6 ms·

Open Source Bait and Switch: Licensing and Beyond

37 points by hodgesrm 4y ago

Affric 4y ago
>Apache 2.0 >open source movement is not about making it easy for you to do business, it is about freedom for users of your software. Say what you will about RMS this is the exact kind of thing that the GPL is written for. "Open Source" exists to benefit business. "Free Software" exists to benefit users. On the flip side I think it's fair that if they have many of these large customers with more than $25 million in turn over not contributing that they do pay for the software development.
- shapefrog 4y ago
  > have many of these large customers with more than $25 million in turn over not contributing that they do pay for the software development If your net worth, inclusive of tech stock options is >$5mil you should have to pay to the developer for any open source software that you use, or is used in any of the products you use. (hint: its going to be expensive)
  - PeterZaitsev 4y ago
    I think it is fantastic if people create proprietary software and make it available for free to everyone with net worth of $5M or less (or any criteria) just do not call it Open Source software.
- hodgesrm 4y ago
  > On the flip side I think it's fair that if they have many of these large customers with more than $25 million in turn over not contributing that they do pay for the software development. Do you mean for every single OSS project? Have a look at the dependency graph for a typical React project or anything built with Maven. Charging for this is unworkable. The collaborative work on which open source is based would collapse. Just as a concrete example, ClickHouse incorporates something like 97 other software packages in contrib ranging from NuRaft to zstd. ClickHouse in its current form is only possible if those packages remain free.
- PeterZaitsev 4y ago
  I think your definition here is Off. Both Apache 2.0 and GPL qualify both as "Open Source" and "Free Software" Yes of course many large companies do not contribute. If your goal is to FORCE to contribute customers to your liking this is what Proprietary license is for. Go proprietary and you can discriminate customers based on their ability to pay. Open Source though requires same access - rich and poor, good and evil and especially relinquishing control for you to decide which is which
  - kdmccormick 4y ago
    You are saying these things as if they are fact. > Open Source though requires same access - rich and poor, good and evil and especially relinquishing control for you to decide which is which No it doesn't. If you believe the legal system, then you believe that we can make real rules about people's behavior, even in circumstances where we won't physically be the there to force that behavior. More concretely: We can certainly say "this code is freely available to read" without saying "you can do whatever you want with this code with no repercussions", even though technically anyone can download any open source code and use it to run a business on their servers. If you do doubt that this is possible to enforce, then consider music: I can listen to almost any piece of modern music on Spotify. That does not mean I can use any piece of modern music in a commercial royalty-free unless I'm interested in getting sued. The question is not whether we can enforce Copyleft/etc licenses. It's whether we have the will and money to do so.
josevalerio 4y ago
I think the BSL license is a good compromise for businesses looking to protect their IP, and after a year release everything under MIT or Apache. As long as they keep innovating, the latest and greatest will always come from the code authors themselves with a potential for dual licensing to enterprise to earn some revenue. That being said, I've personally chosen Apache2 for my projects. I feel that the growth and adoption from the community outweigh not having VCs crawling at my door, if you can afford this path. Curious what others have to say about other high profile switches from Mongo, Elastic, Sentry, etc.
- kevincox 4y ago
  The main missing component is security updates. Usually in this model there is no guarantee that the open-source "tip" is actually supported. Even if it wasn't supported releasing security patches under an open-source license would allow community back porting. Of course security patches are a big driver for businesses so this makes sense from the profit sense. However as an open source project I would be very hesitant to add this as a dependency because now I am forcing my user to enter a contract if they want security. I think this is the problem with non-free licenses in general. It makes it a much harder decision for other projects to build upon. Because now any user is required to become a customer of another business with pricing and licenses that I have no control over and can change at any time.
  - detaro 4y ago
    Indeed, and even if a separate group decides to maintain a (potentially diverging) version based on the open-source versions, without a clear commitment from the BSL upstream every security patch puts them at risk of claims of license violations.
- hodgesrm 4y ago
  BSL is just another form of source code escrow. It's unusable for projects my company works on and uses, for two reasons. We need the freedom to use the software for any purpose. We also need some assurance that others will feel enough ownership to enable a sustainable community of contributors. Apache 2 is overall the best license to achieve that goal, though obviously others do the same. Edit: typo
jacobwg 4y ago
> [...] this rings to me as similar to an alleged quote about the Vietnam War: “We had to destroy the village in order to save it.” Comparing the licensing change to murder during the Vietnam War seems like an odd tone to take on an official company blog.
- mikymoothrowa 4y ago
  Over the last 10 years, did people decide to interpret everything in the most cancel-able form? No sane person before would have read this sentence and thought that the author was comparing licensing changes to murder
  - jacobwg 4y ago
    Not really trying to cancel the author here, it's just an interesting comparison to make. It feels like either the author is trying to invoke the murder of villages during the Vietnam War as a way of lending weight to their argument about licensing changes, or they view the example of village destruction during the Vietnam War as something trivial enough to be in this post about licensing changes. Both of which feel odd. Whatever it is, it's the second sentence of the post and is literally written as a comparison to the license change statement from Lightbend, so it feels like the author intended it to be important.
    - mikymoothrowa 4y ago
      not just you, I’ve been seeing this a lot lately. somebody references a well known phrase or an idiom and then somebody comments “Sure go ahead and compare this with that!” I’m not sure why you feel the author is trying to use vietnam to lend weight to his argument. He’s merely pointing to the absurdity of the sentence. And likening that absurdity to that of Lightbends post
      - jacobwg 4y ago
        I can see that. For me, I’m not familiar with that phrase as an idiom, I’ve not encountered it before. It’s likely landing differently than for someone who experiences it as a common expression.
dessant 4y ago
What the article refers to as bait and switch is what open source maintainers call disillusionment, and the realization that nobody is there to prop them up and feed them while they work for the public good. You should not shame people who try to build something sustainable, but instead try to improve the system that makes altruistic work difficult.
- kevincox 4y ago
  Just because something has upsides doesn't mean it doesn't have downsides. While I am glad that this will likely provide more funding to these projects changing to a non-free license has incredible impact on how a project can be used. I think it is fair to talk about this and how it can maybe be done better.
  - dessant 4y ago
    > I think it is fair to talk about this and how it can maybe be done better. I agree, though it's evident that the discussion is stained by the tone of this article. They aren't approaching this topic with some respect and understanding, while being fully aware that these license changes are aimed at large companies which keep taking, but do not support the open source community.
    - hodgesrm 4y ago
      Isn't it also the case that large companies are the reason projects like Linux have been so successful? Linux is an example. A very high percentage of Linux contributions are from corporate sponsors. [0] [0] https://thenewstack.io/contributes-linux-kernel/ https://thenewstack.io/contributes-linux-kernel/ (Kind of old but I don't think it has changed much.)
      - dessant 4y ago
        Some companies do support open source projects, though that has no relevance here. We're talking about large companies that generate a profit on the back of open source projects, and refuse to support those projects.
kosolam 4y ago
As a user of open source software I’m all in for the freedom it provides. But as a business owner I can’t have my software open source. So these things are not compatible. New, more sustainable models are needed in order to bridge the gap.
- bheadmaster 4y ago
  > But as a business owner I can’t have my software open source. May I ask for more details - in your particular case, how would having your software open source hurt your business? Just pure curiosity, nothing else.
  - melagonster 4y ago
    they write software, and sold it. if source code is open source, they can't required people pay for it. I just guess.
    - kosolam 4y ago
      Yes. More or less this is the case.
mananaysiempre 4y ago
Percona hold software patents covering essentially all of Bender et al.’s cache-oblivious data structures via the Tokutek acquisition, don’t they? Nothing against this text in particular, but interacting with anything originating from there leaves a ... slimy feeling.
- hodgesrm 4y ago
  Many companies own patents for many different reasons. Has Percona ever actually asserted patent rights? I can't think of an instance where this is the case. They have also made major independent contributions like Percona XtraBackup, to name just one that many MySQL users know. Also, if we all avoided companies and products that have patents, wouldn't that rule out owning a mobile phone? Disclaimer: We're Percona partners and Peter Zaitsev is on our board. I endorse the view in his article without reservation as you can probably tell. ;)
- PeterZaitsev 4y ago
  No. (Percona CEO and article author here) - Percona does not own Fractal Trees patents. Patents belong to MIT and Tokutek licensed those patents from MIT, Percona took over this license.
  - mananaysiempre 4y ago
    Thank you! I even remembered reading something to that effect in the original Tokutek PATENTS files, but went on Google Patents to double-check and (it seems) hit the wrong patent. For reference, those are: - “Disk-resident streaming dictionary” (2007) [1] seems to be the main one for both the COLA (if it is patentable at all—the base datastructure, fractional cascading, and deamortization were all in the literature a decade or more before, though impressively obscure from where I’m standing) and the CO B-tree; owned by MIT and (according to Google) exclusively licensed to Tokutek and afterwards Percona; - Same (2012) [2], a “continuation”(?), allowed to lapse and expired; - “High-performance streaming dictionary” (2010) [3], the one I found during the double-check, but hell if I know what it actually discloses—using a search tree to implement a database? a specific database implementation? WTF? definitely not anything cache-oblivious specifically; (according to Google) owned by Tokutek and then Percona. [1] https://patents.google.com/patent/US8185551B2 https://patents.google.com/patent/US8185551B2 ; https://fees.uspto.gov/MaintenanceFees/fees/details?patentNumber=8,185,551&applicationNumber=11%2F760,379 https://fees.uspto.gov/MaintenanceFees/fees/details?patentNu... [2] https://patents.google.com/patent/US8489638B2 https://patents.google.com/patent/US8489638B2 ; https://fees.uspto.gov/MaintenanceFees/fees/details?patentNumber=8,489,638&applicationNumber=13%2F476,826 https://fees.uspto.gov/MaintenanceFees/fees/details?patentNu... [3] https://patents.google.com/patent/US8996563B2 https://patents.google.com/patent/US8996563B2 ; https://fees.uspto.gov/MaintenanceFees/fees/details?patentNumber=8,996,563&applicationNumber=12%2F755,391 https://fees.uspto.gov/MaintenanceFees/fees/details?patentNu...
hgs3 4y ago
The mistake being made is picking licenses that are too permissive. I have no idea why the dual licensing model is not more popular: use a strong copyleft license, like the AGPL, and sell closed-source business licenses. Source code hosting services, like GitHub, should offer payment processors for this purpose.
- mikymoothrowa 4y ago
  Companies wouldn’t touch a GPL let alone an AGPL with a 20ft pole. And if people can’t eventually use it for work, people don’t tend to use it at all these days. projects with no users fizzle out.
  - hgs3 4y ago
    > Companies wouldn’t touch a GPL let alone an AGPL with a 20ft pole. That's the point of dual licensing: companies will need to purchase a closed source license. > And if people can’t eventually use it for work, people don’t tend to use it at all these days. Lots of folks are late night hackers and Free Software enthusiast. They'll use it and pass the good word along to the Big Corp they work for. > projects with no users fizzle out. That's no different than proprietary software.
    - mikymoothrowa 4y ago
      Why would companies purchase a license for something that nobody in their team asked for? and why would people ask for something that haven’t used? and why would people use something that is AGPL and they can’t use it anyway? we would see a lot of AGPL projects out there if it worked the way you described
      - hgs3 4y ago
        Businesses seek out and use 3rd party software, whether it be proprietary or open source, because they have a need for it e.g. it solves a real world problem they have. The whole point of dual licensing is so businesses pay cash for a closed source license because they won't or can't abide by the GPL. The exchange of money for a closed-source software license is no different than the same business purchasing a license to proprietary software. At least with duel licensing they _could_ theoretically choose the copyleft license, but in practice they won't or can't.
PeterZaitsev 4y ago
Many commenters seems to state ah, if company makes $25M it can afford to pay. First, certain amount of revenue, even if it looks high for you, does not mean it is able to pay ANY amount vendor require. Paying Oracle $50.000 per CPU Core to run Oracle (for 100s of thousands of CPU cores) would be steep even for Facebook/Meta This idea what there are those large evil companies do not contributes to Open Source, and there are same large VC funded copyright holders are just struggling to survive is quite wrong - it is not that simple and it is Open Source which is one of the ways which create balance of power Second, it is not about money. Having any restriction on who can use it makes it impractical for using as component of other Open Source software, which Is where I think Open Source power really shines. Check out this article for example https://flink.apache.org/news/2022/09/08/akka-license-change.html https://flink.apache.org/news/2022/09/08/akka-license-change...

37 points by hodgesrm 4y ago

>Apache 2.0 >open source movement is not about making it easy for you to do business, it is about freedom for users of your software. Say what you will about RMS this is the exact kind of thing that the GPL is written for. "Open Source" exists to benefit business. "Free Software" exists to benefit users. On the flip side I think it's fair that if they have many of these large customers with more than $25 million in turn over not contributing that they do pay for the software development.

shapefrog 4y ago
> have many of these large customers with more than $25 million in turn over not contributing that they do pay for the software development If your net worth, inclusive of tech stock options is >$5mil you should have to pay to the developer for any open source software that you use, or is used in any of the products you use. (hint: its going to be expensive)
- PeterZaitsev 4y ago
  I think it is fantastic if people create proprietary software and make it available for free to everyone with net worth of $5M or less (or any criteria) just do not call it Open Source software.
hodgesrm 4y ago
> On the flip side I think it's fair that if they have many of these large customers with more than $25 million in turn over not contributing that they do pay for the software development. Do you mean for every single OSS project? Have a look at the dependency graph for a typical React project or anything built with Maven. Charging for this is unworkable. The collaborative work on which open source is based would collapse. Just as a concrete example, ClickHouse incorporates something like 97 other software packages in contrib ranging from NuRaft to zstd. ClickHouse in its current form is only possible if those packages remain free.
PeterZaitsev 4y ago
I think your definition here is Off. Both Apache 2.0 and GPL qualify both as "Open Source" and "Free Software" Yes of course many large companies do not contribute. If your goal is to FORCE to contribute customers to your liking this is what Proprietary license is for. Go proprietary and you can discriminate customers based on their ability to pay. Open Source though requires same access - rich and poor, good and evil and especially relinquishing control for you to decide which is which
- kdmccormick 4y ago
  You are saying these things as if they are fact. > Open Source though requires same access - rich and poor, good and evil and especially relinquishing control for you to decide which is which No it doesn't. If you believe the legal system, then you believe that we can make real rules about people's behavior, even in circumstances where we won't physically be the there to force that behavior. More concretely: We can certainly say "this code is freely available to read" without saying "you can do whatever you want with this code with no repercussions", even though technically anyone can download any open source code and use it to run a business on their servers. If you do doubt that this is possible to enforce, then consider music: I can listen to almost any piece of modern music on Spotify. That does not mean I can use any piece of modern music in a commercial royalty-free unless I'm interested in getting sued. The question is not whether we can enforce Copyleft/etc licenses. It's whether we have the will and money to do so.

josevalerio 4y ago

I think the BSL license is a good compromise for businesses looking to protect their IP, and after a year release everything under MIT or Apache. As long as they keep innovating, the latest and greatest will always come from the code authors themselves with a potential for dual licensing to enterprise to earn some revenue. That being said, I've personally chosen Apache2 for my projects. I feel that the growth and adoption from the community outweigh not having VCs crawling at my door, if you can afford this path. Curious what others have to say about other high profile switches from Mongo, Elastic, Sentry, etc.

kevincox 4y ago
The main missing component is security updates. Usually in this model there is no guarantee that the open-source "tip" is actually supported. Even if it wasn't supported releasing security patches under an open-source license would allow community back porting. Of course security patches are a big driver for businesses so this makes sense from the profit sense. However as an open source project I would be very hesitant to add this as a dependency because now I am forcing my user to enter a contract if they want security. I think this is the problem with non-free licenses in general. It makes it a much harder decision for other projects to build upon. Because now any user is required to become a customer of another business with pricing and licenses that I have no control over and can change at any time.
- detaro 4y ago
  Indeed, and even if a separate group decides to maintain a (potentially diverging) version based on the open-source versions, without a clear commitment from the BSL upstream every security patch puts them at risk of claims of license violations.
hodgesrm 4y ago
BSL is just another form of source code escrow. It's unusable for projects my company works on and uses, for two reasons. We need the freedom to use the software for any purpose. We also need some assurance that others will feel enough ownership to enable a sustainable community of contributors. Apache 2 is overall the best license to achieve that goal, though obviously others do the same. Edit: typo

jacobwg 4y ago

> [...] this rings to me as similar to an alleged quote about the Vietnam War: “We had to destroy the village in order to save it.” Comparing the licensing change to murder during the Vietnam War seems like an odd tone to take on an official company blog.

mikymoothrowa 4y ago
Over the last 10 years, did people decide to interpret everything in the most cancel-able form? No sane person before would have read this sentence and thought that the author was comparing licensing changes to murder
- jacobwg 4y ago
  Not really trying to cancel the author here, it's just an interesting comparison to make. It feels like either the author is trying to invoke the murder of villages during the Vietnam War as a way of lending weight to their argument about licensing changes, or they view the example of village destruction during the Vietnam War as something trivial enough to be in this post about licensing changes. Both of which feel odd. Whatever it is, it's the second sentence of the post and is literally written as a comparison to the license change statement from Lightbend, so it feels like the author intended it to be important.
  - mikymoothrowa 4y ago
    not just you, I’ve been seeing this a lot lately. somebody references a well known phrase or an idiom and then somebody comments “Sure go ahead and compare this with that!” I’m not sure why you feel the author is trying to use vietnam to lend weight to his argument. He’s merely pointing to the absurdity of the sentence. And likening that absurdity to that of Lightbends post
    - jacobwg 4y ago
      I can see that. For me, I’m not familiar with that phrase as an idiom, I’ve not encountered it before. It’s likely landing differently than for someone who experiences it as a common expression.

dessant 4y ago

What the article refers to as bait and switch is what open source maintainers call disillusionment, and the realization that nobody is there to prop them up and feed them while they work for the public good. You should not shame people who try to build something sustainable, but instead try to improve the system that makes altruistic work difficult.

kevincox 4y ago
Just because something has upsides doesn't mean it doesn't have downsides. While I am glad that this will likely provide more funding to these projects changing to a non-free license has incredible impact on how a project can be used. I think it is fair to talk about this and how it can maybe be done better.
- dessant 4y ago
  > I think it is fair to talk about this and how it can maybe be done better. I agree, though it's evident that the discussion is stained by the tone of this article. They aren't approaching this topic with some respect and understanding, while being fully aware that these license changes are aimed at large companies which keep taking, but do not support the open source community.
  - hodgesrm 4y ago
    Isn't it also the case that large companies are the reason projects like Linux have been so successful? Linux is an example. A very high percentage of Linux contributions are from corporate sponsors. [0] [0] https://thenewstack.io/contributes-linux-kernel/ https://thenewstack.io/contributes-linux-kernel/ (Kind of old but I don't think it has changed much.)
    - dessant 4y ago
      Some companies do support open source projects, though that has no relevance here. We're talking about large companies that generate a profit on the back of open source projects, and refuse to support those projects.

kosolam 4y ago

As a user of open source software I’m all in for the freedom it provides. But as a business owner I can’t have my software open source. So these things are not compatible. New, more sustainable models are needed in order to bridge the gap.

bheadmaster 4y ago
> But as a business owner I can’t have my software open source. May I ask for more details - in your particular case, how would having your software open source hurt your business? Just pure curiosity, nothing else.
- melagonster 4y ago
  they write software, and sold it. if source code is open source, they can't required people pay for it. I just guess.
  - kosolam 4y ago
    Yes. More or less this is the case.

mananaysiempre 4y ago

Percona hold software patents covering essentially all of Bender et al.’s cache-oblivious data structures via the Tokutek acquisition, don’t they? Nothing against this text in particular, but interacting with anything originating from there leaves a ... slimy feeling.

hodgesrm 4y ago
Many companies own patents for many different reasons. Has Percona ever actually asserted patent rights? I can't think of an instance where this is the case. They have also made major independent contributions like Percona XtraBackup, to name just one that many MySQL users know. Also, if we all avoided companies and products that have patents, wouldn't that rule out owning a mobile phone? Disclaimer: We're Percona partners and Peter Zaitsev is on our board. I endorse the view in his article without reservation as you can probably tell. ;)
PeterZaitsev 4y ago
No. (Percona CEO and article author here) - Percona does not own Fractal Trees patents. Patents belong to MIT and Tokutek licensed those patents from MIT, Percona took over this license.
- mananaysiempre 4y ago
  Thank you! I even remembered reading something to that effect in the original Tokutek PATENTS files, but went on Google Patents to double-check and (it seems) hit the wrong patent. For reference, those are: - “Disk-resident streaming dictionary” (2007) [1] seems to be the main one for both the COLA (if it is patentable at all—the base datastructure, fractional cascading, and deamortization were all in the literature a decade or more before, though impressively obscure from where I’m standing) and the CO B-tree; owned by MIT and (according to Google) exclusively licensed to Tokutek and afterwards Percona; - Same (2012) [2], a “continuation”(?), allowed to lapse and expired; - “High-performance streaming dictionary” (2010) [3], the one I found during the double-check, but hell if I know what it actually discloses—using a search tree to implement a database? a specific database implementation? WTF? definitely not anything cache-oblivious specifically; (according to Google) owned by Tokutek and then Percona. [1] https://patents.google.com/patent/US8185551B2 https://patents.google.com/patent/US8185551B2 ; https://fees.uspto.gov/MaintenanceFees/fees/details?patentNumber=8,185,551&applicationNumber=11%2F760,379 https://fees.uspto.gov/MaintenanceFees/fees/details?patentNu... [2] https://patents.google.com/patent/US8489638B2 https://patents.google.com/patent/US8489638B2 ; https://fees.uspto.gov/MaintenanceFees/fees/details?patentNumber=8,489,638&applicationNumber=13%2F476,826 https://fees.uspto.gov/MaintenanceFees/fees/details?patentNu... [3] https://patents.google.com/patent/US8996563B2 https://patents.google.com/patent/US8996563B2 ; https://fees.uspto.gov/MaintenanceFees/fees/details?patentNumber=8,996,563&applicationNumber=12%2F755,391 https://fees.uspto.gov/MaintenanceFees/fees/details?patentNu...

hgs3 4y ago

The mistake being made is picking licenses that are too permissive. I have no idea why the dual licensing model is not more popular: use a strong copyleft license, like the AGPL, and sell closed-source business licenses. Source code hosting services, like GitHub, should offer payment processors for this purpose.

mikymoothrowa 4y ago
Companies wouldn’t touch a GPL let alone an AGPL with a 20ft pole. And if people can’t eventually use it for work, people don’t tend to use it at all these days. projects with no users fizzle out.
- hgs3 4y ago
  > Companies wouldn’t touch a GPL let alone an AGPL with a 20ft pole. That's the point of dual licensing: companies will need to purchase a closed source license. > And if people can’t eventually use it for work, people don’t tend to use it at all these days. Lots of folks are late night hackers and Free Software enthusiast. They'll use it and pass the good word along to the Big Corp they work for. > projects with no users fizzle out. That's no different than proprietary software.
  - mikymoothrowa 4y ago
    Why would companies purchase a license for something that nobody in their team asked for? and why would people ask for something that haven’t used? and why would people use something that is AGPL and they can’t use it anyway? we would see a lot of AGPL projects out there if it worked the way you described
    - hgs3 4y ago
      Businesses seek out and use 3rd party software, whether it be proprietary or open source, because they have a need for it e.g. it solves a real world problem they have. The whole point of dual licensing is so businesses pay cash for a closed source license because they won't or can't abide by the GPL. The exchange of money for a closed-source software license is no different than the same business purchasing a license to proprietary software. At least with duel licensing they _could_ theoretically choose the copyleft license, but in practice they won't or can't.

PeterZaitsev 4y ago

Many commenters seems to state ah, if company makes $25M it can afford to pay. First, certain amount of revenue, even if it looks high for you, does not mean it is able to pay ANY amount vendor require. Paying Oracle $50.000 per CPU Core to run Oracle (for 100s of thousands of CPU cores) would be steep even for Facebook/Meta This idea what there are those large evil companies do not contributes to Open Source, and there are same large VC funded copyright holders are just struggling to survive is quite wrong - it is not that simple and it is Open Source which is one of the ways which create balance of power Second, it is not about money. Having any restriction on who can use it makes it impractical for using as component of other Open Source software, which Is where I think Open Source power really shines. Check out this article for example https://flink.apache.org/news/2022/09/08/akka-license-change.html https://flink.apache.org/news/2022/09/08/akka-license-change...