12 ms·

Monetizing open-source is problematic

460 points by no_wizard 5y ago

pkd 5y ago
Oof, that sounds really bad. Would really like to see the response from Retool.
- no_wizard 5y ago
  Honestly that’s why part of the reason why I posted this here. If this made HN Frontend page I feel like they’re gonna notice and have to respond, a lot of potential customers reside on this forum
  - gabereiser 5y ago
    would it be possible to require a session token or some other secret in order for images from fakercloud.com to resolve? I know of a few services that do this for map tiles to prevent scraping or hot linking.
  - tiltrus 5y ago
    I hope that you reach a fair conclusion with their CEO. :)
neximo64 5y ago
It is MIT licensed so theres nothing wrong them reselling faker but the stuff theyre doing here looks quite dodgy. I am a user of retool but for companies with access to your data you expect a bit of integrity. Would be really interested to know what retools response is. You should follow up a couple of weeks from now on HN if nothing happens.
- ncann 5y ago
  I think the main problem is Retool is using the faker cloud api directly behind the scene (?) and the generated data is hosted on the faker cloud CDN (?).
  - Eikon 5y ago
    But they are paying for it so what's the issue?
    - deleted 5y ago
      [deleted]
    - accountofme 5y ago
      Copyright infringement?
      - HideousKojima 5y ago
        It's MIT licensed. If they're actually reselling the API (and not hosting their own instance) then it could potentially be in violation of the terms of service, but that's it. Using images from Faker's CDN is scummy and potentially illegal, but fairly minor overall.
        accountofme 5y ago
        If you are using images that someone else createdbwithout permission or license that is copyright infringement. If you are also using data created from a service and use it in your product again without permission or license this is also copyright infringement.
  - slver 5y ago
    It's not using the cloud API. All this logic is in Faker.js itself, and apparently Retool unwittingly lifted it with the rest.
- slver 5y ago
  Using the faker CDN is dodgy and actually probably not legal. But everything else is. You don’t want startups using your IP? Don’t license it to them for free with no restrictions. Duh.
  - HideousKojima 5y ago
    All of these stories in the last few months about big tech companies "abusing" open source software is straight out of /r/leopardsatemyface. "I want to build an open source project with a license that lets anyone use it any way they want for free! No, don't use it like that!"
    - slver 5y ago
      FOSS is a cargo cult to many naive developers. They build useful tools, give them out, and expect millions of payout will happen somehow.
      - HideousKojima 5y ago
        It's straight out of the South Park underpants gnome school of business: 1) Write open source code 2) ??? 3) Profit
    - deleted 5y ago
      [deleted]
  - oh_sigh 5y ago
    faker.js - the MIT licensed free software - generates links to fakercloud.com. The error is in faker.js creating links to a paid-service CDN, not in how Retool is using the MIT licensed software. https://github.com/Marak/faker.js/blob/c9764abd20a198e318367952a94587eda1bac645/lib/internet.js#L15 https://github.com/Marak/faker.js/blob/c9764abd20a198e318367...
    - amadvance 5y ago
      The MIT license has a legal disclaimer, so the responsibility is not on the author of the software.
- tiltrus 5y ago
  I have been seeing a lot of Retool lately on my Facebook News feed. What's amazing to me is that they're using his CDN. Does this company have such terrible code review that they forgot to use their own CDN? Definitely makes me think twice about the quality of Retool's software.
  - HideousKojima 5y ago
    Looks like Faker has links to their CDN hardcoded in the source code: https://github.com/Marak/faker.js/blob/c9764abd20a198e318367952a94587eda1bac645/lib/internet.js#L15 https://github.com/Marak/faker.js/blob/c9764abd20a198e318367... Still something Retool should have caught, but a poor choice on Marak's end too
- reputet 5y ago
  Yes, it's MIT and everybody else is allowed to use it as they want. Would it be a good option to relicense the project under the AGPL/SSPL or whatever licenses (how MongoDB/Elastic/Anaconda have done) to get credit?
mtnGoat 5y ago
Hmmm. Certainly questionable ethically and shady. But isn’t that the kind of activity/decisions a lot of SV runs in lately?
deleted 5y ago
[deleted]
mrthrowmantic 5y ago
That’s disappointing, I wonder what legal recourse there may be for using your CDN.
w-j-w 5y ago
Have you considered just turning it off? Or adding a requirement for API keys and disabling any that they hand out to their customers. It would be pretty embarrassing for a large company that had a service go down because they refused to pay for it.
neolog 5y ago
This is what AGPL is for.
- 40four 5y ago
  Yeah, I mean this story sucks, I feel for the creator. But my gut is telling me this is a perfect example we all shouldn’t just default to MIT license out of the ‘goodness of our hearts’.
nyx 5y ago
Have you considered serving Goatse to API hits from their IP ranges?
- ronsor 5y ago
  That's like asking if you've considered telling people to avoid your service forever.
  - nyx 5y ago
    I mean, actually using Goatse here would probably be a bad idea, but what I really meant by my comment is "maybe you ought to treat this like any other hotlinking abuse situation, for which there are many commonly employed mitigations." Serving shock images or other rude content is just the particular mitigation that makes me giggle.
    - asddubs 5y ago
      add a watermark that reads "your free fakercloud 30 day trial has ended - please sign up to keep using the service"
    - fiddlerwoaroof 5y ago
      I think the “professional” way to handle this is to implement API keys and rate limit requests without API keys heavily. (Possibly putting a link to your pricing page in the “too many requests” header.)
austinkhale 5y ago
As a Retool customer, this feels gross. I hope they reach out and find a way to make this right.
- okdjnfweonfe 5y ago
  It's kinda your obligation to do more than "hope", isn't it? If Retool sees that their customers don't care enough to leave because of this, then why would they bother making things right?
  - austinkhale 5y ago
    No, it is not. That being said, I certainly would move to another service if they don’t make it right. However, I also run a business and don’t make knee-jerk reactions to cancel support services on a Saturday evening without giving any sort of time for the provider to respond. Always amazes me how intent people are at trying to frame comments in the least charitable way possible. We all support this person getting paid for their work. End of story.
- patcon 5y ago
  Ditto. I was eager to set up a manufacturing sector client with Retool this coming week, but holy shit, assholes acting with impunity like this is infuriating, and I'm putting in extra time to try to find an alternative. Open to suggestions
  - ianpurton 5y ago
    Take a look at appsmith
    - joejohnston 5y ago
      Or Budibase.com
  - djrogers 5y ago
    Calling people derogatory names after only reading one side of a story on the Internet is not cool…
butner 5y ago
Retool can't handle basic ethnical issues, why should one trust their customer data to them?
- Axsuul 5y ago
  It feels too soon to be jumping to this conclusion.
- rexfuzzle 5y ago
  Links please.
- urda 5y ago
  I appreciate the openness of this article, and I'm not pointing fingers, but I just want to point out we only have one side of the story so far. This needs attention though that's for sure. I'm sure at least one of the Retool engineers read Hacker News so hopefully that will help get traction.
perrohunter 5y ago
Re-license as AGPL, charge for an exemption
- grp000 5y ago
  Are you allowed to retro-actively change your license to something more restrictive?
  - yjftsjthsd-h 5y ago
    Isn't going forward sufficient?
    - HideousKojima 5y ago
      If the code is already fairly mature then the big companies using it can just fork it (and make their new fork entirely closed if they feel like it) and the creator of the original code won't be able to do a thing about it.
  - riquito 5y ago
    You can change your license, but it's not retroactive, the code released so far keeps the old license (and can be forked from there). Note that it would be unsustainable otherwise, e.g. release as free, force people to pay later
- sangnoir 5y ago
  If they use AGPL, how would they get companies to actually use the software before extorti^w shaming them into paying some money for a product they are licensed to use for free? Developers: think long and hard about the license that's right for your project before you push out to the world. I can't help but feel that free/open source software has become a lot less altruistic in the era of Github. We gained quantity and quality, but lost something else that's difficult to express: innocence? Not every project needs to be a job/startup/foundation (cue Left-Pad LLC). I daresay, not all projects ought to be monetized, period.
  - 5y ago
Axsuul 5y ago
Keep following up! However, your email isn't very clear about the situation — it just looks like an offer to sell. Also I noticed that the tool[0] that is referenced in the blog post no longer contains the "Avatar" field. 0. https://retool.com/api-generator https://retool.com/api-generator
Crazyontap 5y ago
Looks like this hasn't happened to him for the first time either. First page results for faker.js show how he has been ripped off before too(1). Really sad how big companies abuse OSS. (1) https://www.reddit.com/r/javascript/comments/jquo97/fakerjs_no_more_free_work_from_marak_pay_me_or/ https://www.reddit.com/r/javascript/comments/jquo97/fakerjs_...
- slver 5y ago
  He needs to figure out if he wants to be paid or not. Offering a free product and support and then complaining people don’t pay you is honestly fucking weird.
  - mynameisvlad 5y ago
    He has a paid product, fakercloud.com. Retool seems to be using or at least linking to it without permission.
    - slver 5y ago
      You’re assuming things he didn’t say. He didn’t investigate that in depth. All we saw is the hosted images. Which is wrong, but most likely a mistake done by the devs charged with copying him.
      - mynameisvlad 5y ago
        And you’re being incredibly charitable to Retool, who haven’t even said their side of the story. Those URLs don’t create themselves. It looks to be using a hash of some sort, which means it needs to be something generating them, it’s not just them appending a hash to https://fakercloud.com https://fakercloud.com. And even if it were, why use fakercloud, a paid service that you don’t subscribe to, and not your own? In either case, your original complaint is that the author can’t decide between working for free or paid. It’s clear that isn’t the case considering, as I pointed out, they have a cloud service that’s paid. They clearly have figured out some way to be paid for their work.
liamwire 5y ago
For when Retool’s team inevitably reads through this: compensate for, and fix this. Until I can see genuine efforts made to repair this situation, I’ve cancelled my account. Shame.
- atian 5y ago
  How big is your account?
Eikon 5y ago
I have a hard time understanding the problem. Retool is paying a fakercloud subscription and using it to power their product which does not sounds like an issue at all?
- capiki 5y ago
  I may have missed it but I didn't see anywhere that Retool is paying for a subscription. Even if they are, I'm not sure that entitles them to free use of the Fakercloud CDN.
  - Axsuul 5y ago
    Retool is a $500/mo supporter of faker.js on Open Collective. Fakercloud has a $500/mo enterprise plan. So it kind of adds up I guess.
deleted 5y ago
[deleted]
foobarbaz33 5y ago
> ... without permission. Actually it sounds like you gave them permission, then regretted it.
- deleted 5y ago
  [deleted]
djrogers 5y ago
Something the blog post doesn’t make clear at all here - are they paying for the fakercloud CDN and API usage? If so, do your TOS prohibit reselling? If so, call a lawyer. If not, rewrite your TOS, then call a lawyer.
adam_arthur 5y ago
I hate to be that guy, but idealism in software needs to die. Don't use a license that's more permissive than you're willing to tolerate. It's absurd to me for a project to publish something with a 100% open source license and then complain when somebody tries to profit off of it. Doesn't really matter how egregious or large the perpetrator is. If you want exceptions, write it into the license. People want the goodwill that comes with open source, without accepting the consequences. That being said, I do empathize with the plight of the author. Perhaps they were naive to this possibility.
- caslon 5y ago
  In this case, I think the main problem is (emphasis mine): "If you can't see the image, Retool's new service is using images hosted from fakercloud.com" There's a difference between using someone's software and using someone's servers.
  - adam_arthur 5y ago
    I'm interested in the legality of what they're doing. But it seems very similar in concept to automated web scraping, which has been deemed legal in the US.
    - judge2020 5y ago
      The U.S. legislature hasn’t touched computer laws in forever, so an armchair guess is hard, but chances are that causing an extreme financial burden by hotlinking someone else’s images is illegal - although maybe the fact that fakercloud could just block hotlinking based on the referrer header means it’s not as open-and-shut of a case.
  - ryandrake 5y ago
    In my view, if your web server responds to an arbitrary HTTP GET with the asset and 200 error code, then your intention is that the asset is public and any browser can request it. If you don’t like a particular request, return 403 and get on with your life.
  - 5y ago
ztratar 5y ago
I think Retool is in the wrong, though I also think your emails were quite indirect. Better to be direct. I think it's very possible the CEO did not fully internalize what you were implying by stating they're using your CDN, etc, and instead it just seemed like a sales email.
dvdhsu 5y ago
Hi all! I'm David, CEO @ Retool. I'm looking in to this right now and will update my comment here with a response in the next two hours. Edit: just did a bit of digging. It looks like we have a Retool template that has some fake data in it (https://retool.com/api-generator/ https://retool.com/api-generator/). This is an app built in Retool, and has a few thousand rows of hard-coded data. Most of this fake data is self-generated, but we used the faker.js library (https://github.com/marak/Faker.js/ https://github.com/marak/Faker.js/) to generate three datatypes: IP address, avatar, and industry. This MIT licensed library, when used, creates data that links directly to fakercloud (https://cdn.fakercloud.com/avatars/ https://cdn.fakercloud.com/avatars/). Here is the code itself: https://github.com/Marak/faker.js/blob/master/lib/internet.js#L15 https://github.com/Marak/faker.js/blob/master/lib/internet.j..., and here is a demo that shows the library generating those links: https://rawgit.com/Marak/faker.js/master/examples/browser/index.html https://rawgit.com/Marak/faker.js/master/examples/browser/in.... I just spoke to the engineers who worked on this project, and we are sorry for including links to fakercloud. This wasn’t intentional, and we just pushed a commit removing all avatars from the template. This is already deployed. I hope you all can understand why we trusted the data generated by the MIT licensed project, and didn’t think it would link to anything proprietary. I myself am an engineer (and avid HN reader, as evinced by how I found this while reading HN on a Sat night), understand Marak’s frustration, and agree that monetizing OSS is hard. While we’ve already contributed around $10k to various libraries we use (https://opencollective.com/retool https://opencollective.com/retool), including faker.js, Babel, ESLint, and JSON Schema, I’m going to see if there is more we can do. We’ll be writing a blog post about it this week and I will follow up with more next steps. I wonder whether there is a better way of sponsoring OSS, other than just donating dollars every month? (Maybe we could commit one engineering-day per month for contributing back to OSS libraries we use heavily?) In the meantime, we'll certainly continue sponsoring all the libraries we’re sponsoring already, including faker.js. (Also: I’m sorry to Marak for not responding to his email re. acquiring Faker. More in this child thread: https://news.ycombinator.com/item?id=27252420 https://news.ycombinator.com/item?id=27252420)
- Exuma 5y ago
  finds popcorn
- 5y ago
spoonjim 5y ago
Time to go back to Stallmanism and license with GPL or AGPL. Besides using your own cloud service (obviously terrible) there’s no theft of “Intellectual Property” when someone takes your MIT licensed code and sells it under their own name.
sastraxi 5y ago
One of the things I liked about this submission was its tone: the lack of vindictiveness. We are quickly made aware that we are reading an article made by the author of faker.js. The facts are laid out, mostly without embellishment. Though we understand the author is biased, they leave it to the reader to form their own conclusion. Overall, I appreciated how I was treated as a reader while reading this piece. As for the matter at hand: despite the MIT license's permissive attitude in this case, it just speaks to the company being complicit somehow in... I don't know what to call it? Shady-ness? I hope you find a worthwhile resolution.
- betwixthewires 5y ago
  I see clear vindictiveness laid out in the facts, or at least passive aggressiveness stemming from fear of conflict. Note that in the initial email spurned on by the actions of the company, the concern with them using the paid service to generate a free service is not mentioned at all. Just a sales pitch for a product. He is lucky he even got a response. A proper email would have directly addressed the concern the author actually had. But he didn't do that. He didn't say "you guys are using my service to provide it to others for free" he said "hey I see you guys use my product, want to buy it?" And then when they didn't he wrote an article about how they're basically stealing from him.
deleted 5y ago
[deleted]
paxys 5y ago
Random bits of semi-related advice: 1. If you wanted Retool to stop using your service, you should have said it up front instead of beating around the bush. From what I can gather from your emails, you sent their CEO a random sales pitch and he ignored it. Hard to fault him for that. 2. I love faker.js. I have used it in the past, and I'm sure several teams in my company use it today. I would, however, never ever pay for your cloud service, simply because taking a dependency on a third party hosted website to run unit tests is madness. The old school corporate software licensing model might be losing favor, but that does not mean it isn't apt for any use case. If faker.js was still downloadable but needed a license key to run I'm sure people would pay for it. It would probably be the easiest thing in the world to bypass, but the same Fortune 500 companies you mention would gladly break our their checkbooks rather than risk getting sued.
- JMTQp8lwXL 5y ago
  Re 1: A CORS header should've blocked the use of <img> tags on domains cdn.fakercloud.com didn't want using them.
  - ignoramous 5y ago
    > Re 1: A CORS header should've blocked the use of <img> tags on domains cdn.fakercloud.com didn't want using them. A limited defense. I've only ever seen browsers respect CORS.
    - JMTQp8lwXL 5y ago
      Exactly: Most modern browsers respect CORS. If you send response header "Access-Control-Allow-Origin: *", you're saying any origin can load the response. Clearly, the owner of cdn.fakercloud.com didn't want that behavior. The server can inspect the Origin header, and if the maintainer doesn't want to support the domain, then don't send the CORS Access-Control-Allow-Origin response header.
- cutemonster 5y ago
  I'm thinking one underlying mistake was to not have read a book like "the mom test" before trying to monetize faker.js? I.e. not first finding out if it's something people want to pay for, before building the SaaS. A mistake that's easy to do
decremental 5y ago
This feels gross. The kind of people who read HN see a headline or read this post and will immediately assume it's all true without caring to hear the other side of the story. Somehow the author thought the best course of action would be to publicly call them out instead of just taking sensible technical measures to stop it. Talk about burning bridges. Tarnishing their image in the eyes of people who will never see the follow up, other side of the story, or retraction to this is very irresponsible.
haltingproblem 5y ago
Kudos to the author for the article tone. I just can't grok the mindset of retool - legal, perhaps but shady AF with nothing but reputation implosion. What were they thinking?
no_wizard 5y ago
Just to clear this up here: I am not marak but I do find this behavior very frustrating and even if it’s technically legally it’s really scummy behavior and I want to air it out so we can get the truth I happen to be in the market for this service and it cropped up when I was doing research and felt it prudent to share with the rest of the industry
throwaway_25434 5y ago
I am surprised at the outrage and the choice of adjectives in this thread. Retool is using faker.js in their app, which is MIT. It also looks like the URLs to fakercloud.com CDN are hardcoded in the library [1] so I doubt this was intentional from the Retool dev. They even have a shout out for faker.js in the “How we built this” box [2] [1]: https://github.com/Marak/faker.js/blob/c9764abd20a198e318367952a94587eda1bac645/lib/internet.js#L15 https://github.com/Marak/faker.js/blob/c9764abd20a198e318367... [2]: https://retool.com/api-generator/ https://retool.com/api-generator/
- kbelder 5y ago
  Using the fakercloud CDN is the only thing that retool is doing that seems wrong; if those URLs are coded into the library itself, than that's faker'js' mistake, not retool's. Sounds like it could be easily fixed with some clear communication. Clear communication that hasn't happened yet.
dsego 5y ago
Nov 8, 2020: No more free work from Marak - Pay Me or Fork This https://news.ycombinator.com/item?id=25032105 https://news.ycombinator.com/item?id=25032105
DoreenMichele 5y ago
I don't know much about Linux, but it seems to have good financial support from various corporations. If this thing is really being used by big companies, maybe they need to find out how Linux did it and borrow some lessons from that.
patcon 5y ago
Someone in Marak's recent thread said it: > We need some sort of open source software developer's union https://github.com/Marak/faker.js/issues/1046#issuecomment-723947036 https://github.com/Marak/faker.js/issues/1046#issuecomment-7... Maybe "union" isn't the right word, but I feel it could be a powerful force if a group created a github app for solidarity amongst maintainers, that hundreds of FOSS maintainers could authorize to submit license-related PRs against their projects. It could collectivize and streamline the effort of swapping or amending licenses, and seeking permission from contributors for such changes. How impactful might it be if the "union" could exercise the threat of a banhammer of sorts, so that (at least in theory) in one fell swoop, it could initiate a license clause that targeted very specific conditions (e.g., "Fortune 500 companies no longer get free license"), or maybe even singling out very specific companies in particularly egregious situations. I wonder if the threat of solidarity amongst FOSS maintainers and consequences would lead to companies starting to play it safe and simply start being better stewards Even just the threat of the infrastructure for such a thing existing might have an effect, even if it's very rarely engaged.
- dsego 5y ago
  Like FSF ?
bussierem 5y ago
So he made a useful service, put it behind an extremely permissive license, another company tried it, copied what they wanted to copy, and then utilized the permissive license to use his service for the rest. Then, "Retool is offering this new service for free". So let's review the title: > Retool is reselling our API... According to TFA, they are not selling it. > ...without permission Except that your MIT license is permission. I noticed the CEO has shown up here to say he's looking into it. I genuinely feel bad for him. Imagine that conversation. "Guys I hear we are using this open source project and people say we shouldn't" "....yeah? It's open source. It has an MIT license. What's the issue?" "Apparently that person didn't REALLY mean for it to be open source, and now a bunch of people on an internet forum are upset." "Do any of them pay us?" "A couple I think? Two said they might stop paying us." "....I'm confused boss, what did we do wrong?" --- Now imagine that conversation having to happen and this worry happening every time someone decided they want to use a FOSS library or API for their work. Can't imagine why OSS is having trouble.
- dang 5y ago
  This comment refers to the submitted title: "Retool Is Reselling Our API Without Permission". We replaced that with the article's title, in keeping with the site guideline "Please use the original title, unless it is misleading or linkbait; don't editorialize."" (https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html) (Since Retool is a YC co, I initially hesitated to do that because of the principle described here: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20moderate%20less%20%22not%20more%22%20yc&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu.... But since the submitted title doesn't appear anywhere in the OP, I ended up going with standard HN moderation in this case.)
  - bussierem 5y ago
    Thank you for the clarification dang I hadn't checked again to see that the title changed. Appreciate the help!
- jillesvangurp 5y ago
Grimm1 5y ago
Yeah so, Marak here should have sent an email more along the lines of: "Hi X, I'm so and so of Faker (link to some info) and you guys are violating our TOS by reselling our API and hosting the generated content on our CDN. I assume this is a misunderstanding and I notice you've sponsored us in the past, so I was thinking there is a mutually beneficial way for us to resolve the issue. <insert the pitch he already sent> If this sounds like a good way forward let's set up a meeting." Instead of like a random sales pitch, without the concerning context that he kind of got lucky he even got a first response e-mail to, that doesn't even mention the issue. And then if he wasn't satisfied with the response then he could have sent a follow up demand, asking Retool to resolve the situation and fly within the TOS. Instead Marak was completely indirect and then when the completely predictable situation of Retool's CEO not reading any more into the situation happened went on full blast in public of Retool. This is an example of how not to solve issues with other human beings and organizations.
- rognjen 5y ago
  > violating our TOS They aren't tho.
  - Grimm1 5y ago
    The article says he thought they were, additionally this changes my point exactly 0.
EGreg 5y ago
Here is how you can monetize it: NETWORK EFFECTS https://qbix.com/token https://qbix.com/token
SirSavary 5y ago
Whelp, that's enough for us to discontinue Retool usage org-wide. Thanks for the write-up, Marak. We've been using Faker for years (?) and will look into supporting you via GitHub ASAP.
- betwixthewires 5y ago
  The CEO of retool has a response in this thread, you should read it.
opensores11 5y ago
For simple create-and-forget or true community-focused serverside software, I no longer see any reason for using anything other than AGPL. For serverside software I want to monetize (so maintaining the software is sustainable, and so I can support myself) I'm increasingly leaning towards things like the Business Source License. I like that it allows pretty much everything e.g. Apache 2 does without allowing other companies to just rob me of my monetization strategy. Yes, it is not open source. But it allows others to self host my software and paves a way for the software to be _eventually_ open source. Honestly, it's time for people to realize that companies are the primary beneficiaries of open source, for server side software, and react accordingly. For me, software is about allowing others see my code and use it for their own purposes. I don't make software so for profit companies can screw me over. The idealism of open source in the server side space only serves large corporations. Go extreme copy left or go source-available or enjoy working for free.
Terrdaggs 5y ago
Try xscode.com
agoldis 5y ago
I have been doing open-source cypress tests dashboard (sorry-cypress) for more than 2 years. Now I have launched https://currents.dev https://currents.dev, which is based on (MIT-licensed) sorry-cypress, which resembles (paid) Cypress Dashboard, that monetizes (MIT-licensed cypress tests runner.
agoldis 5y ago
I have been doing open-source cypress tests dashboard (sorry-cypress) for more than 2 years. It's been used by big names, saving $$$ for those companies. Now I have launched https://currents.dev https://currents.dev, which is based on (MIT-licensed) sorry-cypress, which resembles (paid) Cypress Dashboard, that monetizes (MIT-licensed) cypress tests runner.
- samblr 5y ago
  Why would your users choose you instead of cypress dashboard ?
  - agoldis 5y ago
    It's much more affordable than cypress dashboard
ngc248 5y ago
Open source was never a business model. You cant release something with a permissive license and then complain.
locallost 5y ago
Software companies spend exorbitant amounts of money on e.g. AWS and say they're saving money on engineering, yet they waste engineering time to reinvent the wheel instead of paying something in the ballpark of peanuts to an open source dev. They should be laughed out of the room, and it doesn't matter if they had a legal right to do it.
spankyspangler 5y ago
Stirring up outrage mobs to get what one wants is even more problematic.
phkahler 5y ago
>> I've been working on Faker for over a decade. It's MIT licensed. Well there's the first problem. For cloud stuff you should be looking at AGPL if you dont want this to happen
samblr 5y ago
I love faker.js. However, as many have said - Marak's email to David is salesy. And the blog is perhaps a way of mild marketing of fakercloud.com (reminds of hey.com)
VoodooJuJu 5y ago
Open source software doesn't make money because it isn't designed to make money [1]. Others are able to use faker for profit without owing anything to faker because faker gives them license to do so [2]. You use a hammer to set a nail in wood, you don't use a feather. If you try and fail to set a nail in wood with a feather, then the problem isn't failure to set the nail, the problem is you chose a feather for the job. If you want to make money with software, then offer/license it in a way that requires payment - problem solved. [1] Open Source Doesn’t Make Money Because It Isn’t Designed to Make Money | Hacker News, 2019. https://news.ycombinator.com/item?id=19431444 https://news.ycombinator.com/item?id=19431444 [2] https://opensource.org/licenses/MIT https://opensource.org/licenses/MIT
- sascha_sl 5y ago
  The problem here is that there will always be someone who fills problems that aren't extremely specialized or hard to solve with a permissive license. If you use a less permissive license, you simply wouldn't see your code used. There needs to be some way to balance these interests that do not end up with someone working their ass off for absolutely nothing. Particularly enterprise users of FOSS can afford to pay up. In my experience, developers in those companies want that to happen too, but it simply can't be justified to business. This will keep going for a few years until every single person willing to put in the work is either burned out or has changed to a more copyleft license. We're starting to see that with less trivial projects already (Databases going BSL, Grafana Labs switching to AGPL)
rognjen 5y ago
First of a Makar thanks for faker. I've used it on several projects on a few different platforms. It's an invaluable tool. You are going through exactly what Elastic went through but on a bigger scale. I hope the community is kinder to you then Elastic which was broadly ripped apart for changing their licence to stop this kind of (ab)use by AWS. I on the other hand would fully support it if you did decide to do that. If anyone is interested I've written more in more detail about that here: https://ognjen.io/turns-out-elastic-arent-the-bad-guys/ https://ognjen.io/turns-out-elastic-arent-the-bad-guys/
bmn__ 5y ago
Hey Marak, have you compensated the original author of faker yet or are you too busy being much of a drama queen (ref GH bug #1046)? How about that relicencing removing the copyleft and attribution terms? Copyright 2004-2005 Jason Kohles, GPL-1/Artistic --- https://metacpan.org/source/JASONK/Data-Faker-0.07/lib/Data/Faker/Name.pm#L129 https://metacpan.org/source/JASONK/Data-Faker-0.07/lib/Data/... Copyright 2010 Marak Squires, MIT --- https://github.com/Marak/faker.js/blob/a9f98046c7d5eeaabe12fc587024c06d683800b8/lib/name.js#L17 https://github.com/Marak/faker.js/blob/a9f98046c7d5eeaabe12f... Looks too me like you are really butt-hurt about other people ripping you off, but have no problem doing the same yourself. /cc ddevault
jrh206 5y ago
All other factors aside (I think the responses from David are completely reasonable and bookend this discussion completely). The enterprise plan for Faker Cloud is $500/month [1]. Retool donate $500/month to Marak [2]. I understand that the donation is not the same as paying for the service. But it seems pretty shitty and greedy for Marak to complain about this, _even if_ Retool were in the wrong (Marak could have tried to resolve the issue with them properly, first, before starting a witch hunt). Don't bite the hand that feeds you. This sort of thing really disincentivises me from wanting to donate to or use this project. Personally, I would completely support Retool stopping using faker.js and pulling their donation - but of course they can't do that since it'd be a PR nightmare. EDIT: I see that Open Collective reports that Retool's donation to faker.js has been cancelled. I assume that it will be reinstated per David's comment [3]. But as I said above I wouldn't blame them for cancelling it. [1] https://fakercloud.com/pricing https://fakercloud.com/pricing [2] https://opencollective.com/retool https://opencollective.com/retool [3] "In the meantime, we'll certainly continue sponsoring all the libraries we’re sponsoring already, including faker.js." https://news.ycombinator.com/item?id=27252331 https://news.ycombinator.com/item?id=27252331
anandaverma18 5y ago
Has always been.
rurban 5y ago
Says the guy who took the original GPL faker code, translated it to javascript, changed the license to MIT, started as drama queen wondering why he didn't get paid for it, started a commercial service around it, and then found out, no this doesn't work out with MIT licensed code, which doesn't need support nor extensions. Monetizing open source code is normally not problematic at all.
Iv 5y ago
If you want to open source something, use a copy left license. GPL or AGPL. Licenses like BSD or MIT are basically putting something in the public domain, to be absorbed into propietary packages
Overdr0ne 5y ago
I completely agree, making money writing software is so convoluted. Like, why can't I submit my work to a publisher like all the other authors do? Where are the software publishing companies? Instead, we're expected to also come up with a business model around our software. Then, surprise, you find yourself not really writing software anymore because all of your energy is spent running this business thing you set up just so you could support yourself so you could be a soft..ware...writer. oops. It's a bummer man. Like, yeah, you probably shouldn't have used the MIT license, but like, we have to be lawyers too now? GD.
enveu 5y ago
Thanks for this. Good read.

460 points by no_wizard 5y ago

pkd 5y ago

Oof, that sounds really bad. Would really like to see the response from Retool.

no_wizard 5y ago
Honestly that’s why part of the reason why I posted this here. If this made HN Frontend page I feel like they’re gonna notice and have to respond, a lot of potential customers reside on this forum
- gabereiser 5y ago
  would it be possible to require a session token or some other secret in order for images from fakercloud.com to resolve? I know of a few services that do this for map tiles to prevent scraping or hot linking.
- tiltrus 5y ago
  I hope that you reach a fair conclusion with their CEO. :)

neximo64 5y ago

It is MIT licensed so theres nothing wrong them reselling faker but the stuff theyre doing here looks quite dodgy. I am a user of retool but for companies with access to your data you expect a bit of integrity. Would be really interested to know what retools response is. You should follow up a couple of weeks from now on HN if nothing happens.

ncann 5y ago
I think the main problem is Retool is using the faker cloud api directly behind the scene (?) and the generated data is hosted on the faker cloud CDN (?).
- Eikon 5y ago
  But they are paying for it so what's the issue?
  - deleted 5y ago
    [deleted]
  - accountofme 5y ago
    Copyright infringement?
    - HideousKojima 5y ago
      It's MIT licensed. If they're actually reselling the API (and not hosting their own instance) then it could potentially be in violation of the terms of service, but that's it. Using images from Faker's CDN is scummy and potentially illegal, but fairly minor overall.
      - accountofme 5y ago
        If you are using images that someone else createdbwithout permission or license that is copyright infringement. If you are also using data created from a service and use it in your product again without permission or license this is also copyright infringement.
- slver 5y ago
  It's not using the cloud API. All this logic is in Faker.js itself, and apparently Retool unwittingly lifted it with the rest.
slver 5y ago
Using the faker CDN is dodgy and actually probably not legal. But everything else is. You don’t want startups using your IP? Don’t license it to them for free with no restrictions. Duh.
- HideousKojima 5y ago
  All of these stories in the last few months about big tech companies "abusing" open source software is straight out of /r/leopardsatemyface. "I want to build an open source project with a license that lets anyone use it any way they want for free! No, don't use it like that!"
  - slver 5y ago
    FOSS is a cargo cult to many naive developers. They build useful tools, give them out, and expect millions of payout will happen somehow.
    - HideousKojima 5y ago
      It's straight out of the South Park underpants gnome school of business: 1) Write open source code 2) ??? 3) Profit
  - deleted 5y ago
    [deleted]
- oh_sigh 5y ago
  faker.js - the MIT licensed free software - generates links to fakercloud.com. The error is in faker.js creating links to a paid-service CDN, not in how Retool is using the MIT licensed software. https://github.com/Marak/faker.js/blob/c9764abd20a198e318367952a94587eda1bac645/lib/internet.js#L15 https://github.com/Marak/faker.js/blob/c9764abd20a198e318367...
  - amadvance 5y ago
    The MIT license has a legal disclaimer, so the responsibility is not on the author of the software.
tiltrus 5y ago
I have been seeing a lot of Retool lately on my Facebook News feed. What's amazing to me is that they're using his CDN. Does this company have such terrible code review that they forgot to use their own CDN? Definitely makes me think twice about the quality of Retool's software.
- HideousKojima 5y ago
  Looks like Faker has links to their CDN hardcoded in the source code: https://github.com/Marak/faker.js/blob/c9764abd20a198e318367952a94587eda1bac645/lib/internet.js#L15 https://github.com/Marak/faker.js/blob/c9764abd20a198e318367... Still something Retool should have caught, but a poor choice on Marak's end too
reputet 5y ago
Yes, it's MIT and everybody else is allowed to use it as they want. Would it be a good option to relicense the project under the AGPL/SSPL or whatever licenses (how MongoDB/Elastic/Anaconda have done) to get credit?

mtnGoat 5y ago

Hmmm. Certainly questionable ethically and shady. But isn’t that the kind of activity/decisions a lot of SV runs in lately?

deleted 5y ago

[deleted]

mrthrowmantic 5y ago

That’s disappointing, I wonder what legal recourse there may be for using your CDN.

w-j-w 5y ago

Have you considered just turning it off? Or adding a requirement for API keys and disabling any that they hand out to their customers. It would be pretty embarrassing for a large company that had a service go down because they refused to pay for it.

neolog 5y ago

This is what AGPL is for.

40four 5y ago
Yeah, I mean this story sucks, I feel for the creator. But my gut is telling me this is a perfect example we all shouldn’t just default to MIT license out of the ‘goodness of our hearts’.

nyx 5y ago

Have you considered serving Goatse to API hits from their IP ranges?

ronsor 5y ago
That's like asking if you've considered telling people to avoid your service forever.
- nyx 5y ago
  I mean, actually using Goatse here would probably be a bad idea, but what I really meant by my comment is "maybe you ought to treat this like any other hotlinking abuse situation, for which there are many commonly employed mitigations." Serving shock images or other rude content is just the particular mitigation that makes me giggle.
  - asddubs 5y ago
    add a watermark that reads "your free fakercloud 30 day trial has ended - please sign up to keep using the service"
  - fiddlerwoaroof 5y ago
    I think the “professional” way to handle this is to implement API keys and rate limit requests without API keys heavily. (Possibly putting a link to your pricing page in the “too many requests” header.)

austinkhale 5y ago

As a Retool customer, this feels gross. I hope they reach out and find a way to make this right.

okdjnfweonfe 5y ago
It's kinda your obligation to do more than "hope", isn't it? If Retool sees that their customers don't care enough to leave because of this, then why would they bother making things right?
- austinkhale 5y ago
  No, it is not. That being said, I certainly would move to another service if they don’t make it right. However, I also run a business and don’t make knee-jerk reactions to cancel support services on a Saturday evening without giving any sort of time for the provider to respond. Always amazes me how intent people are at trying to frame comments in the least charitable way possible. We all support this person getting paid for their work. End of story.
patcon 5y ago
Ditto. I was eager to set up a manufacturing sector client with Retool this coming week, but holy shit, assholes acting with impunity like this is infuriating, and I'm putting in extra time to try to find an alternative. Open to suggestions
- ianpurton 5y ago
  Take a look at appsmith
  - joejohnston 5y ago
    Or Budibase.com
- djrogers 5y ago
  Calling people derogatory names after only reading one side of a story on the Internet is not cool…

butner 5y ago

Retool can't handle basic ethnical issues, why should one trust their customer data to them?

Axsuul 5y ago
It feels too soon to be jumping to this conclusion.
rexfuzzle 5y ago
Links please.
urda 5y ago
I appreciate the openness of this article, and I'm not pointing fingers, but I just want to point out we only have one side of the story so far. This needs attention though that's for sure. I'm sure at least one of the Retool engineers read Hacker News so hopefully that will help get traction.

perrohunter 5y ago

Re-license as AGPL, charge for an exemption

grp000 5y ago
Are you allowed to retro-actively change your license to something more restrictive?
- yjftsjthsd-h 5y ago
  Isn't going forward sufficient?
  - HideousKojima 5y ago
    If the code is already fairly mature then the big companies using it can just fork it (and make their new fork entirely closed if they feel like it) and the creator of the original code won't be able to do a thing about it.
- riquito 5y ago
  You can change your license, but it's not retroactive, the code released so far keeps the old license (and can be forked from there). Note that it would be unsustainable otherwise, e.g. release as free, force people to pay later
sangnoir 5y ago
If they use AGPL, how would they get companies to actually use the software before extorti^w shaming them into paying some money for a product they are licensed to use for free? Developers: think long and hard about the license that's right for your project before you push out to the world. I can't help but feel that free/open source software has become a lot less altruistic in the era of Github. We gained quantity and quality, but lost something else that's difficult to express: innocence? Not every project needs to be a job/startup/foundation (cue Left-Pad LLC). I daresay, not all projects ought to be monetized, period.
- 5y ago

Axsuul 5y ago

Keep following up! However, your email isn't very clear about the situation — it just looks like an offer to sell. Also I noticed that the tool[0] that is referenced in the blog post no longer contains the "Avatar" field. 0. https://retool.com/api-generator https://retool.com/api-generator

Crazyontap 5y ago

Looks like this hasn't happened to him for the first time either. First page results for faker.js show how he has been ripped off before too(1). Really sad how big companies abuse OSS. (1) https://www.reddit.com/r/javascript/comments/jquo97/fakerjs_no_more_free_work_from_marak_pay_me_or/ https://www.reddit.com/r/javascript/comments/jquo97/fakerjs_...

slver 5y ago
He needs to figure out if he wants to be paid or not. Offering a free product and support and then complaining people don’t pay you is honestly fucking weird.
- mynameisvlad 5y ago
  He has a paid product, fakercloud.com. Retool seems to be using or at least linking to it without permission.
  - slver 5y ago
    You’re assuming things he didn’t say. He didn’t investigate that in depth. All we saw is the hosted images. Which is wrong, but most likely a mistake done by the devs charged with copying him.
    - mynameisvlad 5y ago
      And you’re being incredibly charitable to Retool, who haven’t even said their side of the story. Those URLs don’t create themselves. It looks to be using a hash of some sort, which means it needs to be something generating them, it’s not just them appending a hash to https://fakercloud.com https://fakercloud.com. And even if it were, why use fakercloud, a paid service that you don’t subscribe to, and not your own? In either case, your original complaint is that the author can’t decide between working for free or paid. It’s clear that isn’t the case considering, as I pointed out, they have a cloud service that’s paid. They clearly have figured out some way to be paid for their work.

liamwire 5y ago

For when Retool’s team inevitably reads through this: compensate for, and fix this. Until I can see genuine efforts made to repair this situation, I’ve cancelled my account. Shame.

atian 5y ago
How big is your account?

Eikon 5y ago

I have a hard time understanding the problem. Retool is paying a fakercloud subscription and using it to power their product which does not sounds like an issue at all?

capiki 5y ago
I may have missed it but I didn't see anywhere that Retool is paying for a subscription. Even if they are, I'm not sure that entitles them to free use of the Fakercloud CDN.
- Axsuul 5y ago
  Retool is a $500/mo supporter of faker.js on Open Collective. Fakercloud has a $500/mo enterprise plan. So it kind of adds up I guess.

deleted 5y ago

[deleted]

foobarbaz33 5y ago

> ... without permission. Actually it sounds like you gave them permission, then regretted it.

deleted 5y ago
[deleted]

djrogers 5y ago

Something the blog post doesn’t make clear at all here - are they paying for the fakercloud CDN and API usage? If so, do your TOS prohibit reselling? If so, call a lawyer. If not, rewrite your TOS, then call a lawyer.

adam_arthur 5y ago

I hate to be that guy, but idealism in software needs to die. Don't use a license that's more permissive than you're willing to tolerate. It's absurd to me for a project to publish something with a 100% open source license and then complain when somebody tries to profit off of it. Doesn't really matter how egregious or large the perpetrator is. If you want exceptions, write it into the license. People want the goodwill that comes with open source, without accepting the consequences. That being said, I do empathize with the plight of the author. Perhaps they were naive to this possibility.

caslon 5y ago
In this case, I think the main problem is (emphasis mine): "If you can't see the image, Retool's new service is using images hosted from fakercloud.com" There's a difference between using someone's software and using someone's servers.
- adam_arthur 5y ago
  I'm interested in the legality of what they're doing. But it seems very similar in concept to automated web scraping, which has been deemed legal in the US.
  - judge2020 5y ago
    The U.S. legislature hasn’t touched computer laws in forever, so an armchair guess is hard, but chances are that causing an extreme financial burden by hotlinking someone else’s images is illegal - although maybe the fact that fakercloud could just block hotlinking based on the referrer header means it’s not as open-and-shut of a case.
- ryandrake 5y ago
  In my view, if your web server responds to an arbitrary HTTP GET with the asset and 200 error code, then your intention is that the asset is public and any browser can request it. If you don’t like a particular request, return 403 and get on with your life.
- 5y ago

ztratar 5y ago

I think Retool is in the wrong, though I also think your emails were quite indirect. Better to be direct. I think it's very possible the CEO did not fully internalize what you were implying by stating they're using your CDN, etc, and instead it just seemed like a sales email.

dvdhsu 5y ago

Hi all! I'm David, CEO @ Retool. I'm looking in to this right now and will update my comment here with a response in the next two hours. Edit: just did a bit of digging. It looks like we have a Retool template that has some fake data in it (https://retool.com/api-generator/ https://retool.com/api-generator/). This is an app built in Retool, and has a few thousand rows of hard-coded data. Most of this fake data is self-generated, but we used the faker.js library (https://github.com/marak/Faker.js/ https://github.com/marak/Faker.js/) to generate three datatypes: IP address, avatar, and industry. This MIT licensed library, when used, creates data that links directly to fakercloud (https://cdn.fakercloud.com/avatars/ https://cdn.fakercloud.com/avatars/). Here is the code itself: https://github.com/Marak/faker.js/blob/master/lib/internet.js#L15 https://github.com/Marak/faker.js/blob/master/lib/internet.j..., and here is a demo that shows the library generating those links: https://rawgit.com/Marak/faker.js/master/examples/browser/index.html https://rawgit.com/Marak/faker.js/master/examples/browser/in.... I just spoke to the engineers who worked on this project, and we are sorry for including links to fakercloud. This wasn’t intentional, and we just pushed a commit removing all avatars from the template. This is already deployed. I hope you all can understand why we trusted the data generated by the MIT licensed project, and didn’t think it would link to anything proprietary. I myself am an engineer (and avid HN reader, as evinced by how I found this while reading HN on a Sat night), understand Marak’s frustration, and agree that monetizing OSS is hard. While we’ve already contributed around $10k to various libraries we use (https://opencollective.com/retool https://opencollective.com/retool), including faker.js, Babel, ESLint, and JSON Schema, I’m going to see if there is more we can do. We’ll be writing a blog post about it this week and I will follow up with more next steps. I wonder whether there is a better way of sponsoring OSS, other than just donating dollars every month? (Maybe we could commit one engineering-day per month for contributing back to OSS libraries we use heavily?) In the meantime, we'll certainly continue sponsoring all the libraries we’re sponsoring already, including faker.js. (Also: I’m sorry to Marak for not responding to his email re. acquiring Faker. More in this child thread: https://news.ycombinator.com/item?id=27252420 https://news.ycombinator.com/item?id=27252420)

Exuma 5y ago
finds popcorn
5y ago

spoonjim 5y ago

Time to go back to Stallmanism and license with GPL or AGPL. Besides using your own cloud service (obviously terrible) there’s no theft of “Intellectual Property” when someone takes your MIT licensed code and sells it under their own name.

sastraxi 5y ago

One of the things I liked about this submission was its tone: the lack of vindictiveness. We are quickly made aware that we are reading an article made by the author of faker.js. The facts are laid out, mostly without embellishment. Though we understand the author is biased, they leave it to the reader to form their own conclusion. Overall, I appreciated how I was treated as a reader while reading this piece. As for the matter at hand: despite the MIT license's permissive attitude in this case, it just speaks to the company being complicit somehow in... I don't know what to call it? Shady-ness? I hope you find a worthwhile resolution.

betwixthewires 5y ago
I see clear vindictiveness laid out in the facts, or at least passive aggressiveness stemming from fear of conflict. Note that in the initial email spurned on by the actions of the company, the concern with them using the paid service to generate a free service is not mentioned at all. Just a sales pitch for a product. He is lucky he even got a response. A proper email would have directly addressed the concern the author actually had. But he didn't do that. He didn't say "you guys are using my service to provide it to others for free" he said "hey I see you guys use my product, want to buy it?" And then when they didn't he wrote an article about how they're basically stealing from him.

deleted 5y ago

[deleted]

paxys 5y ago

Random bits of semi-related advice: 1. If you wanted Retool to stop using your service, you should have said it up front instead of beating around the bush. From what I can gather from your emails, you sent their CEO a random sales pitch and he ignored it. Hard to fault him for that. 2. I love faker.js. I have used it in the past, and I'm sure several teams in my company use it today. I would, however, never ever pay for your cloud service, simply because taking a dependency on a third party hosted website to run unit tests is madness. The old school corporate software licensing model might be losing favor, but that does not mean it isn't apt for any use case. If faker.js was still downloadable but needed a license key to run I'm sure people would pay for it. It would probably be the easiest thing in the world to bypass, but the same Fortune 500 companies you mention would gladly break our their checkbooks rather than risk getting sued.

JMTQp8lwXL 5y ago
Re 1: A CORS header should've blocked the use of <img> tags on domains cdn.fakercloud.com didn't want using them.
- ignoramous 5y ago
  > Re 1: A CORS header should've blocked the use of <img> tags on domains cdn.fakercloud.com didn't want using them. A limited defense. I've only ever seen browsers respect CORS.
  - JMTQp8lwXL 5y ago
    Exactly: Most modern browsers respect CORS. If you send response header "Access-Control-Allow-Origin: *", you're saying any origin can load the response. Clearly, the owner of cdn.fakercloud.com didn't want that behavior. The server can inspect the Origin header, and if the maintainer doesn't want to support the domain, then don't send the CORS Access-Control-Allow-Origin response header.
cutemonster 5y ago
I'm thinking one underlying mistake was to not have read a book like "the mom test" before trying to monetize faker.js? I.e. not first finding out if it's something people want to pay for, before building the SaaS. A mistake that's easy to do

decremental 5y ago

This feels gross. The kind of people who read HN see a headline or read this post and will immediately assume it's all true without caring to hear the other side of the story. Somehow the author thought the best course of action would be to publicly call them out instead of just taking sensible technical measures to stop it. Talk about burning bridges. Tarnishing their image in the eyes of people who will never see the follow up, other side of the story, or retraction to this is very irresponsible.

haltingproblem 5y ago

Kudos to the author for the article tone. I just can't grok the mindset of retool - legal, perhaps but shady AF with nothing but reputation implosion. What were they thinking?

no_wizard 5y ago

Just to clear this up here: I am not marak but I do find this behavior very frustrating and even if it’s technically legally it’s really scummy behavior and I want to air it out so we can get the truth I happen to be in the market for this service and it cropped up when I was doing research and felt it prudent to share with the rest of the industry

throwaway_25434 5y ago

I am surprised at the outrage and the choice of adjectives in this thread. Retool is using faker.js in their app, which is MIT. It also looks like the URLs to fakercloud.com CDN are hardcoded in the library [1] so I doubt this was intentional from the Retool dev. They even have a shout out for faker.js in the “How we built this” box [2] [1]: https://github.com/Marak/faker.js/blob/c9764abd20a198e318367952a94587eda1bac645/lib/internet.js#L15 https://github.com/Marak/faker.js/blob/c9764abd20a198e318367... [2]: https://retool.com/api-generator/ https://retool.com/api-generator/

kbelder 5y ago
Using the fakercloud CDN is the only thing that retool is doing that seems wrong; if those URLs are coded into the library itself, than that's faker'js' mistake, not retool's. Sounds like it could be easily fixed with some clear communication. Clear communication that hasn't happened yet.

dsego 5y ago

Nov 8, 2020: No more free work from Marak - Pay Me or Fork This https://news.ycombinator.com/item?id=25032105 https://news.ycombinator.com/item?id=25032105

DoreenMichele 5y ago

I don't know much about Linux, but it seems to have good financial support from various corporations. If this thing is really being used by big companies, maybe they need to find out how Linux did it and borrow some lessons from that.

patcon 5y ago

Someone in Marak's recent thread said it: > We need some sort of open source software developer's union https://github.com/Marak/faker.js/issues/1046#issuecomment-723947036 https://github.com/Marak/faker.js/issues/1046#issuecomment-7... Maybe "union" isn't the right word, but I feel it could be a powerful force if a group created a github app for solidarity amongst maintainers, that hundreds of FOSS maintainers could authorize to submit license-related PRs against their projects. It could collectivize and streamline the effort of swapping or amending licenses, and seeking permission from contributors for such changes. How impactful might it be if the "union" could exercise the threat of a banhammer of sorts, so that (at least in theory) in one fell swoop, it could initiate a license clause that targeted very specific conditions (e.g., "Fortune 500 companies no longer get free license"), or maybe even singling out very specific companies in particularly egregious situations. I wonder if the threat of solidarity amongst FOSS maintainers and consequences would lead to companies starting to play it safe and simply start being better stewards Even just the threat of the infrastructure for such a thing existing might have an effect, even if it's very rarely engaged.

dsego 5y ago
Like FSF ?

bussierem 5y ago

So he made a useful service, put it behind an extremely permissive license, another company tried it, copied what they wanted to copy, and then utilized the permissive license to use his service for the rest. Then, "Retool is offering this new service for free". So let's review the title: > Retool is reselling our API... According to TFA, they are not selling it. > ...without permission Except that your MIT license is permission. I noticed the CEO has shown up here to say he's looking into it. I genuinely feel bad for him. Imagine that conversation. "Guys I hear we are using this open source project and people say we shouldn't" "....yeah? It's open source. It has an MIT license. What's the issue?" "Apparently that person didn't REALLY mean for it to be open source, and now a bunch of people on an internet forum are upset." "Do any of them pay us?" "A couple I think? Two said they might stop paying us." "....I'm confused boss, what did we do wrong?" --- Now imagine that conversation having to happen and this worry happening every time someone decided they want to use a FOSS library or API for their work. Can't imagine why OSS is having trouble.

dang 5y ago
This comment refers to the submitted title: "Retool Is Reselling Our API Without Permission". We replaced that with the article's title, in keeping with the site guideline "Please use the original title, unless it is misleading or linkbait; don't editorialize."" (https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html) (Since Retool is a YC co, I initially hesitated to do that because of the principle described here: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20moderate%20less%20%22not%20more%22%20yc&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu.... But since the submitted title doesn't appear anywhere in the OP, I ended up going with standard HN moderation in this case.)
- bussierem 5y ago
  Thank you for the clarification dang I hadn't checked again to see that the title changed. Appreciate the help!
jillesvangurp 5y ago

Grimm1 5y ago

Yeah so, Marak here should have sent an email more along the lines of: "Hi X, I'm so and so of Faker (link to some info) and you guys are violating our TOS by reselling our API and hosting the generated content on our CDN. I assume this is a misunderstanding and I notice you've sponsored us in the past, so I was thinking there is a mutually beneficial way for us to resolve the issue. <insert the pitch he already sent> If this sounds like a good way forward let's set up a meeting." Instead of like a random sales pitch, without the concerning context that he kind of got lucky he even got a first response e-mail to, that doesn't even mention the issue. And then if he wasn't satisfied with the response then he could have sent a follow up demand, asking Retool to resolve the situation and fly within the TOS. Instead Marak was completely indirect and then when the completely predictable situation of Retool's CEO not reading any more into the situation happened went on full blast in public of Retool. This is an example of how not to solve issues with other human beings and organizations.

rognjen 5y ago
> violating our TOS They aren't tho.
- Grimm1 5y ago
  The article says he thought they were, additionally this changes my point exactly 0.

EGreg 5y ago

Here is how you can monetize it: NETWORK EFFECTS https://qbix.com/token https://qbix.com/token

SirSavary 5y ago

Whelp, that's enough for us to discontinue Retool usage org-wide. Thanks for the write-up, Marak. We've been using Faker for years (?) and will look into supporting you via GitHub ASAP.

betwixthewires 5y ago
The CEO of retool has a response in this thread, you should read it.

opensores11 5y ago

For simple create-and-forget or true community-focused serverside software, I no longer see any reason for using anything other than AGPL. For serverside software I want to monetize (so maintaining the software is sustainable, and so I can support myself) I'm increasingly leaning towards things like the Business Source License. I like that it allows pretty much everything e.g. Apache 2 does without allowing other companies to just rob me of my monetization strategy. Yes, it is not open source. But it allows others to self host my software and paves a way for the software to be _eventually_ open source. Honestly, it's time for people to realize that companies are the primary beneficiaries of open source, for server side software, and react accordingly. For me, software is about allowing others see my code and use it for their own purposes. I don't make software so for profit companies can screw me over. The idealism of open source in the server side space only serves large corporations. Go extreme copy left or go source-available or enjoy working for free.

Terrdaggs 5y ago

Try xscode.com

agoldis 5y ago

I have been doing open-source cypress tests dashboard (sorry-cypress) for more than 2 years. Now I have launched https://currents.dev https://currents.dev, which is based on (MIT-licensed) sorry-cypress, which resembles (paid) Cypress Dashboard, that monetizes (MIT-licensed cypress tests runner.

agoldis 5y ago

I have been doing open-source cypress tests dashboard (sorry-cypress) for more than 2 years. It's been used by big names, saving $$$ for those companies. Now I have launched https://currents.dev https://currents.dev, which is based on (MIT-licensed) sorry-cypress, which resembles (paid) Cypress Dashboard, that monetizes (MIT-licensed) cypress tests runner.

samblr 5y ago
Why would your users choose you instead of cypress dashboard ?
- agoldis 5y ago
  It's much more affordable than cypress dashboard

ngc248 5y ago

Open source was never a business model. You cant release something with a permissive license and then complain.

locallost 5y ago

Software companies spend exorbitant amounts of money on e.g. AWS and say they're saving money on engineering, yet they waste engineering time to reinvent the wheel instead of paying something in the ballpark of peanuts to an open source dev. They should be laughed out of the room, and it doesn't matter if they had a legal right to do it.

spankyspangler 5y ago

Stirring up outrage mobs to get what one wants is even more problematic.

phkahler 5y ago

>> I've been working on Faker for over a decade. It's MIT licensed. Well there's the first problem. For cloud stuff you should be looking at AGPL if you dont want this to happen

samblr 5y ago

I love faker.js. However, as many have said - Marak's email to David is salesy. And the blog is perhaps a way of mild marketing of fakercloud.com (reminds of hey.com)

VoodooJuJu 5y ago

Open source software doesn't make money because it isn't designed to make money [1]. Others are able to use faker for profit without owing anything to faker because faker gives them license to do so [2]. You use a hammer to set a nail in wood, you don't use a feather. If you try and fail to set a nail in wood with a feather, then the problem isn't failure to set the nail, the problem is you chose a feather for the job. If you want to make money with software, then offer/license it in a way that requires payment - problem solved. [1] Open Source Doesn’t Make Money Because It Isn’t Designed to Make Money | Hacker News, 2019. https://news.ycombinator.com/item?id=19431444 https://news.ycombinator.com/item?id=19431444 [2] https://opensource.org/licenses/MIT https://opensource.org/licenses/MIT

sascha_sl 5y ago
The problem here is that there will always be someone who fills problems that aren't extremely specialized or hard to solve with a permissive license. If you use a less permissive license, you simply wouldn't see your code used. There needs to be some way to balance these interests that do not end up with someone working their ass off for absolutely nothing. Particularly enterprise users of FOSS can afford to pay up. In my experience, developers in those companies want that to happen too, but it simply can't be justified to business. This will keep going for a few years until every single person willing to put in the work is either burned out or has changed to a more copyleft license. We're starting to see that with less trivial projects already (Databases going BSL, Grafana Labs switching to AGPL)

rognjen 5y ago

First of a Makar thanks for faker. I've used it on several projects on a few different platforms. It's an invaluable tool. You are going through exactly what Elastic went through but on a bigger scale. I hope the community is kinder to you then Elastic which was broadly ripped apart for changing their licence to stop this kind of (ab)use by AWS. I on the other hand would fully support it if you did decide to do that. If anyone is interested I've written more in more detail about that here: https://ognjen.io/turns-out-elastic-arent-the-bad-guys/ https://ognjen.io/turns-out-elastic-arent-the-bad-guys/

bmn__ 5y ago

Hey Marak, have you compensated the original author of faker yet or are you too busy being much of a drama queen (ref GH bug #1046)? How about that relicencing removing the copyleft and attribution terms? Copyright 2004-2005 Jason Kohles, GPL-1/Artistic --- https://metacpan.org/source/JASONK/Data-Faker-0.07/lib/Data/Faker/Name.pm#L129 https://metacpan.org/source/JASONK/Data-Faker-0.07/lib/Data/... Copyright 2010 Marak Squires, MIT --- https://github.com/Marak/faker.js/blob/a9f98046c7d5eeaabe12fc587024c06d683800b8/lib/name.js#L17 https://github.com/Marak/faker.js/blob/a9f98046c7d5eeaabe12f... Looks too me like you are really butt-hurt about other people ripping you off, but have no problem doing the same yourself. /cc ddevault

jrh206 5y ago

All other factors aside (I think the responses from David are completely reasonable and bookend this discussion completely). The enterprise plan for Faker Cloud is $500/month [1]. Retool donate $500/month to Marak [2]. I understand that the donation is not the same as paying for the service. But it seems pretty shitty and greedy for Marak to complain about this, _even if_ Retool were in the wrong (Marak could have tried to resolve the issue with them properly, first, before starting a witch hunt). Don't bite the hand that feeds you. This sort of thing really disincentivises me from wanting to donate to or use this project. Personally, I would completely support Retool stopping using faker.js and pulling their donation - but of course they can't do that since it'd be a PR nightmare. EDIT: I see that Open Collective reports that Retool's donation to faker.js has been cancelled. I assume that it will be reinstated per David's comment [3]. But as I said above I wouldn't blame them for cancelling it. [1] https://fakercloud.com/pricing https://fakercloud.com/pricing [2] https://opencollective.com/retool https://opencollective.com/retool [3] "In the meantime, we'll certainly continue sponsoring all the libraries we’re sponsoring already, including faker.js." https://news.ycombinator.com/item?id=27252331 https://news.ycombinator.com/item?id=27252331

anandaverma18 5y ago

Has always been.

rurban 5y ago

Says the guy who took the original GPL faker code, translated it to javascript, changed the license to MIT, started as drama queen wondering why he didn't get paid for it, started a commercial service around it, and then found out, no this doesn't work out with MIT licensed code, which doesn't need support nor extensions. Monetizing open source code is normally not problematic at all.

Iv 5y ago

If you want to open source something, use a copy left license. GPL or AGPL. Licenses like BSD or MIT are basically putting something in the public domain, to be absorbed into propietary packages

Overdr0ne 5y ago

I completely agree, making money writing software is so convoluted. Like, why can't I submit my work to a publisher like all the other authors do? Where are the software publishing companies? Instead, we're expected to also come up with a business model around our software. Then, surprise, you find yourself not really writing software anymore because all of your energy is spent running this business thing you set up just so you could support yourself so you could be a soft..ware...writer. oops. It's a bummer man. Like, yeah, you probably shouldn't have used the MIT license, but like, we have to be lawyers too now? GD.

enveu 5y ago

Thanks for this. Good read.