4 ms·

No PR and no discussion and no announcement. This will be a fun time bomb for anyone using Minio at a company where legal dislikes AGPL licenses.

gsich 6y ago
Just don't upgrade or don't modify the sourcecode.
- marcinzm 6y ago
  See my first sentence. Can't not do something if you don't know the license changed.
  - gsich 6y ago
    Not an issue. If you modify the source you'll notice if you try to keep upstream. If not (as in you don't modify) then it doesn't matter anyway.
    - marcinzm 6y ago
      Many companies have outright internal bans on AGPL or contractual bans imposed by their clients.
      - gsich 6y ago
        And? What's the point? That companies can be stupid? If you don't upgrade literally nothing will change. If you have upgraded and noticed the license change - downgrade. Or just use it anyway, if the value of Minio is worth it.
        yjftsjthsd-h 6y ago
        > If you don't upgrade literally nothing will change. If you have upgraded and noticed the license change - downgrade. And if you upgrade and don't notice the change?
        gsich 6y ago
        Then no one else will either and you most likely haven't modified the source (as that would make you notice the changes) so you are fine too.
    - yjftsjthsd-h 6y ago
      I've seen companies automatically patch software (there was a CI pipeline that would clone upstream, automatically apply a patch file, and ship the result), so it's certainly possible to pull+patch without looking at specific changes, let alone watching for a relicense.
      - gsich 6y ago
        Sounds like a leftpad disaster.
  - chii 6y ago
    > Can't not do something if you don't know the license changed. its your responsibility to know that it has changed when you upgrade.
imglorp 6y ago
What's the grief from legal? All you have to do is post source for changes you make to minio, right? That doesn't seem like a huge burden.
- tirrex 6y ago
  Some companies have no AGPL policy. e.g : https://opensource.google/docs/using/agpl-policy/ https://opensource.google/docs/using/agpl-policy/
  - yebyen 6y ago
    The entire CNCF apparently has a no AGPL policy. We just found out this week that we cannot update and redistribute Grafana anymore with our CNCF projects, (or if we do we will be on very shaky legal footing.)
    - moreati 6y ago
      For anyone else wondering: Cloud Native Compute Foundation https://www.cncf.io/ https://www.cncf.io/ > a Linux Foundation project that was founded in 2015 to help advance container technology[1] and align the tech industry around its evolution. > It was announced alongside Kubernetes 1.0, an open source container cluster manager, which was contributed to the Linux Foundation by Google as a seed technology. Founding members include Google, CoreOS, Mesosphere, Red Hat, Twitter, Huawei, Intel, Cisco, IBM, Docker, Univa, and VMware -- https://en.wikipedia.org/wiki/Cloud_Native_Computing_Foundation https://en.wikipedia.org/wiki/Cloud_Native_Computing_Foundat...
    - sofixa 6y ago
      Why? Is there some document going into more detail ?
      - yebyen 6y ago
        https://github.com/cncf/foundation/blob/master/allowed-third-party-license-policy.md https://github.com/cncf/foundation/blob/master/allowed-third... I haven't read the details, or ever seen this policy before (I'm new to both projects) but it was summarized by one of our counterparts at the Linux Foundation here: https://twitter.com/cra/status/1384859663615864833 https://twitter.com/cra/status/1384859663615864833 Tl;dr: licenses must be approved for use, and the CNCF has this list of allowed licenses, AGPL is not on it. The CNCF is in the business of distributing permissively-licensed software is the short version I guess. I don't understand, I don't work on the legal side, I am a dev and I support end users. It seems if your Apache 2.0 licensed project needs to modify and distribute as modified an AGPL project, (which for Grafana it seems likely we will need to do at some point, the Linkerd project already has needed to do this if I understood correctly) then you cannot distribute them together, or something about this becomes much more complicated. Chris says they are going to try to work something out, but when a component has made a decision to re-license with a restrictive-copyleft license such as AGPL, I don't know what there is that can be done to fix it. I hope they come up with something. Maybe the CNCF adopts AGPL too, (which would mean that then all those "viral-GPL" FUD-spreaders will have been right...) that seems counter-productive if that is the outcome. (So I hope they come up with something else than that!) Everyone is within their own rights to do whatever they want with the output of their own labor, I just wanted to help dispel the notion that only exploitative companies are affected by this change. If the "why" rather than the mechanical/legal "what" is what you're after, this is the CNCF position paper on the topic: https://www.cncf.io/blog/2017/02/01/cncf-recommends-aslv2/ https://www.cncf.io/blog/2017/02/01/cncf-recommends-aslv2/ > Proponents of copyleft licenses have argued that these licenses prevent companies from exploiting open source projects by building proprietary products on top of them. Instead, we have found that successful projects can help companies’ products be successful and that the resulting profits can be fed back into those projects by having the companies employ many of the key developers, creating a positive feedback loop.
neya 6y ago
https://github.com/minio/minio/issues/12143 https://github.com/minio/minio/issues/12143
- zucker42 6y ago
  It's pretty ironic that the person talking about commenters not contributing to open source responded directly after Drew Devault criticized the sudden nature of the change.
  - ajdude 6y ago
    And it may have actually been someone from Minio using a throwaway account, according to the comments before it was locked.
flukus 6y ago
Only if they're modifying the source code, which would be a tiny minority.

gsich 6y ago

Just don't upgrade or don't modify the sourcecode.

marcinzm 6y ago
See my first sentence. Can't not do something if you don't know the license changed.
- gsich 6y ago
  Not an issue. If you modify the source you'll notice if you try to keep upstream. If not (as in you don't modify) then it doesn't matter anyway.
  - marcinzm 6y ago
    Many companies have outright internal bans on AGPL or contractual bans imposed by their clients.
    - gsich 6y ago
      And? What's the point? That companies can be stupid? If you don't upgrade literally nothing will change. If you have upgraded and noticed the license change - downgrade. Or just use it anyway, if the value of Minio is worth it.
      - yjftsjthsd-h 6y ago
        > If you don't upgrade literally nothing will change. If you have upgraded and noticed the license change - downgrade. And if you upgrade and don't notice the change?
        gsich 6y ago
        Then no one else will either and you most likely haven't modified the source (as that would make you notice the changes) so you are fine too.
  - yjftsjthsd-h 6y ago
    I've seen companies automatically patch software (there was a CI pipeline that would clone upstream, automatically apply a patch file, and ship the result), so it's certainly possible to pull+patch without looking at specific changes, let alone watching for a relicense.
    - gsich 6y ago
      Sounds like a leftpad disaster.
- chii 6y ago
  > Can't not do something if you don't know the license changed. its your responsibility to know that it has changed when you upgrade.

imglorp 6y ago

What's the grief from legal? All you have to do is post source for changes you make to minio, right? That doesn't seem like a huge burden.

tirrex 6y ago
Some companies have no AGPL policy. e.g : https://opensource.google/docs/using/agpl-policy/ https://opensource.google/docs/using/agpl-policy/
- yebyen 6y ago
  The entire CNCF apparently has a no AGPL policy. We just found out this week that we cannot update and redistribute Grafana anymore with our CNCF projects, (or if we do we will be on very shaky legal footing.)
  - moreati 6y ago
    For anyone else wondering: Cloud Native Compute Foundation https://www.cncf.io/ https://www.cncf.io/ > a Linux Foundation project that was founded in 2015 to help advance container technology[1] and align the tech industry around its evolution. > It was announced alongside Kubernetes 1.0, an open source container cluster manager, which was contributed to the Linux Foundation by Google as a seed technology. Founding members include Google, CoreOS, Mesosphere, Red Hat, Twitter, Huawei, Intel, Cisco, IBM, Docker, Univa, and VMware -- https://en.wikipedia.org/wiki/Cloud_Native_Computing_Foundation https://en.wikipedia.org/wiki/Cloud_Native_Computing_Foundat...
  - sofixa 6y ago
    Why? Is there some document going into more detail ?
    - yebyen 6y ago
      https://github.com/cncf/foundation/blob/master/allowed-third-party-license-policy.md https://github.com/cncf/foundation/blob/master/allowed-third... I haven't read the details, or ever seen this policy before (I'm new to both projects) but it was summarized by one of our counterparts at the Linux Foundation here: https://twitter.com/cra/status/1384859663615864833 https://twitter.com/cra/status/1384859663615864833 Tl;dr: licenses must be approved for use, and the CNCF has this list of allowed licenses, AGPL is not on it. The CNCF is in the business of distributing permissively-licensed software is the short version I guess. I don't understand, I don't work on the legal side, I am a dev and I support end users. It seems if your Apache 2.0 licensed project needs to modify and distribute as modified an AGPL project, (which for Grafana it seems likely we will need to do at some point, the Linkerd project already has needed to do this if I understood correctly) then you cannot distribute them together, or something about this becomes much more complicated. Chris says they are going to try to work something out, but when a component has made a decision to re-license with a restrictive-copyleft license such as AGPL, I don't know what there is that can be done to fix it. I hope they come up with something. Maybe the CNCF adopts AGPL too, (which would mean that then all those "viral-GPL" FUD-spreaders will have been right...) that seems counter-productive if that is the outcome. (So I hope they come up with something else than that!) Everyone is within their own rights to do whatever they want with the output of their own labor, I just wanted to help dispel the notion that only exploitative companies are affected by this change. If the "why" rather than the mechanical/legal "what" is what you're after, this is the CNCF position paper on the topic: https://www.cncf.io/blog/2017/02/01/cncf-recommends-aslv2/ https://www.cncf.io/blog/2017/02/01/cncf-recommends-aslv2/ > Proponents of copyleft licenses have argued that these licenses prevent companies from exploiting open source projects by building proprietary products on top of them. Instead, we have found that successful projects can help companies’ products be successful and that the resulting profits can be fed back into those projects by having the companies employ many of the key developers, creating a positive feedback loop.

neya 6y ago

https://github.com/minio/minio/issues/12143 https://github.com/minio/minio/issues/12143

zucker42 6y ago
It's pretty ironic that the person talking about commenters not contributing to open source responded directly after Drew Devault criticized the sudden nature of the change.
- ajdude 6y ago
  And it may have actually been someone from Minio using a throwaway account, according to the comments before it was locked.

flukus 6y ago

Only if they're modifying the source code, which would be a tiny minority.