33 ms·

Grafana, Loki, and Tempo will be relicensed to AGPLv3

710 points by WalterSobchak 5y ago

deleted 5y ago
[deleted]
candiddevmike 5y ago
I can see why they would relicense Grafana this way, but why Loki? It's a fairly immature product that needs the boost of a less restrictive license IMO. I'm worried this will harm the adoption of it compared to the ES ecosystem (OpenSearch in particular) and we won't see it used for anything beyond Grafana.
- dvfjsdhgfv 5y ago
  Popularity can increase rapidly, and if they do it too late, Amazon will screw them just like they did with Elastic.
  - sojsurf 5y ago
    Counter opinion: I don't want to host Elasticsearch myself, which is why I pay Elastic to host several clusters. That said, I really don't want to be locked into a single-vendor situation, which is what Elastic is realistically aiming for. I am 100% glad that Amazon forked ES, because it preserves the benefits of using an open source stack. I still have a choice of hosted providers. In my opinion, the amazon fork is much more likely to lead to a healthy ecosystem of hosted ES providers than the Elasticsearch version.
  - josephcsible 5y ago
    I wish people would stop equating what Grafana did with what Elastic did. Grafana switched from one FOSS license to another. Elastic switched from a FOSS license to a proprietary license.
asim 5y ago
All of the most important software of our lifetime is going through this relicensing effort as the creators attempt to capture the value of what it enables. This is not some nefarious plan to screw over the community. It's a very measured and thoughtful way to ensure the long term progress and continuity of these projects. If the core companies maintaining them did not do this they would eventually die and these projects would slowly rot. Hopefully over time rather than having everyone choose their own licenses we end up with some form of standardisation.
- yjftsjthsd-h 5y ago
  > Hopefully over time rather than having everyone choose their own licenses we end up with some form of standardisation. Yes; if you're going to do this, then using AGPL is so much better than flavor-of-the-week license. > If the core companies maintaining them did not do this they would eventually die and these projects would slowly rot. It sounds like you're suggesting that anything but hard-copyleft is doomed to die out, which is a somewhat hard argument to make in a world with lots of counterexamples (postgres, the assorted BSD OSs, kubernetes, Android).
  - nine_k 5y ago
    Postgres looks like the only interesting entry here. K8s and Android have a major corporation backing them, which extracts value from them in its internal operation anyway. They are such products that using them by competition commoditizes said competition. Android on like 95% of phones outside China has very important proprietary parts, making it hardly compatible with a bunch of top-tier apps. BSD OSes don't do excessively well, with regard to market share and mind share. They are reasonably healthy though.
    - gen220 5y ago
      SQLite, Vim/Emacs, Linux, everything in GNU coreutils. All of the Apache projects (some to more/less an extant than others). Most programming language implementations (e.g. CPython). Memcached. WireGuard. SQLAlchemy. Web Frameworks like Flask, Django, Rails, on and on. There are many open source technologies that do not seek to capture the value they create with licensing hijinks. I don’t think it’s an accident, that the ones that persist across generations are generally not structured as VC-backed firms, who care a great deal more about “value capture” than the average programmer capable of building such foundational systems. Usually “value capture” is correlated with “consumer harm”, and so they’re replaced over time. From your example, K8s will definitely outlive Google. Hard to say about Android.
iFire 5y ago
What is the biggest fork of Granafa I can use that is non-share-alike? Edited: Oh, I can't say this... I leave it up for posterity and a note to myself then. http://www.paulgraham.com/say.html http://www.paulgraham.com/say.html
- josephcsible 5y ago
  Is there a specific conflict like ZFS-on-Linux that you want to avoid, or are you just asking "how can I most benefit from other people's work without letting anyone else benefit from mine?"
  - iFire 5y ago
    Exactly. This is the ZFS-on-Linux situation. I prefer to keep all my code as much as possible mit and I share them on Github. This is my mode of operation. Grafana makes me unable to use MIT for that use.
    - zxzax 5y ago
      >keep all my code Huh? Grafana isn't your code, it's someone else's code that you'd be using. Unless I misinterpreted, and you are a Grafana contributor. If you are, you could dual license your contributions under AGPL and MIT, if you wanted.
      - yjftsjthsd-h 5y ago
        Without knowing what they work on, one obvious case is code that interacts with grafana; extensions, plugins, whatever. For that matter, it's perfectly possible to maintain your own personal patchsets without being a "contributor" per se. Niche, but plausible.
        justincormack 5y ago
        Plugins don't seem to have been relicensed looking at https://github.com/grafana/grafana/blob/HEAD/LICENSING.md https://github.com/grafana/grafana/blob/HEAD/LICENSING.md
the_duke 5y ago
"Amazon Announces Grafana Fork , Promises Amazing Things for the Community" (2021/05/08) [1] On a more serious note: there is a bit of a trend in the licensing world. Mongo or ElasticSearch changes, or cool new projects like redpanda [2] launching with BSL. Open source is still a very young business model. One that has provided a tremendous amount of value over the past decades, but we still need to figure out how to build sustainable businesses with it. Be it open core, more restrictive licenses, copyleft, dual licensing, ... I just really hope that we don't slide back into the world of proprietary closed source. The danger is certainly there, and it will hit smaller companies the most. [1] https://aws.amazon.com/grafana/ https://aws.amazon.com/grafana/ [2] https://github.com/vectorizedio/redpanda https://github.com/vectorizedio/redpanda
- josephcsible 5y ago
  Amazon forking ElasticSearch to keep its old license is a good thing, since ElasticSearch's new license is a proprietary visible-source license. Grafana's new license is still FOSS, so it's really not a fair comparison.
  - deleted 5y ago
    [deleted]
  - hutrdvnj 5y ago
    While it is true that Grafana's new license is still FOSS not every company, public cloud provider is willing to accept the AGPLv3 license[1]. Hence a fork with the old license is not unlikely. [1] https://opensource.google/docs/using/agpl-policy/ https://opensource.google/docs/using/agpl-policy/
    - josephcsible 5y ago
      True, but my point wasn't so much about the likelihood of a fork as whether or not it would be a good thing.
    - sitkack 5y ago
      Google has the same OSS philosophy as Microsoft and the rest of the software community needs to pressure Google to change its stance on the AGPL.
jchw 5y ago
I don't want to weigh in here with a huge value judgement on whether this is the right decision. However, I do want to say that what they're saying regarding SSPL vs AGPL is totally right. One of the biggest sticking points with SSPL is that it's not even really plausibly open source, and it tries to create restrictions that implicate software that is not even "linked" with the program that is licensed under it, which calls into question whether it's even legally enforceable.[1] AGPL is somewhat controversial, but the reasoning for AGPL to exist is chiefly to protect the end user's rights, however misguided that may be in your opinion. In this case Grafana presumably retains the copyright to these programs, so presumably they are not beholden to these restrictions in any way. On the other hand, though, it does mean that other providers will have to distribute their patches back to the community, which is pretty much the entire goal of copyleft open source in the first place. In any case, this is, in my opinion, a lot better than SSPL or the Timescale license. [1]: https://www.processmechanics.com/2018/10/18/the-server-side-public-license-is-flawed/ https://www.processmechanics.com/2018/10/18/the-server-side-... edit: wording regarding AGPL was changed, because the claim that considering AGPL as not open source is “somewhat controversial” isn’t quite accurate; it’s more correct to say the license itself is simply controversial.
- globular-toast 5y ago
  Who I earth would argue that AGPL isn't open source? The kind of people who think open source = free lunch I suppose. It's probably the most open source licence there is.
  - jchw 5y ago
    Maybe it isn't so controversial that it is called 'open source' as it is simply controversial. Though GPLv3 + AGPLv3 improves one of the worse problems, which is compatibility with GPL-licensed code. edit: And FWIW, I have dropped this claim from the post with a note, especially since it was not my point anyways.
- josephcsible 5y ago
  How is it debated whether AGPL is open source? Who says it isn't?
jabiko 5y ago
Even though we use Grafana only internally and there would be no problem with AGPLv3 in theory I see big meetings with legal coming up which might result in us not being able to use it anymore. I could image that its the same with other corporations. In the end that might hurt the popularity of Grafana quite a lot.
- globular-toast 5y ago
  There should be no problem with it even if you use it externally. It's about time companies stopped seeing open source as freely exploitable. Every company that uses open source software should be obliged to contribute, or pay for proprietary software.
- bboreham 5y ago
  Would you consider paying for a licence to use it?
  - jabiko 5y ago
    Honestly, I have no idea. I think if there would be a possibility to pay money to have what we are doing reviewed by Grafana and be "certified" to be withing what they consider acceptable under the AGPL that might actually be a good option
    - bboreham 5y ago
      What about just paying for a commercial licence to use it to meet your needs?
      - jabiko 5y ago
        I have no Idea. Realistically its probably not the license cost but the one time and the perpetual operational overhead associated with the license that's going to be the problem.
        5y ago
jononor 5y ago
Hmm. Where does Grafana people stand on what constitutes a "derivative" work? Are my Grafana dashboards derivatives of Grafana, and must now be published? If I embed a Grafana dashboard in my application, is my application now a derivative of Grafana and must be released as AGPLv3?
- jononor 5y ago
  The Q&A suggests that "unmodified" distributions are not an issue. But if I distribute dashboards, custom configurations, etc - is that a "modification" ?
  - nopzor 5y ago
    nope, that wouldn't be a modification to the AGPL-licensed grafana. you are free to do that. plus, dashboards and configuration are inherently ("source available"), so even if one were to consider them to be modifications (which they're not), you are already distributing them in source form ;-) [note: am co-founder/ceo of grafana labs]
    - lovasoa 5y ago
      The AGPL license states > A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate. Doesn't a product that offers grafana-powered dashboards "form a larger program" ?
      - lmm 5y ago
        If you're just exposing your grafana instance, no - and probably not if you're iframing them or similar. If you're actually embedding grafana into your program then yes, but that would be a strange way to structure a system.
rodgerd 5y ago
Seems like a sensible choice - one of the things that as cause me to look askance at some of the anti-serverisation (urgh) licenses has been companies trying to bespoke something when the AGPL has always been right there to solve the problem they're trying to tackle.
yjftsjthsd-h 5y ago
Okay, so they go out of their way to avoid answering how this actually affects people, so I'll ask here: If a company uses grafana internally, this should have no effect, right? And then the next step: If a company did offer grafana-based dashboards to customers but wasn't actually modifying grafana, what if anything does this do?
- e12e 5y ago
  Presumably - offering dashboards to users, would count as distribution to those users (internal or otherwise). Unmodified Grafana like has/will get a link to source code/license - that would likely cover you - although if Grafana goes away (or becomes closed source) - you might have to offer a copy of the source code on request?
- josephcsible 5y ago
  They'd have to offer the source code to Grafana itself, which has basically negligible effect since it doesn't have anything of theirs in it.
- frenchman99 5y ago
  They do say it: > It’s important to note that this change does not prevent our users from using, modifying, or providing our open source software to others — provided, however, that under the AGPL license, users have to share source code if they are modifying it and making it available to others (either as a distribution or over a network). For distributors, AGPL has the same source code sharing requirements as GPL. Those conditions are designed to encourage third parties looking to modify the software to also contribute back to the project and the community.
  - technics256 5y ago
    It's still unclear to me if this also means things like custom dashboards, etc?
    - frenchman99 5y ago
mrwnmonm 5y ago
Sorry for my ignorance, what does this license mean? I find licenses a little bit difficult to understand.
- Shoop 5y ago
  "The GNU Affero General Public License is a modified version of the ordinary GNU GPL version 3. It has one added requirement: if you run a modified program on a server and let other users communicate with it there, your server must also allow them to download the source code corresponding to the modified version running there." https://www.gnu.org/licenses/why-affero-gpl.html https://www.gnu.org/licenses/why-affero-gpl.html
- black_puppydog 5y ago
  IANAL, and this is very simplified. The GPL (without A) requires you to publish sources under compatible license (usually also GPL) if you use a software and distribute it (to clients for example). Git is GPL. Github however can totally run modified versions of git on their servers to build their service, and doesn't necessarily have to contribute back, since they never distribute their programs to the customer, but only some html. The AGPL goes one step further and requires any changes that github makes in that situation to also be licensed under AGPL. That way it is like GPL, but for software that is typically run on servers, not on client hardware.
  - mrwnmonm 5y ago
    Thanks
BringerOfChaos 5y ago
Looks like there were two blog posts. This QA session with the CEO is also interesting. https://grafana.com/blog/2021/04/20/qa-with-our-ceo-on-relicensing/ https://grafana.com/blog/2021/04/20/qa-with-our-ceo-on-relic...
gnalck 5y ago
Those who have reservations about the terms of AGPLv3 - would any of you prefer if it was licensed under BUSL1.1 (i.e., source-available or eventually-open-source) instead? I'm curious to see the perspectives of businesses as to whether AGPLv3 or BUSL-1.1 is a "bigger risk" when compared to the previous Apache 2.0 license. My gut feeling is that those passionate about open source on the whole will tend to prefer AGPLv3, while businesses or those making decisions on the behalf of a business, may prefer BUSL-1.1. I think there are trade offs with either approach.
- richardwhiuk 5y ago
  The BUSL is worse - obscure licenses are problematic. The problem with the AGPL is it's very unclear what counts as linking, and this has never been tested in court, and that it's not clear what "network access" needs to look like.
- josephcsible 5y ago
  > My gut feeling is that those passionate about open source on the whole will tend to prefer AGPLv3, while businesses or those making decisions on the behalf of a business, may prefer BUSL-1.1. Your gut is onto something. People who care about something bigger than themselves prefer AGPL, while those who only care about their own profits prefer BUSL.
blendergeek 5y ago
I applaud this decision. I would like to see all major SaaSS projects be AGPLv3. End users still have freedom to user, modify, and distribute the software. Cloud providers must share contributions. This is how I like it.
- rakoo 5y ago
  > Cloud providers must share contributions To be really strict: AGPL only mandates that contributions be shared with the user. The freedom of users is more important than the freedom of developers. Of course an upstream maintainer can be a user and get the contributions.
  - kevincox 5y ago
    They have to be shared to the user under the same license. So any user could publish the changes publicly.
    - LukeShu 5y ago
      Sure, but there might be out-of-band reasons for users to not do that. For instance, grsecurity will sell you a security-hardening-patched Linux kernel. You, as the user/customer, have the right to take those GPL patches, and share them publicly. But if you do so, grsecurity will blacklist you as a customer, and you won't be able to get any more patches from them.
      - m4rtink 5y ago
        Didn't that preaty much out grsecurity into (an even bigger) obscurity as no one sane will touch a logic bomb like this, not to mention build their business on it ?
      - josephcsible 5y ago
        There's a strong case to be made that grsecurity is violating the GPL by doing that: https://perens.com/2017/06/28/warning-grsecurity-potential-contributory-infringement-risk-for-customers/ https://perens.com/2017/06/28/warning-grsecurity-potential-c...
wdb 5y ago
One of the reasons why I find it hard to contribute to projects that use CLA. Now you don't have any say in this relicensing even when contributed reasonable amount of code.
- josephcsible 5y ago
  This has nothing to do with CLAs. The old license was Apache 2, which is compatible with AGPLv3 (although the converse is not true). You'd only need a CLA to relicense if it weren't compatible.
ltbarcly3 5y ago
I remember when the AGPL was being talked about in around 2008 or so, and thinking it was ludicrous. Now I wonder if it's too lenient. AWS is just rebranding open source products and selling access for infinite markups while killing the open economy that created them. Maybe what we need is a 'no AWS' license, think Apache License but with a clause that says no corporation with more than $50B in revenue can resell it.
- nrmitchi 5y ago
  Is that not essentially what the Server Side Public License (SSPL) went for?
- josephcsible 5y ago
  > I remember when the AGPL was being talked about in around 2008 or so, and thinking it was ludicrous. Now I wonder if it's too lenient. It'd be really hard to come up with a license less lenient than AGPL without it being non-FOSS, which would defeat the purpose. > Maybe what we need is a 'no AWS' license, think Apache License but with a clause that says no corporation with more than $50B in revenue can resell it. This would be a blatant violation of freedom 0.
- retzkek 5y ago
  I mean, good for them? If they're "just rebranding and selling access for infinite markup" then surely the only people who would pay them are either too lazy or too busy to host it themselves, or too rich to care? Would you prefer that people/companies that fall into these categories be forced to go through some _other_ reseller (who is just adding their own markup on top of the cloud hosting costs) instead of getting the service directly from their cloud provider of choice?
  - ltbarcly3 5y ago
    No, that's not the issue. They have a marketplace where ElasticSearch can be sold as SaaS. However, when there is something open source being offered on that marketplace, they co-opt it, give it AWS branding, and sell it themselves. They also own the infrastructure that both their own offering and the 3rd party SaaS offering is hosted on. Lets say they charge $1.00 / unit for EC2. They can charge $1.00 / unit for the 3rd party SaaS to run their service, and $1.00 / unit for their own offering which is basically EC2 + SaaS, so there is literally no way for the 3rd party to be price competitive, and meanwhile their own SaaS offering is blasted into the AWS interface everywhere, while the 3rd party offering has to be searched for and found. So they take the development work of that 3rd party and use their lock in and ability to steer customers to shut out the 3rd party, while taking all their work and selling it themselves at a price that the 3rd party can't possibly match (and not because of efficiency, because they'll just refuse to make a deal with the 3rd party to give an EC2 discount that they give all their other large customers if it would mean the 3rd party can then be price competitive with a SaaS offering that would compete with one of their own).
bonetruck 5y ago
I wonder how many companies will choose to kill off Grafana use as a result of this change. Two companies I've worked for have simply banned the use of anything having a GPL type license.
- lolc 5y ago
  Oh, no Linux at all then?
- natas 5y ago
  only red star os allowed?
  - saagarjha 5y ago
    Red Star OS is Linux-based.
- belorn 5y ago
  Out of curiosity, what kind of markets are those two companies in and how much competition exist. Using open source libraries is, among other things, a cost saving measure. It allows a company to focus their expertise on what they are good at, without having to spend time and resources on reinventing wheels. Banning tools that enable a company to produce products faster, cheaper and (sometimes) more stable and secure can have a major impact when the competition does not limit themselves in the same way. However if the market is dominated by a monopoly or is very slow, then increased costs and delays might not have much of an impact. As an example of such company, Google's revenue would not be impacted by a single percent if they suddenly needed to hire 200 more programmers for android. Delay next version with 2 months and the impact for android market share would unlikely be statistically verifiable.
tlynchpin 5y ago
RIP grafana ^^ this is not a good contribution to HN, not much substance. (edit) Many people who use Grafana will see this news and will stop planning on using Grafana and start planning on doing something else. That has nothing to do with Grafana, that is a common reaction to AGPL. In theory, AGPL is fine under circumstances blahblahblah. In common practice in commercial settings (in my experience), GPL is poison and AGPL is radioactive poison.
- mtmail 5y ago
  I'd say a SaaS competitor build on top of graphana is more affected https://www.hostedgraphite.com/ https://www.hostedgraphite.com/
  - pritambaral 5y ago
    Unless they were making money based on their proprietary modifications to Grafana, Loki, or Tempo, they aren't affected much beyond being required to publish links to the source code. If, however, they _were_ making money off of proprietary modifications, and they wanted to keep such modifications proprietary, they now have the choice to fork Grafana (and Loki and Tempo respectively) as of a pre-AGPL version.
natas 5y ago
this is good, even if loki can't scale well it's still good for the community.
macnale 5y ago
1) We distribute Grafana as docker container along with our product to customers. What is the impact for us and our customers? 2) We build Grafana on a platform which is not supported by out of the box. What is the impact for us and our customers?
- josephcsible 5y ago
  You'll need to give your customers the source code you used to build Grafana. If your customers are just using it internally, then they have no new obligations. If they're letting customers of their own use it, then they have the same new obligations that you do.
  - macnale 5y ago
    Thank you for clarification. I read about Confluents decision about the license change. It looks like Confluent has opposite view than Grafana labs about AGPL. " Why didn’t Confluent use AGPL? AGPL doesn’t solve the problem we are trying to fix. AGPL allows cloud service providers to sell services using the exact software being licensed, and charge for it, without any limitation. This means the software developer has become the unpaid developer and maintainer for the cloud service provider—which is not a scenario we want to enable. Also, AGPL is too aggressive for our customers who need to redistribute commercial products. If you put AGPL code in a distributed program, you have to open source the whole program. We want you to be able to embed our code in proprietary applications, change it and not worry about open sourcing any of your changes. We don’t think that proprietary applications are bad, and we think it’s great if you use Confluent Community software to create them.:"
    - josephcsible 5y ago
      It sounds like Confluent doesn't get what the real problem is. There's 2 ways developers who also sell hosting end up losing all their market share to players like Amazon: 1. The big players like Amazon make custom, proprietary modifications to the software they're hosting, and since they're not technically distributing it, they don't have to release the changes, giving them an unfair advantage. This is the exact loophole that the AGPL closes. 2. Sometimes, the big players are just better/more efficient at hosting the exact same software the exact same way. There's nothing unfair or unethical about this; it's how the free market is meant to work that customers flock to them. Confluent is trying to "fix" the second "problem", which rather than making anything more fair, just makes it unfair in their favor.
renewiltord 5y ago
Is it still possible to integrate Grafana in your product or does the whole thing have to be AGPL. No complaints. Just curious. Like, can I distribute some SaaS that has a Dashboard section that is Grafana-powered while retaining my code?
damm 5y ago
Good. If Amazon wants to continue its creep of using open source software to build their empire they need to support the companies that make open source software. > If Amazon/AWS was not a large monopoly it wouldn't be a problem. DOJ Needs to split up AWS/Amazon and fine them and use that fine to create competition.
wyoawayd 5y ago
There's a lot of weird assumptions in this thread that this is some sort of strike against Amazon/AWS. It's not. AWS's managed grafana is built in partnership with grafana labs, and this license change won't affect it. From Grafana: "AWS is a strategic partner, and given the commercial relationship AWS has with us for AMG, AWS and their AMG customers are not impacted by this change. We hope that other XaaS providers follow AWS’s lead in working with open source software companies in similarly sustainable ways." https://grafana.com/blog/2021/04/20/qa-with-our-ceo-on-relicensing/ https://grafana.com/blog/2021/04/20/qa-with-our-ceo-on-relic...
- sandstrom 5y ago
  It could still be with AWS in mind. After this change, they'll be in a better negotiation position vs. AWS, since AWS can't (as easily) threaten that they'll build their own competing offer.
  - toomanybeersies 5y ago
    > AWS can't (as easily) threaten that they'll build their own competing offer Elasticsearch changed their licence for more or less this reason [1]. So it wouldn't surprise me if Grafana's motivation was to solidify their position against Amazon. [1] https://www.elastic.co/blog/why-license-change-AWS https://www.elastic.co/blog/why-license-change-AWS
    - ignaloidas 5y ago
      > Elasticsearch changed their licence for more or less this reason And look how it's going for them. AWS very nicely forked elsasticsearch and now has the fork that seems to be gathering quite a bit of momentum. I doubt that AWS was even considering talking with them after they announced the license change.
oxfordmale 5y ago
I wonder how long will it take for Amazon to announce their an open source fork.
- josephcsible 5y ago
  Unlike ElasticSearch, Grafana itself is still open-source. Forking Grafana would be viewed a lot less favorably than forking ElasticSearch was.
lovasoa 5y ago
The announcement seems to say that products that include an unmodified version grafana can still be proprietary, and only modifications to grafana itself will have to be published. However, the AGPL itself is quite clear that if you distribute a larger work based on an AGPL software, the whole larger work has to be distributed under the same license. Would you still be confident shipping a proprietary product that includes a grafana dashboard ?
- pavon 5y ago
  The GPL and AGPL are clear that bundling does not constitute a derivative work, and does not require you to license the bundled works under the GPL/APL. > Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate. https://www.gnu.org/licenses/agpl-3.0.en.html#section5 https://www.gnu.org/licenses/agpl-3.0.en.html#section5 https://www.gnu.org/licenses/gpl-faq.html#MereAggregation https://www.gnu.org/licenses/gpl-faq.html#MereAggregation If you write a custom plugin for Grafana, then that plugin will likely need to be distributed under the AGPL (depending on Grafana's plugin architecture), but not your entire app. I would be completely confident in bundling in this manner. The AGPL3 and GPL3 have identical wording on this matter, and it has been a well understood aspect of the GPL for decades.
  - lovasoa 5y ago
    Yes, I understood that just distributing grafana and your app together is not a problem, that is bundling. But what if grafana is a part of your app ? If you have a grafana dashboard inside the UI of your own application, this cannot be considered bundling, can it ? The AGPL is clear that if the result of the aggregation "forms a larger product", then you are NOT covered by the bundling clause.
tyingq 5y ago
Is there some exception for plugins? I can see a weird situation where a plugin for technology 'X' doesn't allow AGPL, but Grafana requires it.
sitkack 5y ago
Thank you! AGPL is a fine license for software freedom.
jrv 5y ago
What I don't like about changes like this is that it makes it impossible to reuse any Grafana/Loki/Tempo pieces or libraries in any more permissively-licensed code without forcing that whole project into the AGPL as well. That doesn't only hinder competitors (which seems to be the legitimate goal), but also hinders interoperability and an open ecosystem evolving where people freely exchange bits and pieces of code to make things work together. I know that some parts of the codebases have been exempted from these changes (see https://twitter.com/TwitchiH/status/1384566382180896769 https://twitter.com/TwitchiH/status/1384566382180896769), but those are only some, and they may change over time...
- josephcsible 5y ago
  IMO, the ideal end-state from a software freedom perspective is that all software becomes AGPL. This change is a step in that direction, not only with the directly affected products, but for the reasons you mentioned, an additional pressure for more things to switch to it. Do you not like that end goal, or do you just think the side effects of the change outweigh the benefits of getting closer to it?
  - jrv 5y ago
    I think it's both a completely unrealistic end goal (we live in the real world), and I also think that the AGPL puts you into a hole where you can never get out of again if you decided that you now need different constraints. So I really much more prefer permissive licenses. Funnily just before you wrote this comment, I also tweeted just that :) : https://twitter.com/juliusvolz/status/1384599249082626052 https://twitter.com/juliusvolz/status/1384599249082626052
    - josephcsible 5y ago
      > I think it's both a completely unrealistic end goal I know :( I just meant it's the ideal we should strive towards, even if we never fully reach it.
      - 5y ago
neatze 5y ago
Can library be licensed under AGPL and class path exemption ? Seems like it will be better solution then MPL.
Andrew_nenakhov 5y ago
When we released our server product under GNU AGPL v3 license, we have received a rather negative reaction from other participants in our field. The general sentiment was, "this license makes a useless curiosity". I wonder where does this hostility come from. Jealosy? FUD? Frustration that they can't take the source and not share own improvements??
- aidenn0 5y ago
  No lawyer wants to be the first one to adopt licenses with novel clauses because the legal system runs on precedent, so using something that is untested in court is higher risk. It wasn't that long ago that no large company would touch the GPL with a 10 foot pole.
- zokier 5y ago
  The problem I have with AGPL is that you need to think about it, even if you just run the software and are not distributing it. Or rather AGPL forces you to distribute the software you run. This is in stark contrast to all other mainstream licenses where in general you don't need to think about the license at all if you are not distributing the software, which makes very worry free experience.
  - gpanders 5y ago
    > Or rather AGPL forces you to distribute the software you run. No it does not. Using AGPL software does not suddenly make your own software a derived work.
    - djb_hackernews 5y ago
      Tell that to the lawyers who are paid lots of money to be risk adverse. As others point out, the law operates on precedent, no lawyer wants their decision to be the one that makes their employer a test piece.
    - zokier 5y ago
      If you run AGPL licensed software you must be prepared to distribute it to its users.
sideeffffect 5y ago
If I contribute a code under the new CLA, is Grafana Labs allowed to relicense that contribution under a non-copyleft license, like Apache Public License 2.0, without my further permission? If yes, than it's a really bad bad thing and I hope they change it. CLAs that permit relicensing for a project that already uses permissive license is fine and fair. But doing that on a project with a copyleft license is a bad taste. It would enable Grafana Labs to give Grafana to a party X which can then give it to party Y, where X isn't required to give all the necessary freedoms to Y. https://opensource.com/article/19/2/cla-problems https://opensource.com/article/19/2/cla-problems https://sfconservancy.org/blog/2014/jun/09/do-not-need-cla/ https://sfconservancy.org/blog/2014/jun/09/do-not-need-cla/
- justincormack 5y ago
  The new CLA doesn't seem to allow relicense. The old one [1] allowed relicense under OSI approved licenses. [1] https://web.archive.org/web/20200311075025/https://grafana.com/docs/grafana/latest/developers/cla/ https://web.archive.org/web/20200311075025/https://grafana.c...
- ec109685 5y ago
  Don’t they have a license to your work and they can do however they please with it? E.g. sell it to X and Y for whatever they want and X and Y have no obligations to ever release anything back?
  - lmm 5y ago
    Not necessarily. They have whatever rights the terms of the CLA say they have.
- rocqua 5y ago
  Usually part of the CLA is meant to allow dual licensing. The idea is that the company also makes the software available under a commercial non-viral license. Hence if you contribute to a GPL project with a CLA, some companies could still publish your code closed source through a commercial license deal.
- 5y ago
dec0dedab0de 5y ago
I like the AGPL, but I would like an extra step that forces you to distribute code even you have not modified it. This would be in the case of the original being unavailable for some reason. Does anyone know how difficult it would be to have the login page for a web app be a different license? The idea being that the only users of the AGPL code are ones that have a valid account. Off the top of my head a reverse proxy, with a completely separate auth app would do the trick, but would be a bit of a pain.
- jblwps 5y ago
  > I like the AGPL, but I would like an extra step that forces you to distribute code even you have not modified it. This is...already the case. The distributor is the one who is bound to supply the source code--"upstream" isn't implicated in the license.
  - dec0dedab0de 5y ago
    I didn't see your reply until just now, but the AGPL does not require you to redistribute source code to network users if it is not modified. The following stack exchange question has quotes from the fsf https://opensource.stackexchange.com/questions/650/do-i-have-to-offer-the-source-of-an-agpl-v3-0-licensed-web-app-even-if-i-didn https://opensource.stackexchange.com/questions/650/do-i-have...
crazypython 5y ago
Note that the AGPLv3 has an exception allowing you to link to GPLv3. GPLv3 allows for private use, in other words keeping changes secret as long as they stay on your own computer. In effect, it becomes a weak copyleft- akin to MPL-2.0 where as long as you keep it in separate files code can stay closed-source.
znpy 5y ago
Big kudos, they learned from elastic' story
867-5309 5y ago
Grafana: The analytics platform for all your metrics. Allows you to query, visualize, alert on and understand your metrics no matter where they are stored. Create, explore, and share dashboards with your team and foster a data driven culture. Loki: Web Analytics Dashboard for NGINX Tempo: An open source, easy-to-use and high-scale distributed tracing backend. Tempo is cost-efficient, requiring only object storage to operate, and is deeply integrated with Grafana, Prometheus, and Loki. Tempo can be used with any of the open source tracing protocols, including Jaeger, Zipkin, and OpenTelemetry.
- remram 5y ago
  Loki is a generic log aggregation platform. It is not built for NGINX or coupled with it in any way.
protomyth 5y ago
Has AGPLv3 had anything decided in court about it?
Proven 5y ago
> For distributors, AGPL has the same source code sharing requirements as GPL. Those conditions are designed to encourage third parties looking to modify the software to also contribute back to the project and the community. Like the government "encourages" me to wear seat belts and pay taxes. License your stuff however you want, but don't sugar-coat it in nonsense PR terms.
toddpersen 5y ago
The funny thing to me, which I haven't seen anyone else mention yet, is that way, way back in the old days, Grafana started out as a fork of Kibana. Go take a look at the first commit in the Grafana source: https://github.com/grafana/grafana/commit/75d03fc49ab4f95ee414f730563f14cbdad9ee64 https://github.com/grafana/grafana/commit/75d03fc49ab4f95ee4... Anyone want to guess what the third commit was? That's right, it was an Apache 2 license: https://github.com/grafana/grafana/commits/master?after=2bb7eb18d1c06b20db63d9e0a9aeca3a8adbb97a+28900&branch=master https://github.com/grafana/grafana/commits/master?after=2bb7... Before there was any code, there was a permissive license. If the choice had been made 8 years ago to make Kibana less-permissively licensed, it's very likely Grafana wouldn't exist right now. And for historical fun, here's the first commit from Torkel after the fork from Kibana v3: https://github.com/grafana/grafana/commit/50e42c8bdd2099552dbc3e7a46f429d501f401ae https://github.com/grafana/grafana/commit/50e42c8bdd2099552d...
- leeoniya 5y ago
  i wonder how much of that original Kibana code remains today (my guess is not very much), and if it were originally AGPL, would a completely rewritten codebase still be subject to it?
  - varajelle 5y ago
    The license talk about derived work. And even if every line of code has been changed, it is still a derived work as it was progressively changed. So pattern and desings from the original are still in use. The Ship of Theseus is still the Ship of Theseus.
    - cutemonster 5y ago
      > it is still a derived work as it was progressively changed. I think that depends. If it was progressively changed to something completely different, then, no. Let's say in 10 days you replaced 10% of the code, with the same amount of code from a different program by another author. During those 10 days there'd be compilation errors, and thereafter the original work and copyright would be all gone (except for in old revisions in the repo), and the copyright holder of the new program could license it however s/he wanted.
angry_octet 5y ago
I look forward to a future AGPL, perhaps Absolutist AGPL. Licencing your code under AAGPL extinguishes your own copyright as the author -- you now only have the same rights as someone triggering the code or a derived work. Triggering is any action which causes the code to run without human intervention. The AAGPL will finally remove the possibility of crippled 'Community Edition' software.
ofrzeta 5y ago
Will AWS now fork the pre-license-change source and create their own "Open Grafana"? /s
pabs3 5y ago
Would be nice if they would drop the CLA too.
linuxhansl 5y ago
I think this is a step in the wrong direction. Open source is about an open community, open contributions, the multiplier you get from contributions from multiple companies. That way open source is a win-win. Companies benefit from each other's contributions. Once you have free and non-free tiers or need restrictive licensing it is already broken. The incentives no longer align. I'm being paid in part to work on the open source projects that we utilize for our service(s). Some of those we started, some of those we're contributing to, but we _own_ none of them. We handed them off to external entities (Apache and others) for governance and we actively encourage others to participate. And, yes, some of those are used by Amazon, and we welcome their contributions to the code. Single support companies that use the popularity and reach of permissive licenses for profit that then turn around and bemoan the fact that their licenses are too permissive are disingenuous.
maxbaines 5y ago
Which version is the last licenced under Apache?
bayindirh 5y ago
Why there's a prevailing hate against xGPL licenses? Almost all of the core infrastructure which runs this Apache/BSD/MIT licensed software is running on xGPL software. I believe that we wouldn't be here without these aggressive copyleft licenses, and some developers embracing this license again is a good thing. I'll always prefer Nextcloud because it's AGPL. Similarly I'll use Grafana with less hesitation since it'll be AGPL from now on. Being able to see everything inside a software and not binned as community/enterprise is better from my point of view. I'd happily pay for AGPL software, and I already pay a lot of money for licenses so, it's not about money.
- 4bpp 5y ago
  I assume the answer to the "why" can be as simple as: being primarily a Silicon Valley software industry forum, HN knows what side its bread is buttered on (namely the side of cobbling together freely available software to make proprietary products).
  - bayindirh 5y ago
    Thanks for your answer. Yes, the answer is simple when you only consider the HN scope however, this is a trend I observe for much longer, well before I found here. Maybe my observation on other places was a reflection of SV mentality, who knows.
  - 533474 5y ago
    Spot on answer
macnale 5y ago
I am writing a datasource for my product, so that data can be rendered in Grafana. I distribute my product to customer. Do I need to open source my datasource code as well?
dig1 5y ago
I'm not surprised with this, seeing their aggressive push to cloud service. I'd say this is the route of popular OSS projects that became SaaS services: 1. Fork something Apache-licensed. 2. Build a community with "awesome" buzz. 3. Start a company, promising bells, and whistles. 4. Hire more and more people because bugs are piling up. 5. Now we need VC to fund all of that. 6. VCs are in charge now; they require "growth" and more paying customers. 7. Start using dark patterns. On the download page, hide the actual package download, redirect users to paying cloud or paying software version. 8. More frequent releases, more drastic redesigns, and changes. VCs need to see where the money goes. 9. VCs are still not happy. The company is spending more and more... relicense everything and force users to pay for the product. Mongo, Elastic, now Grafana... TBH I don't have a problem with *GPL, but let's be honest: they are luring users and companies with permissive licenses, promising "forever" stupidities, then suddenly and silently change the rules. The funniest thing is that most of these projects started on something with apache license...

710 points by WalterSobchak 5y ago

deleted 5y ago

[deleted]

I can see why they would relicense Grafana this way, but why Loki? It's a fairly immature product that needs the boost of a less restrictive license IMO. I'm worried this will harm the adoption of it compared to the ES ecosystem (OpenSearch in particular) and we won't see it used for anything beyond Grafana.

dvfjsdhgfv 5y ago
Popularity can increase rapidly, and if they do it too late, Amazon will screw them just like they did with Elastic.
- sojsurf 5y ago
  Counter opinion: I don't want to host Elasticsearch myself, which is why I pay Elastic to host several clusters. That said, I really don't want to be locked into a single-vendor situation, which is what Elastic is realistically aiming for. I am 100% glad that Amazon forked ES, because it preserves the benefits of using an open source stack. I still have a choice of hosted providers. In my opinion, the amazon fork is much more likely to lead to a healthy ecosystem of hosted ES providers than the Elasticsearch version.
- josephcsible 5y ago
  I wish people would stop equating what Grafana did with what Elastic did. Grafana switched from one FOSS license to another. Elastic switched from a FOSS license to a proprietary license.

asim 5y ago

All of the most important software of our lifetime is going through this relicensing effort as the creators attempt to capture the value of what it enables. This is not some nefarious plan to screw over the community. It's a very measured and thoughtful way to ensure the long term progress and continuity of these projects. If the core companies maintaining them did not do this they would eventually die and these projects would slowly rot. Hopefully over time rather than having everyone choose their own licenses we end up with some form of standardisation.

yjftsjthsd-h 5y ago
> Hopefully over time rather than having everyone choose their own licenses we end up with some form of standardisation. Yes; if you're going to do this, then using AGPL is so much better than flavor-of-the-week license. > If the core companies maintaining them did not do this they would eventually die and these projects would slowly rot. It sounds like you're suggesting that anything but hard-copyleft is doomed to die out, which is a somewhat hard argument to make in a world with lots of counterexamples (postgres, the assorted BSD OSs, kubernetes, Android).
- nine_k 5y ago
  Postgres looks like the only interesting entry here. K8s and Android have a major corporation backing them, which extracts value from them in its internal operation anyway. They are such products that using them by competition commoditizes said competition. Android on like 95% of phones outside China has very important proprietary parts, making it hardly compatible with a bunch of top-tier apps. BSD OSes don't do excessively well, with regard to market share and mind share. They are reasonably healthy though.
  - gen220 5y ago
    SQLite, Vim/Emacs, Linux, everything in GNU coreutils. All of the Apache projects (some to more/less an extant than others). Most programming language implementations (e.g. CPython). Memcached. WireGuard. SQLAlchemy. Web Frameworks like Flask, Django, Rails, on and on. There are many open source technologies that do not seek to capture the value they create with licensing hijinks. I don’t think it’s an accident, that the ones that persist across generations are generally not structured as VC-backed firms, who care a great deal more about “value capture” than the average programmer capable of building such foundational systems. Usually “value capture” is correlated with “consumer harm”, and so they’re replaced over time. From your example, K8s will definitely outlive Google. Hard to say about Android.

iFire 5y ago

What is the biggest fork of Granafa I can use that is non-share-alike? Edited: Oh, I can't say this... I leave it up for posterity and a note to myself then. http://www.paulgraham.com/say.html http://www.paulgraham.com/say.html

josephcsible 5y ago
Is there a specific conflict like ZFS-on-Linux that you want to avoid, or are you just asking "how can I most benefit from other people's work without letting anyone else benefit from mine?"
- iFire 5y ago
  Exactly. This is the ZFS-on-Linux situation. I prefer to keep all my code as much as possible mit and I share them on Github. This is my mode of operation. Grafana makes me unable to use MIT for that use.
  - zxzax 5y ago
    >keep all my code Huh? Grafana isn't your code, it's someone else's code that you'd be using. Unless I misinterpreted, and you are a Grafana contributor. If you are, you could dual license your contributions under AGPL and MIT, if you wanted.
    - yjftsjthsd-h 5y ago
      Without knowing what they work on, one obvious case is code that interacts with grafana; extensions, plugins, whatever. For that matter, it's perfectly possible to maintain your own personal patchsets without being a "contributor" per se. Niche, but plausible.
      - justincormack 5y ago
        Plugins don't seem to have been relicensed looking at https://github.com/grafana/grafana/blob/HEAD/LICENSING.md https://github.com/grafana/grafana/blob/HEAD/LICENSING.md

the_duke 5y ago

"Amazon Announces Grafana Fork , Promises Amazing Things for the Community" (2021/05/08) [1] On a more serious note: there is a bit of a trend in the licensing world. Mongo or ElasticSearch changes, or cool new projects like redpanda [2] launching with BSL. Open source is still a very young business model. One that has provided a tremendous amount of value over the past decades, but we still need to figure out how to build sustainable businesses with it. Be it open core, more restrictive licenses, copyleft, dual licensing, ... I just really hope that we don't slide back into the world of proprietary closed source. The danger is certainly there, and it will hit smaller companies the most. [1] https://aws.amazon.com/grafana/ https://aws.amazon.com/grafana/ [2] https://github.com/vectorizedio/redpanda https://github.com/vectorizedio/redpanda

josephcsible 5y ago
Amazon forking ElasticSearch to keep its old license is a good thing, since ElasticSearch's new license is a proprietary visible-source license. Grafana's new license is still FOSS, so it's really not a fair comparison.
- deleted 5y ago
  [deleted]
- hutrdvnj 5y ago
  While it is true that Grafana's new license is still FOSS not every company, public cloud provider is willing to accept the AGPLv3 license[1]. Hence a fork with the old license is not unlikely. [1] https://opensource.google/docs/using/agpl-policy/ https://opensource.google/docs/using/agpl-policy/
  - josephcsible 5y ago
    True, but my point wasn't so much about the likelihood of a fork as whether or not it would be a good thing.
  - sitkack 5y ago
    Google has the same OSS philosophy as Microsoft and the rest of the software community needs to pressure Google to change its stance on the AGPL.

jchw 5y ago

I don't want to weigh in here with a huge value judgement on whether this is the right decision. However, I do want to say that what they're saying regarding SSPL vs AGPL is totally right. One of the biggest sticking points with SSPL is that it's not even really plausibly open source, and it tries to create restrictions that implicate software that is not even "linked" with the program that is licensed under it, which calls into question whether it's even legally enforceable.[1] AGPL is somewhat controversial, but the reasoning for AGPL to exist is chiefly to protect the end user's rights, however misguided that may be in your opinion. In this case Grafana presumably retains the copyright to these programs, so presumably they are not beholden to these restrictions in any way. On the other hand, though, it does mean that other providers will have to distribute their patches back to the community, which is pretty much the entire goal of copyleft open source in the first place. In any case, this is, in my opinion, a lot better than SSPL or the Timescale license. [1]: https://www.processmechanics.com/2018/10/18/the-server-side-public-license-is-flawed/ https://www.processmechanics.com/2018/10/18/the-server-side-... edit: wording regarding AGPL was changed, because the claim that considering AGPL as not open source is “somewhat controversial” isn’t quite accurate; it’s more correct to say the license itself is simply controversial.

globular-toast 5y ago
Who I earth would argue that AGPL isn't open source? The kind of people who think open source = free lunch I suppose. It's probably the most open source licence there is.
- jchw 5y ago
  Maybe it isn't so controversial that it is called 'open source' as it is simply controversial. Though GPLv3 + AGPLv3 improves one of the worse problems, which is compatibility with GPL-licensed code. edit: And FWIW, I have dropped this claim from the post with a note, especially since it was not my point anyways.
josephcsible 5y ago
How is it debated whether AGPL is open source? Who says it isn't?

jabiko 5y ago

Even though we use Grafana only internally and there would be no problem with AGPLv3 in theory I see big meetings with legal coming up which might result in us not being able to use it anymore. I could image that its the same with other corporations. In the end that might hurt the popularity of Grafana quite a lot.

globular-toast 5y ago
There should be no problem with it even if you use it externally. It's about time companies stopped seeing open source as freely exploitable. Every company that uses open source software should be obliged to contribute, or pay for proprietary software.
bboreham 5y ago
Would you consider paying for a licence to use it?
- jabiko 5y ago
  Honestly, I have no idea. I think if there would be a possibility to pay money to have what we are doing reviewed by Grafana and be "certified" to be withing what they consider acceptable under the AGPL that might actually be a good option
  - bboreham 5y ago
    What about just paying for a commercial licence to use it to meet your needs?
    - jabiko 5y ago
      I have no Idea. Realistically its probably not the license cost but the one time and the perpetual operational overhead associated with the license that's going to be the problem.
      - 5y ago

jononor 5y ago

Hmm. Where does Grafana people stand on what constitutes a "derivative" work? Are my Grafana dashboards derivatives of Grafana, and must now be published? If I embed a Grafana dashboard in my application, is my application now a derivative of Grafana and must be released as AGPLv3?

jononor 5y ago
The Q&A suggests that "unmodified" distributions are not an issue. But if I distribute dashboards, custom configurations, etc - is that a "modification" ?
- nopzor 5y ago
  nope, that wouldn't be a modification to the AGPL-licensed grafana. you are free to do that. plus, dashboards and configuration are inherently ("source available"), so even if one were to consider them to be modifications (which they're not), you are already distributing them in source form ;-) [note: am co-founder/ceo of grafana labs]
  - lovasoa 5y ago
    The AGPL license states > A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate. Doesn't a product that offers grafana-powered dashboards "form a larger program" ?
    - lmm 5y ago
      If you're just exposing your grafana instance, no - and probably not if you're iframing them or similar. If you're actually embedding grafana into your program then yes, but that would be a strange way to structure a system.

rodgerd 5y ago

Seems like a sensible choice - one of the things that as cause me to look askance at some of the anti-serverisation (urgh) licenses has been companies trying to bespoke something when the AGPL has always been right there to solve the problem they're trying to tackle.

yjftsjthsd-h 5y ago

Okay, so they go out of their way to avoid answering how this actually affects people, so I'll ask here: If a company uses grafana internally, this should have no effect, right? And then the next step: If a company did offer grafana-based dashboards to customers but wasn't actually modifying grafana, what if anything does this do?

e12e 5y ago
Presumably - offering dashboards to users, would count as distribution to those users (internal or otherwise). Unmodified Grafana like has/will get a link to source code/license - that would likely cover you - although if Grafana goes away (or becomes closed source) - you might have to offer a copy of the source code on request?
josephcsible 5y ago
They'd have to offer the source code to Grafana itself, which has basically negligible effect since it doesn't have anything of theirs in it.
frenchman99 5y ago
They do say it: > It’s important to note that this change does not prevent our users from using, modifying, or providing our open source software to others — provided, however, that under the AGPL license, users have to share source code if they are modifying it and making it available to others (either as a distribution or over a network). For distributors, AGPL has the same source code sharing requirements as GPL. Those conditions are designed to encourage third parties looking to modify the software to also contribute back to the project and the community.
- technics256 5y ago
  It's still unclear to me if this also means things like custom dashboards, etc?
  - frenchman99 5y ago

mrwnmonm 5y ago

Sorry for my ignorance, what does this license mean? I find licenses a little bit difficult to understand.

Shoop 5y ago
"The GNU Affero General Public License is a modified version of the ordinary GNU GPL version 3. It has one added requirement: if you run a modified program on a server and let other users communicate with it there, your server must also allow them to download the source code corresponding to the modified version running there." https://www.gnu.org/licenses/why-affero-gpl.html https://www.gnu.org/licenses/why-affero-gpl.html
black_puppydog 5y ago
IANAL, and this is very simplified. The GPL (without A) requires you to publish sources under compatible license (usually also GPL) if you use a software and distribute it (to clients for example). Git is GPL. Github however can totally run modified versions of git on their servers to build their service, and doesn't necessarily have to contribute back, since they never distribute their programs to the customer, but only some html. The AGPL goes one step further and requires any changes that github makes in that situation to also be licensed under AGPL. That way it is like GPL, but for software that is typically run on servers, not on client hardware.
- mrwnmonm 5y ago
  Thanks

BringerOfChaos 5y ago

Looks like there were two blog posts. This QA session with the CEO is also interesting. https://grafana.com/blog/2021/04/20/qa-with-our-ceo-on-relicensing/ https://grafana.com/blog/2021/04/20/qa-with-our-ceo-on-relic...

gnalck 5y ago

Those who have reservations about the terms of AGPLv3 - would any of you prefer if it was licensed under BUSL1.1 (i.e., source-available or eventually-open-source) instead? I'm curious to see the perspectives of businesses as to whether AGPLv3 or BUSL-1.1 is a "bigger risk" when compared to the previous Apache 2.0 license. My gut feeling is that those passionate about open source on the whole will tend to prefer AGPLv3, while businesses or those making decisions on the behalf of a business, may prefer BUSL-1.1. I think there are trade offs with either approach.

richardwhiuk 5y ago
The BUSL is worse - obscure licenses are problematic. The problem with the AGPL is it's very unclear what counts as linking, and this has never been tested in court, and that it's not clear what "network access" needs to look like.
josephcsible 5y ago
> My gut feeling is that those passionate about open source on the whole will tend to prefer AGPLv3, while businesses or those making decisions on the behalf of a business, may prefer BUSL-1.1. Your gut is onto something. People who care about something bigger than themselves prefer AGPL, while those who only care about their own profits prefer BUSL.

blendergeek 5y ago

I applaud this decision. I would like to see all major SaaSS projects be AGPLv3. End users still have freedom to user, modify, and distribute the software. Cloud providers must share contributions. This is how I like it.

rakoo 5y ago
> Cloud providers must share contributions To be really strict: AGPL only mandates that contributions be shared with the user. The freedom of users is more important than the freedom of developers. Of course an upstream maintainer can be a user and get the contributions.
- kevincox 5y ago
  They have to be shared to the user under the same license. So any user could publish the changes publicly.
  - LukeShu 5y ago
    Sure, but there might be out-of-band reasons for users to not do that. For instance, grsecurity will sell you a security-hardening-patched Linux kernel. You, as the user/customer, have the right to take those GPL patches, and share them publicly. But if you do so, grsecurity will blacklist you as a customer, and you won't be able to get any more patches from them.
    - m4rtink 5y ago
      Didn't that preaty much out grsecurity into (an even bigger) obscurity as no one sane will touch a logic bomb like this, not to mention build their business on it ?
    - josephcsible 5y ago
      There's a strong case to be made that grsecurity is violating the GPL by doing that: https://perens.com/2017/06/28/warning-grsecurity-potential-contributory-infringement-risk-for-customers/ https://perens.com/2017/06/28/warning-grsecurity-potential-c...

wdb 5y ago

One of the reasons why I find it hard to contribute to projects that use CLA. Now you don't have any say in this relicensing even when contributed reasonable amount of code.

josephcsible 5y ago
This has nothing to do with CLAs. The old license was Apache 2, which is compatible with AGPLv3 (although the converse is not true). You'd only need a CLA to relicense if it weren't compatible.

ltbarcly3 5y ago

I remember when the AGPL was being talked about in around 2008 or so, and thinking it was ludicrous. Now I wonder if it's too lenient. AWS is just rebranding open source products and selling access for infinite markups while killing the open economy that created them. Maybe what we need is a 'no AWS' license, think Apache License but with a clause that says no corporation with more than $50B in revenue can resell it.

nrmitchi 5y ago
Is that not essentially what the Server Side Public License (SSPL) went for?
josephcsible 5y ago
> I remember when the AGPL was being talked about in around 2008 or so, and thinking it was ludicrous. Now I wonder if it's too lenient. It'd be really hard to come up with a license less lenient than AGPL without it being non-FOSS, which would defeat the purpose. > Maybe what we need is a 'no AWS' license, think Apache License but with a clause that says no corporation with more than $50B in revenue can resell it. This would be a blatant violation of freedom 0.
retzkek 5y ago
I mean, good for them? If they're "just rebranding and selling access for infinite markup" then surely the only people who would pay them are either too lazy or too busy to host it themselves, or too rich to care? Would you prefer that people/companies that fall into these categories be forced to go through some _other_ reseller (who is just adding their own markup on top of the cloud hosting costs) instead of getting the service directly from their cloud provider of choice?
- ltbarcly3 5y ago
  No, that's not the issue. They have a marketplace where ElasticSearch can be sold as SaaS. However, when there is something open source being offered on that marketplace, they co-opt it, give it AWS branding, and sell it themselves. They also own the infrastructure that both their own offering and the 3rd party SaaS offering is hosted on. Lets say they charge $1.00 / unit for EC2. They can charge $1.00 / unit for the 3rd party SaaS to run their service, and $1.00 / unit for their own offering which is basically EC2 + SaaS, so there is literally no way for the 3rd party to be price competitive, and meanwhile their own SaaS offering is blasted into the AWS interface everywhere, while the 3rd party offering has to be searched for and found. So they take the development work of that 3rd party and use their lock in and ability to steer customers to shut out the 3rd party, while taking all their work and selling it themselves at a price that the 3rd party can't possibly match (and not because of efficiency, because they'll just refuse to make a deal with the 3rd party to give an EC2 discount that they give all their other large customers if it would mean the 3rd party can then be price competitive with a SaaS offering that would compete with one of their own).

bonetruck 5y ago

I wonder how many companies will choose to kill off Grafana use as a result of this change. Two companies I've worked for have simply banned the use of anything having a GPL type license.

lolc 5y ago
Oh, no Linux at all then?
natas 5y ago
only red star os allowed?
- saagarjha 5y ago
  Red Star OS is Linux-based.
belorn 5y ago
Out of curiosity, what kind of markets are those two companies in and how much competition exist. Using open source libraries is, among other things, a cost saving measure. It allows a company to focus their expertise on what they are good at, without having to spend time and resources on reinventing wheels. Banning tools that enable a company to produce products faster, cheaper and (sometimes) more stable and secure can have a major impact when the competition does not limit themselves in the same way. However if the market is dominated by a monopoly or is very slow, then increased costs and delays might not have much of an impact. As an example of such company, Google's revenue would not be impacted by a single percent if they suddenly needed to hire 200 more programmers for android. Delay next version with 2 months and the impact for android market share would unlikely be statistically verifiable.

tlynchpin 5y ago

RIP grafana ^^ this is not a good contribution to HN, not much substance. (edit) Many people who use Grafana will see this news and will stop planning on using Grafana and start planning on doing something else. That has nothing to do with Grafana, that is a common reaction to AGPL. In theory, AGPL is fine under circumstances blahblahblah. In common practice in commercial settings (in my experience), GPL is poison and AGPL is radioactive poison.

mtmail 5y ago
I'd say a SaaS competitor build on top of graphana is more affected https://www.hostedgraphite.com/ https://www.hostedgraphite.com/
- pritambaral 5y ago
  Unless they were making money based on their proprietary modifications to Grafana, Loki, or Tempo, they aren't affected much beyond being required to publish links to the source code. If, however, they _were_ making money off of proprietary modifications, and they wanted to keep such modifications proprietary, they now have the choice to fork Grafana (and Loki and Tempo respectively) as of a pre-AGPL version.

natas 5y ago

this is good, even if loki can't scale well it's still good for the community.

macnale 5y ago

1) We distribute Grafana as docker container along with our product to customers. What is the impact for us and our customers? 2) We build Grafana on a platform which is not supported by out of the box. What is the impact for us and our customers?

josephcsible 5y ago
You'll need to give your customers the source code you used to build Grafana. If your customers are just using it internally, then they have no new obligations. If they're letting customers of their own use it, then they have the same new obligations that you do.
- macnale 5y ago
  Thank you for clarification. I read about Confluents decision about the license change. It looks like Confluent has opposite view than Grafana labs about AGPL. " Why didn’t Confluent use AGPL? AGPL doesn’t solve the problem we are trying to fix. AGPL allows cloud service providers to sell services using the exact software being licensed, and charge for it, without any limitation. This means the software developer has become the unpaid developer and maintainer for the cloud service provider—which is not a scenario we want to enable. Also, AGPL is too aggressive for our customers who need to redistribute commercial products. If you put AGPL code in a distributed program, you have to open source the whole program. We want you to be able to embed our code in proprietary applications, change it and not worry about open sourcing any of your changes. We don’t think that proprietary applications are bad, and we think it’s great if you use Confluent Community software to create them.:"
  - josephcsible 5y ago
    It sounds like Confluent doesn't get what the real problem is. There's 2 ways developers who also sell hosting end up losing all their market share to players like Amazon: 1. The big players like Amazon make custom, proprietary modifications to the software they're hosting, and since they're not technically distributing it, they don't have to release the changes, giving them an unfair advantage. This is the exact loophole that the AGPL closes. 2. Sometimes, the big players are just better/more efficient at hosting the exact same software the exact same way. There's nothing unfair or unethical about this; it's how the free market is meant to work that customers flock to them. Confluent is trying to "fix" the second "problem", which rather than making anything more fair, just makes it unfair in their favor.

renewiltord 5y ago

Is it still possible to integrate Grafana in your product or does the whole thing have to be AGPL. No complaints. Just curious. Like, can I distribute some SaaS that has a Dashboard section that is Grafana-powered while retaining my code?

damm 5y ago

Good. If Amazon wants to continue its creep of using open source software to build their empire they need to support the companies that make open source software. > If Amazon/AWS was not a large monopoly it wouldn't be a problem. DOJ Needs to split up AWS/Amazon and fine them and use that fine to create competition.

wyoawayd 5y ago

There's a lot of weird assumptions in this thread that this is some sort of strike against Amazon/AWS. It's not. AWS's managed grafana is built in partnership with grafana labs, and this license change won't affect it. From Grafana: "AWS is a strategic partner, and given the commercial relationship AWS has with us for AMG, AWS and their AMG customers are not impacted by this change. We hope that other XaaS providers follow AWS’s lead in working with open source software companies in similarly sustainable ways." https://grafana.com/blog/2021/04/20/qa-with-our-ceo-on-relicensing/ https://grafana.com/blog/2021/04/20/qa-with-our-ceo-on-relic...

sandstrom 5y ago
It could still be with AWS in mind. After this change, they'll be in a better negotiation position vs. AWS, since AWS can't (as easily) threaten that they'll build their own competing offer.
- toomanybeersies 5y ago
  > AWS can't (as easily) threaten that they'll build their own competing offer Elasticsearch changed their licence for more or less this reason [1]. So it wouldn't surprise me if Grafana's motivation was to solidify their position against Amazon. [1] https://www.elastic.co/blog/why-license-change-AWS https://www.elastic.co/blog/why-license-change-AWS
  - ignaloidas 5y ago
    > Elasticsearch changed their licence for more or less this reason And look how it's going for them. AWS very nicely forked elsasticsearch and now has the fork that seems to be gathering quite a bit of momentum. I doubt that AWS was even considering talking with them after they announced the license change.

oxfordmale 5y ago

I wonder how long will it take for Amazon to announce their an open source fork.

josephcsible 5y ago
Unlike ElasticSearch, Grafana itself is still open-source. Forking Grafana would be viewed a lot less favorably than forking ElasticSearch was.

lovasoa 5y ago

The announcement seems to say that products that include an unmodified version grafana can still be proprietary, and only modifications to grafana itself will have to be published. However, the AGPL itself is quite clear that if you distribute a larger work based on an AGPL software, the whole larger work has to be distributed under the same license. Would you still be confident shipping a proprietary product that includes a grafana dashboard ?

pavon 5y ago
The GPL and AGPL are clear that bundling does not constitute a derivative work, and does not require you to license the bundled works under the GPL/APL. > Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate. https://www.gnu.org/licenses/agpl-3.0.en.html#section5 https://www.gnu.org/licenses/agpl-3.0.en.html#section5 https://www.gnu.org/licenses/gpl-faq.html#MereAggregation https://www.gnu.org/licenses/gpl-faq.html#MereAggregation If you write a custom plugin for Grafana, then that plugin will likely need to be distributed under the AGPL (depending on Grafana's plugin architecture), but not your entire app. I would be completely confident in bundling in this manner. The AGPL3 and GPL3 have identical wording on this matter, and it has been a well understood aspect of the GPL for decades.
- lovasoa 5y ago
  Yes, I understood that just distributing grafana and your app together is not a problem, that is bundling. But what if grafana is a part of your app ? If you have a grafana dashboard inside the UI of your own application, this cannot be considered bundling, can it ? The AGPL is clear that if the result of the aggregation "forms a larger product", then you are NOT covered by the bundling clause.

tyingq 5y ago

Is there some exception for plugins? I can see a weird situation where a plugin for technology 'X' doesn't allow AGPL, but Grafana requires it.

sitkack 5y ago

Thank you! AGPL is a fine license for software freedom.

jrv 5y ago

What I don't like about changes like this is that it makes it impossible to reuse any Grafana/Loki/Tempo pieces or libraries in any more permissively-licensed code without forcing that whole project into the AGPL as well. That doesn't only hinder competitors (which seems to be the legitimate goal), but also hinders interoperability and an open ecosystem evolving where people freely exchange bits and pieces of code to make things work together. I know that some parts of the codebases have been exempted from these changes (see https://twitter.com/TwitchiH/status/1384566382180896769 https://twitter.com/TwitchiH/status/1384566382180896769), but those are only some, and they may change over time...

josephcsible 5y ago
IMO, the ideal end-state from a software freedom perspective is that all software becomes AGPL. This change is a step in that direction, not only with the directly affected products, but for the reasons you mentioned, an additional pressure for more things to switch to it. Do you not like that end goal, or do you just think the side effects of the change outweigh the benefits of getting closer to it?
- jrv 5y ago
  I think it's both a completely unrealistic end goal (we live in the real world), and I also think that the AGPL puts you into a hole where you can never get out of again if you decided that you now need different constraints. So I really much more prefer permissive licenses. Funnily just before you wrote this comment, I also tweeted just that :) : https://twitter.com/juliusvolz/status/1384599249082626052 https://twitter.com/juliusvolz/status/1384599249082626052
  - josephcsible 5y ago
    > I think it's both a completely unrealistic end goal I know :( I just meant it's the ideal we should strive towards, even if we never fully reach it.
    - 5y ago

neatze 5y ago

Can library be licensed under AGPL and class path exemption ? Seems like it will be better solution then MPL.

Andrew_nenakhov 5y ago

When we released our server product under GNU AGPL v3 license, we have received a rather negative reaction from other participants in our field. The general sentiment was, "this license makes a useless curiosity". I wonder where does this hostility come from. Jealosy? FUD? Frustration that they can't take the source and not share own improvements??

aidenn0 5y ago
No lawyer wants to be the first one to adopt licenses with novel clauses because the legal system runs on precedent, so using something that is untested in court is higher risk. It wasn't that long ago that no large company would touch the GPL with a 10 foot pole.
zokier 5y ago
The problem I have with AGPL is that you need to think about it, even if you just run the software and are not distributing it. Or rather AGPL forces you to distribute the software you run. This is in stark contrast to all other mainstream licenses where in general you don't need to think about the license at all if you are not distributing the software, which makes very worry free experience.
- gpanders 5y ago
  > Or rather AGPL forces you to distribute the software you run. No it does not. Using AGPL software does not suddenly make your own software a derived work.
  - djb_hackernews 5y ago
    Tell that to the lawyers who are paid lots of money to be risk adverse. As others point out, the law operates on precedent, no lawyer wants their decision to be the one that makes their employer a test piece.
  - zokier 5y ago
    If you run AGPL licensed software you must be prepared to distribute it to its users.

sideeffffect 5y ago

If I contribute a code under the new CLA, is Grafana Labs allowed to relicense that contribution under a non-copyleft license, like Apache Public License 2.0, without my further permission? If yes, than it's a really bad bad thing and I hope they change it. CLAs that permit relicensing for a project that already uses permissive license is fine and fair. But doing that on a project with a copyleft license is a bad taste. It would enable Grafana Labs to give Grafana to a party X which can then give it to party Y, where X isn't required to give all the necessary freedoms to Y. https://opensource.com/article/19/2/cla-problems https://opensource.com/article/19/2/cla-problems https://sfconservancy.org/blog/2014/jun/09/do-not-need-cla/ https://sfconservancy.org/blog/2014/jun/09/do-not-need-cla/

justincormack 5y ago
The new CLA doesn't seem to allow relicense. The old one [1] allowed relicense under OSI approved licenses. [1] https://web.archive.org/web/20200311075025/https://grafana.com/docs/grafana/latest/developers/cla/ https://web.archive.org/web/20200311075025/https://grafana.c...
ec109685 5y ago
Don’t they have a license to your work and they can do however they please with it? E.g. sell it to X and Y for whatever they want and X and Y have no obligations to ever release anything back?
- lmm 5y ago
  Not necessarily. They have whatever rights the terms of the CLA say they have.
rocqua 5y ago
Usually part of the CLA is meant to allow dual licensing. The idea is that the company also makes the software available under a commercial non-viral license. Hence if you contribute to a GPL project with a CLA, some companies could still publish your code closed source through a commercial license deal.
5y ago

dec0dedab0de 5y ago

I like the AGPL, but I would like an extra step that forces you to distribute code even you have not modified it. This would be in the case of the original being unavailable for some reason. Does anyone know how difficult it would be to have the login page for a web app be a different license? The idea being that the only users of the AGPL code are ones that have a valid account. Off the top of my head a reverse proxy, with a completely separate auth app would do the trick, but would be a bit of a pain.

jblwps 5y ago
> I like the AGPL, but I would like an extra step that forces you to distribute code even you have not modified it. This is...already the case. The distributor is the one who is bound to supply the source code--"upstream" isn't implicated in the license.
- dec0dedab0de 5y ago
  I didn't see your reply until just now, but the AGPL does not require you to redistribute source code to network users if it is not modified. The following stack exchange question has quotes from the fsf https://opensource.stackexchange.com/questions/650/do-i-have-to-offer-the-source-of-an-agpl-v3-0-licensed-web-app-even-if-i-didn https://opensource.stackexchange.com/questions/650/do-i-have...

crazypython 5y ago

Note that the AGPLv3 has an exception allowing you to link to GPLv3. GPLv3 allows for private use, in other words keeping changes secret as long as they stay on your own computer. In effect, it becomes a weak copyleft- akin to MPL-2.0 where as long as you keep it in separate files code can stay closed-source.

znpy 5y ago

Big kudos, they learned from elastic' story

867-5309 5y ago

Grafana: The analytics platform for all your metrics. Allows you to query, visualize, alert on and understand your metrics no matter where they are stored. Create, explore, and share dashboards with your team and foster a data driven culture. Loki: Web Analytics Dashboard for NGINX Tempo: An open source, easy-to-use and high-scale distributed tracing backend. Tempo is cost-efficient, requiring only object storage to operate, and is deeply integrated with Grafana, Prometheus, and Loki. Tempo can be used with any of the open source tracing protocols, including Jaeger, Zipkin, and OpenTelemetry.

remram 5y ago
Loki is a generic log aggregation platform. It is not built for NGINX or coupled with it in any way.

protomyth 5y ago

Has AGPLv3 had anything decided in court about it?

Proven 5y ago

> For distributors, AGPL has the same source code sharing requirements as GPL. Those conditions are designed to encourage third parties looking to modify the software to also contribute back to the project and the community. Like the government "encourages" me to wear seat belts and pay taxes. License your stuff however you want, but don't sugar-coat it in nonsense PR terms.

toddpersen 5y ago

The funny thing to me, which I haven't seen anyone else mention yet, is that way, way back in the old days, Grafana started out as a fork of Kibana. Go take a look at the first commit in the Grafana source: https://github.com/grafana/grafana/commit/75d03fc49ab4f95ee414f730563f14cbdad9ee64 https://github.com/grafana/grafana/commit/75d03fc49ab4f95ee4... Anyone want to guess what the third commit was? That's right, it was an Apache 2 license: https://github.com/grafana/grafana/commits/master?after=2bb7eb18d1c06b20db63d9e0a9aeca3a8adbb97a+28900&branch=master https://github.com/grafana/grafana/commits/master?after=2bb7... Before there was any code, there was a permissive license. If the choice had been made 8 years ago to make Kibana less-permissively licensed, it's very likely Grafana wouldn't exist right now. And for historical fun, here's the first commit from Torkel after the fork from Kibana v3: https://github.com/grafana/grafana/commit/50e42c8bdd2099552dbc3e7a46f429d501f401ae https://github.com/grafana/grafana/commit/50e42c8bdd2099552d...

leeoniya 5y ago
i wonder how much of that original Kibana code remains today (my guess is not very much), and if it were originally AGPL, would a completely rewritten codebase still be subject to it?
- varajelle 5y ago
  The license talk about derived work. And even if every line of code has been changed, it is still a derived work as it was progressively changed. So pattern and desings from the original are still in use. The Ship of Theseus is still the Ship of Theseus.
  - cutemonster 5y ago
    > it is still a derived work as it was progressively changed. I think that depends. If it was progressively changed to something completely different, then, no. Let's say in 10 days you replaced 10% of the code, with the same amount of code from a different program by another author. During those 10 days there'd be compilation errors, and thereafter the original work and copyright would be all gone (except for in old revisions in the repo), and the copyright holder of the new program could license it however s/he wanted.

angry_octet 5y ago

I look forward to a future AGPL, perhaps Absolutist AGPL. Licencing your code under AAGPL extinguishes your own copyright as the author -- you now only have the same rights as someone triggering the code or a derived work. Triggering is any action which causes the code to run without human intervention. The AAGPL will finally remove the possibility of crippled 'Community Edition' software.

ofrzeta 5y ago

Will AWS now fork the pre-license-change source and create their own "Open Grafana"? /s

pabs3 5y ago

Would be nice if they would drop the CLA too.

linuxhansl 5y ago

I think this is a step in the wrong direction. Open source is about an open community, open contributions, the multiplier you get from contributions from multiple companies. That way open source is a win-win. Companies benefit from each other's contributions. Once you have free and non-free tiers or need restrictive licensing it is already broken. The incentives no longer align. I'm being paid in part to work on the open source projects that we utilize for our service(s). Some of those we started, some of those we're contributing to, but we _own_ none of them. We handed them off to external entities (Apache and others) for governance and we actively encourage others to participate. And, yes, some of those are used by Amazon, and we welcome their contributions to the code. Single support companies that use the popularity and reach of permissive licenses for profit that then turn around and bemoan the fact that their licenses are too permissive are disingenuous.

maxbaines 5y ago

Which version is the last licenced under Apache?

bayindirh 5y ago

Why there's a prevailing hate against xGPL licenses? Almost all of the core infrastructure which runs this Apache/BSD/MIT licensed software is running on xGPL software. I believe that we wouldn't be here without these aggressive copyleft licenses, and some developers embracing this license again is a good thing. I'll always prefer Nextcloud because it's AGPL. Similarly I'll use Grafana with less hesitation since it'll be AGPL from now on. Being able to see everything inside a software and not binned as community/enterprise is better from my point of view. I'd happily pay for AGPL software, and I already pay a lot of money for licenses so, it's not about money.

4bpp 5y ago
I assume the answer to the "why" can be as simple as: being primarily a Silicon Valley software industry forum, HN knows what side its bread is buttered on (namely the side of cobbling together freely available software to make proprietary products).
- bayindirh 5y ago
  Thanks for your answer. Yes, the answer is simple when you only consider the HN scope however, this is a trend I observe for much longer, well before I found here. Maybe my observation on other places was a reflection of SV mentality, who knows.
- 533474 5y ago
  Spot on answer

macnale 5y ago

I am writing a datasource for my product, so that data can be rendered in Grafana. I distribute my product to customer. Do I need to open source my datasource code as well?

dig1 5y ago

I'm not surprised with this, seeing their aggressive push to cloud service. I'd say this is the route of popular OSS projects that became SaaS services: 1. Fork something Apache-licensed. 2. Build a community with "awesome" buzz. 3. Start a company, promising bells, and whistles. 4. Hire more and more people because bugs are piling up. 5. Now we need VC to fund all of that. 6. VCs are in charge now; they require "growth" and more paying customers. 7. Start using dark patterns. On the download page, hide the actual package download, redirect users to paying cloud or paying software version. 8. More frequent releases, more drastic redesigns, and changes. VCs need to see where the money goes. 9. VCs are still not happy. The company is spending more and more... relicense everything and force users to pay for the product. Mongo, Elastic, now Grafana... TBH I don't have a problem with *GPL, but let's be honest: they are luring users and companies with permissive licenses, promising "forever" stupidities, then suddenly and silently change the rules. The funniest thing is that most of these projects started on something with apache license...