8 ms·

WEKA Responds to Allegations Made by MinIO Regarding OSS Licensing

97 points by dagmx 4y ago

yencabulator 4y ago
What's a good simple open source S3-style object store to use? Does one even exist? Do we need to start a project to (re-)write one in Rust? - MinIO: more trouble than it's worth, as demonstrated here - Radosgw of Ceph: not really suitable for a single server install - Garage (https://garagehq.deuxfleurs.fr/ https://garagehq.deuxfleurs.fr/): Their writing about the distributed design didn't convince me in 2022. - https://lakefs.io/ https://lakefs.io/ Haven't studied
sokoloff 4y ago
Having read the minIO allegations last week, I was fully expecting to read some weasel-y/half refutation here. Instead, this is a strong refutation and, if everything WEKA says here is true, it is much less certain that they've done anything wrong and it seems like it's on minIO to prove that they've used minIO software subject to AGPL rather than only to Apache. Previous HN discussion: https://news.ycombinator.com/item?id=35299665 https://news.ycombinator.com/item?id=35299665
- xoa 4y ago
  Not a lawyer and this is an area where I genuinely just don't know, so I'd love to find a place that's explored this and could read more. But WEKA's statement #2 about the irrevocability struck me as odd in its expansiveness. My understand was that "irrevocable" essentially is about arbitrariness and time, that so long as the licensee follows the governing license as written then it continues indefinitely and the licensor may not ever simply decide to revoke it. But if the license terms were broken, then could the copyright holder then say the contract was broken? I didn't think "irrevocable" meant "every other aspect of this contract doesn't matter beyond damages because even if you blow off them all it can't be revoked anyway". Like if I signed a copyright license saying "in exchange for $50/year paid on Jan 1 each year for a period of 10 years I grant a perpetual, worldwide, non-exclusive, irrevocable copyright license to said work" and then they just stop paying after the first year does that mean the license is still irrevocable, but I can sue them for damages? Or is the contract done due to non-performance? Or would that depend on other clauses? What if the value exchange is more of a quid pro quo thing, does that became a rare instance where suit for specific performance would be an option, or would the court translate it to money? Just really curious, I've seen that term language lots and never really gave it much thought until now. Surely this must have been fought over before. But I'd have expected a lawyer drafted response by WEKA to cite case law and any governing state/national law. Just saying "see the contract says irrevocable so that's that duh!" feels kinda odd. -- Edit: Also to be clear, this is all purely dependent on any license terms actually having been broken. If none were then yes that'd be that. It just seemed like WEKA was making an argument that MinIO couldn't revoke no matter what.
  - roundandround 4y ago
    I would interpret the Apache Licenses terms on breaking the license to apply to patents and there it is pretty clear that the party who starts litigation loses their own license. I don't think any open source license writer would intentionally want the situation where a middle-man causes a license to never be valid, and in this case it makes no sense as attribution is meant to be optional information.
  - _cenw 4y ago
    I think the overarching point is that MinIO doesn't understand their own license. MinIO can't retaliate at will, except by suing. It also shows that - as it has been since the inception of the AGPL - nobody knows what the actual obligations are. MinIO seems to believe that interaction with MinIO, including calling the API, makes your code subject to the AGPL too. They say as much on their compliance page.[1] This is the opposite view of someone like MongoDB, who used to have their software AGPL licensed, but explicitly made their clients permissively licensed, because their expectation from the AGPL was that it is not infectious across process boundaries. MinIO has taken this to other extremes, including believing that your config file for MinIO is subject to AGPL. Even if you assume that an implicit dependence on an API is making the calling code AGPL, MinIO has the least strong claim for their service being infectious, because their API is mostly a reimplementation of S3. This is like the "are Java APIs copyrightable" case all over again, except the people who are threatening legal action didn't even invent the API. [1]: https://min.io/compliance https://min.io/compliance "When MinIO is linked to a larger software stack in any form, including statically, dynamically, pipes, or containerized and invoked remotely, the AGPL v3 applies to your use. What triggers the AGPL v3 obligations is the exchanging data between the larger stack and MinIO."
    - sidewndr46 4y ago
      I read through this as well & it is a joke. Under their interpretation if I run MinIO in the Linux subsystem that is part of Windows, I'd need to open source that. Their interpretation is so extreme that using a browser would require me to open source the browser. If I used a shell script to test if the service is running, I'd need to make that open source too. There is also this: "Passing configuration parameters to a MinIO binary instance constitutes making a modified version, as it does not produce an exact binary copy." How do they know it doesn't produce an exact binary copy? Maybe my x86 computer is quantum based. I'm pretty sure if I compiled MinIO with a proprietary Golang implementation, MinIO would want me to open source the compiler. They also include their trademarked logo in the git repo., then try and tack on a supplemental policy about that later. Which you can't do, because the AGPL grants you a license to the logo.
- jzb 4y ago
  If you read the minio blog, they give very detailed instructions on how to check that they are using the software. It shouldn’t be super difficult to figure out if any of the software being distributed today is post license switch. So what we have here is a very detailed description of what they are claiming is a violation, then a refutation that is very strong, but also doesn’t actually address some of the claims in the other blog, as far as I can tell. There is a blog from minio that says they switched to AGPLv3 in 2021. It’s unclear to me from the screenshots whether the software is later than that or not. I hope someone takes the time to do an independent analysis, and a more neutral take. Note that Weka redacted the language from the Apache license that says “subject to the terms and conditions,” which (not a lawyer) seems to allow a copyright holder to deny permission if they’re not meeting the conditions of the license. Whether they are or not is another question.
  - arp242 4y ago
    > they give very detailed instructions on how to check that they are using the software It's not that detailed; it just says "there is a minio binary, and that's our minio". Okay, but what version is that? This is the crucial part, because Apache vs AGPL license makes a world of difference. The Apache attribution requirement seems satisfied; perhaps not as prominently as minio would like, but there is no "prominence requirement". It fails to demonstrate any AGPL code is used, although according to some other comments the monio people have a unique and interesting interpretation of relicensing where they think they can retroactively relicense Apache code to AGPL. The claim that backporting any security fixes would trigger the AGPL is also suspect; typically many security fixes are simple in terms of code changed, and tend to be fairly easy to re-implement independently once you know the description of the problem. Either way, "it's likely that [..]" doesn't really demonstrate much of anything and is certainly not "very detailed". In short, the minio post is vague and full of assumptions; even without this rebuttal I wouldn't put too much stock in it as it seems borderline FUD.
Takennickname 4y ago
I just want to know if MinIO contact Weka before this fall out or not. If not, then MinIO comes off as a bunch of psychos. If so, then grab your popcorn.
- chatmasta 4y ago
  According to the article, they did not: > At the end of the business day on Friday, March 24th – without warning, provocation, or even providing WEKA with an opportunity to review and respond to their claims – MinIO issued a public statement that made several false and baseless accusations against WEKA. It was the first time MinIO had made us aware of their concerns.
- remram 4y ago
  It seems they might be psychos, they are misrepresenting what AGPL allows all over their issue tracker, for example this: https://github.com/minio/minio/issues/12829#issuecomment-889588802 https://github.com/minio/minio/issues/12829#issuecomment-889... > Also NOTE: I need to remind you are under AGPLv3 violation here if you are using MinIO with proprietary purposes. Please consult a software lawyer for more information. Or this: https://github.com/minio/minio/issues/13308#issuecomment-929254690 https://github.com/minio/minio/issues/13308#issuecomment-929... > Also, just want to mention that the AGPL license requires that all software connecting with MinIO be 100% open source for you/your users not to be in violation of the license. All that AGPL actually requires is that you share the source of your server, if you modify it.
  - favsq 4y ago
    lol @ that second link. What a bunch of crooks.
  - donmcronald 4y ago
    > Also, just want to mention that the AGPL license requires that all software connecting with MinIO be 100% open source for you/your users not to be in violation of the license. So they would consider my Arq backups to MinIO a license violation? What if I access the GUI from a Windows PC? What about a Linux PC with a proprietary GPU driver?
meepmorp 4y ago
Interesting - is this a name collision with Weka (https://www.cs.waikato.ac.nz/ml/weka/ https://www.cs.waikato.ac.nz/ml/weka/) or a commercialization of the project? I assume the former.
- sudosysgen 4y ago
  It is a name collision.
nikeee 4y ago
Didn't know that MinIO used to be Apache licensed. This [0] is the commit that changed it. Since the S3 API largely remained the same over the last two years, it might be an option to use the Apache version, if AGPL is not possible. Of course, that would lack security fixes that were done in the meantime. There is also a discussion [1] about that license change. [0]: https://github.com/minio/minio/commit/069432566fcfac1f1053677cc925ddafd750730a https://github.com/minio/minio/commit/069432566fcfac1f105367... [1]: https://github.com/minio/minio/issues/12143 https://github.com/minio/minio/issues/12143
- phoronixrly 4y ago
  I hope more people start using AGPL from the get-go for their projects.
  - wmf 4y ago
    Companies are using AGPL not to benefit users or the community but to extort users and competitors into paying them. It's becoming fake open source.
    - phoronixrly 4y ago
      Links please, also it's literally FSF and OSI approved, how come you call it fake open source?
      - dilyevsky 4y ago
        https://github.com/minio/minio/discussions/13571#discussioncomment-1583482 https://github.com/minio/minio/discussions/13571#discussionc... https://github.com/minio/minio/issues/13308#issuecomment-929254690 https://github.com/minio/minio/issues/13308#issuecomment-929... Lets just say they have a weird take on what constitutes agpl-compliant
        phoronixrly 4y ago
        Seems like people misunderstanding the AGPL. (btw, I don't think this makes it fake open-source!)
candiddevmike 4y ago
There needs to be a phrase like "play open source games, win open source prizes" for companies that get all upset when someone else monetizes their product.
- jzb 4y ago
  I think it depends a lot on whether they’re upset because they failed to license the software in a way that would prevent behavior they don’t like, or because someone doesn’t seem to be complying with the license in the first place. If you chose a permissive license and then are shocked when people actually take advantage of that, you kind of deserve what you get. If you chose a reciprocal license and someone just ignores it, then I think you still have a license to complain. Pun kind of intended.
  - candiddevmike 4y ago
    I personally don't care for any open source sob stories by companies that use open source as a growth strategy. When you open source something, you will need pay the legal costs to enforce your license, the license doesn't enforce itself. It will most likely be a long drawn out process and will be a drain on your resources, especially technical ones. Don't complain when this happens, nobody forced you to open source your stuff to begin with.
    - kadoban 4y ago
      Is anyone complaining? Seems like they're just doing what you suggest, enforcing the license. (ignoring that they may be wrong about the breaches of the license, I'm sure the lawyers will work that out)
    - jzb 4y ago
      This is a curious attitude. No, the license doesn’t enforce itself. But usually when someone violates copyright companies tend to complain about it. Often that complaint is accompanied by a lawsuit, but I’ve heard a lot of complaints out of the entertainment industry the past 20 some years about copyright infringement, and I haven’t heard anybody talking about not complaining because they released things and should just assume somebody is going to infringe. Nobody forces me to choose an open source license. Nobody forces me to use code that is open sourced either. So it’s a curious attitude to take issue with a company that providing software under an open source license as a bad guy for complaining when people don’t follow their license but not the entity that is violating the license that gives them the right to use software in the first place.
deleted 4y ago
[deleted]
hiddendoom45 4y ago
It does appear that their minio instance is the apache version. From the minio allegations the ui in the screenshots matches the pre-AGPL instance that I've kept around which was really just a simple bucket/files manager. I think all post-AGPL versions should be using the new ui announced here[1] in April 2021. The AGPL change was announced 12 May 2021[2]. The newer date in the out of date message could be due to them re-compiling the Apache version themselves. However looking at the warp version in the screenshot, version 3.40 is licensed under AGPL. [1] https://blog.min.io/new-minio-console/ https://blog.min.io/new-minio-console/ [2] https://blog.min.io/from-open-source-to-free-and-open-source-minio-is-now-fully-licensed-under-gnu-agplv3/ https://blog.min.io/from-open-source-to-free-and-open-source...
- 1980phipsi 4y ago
  Yeah, I noticed that about warp too.
kapitanjakc 4y ago
From my perspective, only lawyers will get the benefits. Neither Weka nor MinIO and definitely not the community. The way MinIO accusation was worded, felt like this a reaction to someone saying "Boss, they've ripped us off and are earning from it and not attributing us, here's the proof, revoke their licence." And the way this response is worded, feels like, "Check everything if we're using their stuff, get a lawyer to draft a response, and tell them, this is not the way to handle it." I hope both parties resolves it soon.
- deleted 4y ago
  [deleted]
endigma 4y ago
I recall minio previously playing fast and loose with the terms of their prized infectious foss license, a github issue perhaps? I recall they believed that interfacing with their AGPL minio through a standard s3 interface with no source changes mandated open sourcing of the client application.
- xet7 4y ago
  Maybe these? https://github.com/minio/minio/discussions/12895 https://github.com/minio/minio/discussions/12895 https://min.io/compliance https://min.io/compliance Trying to read and understand.
  - dilyevsky 4y ago
    Basically they claim that even calling it from proprietary stack over s3 api triggers apgl obligations which most lawyers don’t believe is true but never been tested in court afaik. I wouldn’t recommend touching it for anything unless you want to play those games (or unless you want to pay for enterprise ofc =)) It’s fake open source.
- dilyevsky 4y ago
  Yup https://github.com/minio/minio/discussions/13571#discussioncomment-1583482 https://github.com/minio/minio/discussions/13571#discussionc... https://github.com/minio/minio/issues/13308#issuecomment-929254690 https://github.com/minio/minio/issues/13308#issuecomment-929...
- lyu07282 4y ago
  They have a unique interpretation of AGPL, they also seem to think they can retroactively change the license from Apache 2 to AGPL on their old code. So even if WEKA forked the older version of MinIO when it still was Apache they would still violate the license. Which means anyone using MinIO without a commercial license needs to open source their entire application regardless if MinIO itself was modified or not. Well according to MinIO anyway. This eventually surely lead to a lawsuit where this is tested, but in the meantime I would avoid MinIO at all cost. The commercial license to self host it is minimum $1000 per month for 100TB. > If you distribute, host or create derivative works of the MinIO software over the network, the GNU AGPL v3 license requires that you also distribute the complete, corresponding source code of the combined work under the same GNU AGPL v3 license. This requirement applies whether or not you modified MinIO. https://min.io/pricing https://min.io/pricing
lapinot 4y ago
So they are using an outdated version because they wanted to stay with permissive licensing.. Kinda fun to see the reverse of what usually happens to a community when a company-led project goes closed source. Definitely got no empathy for weka in this case tho. Also kinda fun that minio noticed they used an old version but forgot that they used permissive licensing at that time.
- sokoloff 4y ago
  My experience is that it's often hard for companies (and people) to remember facts that are inconvenient for them. If WEKA is using Apache-licensed software in compliance with the Apache license (as they claim) and is being accused of doing something else by a company with, let's just say, non-mainstream interpretations of license terms, I do have empathy and sympathy for them. (They claim that's what's happening. MinIO claims something else. Several of these claims are pretty much testable facts and I'm sure someone with time and motivation will test them.)
lyu07282 4y ago
Relevant: https://news.ycombinator.com/item?id=35329882 https://news.ycombinator.com/item?id=35329882
tobias3 4y ago
MinIO had a large investment round at unicorn valuation at the end of last year. Watch them desparately move up market (or more like flailing around) to recoup that investment. Meanwhile they cannot get their software to work on ext4 and it is apparently ext4s fault[0]. [0] https://github.com/minio/minio/issues/16602#issuecomment-1427509203 https://github.com/minio/minio/issues/16602#issuecomment-142...
- dekhn 4y ago
  You're misinterpreting the bug, the software works but could lose data. However, the person who wrote the update about O_DIRECT and ext4 in production environments is just wrong.
  - singron 4y ago
    If it loses data, does it work?
    - dekhn 4y ago
      I mean, losing data is an extremely complex problem. What I'll say is that I've run large production systems with heavy load on ext2 and ext4 and did not find that it "lost data" more frequently than xfs, and in fact performed fine. What's really important here is the person who closed the bug did some summarily, with little to no explanation, other than a reference to O_DIRECT not being supported in ext4, and therefore it "loses data" in production. This is an unprofessional comment to close a bug and I'd expect one of the co-founders of MinIO to do a better job. See https://ext4.wiki.kernel.org/index.php/Clarifying_Direct_IO%27s_Semantics https://ext4.wiki.kernel.org/index.php/Clarifying_Direct_IO%... for a discussion of the subletly of O_DIRECT. It's also not really required to make a production filesystem reliable, and would only be a tiny part of an overall reliability solution (because drives themselves often buffer and reorder their writes, sometimes even lying about whether data was "commited durably to disk")

97 points by dagmx 4y ago

What's a good simple open source S3-style object store to use? Does one even exist? Do we need to start a project to (re-)write one in Rust? - MinIO: more trouble than it's worth, as demonstrated here - Radosgw of Ceph: not really suitable for a single server install - Garage (https://garagehq.deuxfleurs.fr/ https://garagehq.deuxfleurs.fr/): Their writing about the distributed design didn't convince me in 2022. - https://lakefs.io/ https://lakefs.io/ Haven't studied

sokoloff 4y ago

Having read the minIO allegations last week, I was fully expecting to read some weasel-y/half refutation here. Instead, this is a strong refutation and, if everything WEKA says here is true, it is much less certain that they've done anything wrong and it seems like it's on minIO to prove that they've used minIO software subject to AGPL rather than only to Apache. Previous HN discussion: https://news.ycombinator.com/item?id=35299665 https://news.ycombinator.com/item?id=35299665

xoa 4y ago
Not a lawyer and this is an area where I genuinely just don't know, so I'd love to find a place that's explored this and could read more. But WEKA's statement #2 about the irrevocability struck me as odd in its expansiveness. My understand was that "irrevocable" essentially is about arbitrariness and time, that so long as the licensee follows the governing license as written then it continues indefinitely and the licensor may not ever simply decide to revoke it. But if the license terms were broken, then could the copyright holder then say the contract was broken? I didn't think "irrevocable" meant "every other aspect of this contract doesn't matter beyond damages because even if you blow off them all it can't be revoked anyway". Like if I signed a copyright license saying "in exchange for $50/year paid on Jan 1 each year for a period of 10 years I grant a perpetual, worldwide, non-exclusive, irrevocable copyright license to said work" and then they just stop paying after the first year does that mean the license is still irrevocable, but I can sue them for damages? Or is the contract done due to non-performance? Or would that depend on other clauses? What if the value exchange is more of a quid pro quo thing, does that became a rare instance where suit for specific performance would be an option, or would the court translate it to money? Just really curious, I've seen that term language lots and never really gave it much thought until now. Surely this must have been fought over before. But I'd have expected a lawyer drafted response by WEKA to cite case law and any governing state/national law. Just saying "see the contract says irrevocable so that's that duh!" feels kinda odd. -- Edit: Also to be clear, this is all purely dependent on any license terms actually having been broken. If none were then yes that'd be that. It just seemed like WEKA was making an argument that MinIO couldn't revoke no matter what.
- roundandround 4y ago
  I would interpret the Apache Licenses terms on breaking the license to apply to patents and there it is pretty clear that the party who starts litigation loses their own license. I don't think any open source license writer would intentionally want the situation where a middle-man causes a license to never be valid, and in this case it makes no sense as attribution is meant to be optional information.
- _cenw 4y ago
  I think the overarching point is that MinIO doesn't understand their own license. MinIO can't retaliate at will, except by suing. It also shows that - as it has been since the inception of the AGPL - nobody knows what the actual obligations are. MinIO seems to believe that interaction with MinIO, including calling the API, makes your code subject to the AGPL too. They say as much on their compliance page.[1] This is the opposite view of someone like MongoDB, who used to have their software AGPL licensed, but explicitly made their clients permissively licensed, because their expectation from the AGPL was that it is not infectious across process boundaries. MinIO has taken this to other extremes, including believing that your config file for MinIO is subject to AGPL. Even if you assume that an implicit dependence on an API is making the calling code AGPL, MinIO has the least strong claim for their service being infectious, because their API is mostly a reimplementation of S3. This is like the "are Java APIs copyrightable" case all over again, except the people who are threatening legal action didn't even invent the API. [1]: https://min.io/compliance https://min.io/compliance "When MinIO is linked to a larger software stack in any form, including statically, dynamically, pipes, or containerized and invoked remotely, the AGPL v3 applies to your use. What triggers the AGPL v3 obligations is the exchanging data between the larger stack and MinIO."
  - sidewndr46 4y ago
    I read through this as well & it is a joke. Under their interpretation if I run MinIO in the Linux subsystem that is part of Windows, I'd need to open source that. Their interpretation is so extreme that using a browser would require me to open source the browser. If I used a shell script to test if the service is running, I'd need to make that open source too. There is also this: "Passing configuration parameters to a MinIO binary instance constitutes making a modified version, as it does not produce an exact binary copy." How do they know it doesn't produce an exact binary copy? Maybe my x86 computer is quantum based. I'm pretty sure if I compiled MinIO with a proprietary Golang implementation, MinIO would want me to open source the compiler. They also include their trademarked logo in the git repo., then try and tack on a supplemental policy about that later. Which you can't do, because the AGPL grants you a license to the logo.
jzb 4y ago
If you read the minio blog, they give very detailed instructions on how to check that they are using the software. It shouldn’t be super difficult to figure out if any of the software being distributed today is post license switch. So what we have here is a very detailed description of what they are claiming is a violation, then a refutation that is very strong, but also doesn’t actually address some of the claims in the other blog, as far as I can tell. There is a blog from minio that says they switched to AGPLv3 in 2021. It’s unclear to me from the screenshots whether the software is later than that or not. I hope someone takes the time to do an independent analysis, and a more neutral take. Note that Weka redacted the language from the Apache license that says “subject to the terms and conditions,” which (not a lawyer) seems to allow a copyright holder to deny permission if they’re not meeting the conditions of the license. Whether they are or not is another question.
- arp242 4y ago
  > they give very detailed instructions on how to check that they are using the software It's not that detailed; it just says "there is a minio binary, and that's our minio". Okay, but what version is that? This is the crucial part, because Apache vs AGPL license makes a world of difference. The Apache attribution requirement seems satisfied; perhaps not as prominently as minio would like, but there is no "prominence requirement". It fails to demonstrate any AGPL code is used, although according to some other comments the monio people have a unique and interesting interpretation of relicensing where they think they can retroactively relicense Apache code to AGPL. The claim that backporting any security fixes would trigger the AGPL is also suspect; typically many security fixes are simple in terms of code changed, and tend to be fairly easy to re-implement independently once you know the description of the problem. Either way, "it's likely that [..]" doesn't really demonstrate much of anything and is certainly not "very detailed". In short, the minio post is vague and full of assumptions; even without this rebuttal I wouldn't put too much stock in it as it seems borderline FUD.

Takennickname 4y ago

I just want to know if MinIO contact Weka before this fall out or not. If not, then MinIO comes off as a bunch of psychos. If so, then grab your popcorn.

chatmasta 4y ago
According to the article, they did not: > At the end of the business day on Friday, March 24th – without warning, provocation, or even providing WEKA with an opportunity to review and respond to their claims – MinIO issued a public statement that made several false and baseless accusations against WEKA. It was the first time MinIO had made us aware of their concerns.
remram 4y ago
It seems they might be psychos, they are misrepresenting what AGPL allows all over their issue tracker, for example this: https://github.com/minio/minio/issues/12829#issuecomment-889588802 https://github.com/minio/minio/issues/12829#issuecomment-889... > Also NOTE: I need to remind you are under AGPLv3 violation here if you are using MinIO with proprietary purposes. Please consult a software lawyer for more information. Or this: https://github.com/minio/minio/issues/13308#issuecomment-929254690 https://github.com/minio/minio/issues/13308#issuecomment-929... > Also, just want to mention that the AGPL license requires that all software connecting with MinIO be 100% open source for you/your users not to be in violation of the license. All that AGPL actually requires is that you share the source of your server, if you modify it.
- favsq 4y ago
  lol @ that second link. What a bunch of crooks.
- donmcronald 4y ago
  > Also, just want to mention that the AGPL license requires that all software connecting with MinIO be 100% open source for you/your users not to be in violation of the license. So they would consider my Arq backups to MinIO a license violation? What if I access the GUI from a Windows PC? What about a Linux PC with a proprietary GPU driver?

meepmorp 4y ago

Interesting - is this a name collision with Weka (https://www.cs.waikato.ac.nz/ml/weka/ https://www.cs.waikato.ac.nz/ml/weka/) or a commercialization of the project? I assume the former.

sudosysgen 4y ago
It is a name collision.

nikeee 4y ago

Didn't know that MinIO used to be Apache licensed. This [0] is the commit that changed it. Since the S3 API largely remained the same over the last two years, it might be an option to use the Apache version, if AGPL is not possible. Of course, that would lack security fixes that were done in the meantime. There is also a discussion [1] about that license change. [0]: https://github.com/minio/minio/commit/069432566fcfac1f1053677cc925ddafd750730a https://github.com/minio/minio/commit/069432566fcfac1f105367... [1]: https://github.com/minio/minio/issues/12143 https://github.com/minio/minio/issues/12143

phoronixrly 4y ago
I hope more people start using AGPL from the get-go for their projects.
- wmf 4y ago
  Companies are using AGPL not to benefit users or the community but to extort users and competitors into paying them. It's becoming fake open source.
  - phoronixrly 4y ago
    Links please, also it's literally FSF and OSI approved, how come you call it fake open source?
    - dilyevsky 4y ago
      https://github.com/minio/minio/discussions/13571#discussioncomment-1583482 https://github.com/minio/minio/discussions/13571#discussionc... https://github.com/minio/minio/issues/13308#issuecomment-929254690 https://github.com/minio/minio/issues/13308#issuecomment-929... Lets just say they have a weird take on what constitutes agpl-compliant
      - phoronixrly 4y ago
        Seems like people misunderstanding the AGPL. (btw, I don't think this makes it fake open-source!)

candiddevmike 4y ago

There needs to be a phrase like "play open source games, win open source prizes" for companies that get all upset when someone else monetizes their product.

jzb 4y ago
I think it depends a lot on whether they’re upset because they failed to license the software in a way that would prevent behavior they don’t like, or because someone doesn’t seem to be complying with the license in the first place. If you chose a permissive license and then are shocked when people actually take advantage of that, you kind of deserve what you get. If you chose a reciprocal license and someone just ignores it, then I think you still have a license to complain. Pun kind of intended.
- candiddevmike 4y ago
  I personally don't care for any open source sob stories by companies that use open source as a growth strategy. When you open source something, you will need pay the legal costs to enforce your license, the license doesn't enforce itself. It will most likely be a long drawn out process and will be a drain on your resources, especially technical ones. Don't complain when this happens, nobody forced you to open source your stuff to begin with.
  - kadoban 4y ago
    Is anyone complaining? Seems like they're just doing what you suggest, enforcing the license. (ignoring that they may be wrong about the breaches of the license, I'm sure the lawyers will work that out)
  - jzb 4y ago
    This is a curious attitude. No, the license doesn’t enforce itself. But usually when someone violates copyright companies tend to complain about it. Often that complaint is accompanied by a lawsuit, but I’ve heard a lot of complaints out of the entertainment industry the past 20 some years about copyright infringement, and I haven’t heard anybody talking about not complaining because they released things and should just assume somebody is going to infringe. Nobody forces me to choose an open source license. Nobody forces me to use code that is open sourced either. So it’s a curious attitude to take issue with a company that providing software under an open source license as a bad guy for complaining when people don’t follow their license but not the entity that is violating the license that gives them the right to use software in the first place.

deleted 4y ago

[deleted]

hiddendoom45 4y ago

It does appear that their minio instance is the apache version. From the minio allegations the ui in the screenshots matches the pre-AGPL instance that I've kept around which was really just a simple bucket/files manager. I think all post-AGPL versions should be using the new ui announced here[1] in April 2021. The AGPL change was announced 12 May 2021[2]. The newer date in the out of date message could be due to them re-compiling the Apache version themselves. However looking at the warp version in the screenshot, version 3.40 is licensed under AGPL. [1] https://blog.min.io/new-minio-console/ https://blog.min.io/new-minio-console/ [2] https://blog.min.io/from-open-source-to-free-and-open-source-minio-is-now-fully-licensed-under-gnu-agplv3/ https://blog.min.io/from-open-source-to-free-and-open-source...

1980phipsi 4y ago
Yeah, I noticed that about warp too.

kapitanjakc 4y ago

From my perspective, only lawyers will get the benefits. Neither Weka nor MinIO and definitely not the community. The way MinIO accusation was worded, felt like this a reaction to someone saying "Boss, they've ripped us off and are earning from it and not attributing us, here's the proof, revoke their licence." And the way this response is worded, feels like, "Check everything if we're using their stuff, get a lawyer to draft a response, and tell them, this is not the way to handle it." I hope both parties resolves it soon.

deleted 4y ago
[deleted]

endigma 4y ago

I recall minio previously playing fast and loose with the terms of their prized infectious foss license, a github issue perhaps? I recall they believed that interfacing with their AGPL minio through a standard s3 interface with no source changes mandated open sourcing of the client application.

xet7 4y ago
Maybe these? https://github.com/minio/minio/discussions/12895 https://github.com/minio/minio/discussions/12895 https://min.io/compliance https://min.io/compliance Trying to read and understand.
- dilyevsky 4y ago
  Basically they claim that even calling it from proprietary stack over s3 api triggers apgl obligations which most lawyers don’t believe is true but never been tested in court afaik. I wouldn’t recommend touching it for anything unless you want to play those games (or unless you want to pay for enterprise ofc =)) It’s fake open source.
dilyevsky 4y ago
Yup https://github.com/minio/minio/discussions/13571#discussioncomment-1583482 https://github.com/minio/minio/discussions/13571#discussionc... https://github.com/minio/minio/issues/13308#issuecomment-929254690 https://github.com/minio/minio/issues/13308#issuecomment-929...
lyu07282 4y ago
They have a unique interpretation of AGPL, they also seem to think they can retroactively change the license from Apache 2 to AGPL on their old code. So even if WEKA forked the older version of MinIO when it still was Apache they would still violate the license. Which means anyone using MinIO without a commercial license needs to open source their entire application regardless if MinIO itself was modified or not. Well according to MinIO anyway. This eventually surely lead to a lawsuit where this is tested, but in the meantime I would avoid MinIO at all cost. The commercial license to self host it is minimum $1000 per month for 100TB. > If you distribute, host or create derivative works of the MinIO software over the network, the GNU AGPL v3 license requires that you also distribute the complete, corresponding source code of the combined work under the same GNU AGPL v3 license. This requirement applies whether or not you modified MinIO. https://min.io/pricing https://min.io/pricing

lapinot 4y ago

So they are using an outdated version because they wanted to stay with permissive licensing.. Kinda fun to see the reverse of what usually happens to a community when a company-led project goes closed source. Definitely got no empathy for weka in this case tho. Also kinda fun that minio noticed they used an old version but forgot that they used permissive licensing at that time.

sokoloff 4y ago
My experience is that it's often hard for companies (and people) to remember facts that are inconvenient for them. If WEKA is using Apache-licensed software in compliance with the Apache license (as they claim) and is being accused of doing something else by a company with, let's just say, non-mainstream interpretations of license terms, I do have empathy and sympathy for them. (They claim that's what's happening. MinIO claims something else. Several of these claims are pretty much testable facts and I'm sure someone with time and motivation will test them.)

lyu07282 4y ago

Relevant: https://news.ycombinator.com/item?id=35329882 https://news.ycombinator.com/item?id=35329882

tobias3 4y ago

MinIO had a large investment round at unicorn valuation at the end of last year. Watch them desparately move up market (or more like flailing around) to recoup that investment. Meanwhile they cannot get their software to work on ext4 and it is apparently ext4s fault[0]. [0] https://github.com/minio/minio/issues/16602#issuecomment-1427509203 https://github.com/minio/minio/issues/16602#issuecomment-142...

dekhn 4y ago
You're misinterpreting the bug, the software works but could lose data. However, the person who wrote the update about O_DIRECT and ext4 in production environments is just wrong.
- singron 4y ago
  If it loses data, does it work?
  - dekhn 4y ago
    I mean, losing data is an extremely complex problem. What I'll say is that I've run large production systems with heavy load on ext2 and ext4 and did not find that it "lost data" more frequently than xfs, and in fact performed fine. What's really important here is the person who closed the bug did some summarily, with little to no explanation, other than a reference to O_DIRECT not being supported in ext4, and therefore it "loses data" in production. This is an unprofessional comment to close a bug and I'd expect one of the co-founders of MinIO to do a better job. See https://ext4.wiki.kernel.org/index.php/Clarifying_Direct_IO%27s_Semantics https://ext4.wiki.kernel.org/index.php/Clarifying_Direct_IO%... for a discussion of the subletly of O_DIRECT. It's also not really required to make a production filesystem reliable, and would only be a tiny part of an overall reliability solution (because drives themselves often buffer and reorder their writes, sometimes even lying about whether data was "commited durably to disk")