibility. Suddenly changing licenses to increase how restrictive it is absolutely is a nightmare scenario to a lot of businesses and it quite rationally is so. We share software and build on each other's shoulders, to reject that and build everything from scratch is silly and fiscally irresponsible. I'm very confused why this is so strongly stated when it's likely that most of us have, at one point, sat down with two pieces of libraries and gone with the less useful one due to licensing issues.
- mikl 6y ago
  GPL has the well-known web services loophole, that effectively makes copy-left protections moot. Without that, Wordpress and other GPL-licensed web CMS/frameworks would never have taken off like they have. As for MySQL, notice how no one builds anything on top of it (like TimescaleDB and others did with PostgreSQL), but just uses MySQL as-is without modifying it, also rendering copy-left moot.
- GordonS 6y ago
  >> some of our customers (and many large enterprises do by default) banned GPL licensed software from their application stacks for legal risks. > Which is completely new to me I work in a consultancy for enterprise-scale customers - every.single.one prohibits the use of GPL libraries and frameworks.
temp667 6y ago
The Elasticsearch SPPL is going to be pretty incompatible with many or most contributors business models and personal needs. The question is will the community harmonize around 1-2 forks or will the there not be enough critical mass in a fork to keep things going.
- jasontedor 6y ago
  Jason from Elastic here. I want to clarify one aspect here. Elasticsearch and Kibana will be dual licensed under the Elastic License or the SSPL license, not only SSPL. The distributions that we provide will be licensed under the Elastic License, which does not have the copyleft requirements that are sometimes concerning to legal teams. That is, if you download our distribution and run it in your infrastructure, you are subject to the Elastic License. The same license that most (90%+) of our users are already running under today, when they download our default distribution from elastic.co. This is why we say the vast majority of our users are not impacted by this change. Note: we are considering making changes to the Elastic License to simplify it. Please see more on our [blog][0]. Disclaimer: I am on the Elasticsearch team and work for Elastic; I welcome any and all feedback. [0]: https://www.elastic.co/blog/license-change-clarification https://www.elastic.co/blog/license-change-clarification
  - Xylakant 6y ago
    How is the elastic license any more compatible with the needs of other open source projects than the SSPL? Before, elasticsearch and/or kibana were usable together with (A)GPL licensed code. That’s no longer the case, neither under SSPL nor under the elastic license. The fact that most users use the basic license may well be explained by two things: A) Your website offers it as the primary download. B) Elasticsearch without the basic licensed modules lacks severely when it comes to security features. It doesn’t even offer basic auth, let alone TLS or similar.
  - temp667 6y ago
    Sure. The Elastic license is also a change from Apache 2.0, and is also not an OSI approved license as far as I am aware. Doesn't the elastic license specifically limit use of software to basic features, prohibit modification of licensing control mechanisms etc. I haven't dug through it, but it seemed FAR FAR different than a normal open source license. One question I had - is the Elastic license transferable? Ie, if you run a startup and are bought out with an asset buyout, can you transfer the stack including the Elastic licensed software to the acquiring party (assuming in the interim elastic has ceased to offer new elastic licenses so they can't get their own). Can you sell software built out on elastic licensed code and transfer the elastic license to the users so they can also use it? Or does everyone need to go back to elastic to get these licenses. A lot of discussion about being open, but reading the details - seems far from open at first glance.
anderspitman 6y ago
I find it fascinating to wonder whether it's better to go permissive and risk Amazon "stealing" your work vs going copyleft and risk never getting big enough for Amazon to care. Even if Amazon is making 10x more money than your off your code, you might still be making more than you otherwise would, due to exposure. Anyone aware of any hard numbers/research on this?
- cardanome 6y ago
  The issues is not so much Amazon making money from it but Amazon acting as a direct competitor against their own cloud offering. Personally I am happy about their decisions, as it stops the bleeding caused by big monopolistic corporations while protecting the freedom of users like me.
  - anderspitman 6y ago
    But the question is would you have ever even known it existed or trusted it if Amazon hadn't picked it up and made it big?
    - chrisco255 6y ago
      Elasticsearch? Of course you would, it's the most well known open source search tool and has been for the better part of a decade.
      - ineedasername 6y ago
        For about 6 years of that past decade it has been a major offering of AWS. You can't claim it would be as popular without AWS by just pointing to it's popularity during the period of time that AWS has used it. A significant amount of it's current popularity occured after AWS began offering it. Even without that, how many would have adopted it without it's permissive licenses? Probably none of the major cloud offerings, which would have severely limited growth given the continuing sig ificant shift from on-prem to cloud during that period of time.
rafaelturk 6y ago
Kudos! Highly recommended article [1] about what the ES move realy means 1. https://anonymoushash.vmbrasseur.com/2021/01/14/elasticsearch-and-kibana-are-now-business-risks https://anonymoushash.vmbrasseur.com/2021/01/14/elasticsearc...
- nealmcb2 6y ago
  That article makes good points, but doesn't even mention the obvious alternative: join the fork that Amazon immediately announced, the need for which has also been supported by other significant contributors besides CrateDB like Logz.io and Aiven. See https://www.zdnet.com/article/aws-as-predicted-is-forking-elasticsearch/ https://www.zdnet.com/article/aws-as-predicted-is-forking-el...
galkk 6y ago
This is the great, concise callout that is clearer than hundreds of messages in HN discussions.
- quink 6y ago
  That's because Elastic did their own great, concise callout, it's just a little bit hard to find for those not following things closely: Announcement from 2018: > "We did not change the licence of any of the Apache 2.0 code of Elasticsearch [...] and we never will" Edited announcement in 2021: > "We did not change the licence of any of the Apache 2.0 code of Elasticsearch [...] and we never will¹" > ¹ [...] we announced a further change to our licensing strategy.
  - proddata 6y ago
    The thing is, that all the arguments they now bring up for the move, have been true in 2018 as well ...
jwildeboer 6y ago
Red Hatter speaking. You can be quite succesful with GPL licensed code. #justsayin
bkuhn 6y ago
It seems to me that almost everything that needs to be said about the SS Public License has already been said. I have even posted twice about it (and related issues) myself a few times: https://sfconservancy.org/blog/2018/oct/16/mongodb-copyleft-drafting/ https://sfconservancy.org/blog/2018/oct/16/mongodb-copyleft-... https://sfconservancy.org/blog/2020/jan/06/copyleft-equality/ https://sfconservancy.org/blog/2020/jan/06/copyleft-equality... The only thing I haven't seen said succinctly, although it's been hinted at by many, is this: There is no one on the planet yet who has agreed that they will run a project under the SS Public License and be themselves bound by the SS Public License. That really says it all. Whatever your view about copyleft licenses generally: legitimate and well-intentioned copyleft licenses (e.g., CC-BY-SA, GPL, and Affero GPL) have many projects that use the license in an inbound=outbound contributor licensing fashion. All (two of the) SS Public License uses have a strict CLA that give the publishing entity non-SS-Public-Licensed rights to the contributions. We shouldn't take anyone seriously who promulgates a license but won't use it themselves in an inbound=outbound way. Period. I suggest we all try to not give further interest to this clearly risible licensing proposals from MongoDB and Elastic. If there's energy to focus here, I'd say it's toward figuring out how to handle good governance of forks of these two projects. I hope folks can maintain the discipline to discern and bifricate these two very different issues.
- ocdtrekkie 6y ago
  It's worth noting that Crate isn't contesting that SSPL is a perfectly legitimate open source license, it's the GPL part that's the issue for them. GPL and AGPL are just as much used to "poison the well" for potential competitors to a product also released as open source, and dual licensing strategies are a well-known part of open source businesses. This hasn't changed with SSPL at all, there's just a lot of pearl-clutching about the fact that the high and mighty OSI has not signed off on it.
  - Pet_Ant 6y ago
    > GPL and AGPL are just as much used to "poison the well" But it is also legitimately outside of the purpose as well... unlike the SSPL. The Linux kernel for example. No one has ever looked at the SSPL and said “I want to work on that project” unlike the the GPL, which I believe is the GP’s point. > There is no one on the planet yet who has agreed that they will run a project under the SS Public License and be themselves bound by the SS Public License.
hbogert 6y ago
> What is “not ok” is the fact that switching to a GPL based license forces projects depending on the code like CrateDB to use a fork since it kills the business model. This is the most important statement, yet they don't explain why it kills their business model Also, did I miss something in the SSPL wording? is the consensus really that SSPL equates to GPL? I can see the similarity to GPLv3 in the sense that you have to provide a lot of the environment on which you run the software,but the article just equates SSPL to GPL after the first paragraph, which is a pity imo. > We would never have chosen Elasticsearch in the first place, had it been licensed under the GPL as some of our customers (and many large enterprises do by default) banned GPL licensed software from their application stacks for legal risks You should feel fine using GPLv2 in your business, if your are really opensource company (if there is such a thing.) That's really an opinionated statement by someone who doesn't even have business, but please comment; why would they care if they're the ones making the FOSS plugins and will only see changes going back upstream.
mikl 6y ago
SS Public License + CLA is basically Elastic (or Mongo) making their software “open source for me, but not for thee”. They are free to use the contributions of everyone for any purpose they wish, but everyone else is curtailed and limited. It’ll be interesting to see if their “eat the cake and have it too” move works. I hope not.
rob74 6y ago
Aside from this particular fracas, it's fascinating to see the proponents of "copyleft" and "permissive" licenses argue again about who is "freer": Elastic announced the license change with a blog post titled "Doubling down on open" (https://www.elastic.co/blog/licensing-change https://www.elastic.co/blog/licensing-change). Then these guys come along with a blog post "Doubling Down on Permissive Licensing and the Elasticsearch Lockdown" which accuses Elastic of "locking down" their code because they switched to a non-permissive license which in their view is "less free". Reminds me of Trump trying to steal the election by accusing the other side of stealing the election. But in that case it was at least easier to find out who was lying...
luord 6y ago
While I have no problem with copyleft licenses (at least those approved by the OSI) and in fact think that they should probably use the AGPL, I commend them for sticking to their guns and commitment to open source.
dathinab 6y ago
So the conclusion is we need a Apache v2 license with a extra "this software as a service" forbidding clause...

120 points by carlotasoto 6y ago

> What is “not ok” is the fact that switching to a GPL based license forces projects depending on the code like CrateDB to use a fork since it kills the business model. If your business model cannot survive when a critical upstream piece of your infrastructure moves to GPL, you probably have a bad business model to begin with. They say: > We would never have chosen Elasticsearch in the first place, had it been licensed under the GPL as some of our customers (and many large enterprises do by default) banned GPL licensed software from their application stacks for legal risks. Which is completely new to me. There are numerous examples of software that has a successfull business model, and is GPL or GPL compatible. From WordPress to MySQL, and from ProtonMail to PostgreSQL (GPL compatible). Used in enterprise, and other large organisations, just fine. It sounds like they are making up excuses for not wanting to fully Open Source their code; which is fine. But don't blame upstream for your reluctance or inability to adhere to this.

temp667 6y ago
PostgreSQL is explicitly NOT GPL (it's basically a very permissive BSD / MIT style license). More here: https://www.postgresql.org/about/licence/ https://www.postgresql.org/about/licence/ See section and links for "Why not the GNU General Public License?" It's not GPL for some of the same reasons described here and enterprise does like it.
- fartcannon 6y ago
  Hmm, I went to go find the 'why not GPL' section but they just say, 'because' and then link to their mailing lists.. but not (as far as I can see) to the relevant thread. Do you happen to know where it's located? Is there not an html version somewhere?
  - temp667 6y ago
    I think they got tired of having folks argue with them about the license. In short though - was developed at berkeley so released under a BSD license. The license has served them well (there are a lot of commercial entities supporting postgresql development, and lots of others with various forks). And finally, it would be hard to change at this point and they don't see a gain. A note - in contrast to Elastic, there is no one copyright holder with postgresql. So this makes it much hard to get a relicense to for example a situation where one commercial entity has a special right to the terms / relicensing power.
    - yjftsjthsd-h 6y ago
      That doesn't sound quite right: MIT/BSD licenses are GPL compatible; you could trivially release MIT code under the GPL. I believe that's what https://www.hyperbola.info/ https://www.hyperbola.info/ is doing, for example.
      - temp667 6y ago
        It's compatible, but if Postgresql wanted to go harder copyleft and switch the license for future releases, they'd need to get pretty broad agreement, and that would be difficult, there are a lot of corps / enterprise players in the ecosystem, and things like (a)GPLv3 are often totally banned. Is GPLv3 software even allowed in the Apple iphone App Store? The Windows Phone app store?
  - munk-a 6y ago
    GPL is a big hammer you can use to force back contribution into the project and ensure that folks that use the software actually contribution to it continuing to be available and relevant - if Postgres has been able to sustain themselves for all these years with a more permissive license then why would they risk going GPL and scaring off a lot of their customers just to ensure that each customer that remains can be forced to back-contribute any innovations they make. (please note that GPL doesn't in actuality force anyone to back-contribute but in effect it tends to work that way - it actually puts a lot of responsibility on the original authors to re-acquire improved versions of the library but it does ensure that those improved versions are accessible in some manner)
ArchOversight 6y ago
> It sounds like they are making up excuses for not wanting to fully Open Source their code; which is fine. But don't blame upstream for your reluctance or inability to adhere to this. They are changing the license on ALL of their source code. How is this making up excuses? Second, I know plenty of companies where MySQL or Wordpress are not allowed to be used because they are GPL. PostgreSQL is NOT GPL and thus is allowed.
- ForHackernews 6y ago
  > Second, I know plenty of companies where MySQL or Wordpress are not allowed to be used because they are GPL. The fact that some companies have incompetent legal teams isn't a good argument against the GPL. There's no reason you can't use Wordpress to back a commercial website.
  - derefr 6y ago
    It's not about "backing a commercial website"; it's about selling a solution for your own customers to use, where WordPress might be a component of that offered solution, customized into being something else (e.g. a control panel.) There are concerns that doing so, in the context of a monorepo, might infect your entire codebase — including the components that have nothing to do with the control-panel, and so never touch the Wordpress stuff — with GPL. Of course, you can architect code to get around that, e.g. building your shared architecture that the control-panel uses as a library, and then pulling that lib in from your isolated Wordpress control-panel codebase. But enterprises don't want to be forced into (possibly sub-optimal) architectures just because one component legally requires it. They'd rather just not use that component, so that their architecture can be totally determined by what's best for their development.
    - ForHackernews 6y ago
      Sure, okay, fine. I realize this is an ideological position (and not necessarily a popular one on this board) but that's the point of the GPL. If certain companies lose out because they're afraid to share, then they have no one to blame but themselves. The pitch is that the world of free software can, collectively, build better software for everyone sharing, than the proprietary islands who selfishly cut themselves off from that ocean.
proddata 6y ago
> If your business model cannot survive when a critical upstream piece of your infrastructure moves to GPL, you probably have a bad business model to begin with. To be clear CrateDB started out as OSS and we decide to stay OSS. Elasticsearch used the Apache License and so did CrateDB. All in the spirit of OSS. Elastic are however now the ones how decided, that their business model isn't viable anymore. > It sounds like they are making up excuses for not wanting to fully Open Source their code We do want to make it fully open source! Everything that was under a more restrictive License is going to be offered under Apache License.
- berkes 6y ago
  Thanks for correcting me! > We do want to make it fully open source! This begs the question: isn't "a restrictive OSS licence" not less "fully open source" than a more permissive licence like GPL, MIT or BSD? If you are fully committed to OSS, why not go full-oss, instead of retaining control through a restrictive OSS licence? Is that really only because of some enterprises not liking GPL?
  - proddata 6y ago
    > This begs the question: isn't "a restrictive OSS licence" not less "fully open source" than a more permissive licence like GPL, MIT or BSD? We gonna change CrateDB fully to Apache License v2 ;) I would say that counts as a "more permissive" license. > Is that really only because of some enterprises not liking GPL? There are various reasons for the change. A big part is definitely also the spirit of many our contributors. We built CrateDB on open source software and also want to make the software available as open source. It also was planned for quite some time to be more open.
  - eeZah7Ux 6y ago
    > why not go full-oss, instead of retaining control through a restrictive OSS licence? The main point of copyleft is to pass down freedoms to use/modify/distribute all the way to the end user. Instead we got locked-down privacy-breaching smartphones, IoT devices, SaaS, where only the manufacturer benefits from OSS.
e12e 6y ago
> We would never have chosen Elasticsearch in the first place, had it been licensed under the GPL as some of our customers (and many large enterprises do by default) banned GPL licensed software from their application stacks for legal risks. So, they don't run Linux, don't use glibc? That can't be all that common? (I mean sure, there's the bsds.. But still..).
- proddata 6y ago
  > So, they don't run Linux, don't use glibc? That can't be all that common? (I mean sure, there's the bsds.. But still..). We do run Linux :) But there is a difference between building on and building with.
- dd_roger 6y ago
  The problem is not using a GPL software internally, but using it in a product that you'd want to sell and at this point be forced to opensource your entire product. Despite what some people like to pretend there's basically no scalable business model outside of SaaS that will make you any money selling GPL-licensed software so this situation is extremely undesireable.
tracker1 6y ago
MySQL is a poor example... for a while, their client library license was GPL and insisted that anything not using a commercial license needed to be GPL, which is one of the reasons I pushed against MySQL for a long time, one of a long list of reasons over the years.
munk-a 6y ago
> If your business model cannot survive when a critical upstream piece of your infrastructure moves to GPL, you probably have a bad business model to begin with. I think they appear to be surviving just fine - they are switching forks not shuttering their doors or even withdrawing ES compatibility. Suddenly changing licenses to increase how restrictive it is absolutely is a nightmare scenario to a lot of businesses and it quite rationally is so. We share software and build on each other's shoulders, to reject that and build everything from scratch is silly and fiscally irresponsible. I'm very confused why this is so strongly stated when it's likely that most of us have, at one point, sat down with two pieces of libraries and gone with the less useful one due to licensing issues.
mikl 6y ago
GPL has the well-known web services loophole, that effectively makes copy-left protections moot. Without that, Wordpress and other GPL-licensed web CMS/frameworks would never have taken off like they have. As for MySQL, notice how no one builds anything on top of it (like TimescaleDB and others did with PostgreSQL), but just uses MySQL as-is without modifying it, also rendering copy-left moot.
GordonS 6y ago
>> some of our customers (and many large enterprises do by default) banned GPL licensed software from their application stacks for legal risks. > Which is completely new to me I work in a consultancy for enterprise-scale customers - every.single.one prohibits the use of GPL libraries and frameworks.

temp667 6y ago

The Elasticsearch SPPL is going to be pretty incompatible with many or most contributors business models and personal needs. The question is will the community harmonize around 1-2 forks or will the there not be enough critical mass in a fork to keep things going.

jasontedor 6y ago
Jason from Elastic here. I want to clarify one aspect here. Elasticsearch and Kibana will be dual licensed under the Elastic License or the SSPL license, not only SSPL. The distributions that we provide will be licensed under the Elastic License, which does not have the copyleft requirements that are sometimes concerning to legal teams. That is, if you download our distribution and run it in your infrastructure, you are subject to the Elastic License. The same license that most (90%+) of our users are already running under today, when they download our default distribution from elastic.co. This is why we say the vast majority of our users are not impacted by this change. Note: we are considering making changes to the Elastic License to simplify it. Please see more on our [blog][0]. Disclaimer: I am on the Elasticsearch team and work for Elastic; I welcome any and all feedback. [0]: https://www.elastic.co/blog/license-change-clarification https://www.elastic.co/blog/license-change-clarification
- Xylakant 6y ago
  How is the elastic license any more compatible with the needs of other open source projects than the SSPL? Before, elasticsearch and/or kibana were usable together with (A)GPL licensed code. That’s no longer the case, neither under SSPL nor under the elastic license. The fact that most users use the basic license may well be explained by two things: A) Your website offers it as the primary download. B) Elasticsearch without the basic licensed modules lacks severely when it comes to security features. It doesn’t even offer basic auth, let alone TLS or similar.
- temp667 6y ago
  Sure. The Elastic license is also a change from Apache 2.0, and is also not an OSI approved license as far as I am aware. Doesn't the elastic license specifically limit use of software to basic features, prohibit modification of licensing control mechanisms etc. I haven't dug through it, but it seemed FAR FAR different than a normal open source license. One question I had - is the Elastic license transferable? Ie, if you run a startup and are bought out with an asset buyout, can you transfer the stack including the Elastic licensed software to the acquiring party (assuming in the interim elastic has ceased to offer new elastic licenses so they can't get their own). Can you sell software built out on elastic licensed code and transfer the elastic license to the users so they can also use it? Or does everyone need to go back to elastic to get these licenses. A lot of discussion about being open, but reading the details - seems far from open at first glance.

anderspitman 6y ago

I find it fascinating to wonder whether it's better to go permissive and risk Amazon "stealing" your work vs going copyleft and risk never getting big enough for Amazon to care. Even if Amazon is making 10x more money than your off your code, you might still be making more than you otherwise would, due to exposure. Anyone aware of any hard numbers/research on this?

cardanome 6y ago
The issues is not so much Amazon making money from it but Amazon acting as a direct competitor against their own cloud offering. Personally I am happy about their decisions, as it stops the bleeding caused by big monopolistic corporations while protecting the freedom of users like me.
- anderspitman 6y ago
  But the question is would you have ever even known it existed or trusted it if Amazon hadn't picked it up and made it big?
  - chrisco255 6y ago
    Elasticsearch? Of course you would, it's the most well known open source search tool and has been for the better part of a decade.
    - ineedasername 6y ago
      For about 6 years of that past decade it has been a major offering of AWS. You can't claim it would be as popular without AWS by just pointing to it's popularity during the period of time that AWS has used it. A significant amount of it's current popularity occured after AWS began offering it. Even without that, how many would have adopted it without it's permissive licenses? Probably none of the major cloud offerings, which would have severely limited growth given the continuing sig ificant shift from on-prem to cloud during that period of time.

rafaelturk 6y ago

Kudos! Highly recommended article [1] about what the ES move realy means 1. https://anonymoushash.vmbrasseur.com/2021/01/14/elasticsearch-and-kibana-are-now-business-risks https://anonymoushash.vmbrasseur.com/2021/01/14/elasticsearc...

nealmcb2 6y ago
That article makes good points, but doesn't even mention the obvious alternative: join the fork that Amazon immediately announced, the need for which has also been supported by other significant contributors besides CrateDB like Logz.io and Aiven. See https://www.zdnet.com/article/aws-as-predicted-is-forking-elasticsearch/ https://www.zdnet.com/article/aws-as-predicted-is-forking-el...

galkk 6y ago

This is the great, concise callout that is clearer than hundreds of messages in HN discussions.

quink 6y ago
That's because Elastic did their own great, concise callout, it's just a little bit hard to find for those not following things closely: Announcement from 2018: > "We did not change the licence of any of the Apache 2.0 code of Elasticsearch [...] and we never will" Edited announcement in 2021: > "We did not change the licence of any of the Apache 2.0 code of Elasticsearch [...] and we never will¹" > ¹ [...] we announced a further change to our licensing strategy.
- proddata 6y ago
  The thing is, that all the arguments they now bring up for the move, have been true in 2018 as well ...

jwildeboer 6y ago

Red Hatter speaking. You can be quite succesful with GPL licensed code. #justsayin

bkuhn 6y ago

It seems to me that almost everything that needs to be said about the SS Public License has already been said. I have even posted twice about it (and related issues) myself a few times: https://sfconservancy.org/blog/2018/oct/16/mongodb-copyleft-drafting/ https://sfconservancy.org/blog/2018/oct/16/mongodb-copyleft-... https://sfconservancy.org/blog/2020/jan/06/copyleft-equality/ https://sfconservancy.org/blog/2020/jan/06/copyleft-equality... The only thing I haven't seen said succinctly, although it's been hinted at by many, is this: There is no one on the planet yet who has agreed that they will run a project under the SS Public License and be themselves bound by the SS Public License. That really says it all. Whatever your view about copyleft licenses generally: legitimate and well-intentioned copyleft licenses (e.g., CC-BY-SA, GPL, and Affero GPL) have many projects that use the license in an inbound=outbound contributor licensing fashion. All (two of the) SS Public License uses have a strict CLA that give the publishing entity non-SS-Public-Licensed rights to the contributions. We shouldn't take anyone seriously who promulgates a license but won't use it themselves in an inbound=outbound way. Period. I suggest we all try to not give further interest to this clearly risible licensing proposals from MongoDB and Elastic. If there's energy to focus here, I'd say it's toward figuring out how to handle good governance of forks of these two projects. I hope folks can maintain the discipline to discern and bifricate these two very different issues.

ocdtrekkie 6y ago
It's worth noting that Crate isn't contesting that SSPL is a perfectly legitimate open source license, it's the GPL part that's the issue for them. GPL and AGPL are just as much used to "poison the well" for potential competitors to a product also released as open source, and dual licensing strategies are a well-known part of open source businesses. This hasn't changed with SSPL at all, there's just a lot of pearl-clutching about the fact that the high and mighty OSI has not signed off on it.
- Pet_Ant 6y ago
  > GPL and AGPL are just as much used to "poison the well" But it is also legitimately outside of the purpose as well... unlike the SSPL. The Linux kernel for example. No one has ever looked at the SSPL and said “I want to work on that project” unlike the the GPL, which I believe is the GP’s point. > There is no one on the planet yet who has agreed that they will run a project under the SS Public License and be themselves bound by the SS Public License.

hbogert 6y ago

> What is “not ok” is the fact that switching to a GPL based license forces projects depending on the code like CrateDB to use a fork since it kills the business model. This is the most important statement, yet they don't explain why it kills their business model Also, did I miss something in the SSPL wording? is the consensus really that SSPL equates to GPL? I can see the similarity to GPLv3 in the sense that you have to provide a lot of the environment on which you run the software,but the article just equates SSPL to GPL after the first paragraph, which is a pity imo. > We would never have chosen Elasticsearch in the first place, had it been licensed under the GPL as some of our customers (and many large enterprises do by default) banned GPL licensed software from their application stacks for legal risks You should feel fine using GPLv2 in your business, if your are really opensource company (if there is such a thing.) That's really an opinionated statement by someone who doesn't even have business, but please comment; why would they care if they're the ones making the FOSS plugins and will only see changes going back upstream.

mikl 6y ago

SS Public License + CLA is basically Elastic (or Mongo) making their software “open source for me, but not for thee”. They are free to use the contributions of everyone for any purpose they wish, but everyone else is curtailed and limited. It’ll be interesting to see if their “eat the cake and have it too” move works. I hope not.

rob74 6y ago

Aside from this particular fracas, it's fascinating to see the proponents of "copyleft" and "permissive" licenses argue again about who is "freer": Elastic announced the license change with a blog post titled "Doubling down on open" (https://www.elastic.co/blog/licensing-change https://www.elastic.co/blog/licensing-change). Then these guys come along with a blog post "Doubling Down on Permissive Licensing and the Elasticsearch Lockdown" which accuses Elastic of "locking down" their code because they switched to a non-permissive license which in their view is "less free". Reminds me of Trump trying to steal the election by accusing the other side of stealing the election. But in that case it was at least easier to find out who was lying...

luord 6y ago

While I have no problem with copyleft licenses (at least those approved by the OSI) and in fact think that they should probably use the AGPL, I commend them for sticking to their guns and commitment to open source.

dathinab 6y ago

So the conclusion is we need a Apache v2 license with a extra "this software as a service" forbidding clause...