11 ms·

Terraform-AWS-modules/Terraform-AWS-eks transitions to non-free license

80 points by pricechild 5y ago

tyropita 5y ago
Have you found more open-source projects that follow a similar approach to spreading information about the Ukraine-Russia conflict? Would be nice to compile a list of them!
- toyg 5y ago
  Lists tend to attract the "proscription" prefix, when in a political context. Also, if you support the stance, you arguably don't want to make it easy for Russian/Belarusian users to avoid software, you want to maximize their inconvenience - which you do when they invest time into learning something and then find out they are technically not allowed to use it in production. This said, it's all theatre anyway - I would bet good money that most Russian businesses already didn't care about respecting FOSS licenses, considering the infamously lax attitude about copyright enforcement in that country (and in China and Iran). So adding that sort of clause will stop absolutely no one, in practice, and I bet the authors will never even try to sue anyone in Russia (or anywhere else with some sort of jurisdiction over Russia, like the WTO) for infringing it.
johndfsgdgdfg 5y ago
marcinzm 5y ago
edited: I see the addition now.
- detaro 5y ago
  How is adding "Additional terms of use" not a license change? That's not just a "statement of support".
  - c0l0 5y ago
    IANAL, but afaik, copyright licenses can only ever affect (re)distribution - not use.
    - detaro 5y ago
      That makes zero sense. Of course licenses regulate use. Apache2 license text literally starts with "TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION"
    - marcinzm 5y ago
      Which means this repo has an EULA which I'm sure is going to trigger all sorts of compliance alerts at larger companies once they learn of it.
    - kmeisthax 5y ago
      Only iff the copyrighted work was "sold" and not "licensed". There has been a huge effort on the part of copyright holders to avoid "selling" things, and make "sold" software legally unusable without a corresponding license agreement. Once you exit the realm of a "sale", there are very few restrictions on what you can require of your licensees. Freedom Zero restrictions are absolutely on the table, as well as curtailing fair use. And these license restrictions are generally considered watertight - you are not going to convince a judge that a license agreement should be reconstrued such that you get the permissions you want without the restrictions the copyright owner added to them. That being said, your average EULA has about 4000x more clauses in it than it needs to be, because they don't expect anyone to read them and those clauses are rarely, if ever, enforceable. FOSS licenses tend to be short and easily readable because they are written by people who want you to know what they entail. Proprietary EULAs tend to be forked from some internal corporate list of legal requirements that get copypasted everywhere. My favorite example of this is the clause in iTunes - a music store - that prohibits you from designing nuclear weapons with it. Second favorite is the LICENSE file included in all Swift Playgrounds example code, which has about 2 actual provisions Apple cares about (don't resell the sample code in the app and don't hack people with Swift Playgrounds), and a hundred clauses copypasted from the iPadOS EULAs that I've already agreed to. As far as I can tell, nobody at Apple is actually going to care if an individual user does something that technically breaches the EULA.
- josephcsible 5y ago
  The "Additional terms of use" section makes it non-free. Compare it to the Commons Clause.
  - antonbabenko 5y ago
    I have updated the wording in README - https://github.com/terraform-aws-modules/terraform-aws-eks#additional-information-for-users-from-russia-and-belarus https://github.com/terraform-aws-modules/terraform-aws-eks#a... . The project was and will be under the same Apache 2 license.
    - josephcsible 5y ago
      Okay, https://github.com/terraform-aws-modules/terraform-aws-eks/commit/f5511e4df1f06954229f48df1cf87f9ebc8da26a https://github.com/terraform-aws-modules/terraform-aws-eks/c... means that now it is free again. Thanks!
reacharavindh 5y ago
As much as I hate what Russia is doing, I’d hate even more for software to come under political purviews. If an author of a library chooses to apply political condition(however justified they may be), then the software is simply not free by definition. I’m neither Russian nor Ukrainian. I cannot turn a blind eye simply because it doesn’t apply to me. What if another library that I use apply a license that says “those that look like this cannot use my software from now on”?
- black_puppydog 5y ago
  > I’d hate even more for software to come under political purviews. Really? Making software free is just about as political as it gets. Restricting that freedom, as happens here, is equally political. I guess you just don't this special kind of politics in your software.
  - joshmanders 5y ago
    Right? Like the whole open source movement was a massive political thing... Open source by definition is political.
    - charcircuit 5y ago
      I think you are confusing it with the free software movement. Their idea of proprietary software being "evil" is why they don't get as much support as compared to open source.
    - chii 5y ago
      but software licenses are related to the field of software and freedom _within_ software. I'd hate to say it, but including other political ideologies into the software license is making it more political. If the author of the software wants to, he is within his rights, but i think it's the wrong platform to try to voice his opinion. A piece of software is a platform - but using this platform (granted to the author by the participation of a community) to further a different, unrelated ideology could be considered abuse of power. May be this war is extenuating circumstances - and understandable. But i'm concerned about the slippery slope. Realistically a license change is not going to affect the course of the war, nor make putin reconsider. I argue that the effort is only going to inconvenience their users, without actually making a true change. It may be better to ask for donations, etc, rather than changing the license as a political statement.
crmd 5y ago
I’m ethically torn here. On one hand, I ask myself what I would have done if I worked at IBM in the 1930s[0] On the other hand, as an LGBT person, I firmly believe that maximal freedom of speech protects vulnerable people from erasure. What this means for free software is a tough question. [0]https://en.wikipedia.org/wiki/IBM_and_World_War_II https://en.wikipedia.org/wiki/IBM_and_World_War_II
- sonjaqql 5y ago
  As an LGBT person, I fear that efforts like these are noble but empty. Assholes gonna still be assholes, Russia is gonna pirate software [0], and global Terraform users won't notice. Could this act actually awaken an IT team to the atrocities, in a way that makes a difference? [0] https://writing.kemitchell.com/2022/03/05/Russia-to-Legalize-Software-Piracy.html https://writing.kemitchell.com/2022/03/05/Russia-to-Legalize...
- gzer0 5y ago
  > "maximal freedom of speech protects vulnerable people from erasure" It's very easy to say things like this without fully comprehending all of the implications. Here's an example: Google restricted the usage of its own product, Google Maps, in an effort to halt the killing of Ukrainians by Russian armed forces, who were using Google Maps to launch their operations. This directly contradicts your claim.
  - GreenWatermelon 5y ago
    Here, google didn't approache freedom of speech. They merely restricted the services of their product in a particular area
- jacobr1 5y ago
  I don't think there is a tradeoff. Not all actions constitute speech. Supporters of Russian actions should be able to spout off their horrible thoughts, but that doesn't mean companies the need to sell their goods or services to Russia. The two categories of acts aren't the same.
igetspam 5y ago
It sucks to have to agree with someone that you don't fundamentally agree with but I think the author of the PR is correct. This is a modification of the Apache license and while I appreciate and support their stance, it does seem to mean that the license is non compliant. I support anyone's desire to protest things (no matter which side I'm on) but you can't just make up your own rules.
- Proven 5y ago
  You fundamentally agree with the person who opened the issue on the issue of license, that's the only thing that matters here. He is right, the changed license is discriminatory. Older commits can be used freely, so not a big deal for a while at least and by then someone can fork the code.
- the-lazy-guy 5y ago
  How exactly do you fundamentally disagree with the author of the PR? He literally did no statements beyond saying that this is not an Apache License anymore.
  - dtech 5y ago
    The author of the module disagrees with the author of the PR that adding this additional restriction does not make the project Apache License anymore.
    - the-lazy-guy 5y ago
      Thanks for the explanation. English is not my native language and I read the comment as if the commenter had fundamental disagreements with the author of the PR but had to agree with him on this particular point about license terms.
      - Handytinge 5y ago
        English is my native language and I also read it that way!
black_puppydog 5y ago
I'm not sure what the title here should be, but this one seems incomplete Edit: maybe this? > Terraform-AWS-modules/Terraform-AWS-eks restricts license for Russian/Belarussian users
- glogla 5y ago
  The title is technically true, but it makes a strong effort to paint it as a bad thing.
  - krageon 5y ago
    Nothing is being painted, the title is factually correct
nigma1337 5y ago
I hate this presidence things like these set. I would hate code being split into left/right, and that's kinda the presidence set here As much as I think the war is wrong, having it seep into other things which are "non-political", is incredibly annoying.
- toxik 5y ago
  Nothing is non-political. You do not exist in a vacuum.
  - glogla 5y ago
    Yes. "I don't want politics in X" (software, video games, etc) mean "I support the status quo" which is by itself a political position - and often a privileged one.
    - nigma1337 5y ago
      But i dont support the status quo lol. I just dont want to have someones political opinion shoved down my throat wherever i go.
      - aaomidi 5y ago
        Except free software itself is political. There really needs to be a history class for developers.
        encryptluks2 5y ago
        I don't really think it is. I believe free software is natural. Saying free software is political is like saying freedom is political. How is being against oppression political? Wouldn't that just be considered natural, and the people saying it is a political stance be the ones oppressing trying to make it political?
        5y ago
0xbadcafebee 5y ago
I'm in favor of a license hack for humanity. The International Science Council [1] has a Committee for Freedom and Responsibility in Science that "promotes freedom for scientists to pursue knowledge and to freely exchange ideas, at the same time as advocating the responsibility of scientists to maintain scientifically defensible conclusions, and of scientific institutions to apply high standards." [2] They have published a list of Freedoms and Responsibilities of Scientists[3], the main principle of which is "the free and responsible practice of science is fundamental to scientific advancement and human and environmental well-being." Reading the list in full, it seems evident that there is intellectual dissonance between the aims of scientific freedom and the aims of the Universal Declaration of Human Rights[4] (which it references). It opposes blocking access to science based on discrimination, which is laudable. However, it also doesn't explicitly oppose science done that supports discrimination, or science done by organizations that support discrimination. This makes sense when you consider that advances in science like GPS can be used to help you drive to a birthday party, or to guide a missile towards one. Clearly you can't condemn scientific research by itself, as it has too many potential applications for both good and harm, often unknown at the time the research is done. Similarly, discriminating against research on the basis of "ethnic origin, religion, citizenship, language, political or other opinion, sex, gender identity, sexual orientation, disability, or age" also prevents the free and responsible practice of science, so the list of Freedoms and Responsibilities of course opposes this discrimination. But what if the end result of that science research is used to discriminate against those same people for the same reasons? What does a responsible, ethical scientist do then? What we can do is oppose the use of science by people with those discriminatory goals, or goals that violate universal human rights. If you know someone is researching genetics in order to popularize Eugenics, there should be no responsibility to continue supporting that research. Similarly, if you believe that not supporting scientific research may help put pressure on a nation that is waging an unjust and unprovoked war which is killing thousands of innocent civilians [in violation of universal human rights], you should have no responsibility to continue supporting said nation's scientific research. In other words, it should be okay to discriminate if you are discriminating against violations of universal human rights. Considering this, I would propose that one major tenant of any new Open Source license is to discriminate against organizations or nations that want to research, use, or produce science or technology, if that organization or nation is widely considered to be violating universal human rights. This goal has the effect of communicating an ethical red line you must not cross if you want to participate in a global human community, and will be a discouraging factor when nations again consider the potential ramifications of their actions. Basically, we should use access to collaboration in science and technology as a lever to improve human rights. edit Ethical minds think alike! Somebody already created a version of the MIT license with this exact restriction! The Hippocratic License[5]: "an Ethical Source license that specifically prohibits the use of software to violate universal standards of human rights, and embodying the Ethical Source Principles." It appears there are many[6] other such licenses. [1] https://council.science https://council.science [2] https://council.science/about-us/governance/committees/committee-for-freedom-and-responsibility-in-science/ https://council.science/about-us/governance/committees/commi... [3] https://council.science/what-we-do/freedoms-and-responsibilities-of-scientists/ https://council.science/what-we-do/freedoms-and-responsibili... [4] https://en.wikipedia.org/wiki/Universal_Declaration_of_Human_Rights https://en.wikipedia.org/wiki/Universal_Declaration_of_Human... [5] https://firstdonoharm.dev/ https://firstdonoharm.dev/ [6] https://ethicalsource.dev/licenses/ https://ethicalsource.dev/licenses/
raffraffraff 5y ago
Ugh. Lookit: it sucks to be forced to say anything at all, whether you agree with it or not. One thing I can say for certain is that my employer (and probably yours) is only into virtue signalling when it's 100% safe, everyone else is doing it and it has zero negative repercussions. I don't get to decide what my employer's stance is on licenses. I guarantee you that many people will end up moving away from these modules, not because they agree with Putin, but because they have to. Nobody wants the hassle or risk of auditing a million different licenses. I'm an environmentalist. Should I update all my licenses to ban meat eaters, frequent flyers and drivers? Where does this shit end?
- sofixa 5y ago
  FYI this is not an employer doing the "virtue signaling", it's the individual contributor to the project.
  - raffraffraff 5y ago
    I know that. What I'm saying is that most employers are interested in virtue signalling, as long as it's a nice visible logo at a rainbow parade. That's cheap PR. But give them a legal headache and see how long they're willing to keep it up. My point is that many employers (certainly mine) would tell me to find another module or write my own, if they see this.
- antonbabenko 5y ago
  I have updated the wording in README - https://github.com/terraform-aws-modules/terraform-aws-eks#additional-information-for-users-from-russia-and-belarus https://github.com/terraform-aws-modules/terraform-aws-eks#a... . The project was and will be under the same Apache 2 license. You can continue using it as nothing is happening in Ukraine. I will never stop you or anyone else.
ryandvm 5y ago
Ugh. As much as I am against the invasion, I absolutely do not want to have to start examining software licenses for obscure political litmus tests. Especially pointless ones like "I believe Putin is a bad dude". I mean, if we're going to go down this road, then let's actually effect real change and slip some clauses in there with teeth like "no click-through license agreements" or "no pop-up cookie prompts" or "no ad trackers"...
nrmitchi 5y ago
Okay, so while this title is technically true, it is phrased in a way to incite panic. Just to be clear, AWS/Hashicorp is NOT beginning to charge people for the use of Terraform modules.
- jhugo 5y ago
  terraform-aws-modules is a community thing, that consists of modules that are thin wrappers around the official AWS provider, that serve very little purpose other than to add a dependency and create problems like this.
  - antonbabenko 5y ago
    lol
    - jhugo 5y ago
      Thanks for the downvote and the no-content comment, I guess? I've worked with numerous large Terraform configurations, and the ones that use terraform-aws-modules are harder to maintan, have more churn due to updates of the modules, and are more divorced from the actual underlying cloud resources due to random decisions made by the module authors. I really struggle to understand the reason for using the modules rather than the underlying resources, except that there are a lot of tutorials and blog posts written based on using the modules. Maybe you can enlighten me rather than writing a three-letter comment?
      - antonbabenko 5y ago
        no
      - nrmitchi 5y ago
        I will enlighten you. > serve very little purpose other than to add a dependency and create problems You're expressing your opinion as fact in a way that only serves to degrade people who don't agree with you. Obviously these modules serve a purpose, otherwise the repositories would not have hundreds-to-thousands of github stars/forks, and people would not be arguing about a license change on the front page of HN.
lars_francke 5y ago
It is fine for people to reuse/derive from the Apache license but it is _not_ fine to continue to use the name "Apache" in the license name as "Apache" is trademarked. I believe this is a changed license as it does not matter whether the change is in another file or not. Edit: https://www.apache.org/foundation/license-faq.html#mod-license https://www.apache.org/foundation/license-faq.html#mod-licen...
antonbabenko 5y ago
Hi. I am Anton Babenko, maintainer (ukrainian by heart) here. I have updated the wording in README to state the facts about Russia (facts with links to wikipedia) - https://github.com/terraform-aws-modules/terraform-aws-eks#additional-information-for-users-from-russia-and-belarus https://github.com/terraform-aws-modules/terraform-aws-eks#a... It was never my intention to make changes in a license in any way. It would be just wrong to drop 5+ years of my life working on all terraform-aws-modules and betray everyone who have been participating as contributors and users. If there are questions, please ask here or twitter (@antonbabenko).
- seneca 5y ago
  I hope you and your loved ones are safe and weathering this this war of aggression as best as possible. I hope your homeland remains free and is able to oust the dictator attacking it. I commend you for reverting the terms of use change. I also believe that this sort of remaining political statement in a project sets a poor precedent, and diminishes the work. Free software is meant to be open to all. Throwing ideological barbs in the project, however correct and riteous, undermines the project's freedom. I would urge you to reconsider.
  - antonbabenko 5y ago
    As I said earlier, I have updated the wording in README - https://github.com/terraform-aws-modules/terraform-aws-eks#additional-information-for-users-from-russia-and-belarus https://github.com/terraform-aws-modules/terraform-aws-eks#a... . The project was and will be under the same Apache 2 license. You can continue using it as nothing is happening in Ukraine. I will never stop you or anyone else. PS: It is not just Putin who attacks Ukraine but I don't want to go into this discussion here.
  - DandyDev 5y ago
    Question: what is "ideological" about the facts stated in the README? Putin invaded Ukraine. Lives are at stake. Being against that is no more ideological than the need for you and me to eat and sleep.
- 5y ago
bombcar 5y ago
Stallman has discussed this years ago: https://www.gnu.org/philosophy/programs-must-not-limit-freedom-to-run.en.html https://www.gnu.org/philosophy/programs-must-not-limit-freed... The most pertinent part is: > A condition against torture would not work, because enforcement of any free software license is done through the state. A state that wants to carry out torture will ignore the license. When victims of US torture try suing the US government, courts dismiss the cases on the grounds that their treatment is a national security secret. If a software developer tried to sue the US government for using a program for torture against the conditions of its license, that suit would be dismissed too. In general, states are clever at making legal excuses for whatever terrible things they want to do. Businesses with powerful lobbies can do it too.
- aaomidi 5y ago
  - encryptluks2 5y ago
sciurus 5y ago
This license change appears to affect not just the EKS module, but all the modules in the terraform-aws-modules organization. For example, here is the same change in their VPC module: https://github.com/terraform-aws-modules/terraform-aws-vpc/commit/acb0ae548d7c6dd0594565c7a6087f65b4c45f93 https://github.com/terraform-aws-modules/terraform-aws-vpc/c...
- antonbabenko 5y ago
  I have updated the wording in README - https://github.com/terraform-aws-modules/terraform-aws-vpc#additional-information-for-users-from-russia-and-belarus https://github.com/terraform-aws-modules/terraform-aws-vpc#a... . The project was and will be under the same Apache 2 license.
  - jhugo 5y ago
    By definition, it's not under the Apache 2 license if you add extra terms, even if those terms only apply to some people.
    - antonbabenko 5y ago
      That's why I call it "Additional information for ..." and links to wikipedia (not yet blocked in those countries, I guess). It is the same Apache2 license.
      - jhugo 5y ago
        I applaud you for fixing that. As you know, when I wrote my comment, it still said "Additional terms for …"
        antonbabenko 5y ago
        Github was down. It says "information" now.
aaomidi 5y ago
FWIW anyone I don't think apache 2's definition is set in stone. Think of this as derivative of apache 2, without the author saying it's apache 2.
- skyzyx 5y ago
  It’s literally a pre-defined legal document. It’s definitely set in stone enough to warrant filing lawsuits and taking people to court over.
beny23 5y ago
While I completely abhor the invasion, I can't help but feeling that the licence (and equally important) accompanying code change - https://github.com/terraform-aws-modules/terraform-aws-eks/blob/fad350d5bf36a7e39aa3840926b4c9968e9f594c/variables.tf https://github.com/terraform-aws-modules/terraform-aws-eks/b... - feels like a weaponisation of open source, and I think this is a dangerous thing to do. I do think that with change of "additional terms & conditions" to "additional information", it still feels an ethically dangerous place to be. I would not be happy if a library codifies political statements. What could be next? Conditions that state you agree to vote for/against Trump, that you disagree with homosexuality or are against transphobia. Note, I'm not accusing anyone of having those views neither am I commenting on them, they merely serve as an example of the dangers of discriminating. Dependencies and supply chain attacks are the big thing - and while dependency scanning and pinning are an important component, but I don't think it is possible to use open source libs at scale without a certain amount of trust. I work on a platform where there are hundreds of teams and thousands of microservices. I'm now trying to think how we can assess the risk of thousands of dependencies and millions of lines of code. Without trust, the only way that's possible is to fork all libs, prevent open source and generally kill off any agility and velocity. My problem is that this weaponisation is killing off trust. It's not about sitting on the fence or taking sides in a war. It's about what open source has achieved over the last 30 years and I think that's now more at risk than before…
AitchEmArsey 5y ago
The only appropriate response here is for a corporate owner (Hashicorp preferably) to fork the repo just before the license change and to assert that their version is the default, and drive future development there. The original author is entitled to their opinion and can restrict their own development to a repo with license conditions they define, but it is not reasonable to expect companies to accept non-standard and politically charged license terms. Getting shit done is hard enough and this change will not move the needle on Ukraine/Russia sentiment one iota.
- antonbabenko 5y ago
  You are asking a corporation to clone "a community-driven project" and maintain it. Ok. There are 2.7K of forks of just this module already if you want to use them.
skyzyx 5y ago
It is astonishing to me how poor our literacy of software licenses is as a community. Also, reading the comments here, there are two wholly independent things happening that most people are conflating as the same thing. Software licenses are LEGAL DOCUMENTS. If you are not a lawyer, who has a specialty in this specific area of law, don’t go fucking with them. 1. Fuck Russia. This is the only right answer to the question. Entirely separately is #2. 2. If you change the terms of a license, it’s a different license. The changed license was not the Apache 2.0 license, and was additionally a breaking change in every sense of the phrase. I appreciate that @antonbabenko recognized this and fixed it, but these two issues are entirely separate. What Russia is doing is terrible. That is an absolute fact. But the new Terraform variables that were added in that commit have absolutely nothing to do with making the software work in the way that it was intended to, therefore, they do not belong. This has nothing to do with being anti-politics. I’m very heavily political, and I fully support Ukraine in this case. I also have strong opinions on both “free software“ and also “open source software“, and I apply them at the license level by selecting a pre-existing license without making custom modifications to it. But things like `var.putin_khuylo` simply don’t belong in the software itself. Nor does it belong in an OSI-approved software license.
- skyzyx 5y ago
  Similarly: https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/ https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-pack...

80 points by pricechild 5y ago

Have you found more open-source projects that follow a similar approach to spreading information about the Ukraine-Russia conflict? Would be nice to compile a list of them!

toyg 5y ago
Lists tend to attract the "proscription" prefix, when in a political context. Also, if you support the stance, you arguably don't want to make it easy for Russian/Belarusian users to avoid software, you want to maximize their inconvenience - which you do when they invest time into learning something and then find out they are technically not allowed to use it in production. This said, it's all theatre anyway - I would bet good money that most Russian businesses already didn't care about respecting FOSS licenses, considering the infamously lax attitude about copyright enforcement in that country (and in China and Iran). So adding that sort of clause will stop absolutely no one, in practice, and I bet the authors will never even try to sue anyone in Russia (or anywhere else with some sort of jurisdiction over Russia, like the WTO) for infringing it.

johndfsgdgdfg 5y ago

marcinzm 5y ago

edited: I see the addition now.

detaro 5y ago
How is adding "Additional terms of use" not a license change? That's not just a "statement of support".
- c0l0 5y ago
  IANAL, but afaik, copyright licenses can only ever affect (re)distribution - not use.
  - detaro 5y ago
    That makes zero sense. Of course licenses regulate use. Apache2 license text literally starts with "TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION"
  - marcinzm 5y ago
    Which means this repo has an EULA which I'm sure is going to trigger all sorts of compliance alerts at larger companies once they learn of it.
  - kmeisthax 5y ago
    Only iff the copyrighted work was "sold" and not "licensed". There has been a huge effort on the part of copyright holders to avoid "selling" things, and make "sold" software legally unusable without a corresponding license agreement. Once you exit the realm of a "sale", there are very few restrictions on what you can require of your licensees. Freedom Zero restrictions are absolutely on the table, as well as curtailing fair use. And these license restrictions are generally considered watertight - you are not going to convince a judge that a license agreement should be reconstrued such that you get the permissions you want without the restrictions the copyright owner added to them. That being said, your average EULA has about 4000x more clauses in it than it needs to be, because they don't expect anyone to read them and those clauses are rarely, if ever, enforceable. FOSS licenses tend to be short and easily readable because they are written by people who want you to know what they entail. Proprietary EULAs tend to be forked from some internal corporate list of legal requirements that get copypasted everywhere. My favorite example of this is the clause in iTunes - a music store - that prohibits you from designing nuclear weapons with it. Second favorite is the LICENSE file included in all Swift Playgrounds example code, which has about 2 actual provisions Apple cares about (don't resell the sample code in the app and don't hack people with Swift Playgrounds), and a hundred clauses copypasted from the iPadOS EULAs that I've already agreed to. As far as I can tell, nobody at Apple is actually going to care if an individual user does something that technically breaches the EULA.
josephcsible 5y ago
The "Additional terms of use" section makes it non-free. Compare it to the Commons Clause.
- antonbabenko 5y ago
  I have updated the wording in README - https://github.com/terraform-aws-modules/terraform-aws-eks#additional-information-for-users-from-russia-and-belarus https://github.com/terraform-aws-modules/terraform-aws-eks#a... . The project was and will be under the same Apache 2 license.
  - josephcsible 5y ago
    Okay, https://github.com/terraform-aws-modules/terraform-aws-eks/commit/f5511e4df1f06954229f48df1cf87f9ebc8da26a https://github.com/terraform-aws-modules/terraform-aws-eks/c... means that now it is free again. Thanks!

reacharavindh 5y ago

As much as I hate what Russia is doing, I’d hate even more for software to come under political purviews. If an author of a library chooses to apply political condition(however justified they may be), then the software is simply not free by definition. I’m neither Russian nor Ukrainian. I cannot turn a blind eye simply because it doesn’t apply to me. What if another library that I use apply a license that says “those that look like this cannot use my software from now on”?

black_puppydog 5y ago
> I’d hate even more for software to come under political purviews. Really? Making software free is just about as political as it gets. Restricting that freedom, as happens here, is equally political. I guess you just don't this special kind of politics in your software.
- joshmanders 5y ago
  Right? Like the whole open source movement was a massive political thing... Open source by definition is political.
  - charcircuit 5y ago
    I think you are confusing it with the free software movement. Their idea of proprietary software being "evil" is why they don't get as much support as compared to open source.
  - chii 5y ago
    but software licenses are related to the field of software and freedom _within_ software. I'd hate to say it, but including other political ideologies into the software license is making it more political. If the author of the software wants to, he is within his rights, but i think it's the wrong platform to try to voice his opinion. A piece of software is a platform - but using this platform (granted to the author by the participation of a community) to further a different, unrelated ideology could be considered abuse of power. May be this war is extenuating circumstances - and understandable. But i'm concerned about the slippery slope. Realistically a license change is not going to affect the course of the war, nor make putin reconsider. I argue that the effort is only going to inconvenience their users, without actually making a true change. It may be better to ask for donations, etc, rather than changing the license as a political statement.

crmd 5y ago

I’m ethically torn here. On one hand, I ask myself what I would have done if I worked at IBM in the 1930s[0] On the other hand, as an LGBT person, I firmly believe that maximal freedom of speech protects vulnerable people from erasure. What this means for free software is a tough question. [0]https://en.wikipedia.org/wiki/IBM_and_World_War_II https://en.wikipedia.org/wiki/IBM_and_World_War_II

sonjaqql 5y ago
As an LGBT person, I fear that efforts like these are noble but empty. Assholes gonna still be assholes, Russia is gonna pirate software [0], and global Terraform users won't notice. Could this act actually awaken an IT team to the atrocities, in a way that makes a difference? [0] https://writing.kemitchell.com/2022/03/05/Russia-to-Legalize-Software-Piracy.html https://writing.kemitchell.com/2022/03/05/Russia-to-Legalize...
gzer0 5y ago
> "maximal freedom of speech protects vulnerable people from erasure" It's very easy to say things like this without fully comprehending all of the implications. Here's an example: Google restricted the usage of its own product, Google Maps, in an effort to halt the killing of Ukrainians by Russian armed forces, who were using Google Maps to launch their operations. This directly contradicts your claim.
- GreenWatermelon 5y ago
  Here, google didn't approache freedom of speech. They merely restricted the services of their product in a particular area
jacobr1 5y ago
I don't think there is a tradeoff. Not all actions constitute speech. Supporters of Russian actions should be able to spout off their horrible thoughts, but that doesn't mean companies the need to sell their goods or services to Russia. The two categories of acts aren't the same.

igetspam 5y ago

It sucks to have to agree with someone that you don't fundamentally agree with but I think the author of the PR is correct. This is a modification of the Apache license and while I appreciate and support their stance, it does seem to mean that the license is non compliant. I support anyone's desire to protest things (no matter which side I'm on) but you can't just make up your own rules.

Proven 5y ago
You fundamentally agree with the person who opened the issue on the issue of license, that's the only thing that matters here. He is right, the changed license is discriminatory. Older commits can be used freely, so not a big deal for a while at least and by then someone can fork the code.
the-lazy-guy 5y ago
How exactly do you fundamentally disagree with the author of the PR? He literally did no statements beyond saying that this is not an Apache License anymore.
- dtech 5y ago
  The author of the module disagrees with the author of the PR that adding this additional restriction does not make the project Apache License anymore.
  - the-lazy-guy 5y ago
    Thanks for the explanation. English is not my native language and I read the comment as if the commenter had fundamental disagreements with the author of the PR but had to agree with him on this particular point about license terms.
    - Handytinge 5y ago
      English is my native language and I also read it that way!

black_puppydog 5y ago

I'm not sure what the title here should be, but this one seems incomplete Edit: maybe this? > Terraform-AWS-modules/Terraform-AWS-eks restricts license for Russian/Belarussian users

glogla 5y ago
The title is technically true, but it makes a strong effort to paint it as a bad thing.
- krageon 5y ago
  Nothing is being painted, the title is factually correct

nigma1337 5y ago

I hate this presidence things like these set. I would hate code being split into left/right, and that's kinda the presidence set here As much as I think the war is wrong, having it seep into other things which are "non-political", is incredibly annoying.

toxik 5y ago
Nothing is non-political. You do not exist in a vacuum.
- glogla 5y ago
  Yes. "I don't want politics in X" (software, video games, etc) mean "I support the status quo" which is by itself a political position - and often a privileged one.
  - nigma1337 5y ago
    But i dont support the status quo lol. I just dont want to have someones political opinion shoved down my throat wherever i go.
    - aaomidi 5y ago
      Except free software itself is political. There really needs to be a history class for developers.
      - encryptluks2 5y ago
        I don't really think it is. I believe free software is natural. Saying free software is political is like saying freedom is political. How is being against oppression political? Wouldn't that just be considered natural, and the people saying it is a political stance be the ones oppressing trying to make it political?
        5y ago

0xbadcafebee 5y ago

I'm in favor of a license hack for humanity. The International Science Council [1] has a Committee for Freedom and Responsibility in Science that "promotes freedom for scientists to pursue knowledge and to freely exchange ideas, at the same time as advocating the responsibility of scientists to maintain scientifically defensible conclusions, and of scientific institutions to apply high standards." [2] They have published a list of Freedoms and Responsibilities of Scientists[3], the main principle of which is "the free and responsible practice of science is fundamental to scientific advancement and human and environmental well-being." Reading the list in full, it seems evident that there is intellectual dissonance between the aims of scientific freedom and the aims of the Universal Declaration of Human Rights[4] (which it references). It opposes blocking access to science based on discrimination, which is laudable. However, it also doesn't explicitly oppose science done that supports discrimination, or science done by organizations that support discrimination. This makes sense when you consider that advances in science like GPS can be used to help you drive to a birthday party, or to guide a missile towards one. Clearly you can't condemn scientific research by itself, as it has too many potential applications for both good and harm, often unknown at the time the research is done. Similarly, discriminating against research on the basis of "ethnic origin, religion, citizenship, language, political or other opinion, sex, gender identity, sexual orientation, disability, or age" also prevents the free and responsible practice of science, so the list of Freedoms and Responsibilities of course opposes this discrimination. But what if the end result of that science research is used to discriminate against those same people for the same reasons? What does a responsible, ethical scientist do then? What we can do is oppose the use of science by people with those discriminatory goals, or goals that violate universal human rights. If you know someone is researching genetics in order to popularize Eugenics, there should be no responsibility to continue supporting that research. Similarly, if you believe that not supporting scientific research may help put pressure on a nation that is waging an unjust and unprovoked war which is killing thousands of innocent civilians [in violation of universal human rights], you should have no responsibility to continue supporting said nation's scientific research. In other words, it should be okay to discriminate if you are discriminating against violations of universal human rights. Considering this, I would propose that one major tenant of any new Open Source license is to discriminate against organizations or nations that want to research, use, or produce science or technology, if that organization or nation is widely considered to be violating universal human rights. This goal has the effect of communicating an ethical red line you must not cross if you want to participate in a global human community, and will be a discouraging factor when nations again consider the potential ramifications of their actions. Basically, we should use access to collaboration in science and technology as a lever to improve human rights. edit Ethical minds think alike! Somebody already created a version of the MIT license with this exact restriction! The Hippocratic License[5]: "an Ethical Source license that specifically prohibits the use of software to violate universal standards of human rights, and embodying the Ethical Source Principles." It appears there are many[6] other such licenses. [1] https://council.science https://council.science [2] https://council.science/about-us/governance/committees/committee-for-freedom-and-responsibility-in-science/ https://council.science/about-us/governance/committees/commi... [3] https://council.science/what-we-do/freedoms-and-responsibilities-of-scientists/ https://council.science/what-we-do/freedoms-and-responsibili... [4] https://en.wikipedia.org/wiki/Universal_Declaration_of_Human_Rights https://en.wikipedia.org/wiki/Universal_Declaration_of_Human... [5] https://firstdonoharm.dev/ https://firstdonoharm.dev/ [6] https://ethicalsource.dev/licenses/ https://ethicalsource.dev/licenses/

raffraffraff 5y ago

Ugh. Lookit: it sucks to be forced to say anything at all, whether you agree with it or not. One thing I can say for certain is that my employer (and probably yours) is only into virtue signalling when it's 100% safe, everyone else is doing it and it has zero negative repercussions. I don't get to decide what my employer's stance is on licenses. I guarantee you that many people will end up moving away from these modules, not because they agree with Putin, but because they have to. Nobody wants the hassle or risk of auditing a million different licenses. I'm an environmentalist. Should I update all my licenses to ban meat eaters, frequent flyers and drivers? Where does this shit end?

sofixa 5y ago
FYI this is not an employer doing the "virtue signaling", it's the individual contributor to the project.
- raffraffraff 5y ago
  I know that. What I'm saying is that most employers are interested in virtue signalling, as long as it's a nice visible logo at a rainbow parade. That's cheap PR. But give them a legal headache and see how long they're willing to keep it up. My point is that many employers (certainly mine) would tell me to find another module or write my own, if they see this.
antonbabenko 5y ago
I have updated the wording in README - https://github.com/terraform-aws-modules/terraform-aws-eks#additional-information-for-users-from-russia-and-belarus https://github.com/terraform-aws-modules/terraform-aws-eks#a... . The project was and will be under the same Apache 2 license. You can continue using it as nothing is happening in Ukraine. I will never stop you or anyone else.

ryandvm 5y ago

Ugh. As much as I am against the invasion, I absolutely do not want to have to start examining software licenses for obscure political litmus tests. Especially pointless ones like "I believe Putin is a bad dude". I mean, if we're going to go down this road, then let's actually effect real change and slip some clauses in there with teeth like "no click-through license agreements" or "no pop-up cookie prompts" or "no ad trackers"...

nrmitchi 5y ago

Okay, so while this title is technically true, it is phrased in a way to incite panic. Just to be clear, AWS/Hashicorp is NOT beginning to charge people for the use of Terraform modules.

jhugo 5y ago
terraform-aws-modules is a community thing, that consists of modules that are thin wrappers around the official AWS provider, that serve very little purpose other than to add a dependency and create problems like this.
- antonbabenko 5y ago
  lol
  - jhugo 5y ago
    Thanks for the downvote and the no-content comment, I guess? I've worked with numerous large Terraform configurations, and the ones that use terraform-aws-modules are harder to maintan, have more churn due to updates of the modules, and are more divorced from the actual underlying cloud resources due to random decisions made by the module authors. I really struggle to understand the reason for using the modules rather than the underlying resources, except that there are a lot of tutorials and blog posts written based on using the modules. Maybe you can enlighten me rather than writing a three-letter comment?
    - antonbabenko 5y ago
      no
    - nrmitchi 5y ago
      I will enlighten you. > serve very little purpose other than to add a dependency and create problems You're expressing your opinion as fact in a way that only serves to degrade people who don't agree with you. Obviously these modules serve a purpose, otherwise the repositories would not have hundreds-to-thousands of github stars/forks, and people would not be arguing about a license change on the front page of HN.

lars_francke 5y ago

It is fine for people to reuse/derive from the Apache license but it is _not_ fine to continue to use the name "Apache" in the license name as "Apache" is trademarked. I believe this is a changed license as it does not matter whether the change is in another file or not. Edit: https://www.apache.org/foundation/license-faq.html#mod-license https://www.apache.org/foundation/license-faq.html#mod-licen...

antonbabenko 5y ago

Hi. I am Anton Babenko, maintainer (ukrainian by heart) here. I have updated the wording in README to state the facts about Russia (facts with links to wikipedia) - https://github.com/terraform-aws-modules/terraform-aws-eks#additional-information-for-users-from-russia-and-belarus https://github.com/terraform-aws-modules/terraform-aws-eks#a... It was never my intention to make changes in a license in any way. It would be just wrong to drop 5+ years of my life working on all terraform-aws-modules and betray everyone who have been participating as contributors and users. If there are questions, please ask here or twitter (@antonbabenko).

seneca 5y ago
I hope you and your loved ones are safe and weathering this this war of aggression as best as possible. I hope your homeland remains free and is able to oust the dictator attacking it. I commend you for reverting the terms of use change. I also believe that this sort of remaining political statement in a project sets a poor precedent, and diminishes the work. Free software is meant to be open to all. Throwing ideological barbs in the project, however correct and riteous, undermines the project's freedom. I would urge you to reconsider.
- antonbabenko 5y ago
  As I said earlier, I have updated the wording in README - https://github.com/terraform-aws-modules/terraform-aws-eks#additional-information-for-users-from-russia-and-belarus https://github.com/terraform-aws-modules/terraform-aws-eks#a... . The project was and will be under the same Apache 2 license. You can continue using it as nothing is happening in Ukraine. I will never stop you or anyone else. PS: It is not just Putin who attacks Ukraine but I don't want to go into this discussion here.
- DandyDev 5y ago
  Question: what is "ideological" about the facts stated in the README? Putin invaded Ukraine. Lives are at stake. Being against that is no more ideological than the need for you and me to eat and sleep.
5y ago

bombcar 5y ago

Stallman has discussed this years ago: https://www.gnu.org/philosophy/programs-must-not-limit-freedom-to-run.en.html https://www.gnu.org/philosophy/programs-must-not-limit-freed... The most pertinent part is: > A condition against torture would not work, because enforcement of any free software license is done through the state. A state that wants to carry out torture will ignore the license. When victims of US torture try suing the US government, courts dismiss the cases on the grounds that their treatment is a national security secret. If a software developer tried to sue the US government for using a program for torture against the conditions of its license, that suit would be dismissed too. In general, states are clever at making legal excuses for whatever terrible things they want to do. Businesses with powerful lobbies can do it too.

aaomidi 5y ago
- encryptluks2 5y ago

sciurus 5y ago

This license change appears to affect not just the EKS module, but all the modules in the terraform-aws-modules organization. For example, here is the same change in their VPC module: https://github.com/terraform-aws-modules/terraform-aws-vpc/commit/acb0ae548d7c6dd0594565c7a6087f65b4c45f93 https://github.com/terraform-aws-modules/terraform-aws-vpc/c...

antonbabenko 5y ago
I have updated the wording in README - https://github.com/terraform-aws-modules/terraform-aws-vpc#additional-information-for-users-from-russia-and-belarus https://github.com/terraform-aws-modules/terraform-aws-vpc#a... . The project was and will be under the same Apache 2 license.
- jhugo 5y ago
  By definition, it's not under the Apache 2 license if you add extra terms, even if those terms only apply to some people.
  - antonbabenko 5y ago
    That's why I call it "Additional information for ..." and links to wikipedia (not yet blocked in those countries, I guess). It is the same Apache2 license.
    - jhugo 5y ago
      I applaud you for fixing that. As you know, when I wrote my comment, it still said "Additional terms for …"
      - antonbabenko 5y ago
        Github was down. It says "information" now.

aaomidi 5y ago

FWIW anyone I don't think apache 2's definition is set in stone. Think of this as derivative of apache 2, without the author saying it's apache 2.

skyzyx 5y ago
It’s literally a pre-defined legal document. It’s definitely set in stone enough to warrant filing lawsuits and taking people to court over.

beny23 5y ago

While I completely abhor the invasion, I can't help but feeling that the licence (and equally important) accompanying code change - https://github.com/terraform-aws-modules/terraform-aws-eks/blob/fad350d5bf36a7e39aa3840926b4c9968e9f594c/variables.tf https://github.com/terraform-aws-modules/terraform-aws-eks/b... - feels like a weaponisation of open source, and I think this is a dangerous thing to do. I do think that with change of "additional terms & conditions" to "additional information", it still feels an ethically dangerous place to be. I would not be happy if a library codifies political statements. What could be next? Conditions that state you agree to vote for/against Trump, that you disagree with homosexuality or are against transphobia. Note, I'm not accusing anyone of having those views neither am I commenting on them, they merely serve as an example of the dangers of discriminating. Dependencies and supply chain attacks are the big thing - and while dependency scanning and pinning are an important component, but I don't think it is possible to use open source libs at scale without a certain amount of trust. I work on a platform where there are hundreds of teams and thousands of microservices. I'm now trying to think how we can assess the risk of thousands of dependencies and millions of lines of code. Without trust, the only way that's possible is to fork all libs, prevent open source and generally kill off any agility and velocity. My problem is that this weaponisation is killing off trust. It's not about sitting on the fence or taking sides in a war. It's about what open source has achieved over the last 30 years and I think that's now more at risk than before…

AitchEmArsey 5y ago

The only appropriate response here is for a corporate owner (Hashicorp preferably) to fork the repo just before the license change and to assert that their version is the default, and drive future development there. The original author is entitled to their opinion and can restrict their own development to a repo with license conditions they define, but it is not reasonable to expect companies to accept non-standard and politically charged license terms. Getting shit done is hard enough and this change will not move the needle on Ukraine/Russia sentiment one iota.

antonbabenko 5y ago
You are asking a corporation to clone "a community-driven project" and maintain it. Ok. There are 2.7K of forks of just this module already if you want to use them.

skyzyx 5y ago

It is astonishing to me how poor our literacy of software licenses is as a community. Also, reading the comments here, there are two wholly independent things happening that most people are conflating as the same thing. Software licenses are LEGAL DOCUMENTS. If you are not a lawyer, who has a specialty in this specific area of law, don’t go fucking with them. 1. Fuck Russia. This is the only right answer to the question. Entirely separately is #2. 2. If you change the terms of a license, it’s a different license. The changed license was not the Apache 2.0 license, and was additionally a breaking change in every sense of the phrase. I appreciate that @antonbabenko recognized this and fixed it, but these two issues are entirely separate. What Russia is doing is terrible. That is an absolute fact. But the new Terraform variables that were added in that commit have absolutely nothing to do with making the software work in the way that it was intended to, therefore, they do not belong. This has nothing to do with being anti-politics. I’m very heavily political, and I fully support Ukraine in this case. I also have strong opinions on both “free software“ and also “open source software“, and I apply them at the license level by selecting a pre-existing license without making custom modifications to it. But things like `var.putin_khuylo` simply don’t belong in the software itself. Nor does it belong in an OSI-approved software license.

skyzyx 5y ago
Similarly: https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/ https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-pack...