6 ms·

I was wrong about Red Hat's EULA and its enforceability

71 points by matricaria 3y ago

InvaderFizz 3y ago
I'm personally happy about this whole situation. Not because I agree with RH at all, but because it will accelerate the decline of RHEL and the entire EL ecosystem and mean I have to support those distros less in the future. (In a DevOps capacity, I'm not a contributor.) There is a lot of back and forth as to why RedHat is employing this footgun now. It comes down to them feeling, in part, that they are footing the development labor bill while rebuilders (Oracle Linux, Rocky Linux, Alma Linux) reap the rewards and undercut them on support contracts. The other part is enterprises and SMB running thousands of CentOS/non-subscription EL variants and having a token number of RHEL subscriptions to use for support any time they get into trouble. The real solution to the second problem is to explicitly forbid it within the RHEL support contracts and enforce that. You are either a RHEL shop or you are not. Make it a binary decision. This weird tactic of trying to kill off the customer alternatives is going to just kill off the EL ecosystem in the end. I know I abandoned the EL ecosystem entirely when CentOS Stream became the thing.
- op00to 3y ago
  The second is not a concern at all. If there is an odor of subscription abuse worth investigating, Red Hat’s Subscription Enforcment team will audit your systems. By signing the enterprise agreement you give them permission to do so whenever they want.
- raincom 3y ago
  Redhat should have stopped rebuilders seven years ago, when many large enterprises signed up site-wide contracts with Oracle. Maybe, they want to keep the EL ecosystem grow, then cut it off.
- emptysongglass 3y ago
  I think Red Hat was fully in the right and that the internet drama around their decision reeks of privilege. If you want the sources, go get them, they're in Stream but Red Hat won't be gift wrapping it for shops competing to offer support. They've been, and continue to be, fantastic stewards of the Linux ecosystem. I use many of their inventions today on my Linux workstation and my experience would be decidedly worse without. I am grateful for their continued pledge to OSS: it's so much further ahead of any other big tech company with their revenue, you'd think they were the loonies. Most companies are doing a mix of OSS and closed source with OSS the core that's dressed up in proprietary services you can't do without. It's the Microsoft strategy, the Docker strategy, the VMware strategy, and on and on and on until most conference showfloors are ghastly apparitions of OSS fun with the real party in their "special sauce". When Red Hat buys a company's tech stack, they take the time to open source all of its components. We are truly living in the most insane times of privilege when we blow up in the most petulant outrage for a company saying, "here's the sources, you prep it if you want to sell it". Rocky and AlmaLinux are not ethical paragons here, in the least.
  - geerlingguy 3y ago
    > I think Red Hat was fully in the right I think the reason for the initial uproar was this[1]: Q: Will the source code for Red Hat Enterprise Linux continue to appear on git.centos.org? A: Yes, the source code for Red Hat Enterprise Linux will continue to be published on git.centos.org. Nothing will change about how the source code is published. This change is only related to the binaries the CentOS Project is building and how they are published. They struck that answer and replaced it with: A: June 2023 Update: CentOS Stream is now the location for public RHEL source code, sources will no longer be published to git.centos.org. The problem is for any downstream users (not just the 'freeloaders' or 'license abusers'), the main reason they remained in the RHEL ecosystem after the great CentOS to Stream migration was because free clones (Rocky and Alma) appeared in the wake of that decision. Timing is important here. Companies and individuals were working on migration from CentOS 7 to 8 when CentOS 8 was killed off 2 years into a planned 10 year cycle. Then once companies and individuals started migrating from Rocky/Alma 8 to Rocky/Alma 9, in the middle of the next 10 year support cycle of offering git.centos.org code dumps, Red Hat rugpulled the second time in as many release cycles. Red Hat is within their rights, but I don't think they are 'in the right' either in the way they announced the change, or in the timing. And IMO in the way they are treating the response ("we do so much good, so it's okay for us to have a EULA which is against the spirit of FOSS/GPL"). Also, the discourse started getting weird when there were implications by Red Hat leadership someone did something so bad to trigger this sudden change, yet nobody will say who it was. I admittedly don't know much about the Rocky/Alma situation, but it would be great if instead of vague accusations, someone would speak up because right now, for downstream users, it is annoying to have Red Hat imply one of these two orgs (maybe both?) is doing something nefarious, but to not know which one. [1] https://www.centos.org/distro-faq/ https://www.centos.org/distro-faq/
    - rhaway84773 3y ago
      > Also, the discourse started getting weird when there were implications by Red Hat leadership someone did something so bad to trigger this sudden change, yet nobody will say who it was. No company is gonna open itself up to libel lawsuits by naming a company that did something “bad” when they didn’t even need to state the fact that something bad happened in the first place. Don’t expect Red Hat to name a company here.
- type0 3y ago
  > This weird tactic of trying to kill off the customer alternatives is going to just kill off the EL ecosystem in the end. This is going to be a slow death, they are cutting out people who also contribute to different projects upstream. They don't know how to grow any-more; RH used to do some goodwill, now they think that badwill will work better. We should expect that "not invented here" syndrome of RH will only get stronger.
TimSchumann 3y ago
Kudos to Jeff for being willing to issue a public correction like this.
lowbloodsugar 3y ago
>4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. I don't know the whole situation, but it sounds like RedHat has created additional licensing terms for their GPL covered software, which would fall foul of 4 above, meaning that RedHat itself may not use any or distribute any of the GPL software it currently distributes?
- jmole 3y ago
  RedHat basically said: if you redistribute our code, we’re not going to be your friend anymore. And only our friends can get our latest code. There is no clause in the GPL that says, “if you get one version of the software, you have the right to all future versions”
  - geerlingguy 3y ago
    The concern is mostly a moral one, not a legal one. The idea that someone can take GPLv2-licensed code, build a platform/product on top of it, then coerce people to not share the source code after becoming a customer through a threat of ending their business relationship... that's what people take issue with. I do too, though as I said in the OP, I agree it seems they're in the clear, legally-speaking.
    - gary_0 3y ago
      We got the GPLv3 to close the TiVo loophole, I wonder if we'll get the GPLv4 to close the Red Hat loophole.
      - mindslight 3y ago
        Don't forget AGPL to close the SaaS loophole. FWIW it's arguable whether GPL3 was even needed to close the Tivo loophole, since GPL2 includes "the scripts used to control compilation and installation of the executable". It's unfortunate that none of the major kernel copyright holders are willing to litigate This whole GPL with contractual restrictions was tried before by Sveasoft (WRT54G firmware). They ended up failing and becoming a footnote in history, but Redhat is obviously much larger and more significant to the overall ecosystem.
mistrial9 3y ago
from a different version of this, re Alma and Rocky the loaded words "freeloader" and to a lesser extent "copycats" .. misses an important aspect of the real lifecycle of GNU/Linux software.. maybe you have heard of a book about tech markets called "crossing the chasm".. one part of that book says that there are easily four layers to participation and customers with tech in some markets.. you can imagine those four yourself because there is more than one valid diagram, but basically developers and their employment or income is innermost, their immediate dependencies for inputs, and their most rabid consumers are second, most customers and business relations of varying flavors third, and then "the Chasm" .. a catchy term to say that getting to those outside the regular channels, is very challenging. So in the RedHat so-called "copycat" case, the immediate downstream fill an important role in getting to the fourth+ layer.. there are more informal, unexpected, temporary or otherwise oddball cases than anyone can imagine. So in a growing and evolving network, the full, paid product from the original brand name source is aided and abetted by these immediate downstream distros. That's not the same as simply counterfeit on black markets. Neither is it low effort, since these two distros Alma and Rocky, show long-term commitment and good skill levels. Those are valuable growth themselves. What this "squeezeplay on the copycats" does is remove growth at the edges for lots of people, and consolidate revenue in the center, at RedHat. This is common knowledge among MBAs, and they do it all the time.
- Woodi 3y ago
  And buying RH by IBM was removing single serious seed of potential hi-quality hardware & software vendor. Hi-quality like in military hw - redundant (double or triple) power lines, multi-socket boards, high IO throughput, etc, etc. This is what RH could be. But few B's just before inflation did the job :>
noizejoy 3y ago
I wish Alma, Rocky - or preferably both — would just fork. i.e. create a roughly parallel stable distribution in the approximate style of RHEL. For my use case, I’d just be interested in the server side stuff, but I don’t know how important desktops are for the RHEL styled distros. But just in case, I’ve started practicing on Debian 12.
- rhaway84773 3y ago
  If they’d “just fork” they’d actually have to invest money into building credibility for their forks. The whole point is to essentially freeload off the money Red Hat is investing instead. There’s probably a great business to build on a RH fork, but the Rocky Linux one isn’t it.
  - noizejoy 3y ago
    > The whole point is to essentially freeload off the money Red Hat is investing instead. With bug for bug compatibility, that’s indeed an accusation that will linger. A fork would arguably re-establish moral high ground. I for one would enjoy a Debian stable alternative in the rpm/dnf eco-system.
unmole 3y ago
The original post got a lot of traction on HN and the number of commenters who were convinced that Red Had was violating the GPL was really incredible. Good on Jeff for writing this.
musicale 3y ago
> This doesn't restrict your right to share the source code that has been previously provided, since you are still free to do so. You're perfectly free to share the source code. By the way, nice business you have there; shame if something were to happen to it.
- geerlingguy 3y ago
  Yeah, shady and definitely against the intention of GPLv2 at least, but... legal.
  - matricaria 3y ago
    Hey Jeff! Love your work and your videos! Good luck to you!
solarkraft 3y ago
Dunno, seems like a pretty big restriction to me.
- geerlingguy 3y ago
  Morally and logically, yes. Legally, no.

71 points by matricaria 3y ago

I'm personally happy about this whole situation. Not because I agree with RH at all, but because it will accelerate the decline of RHEL and the entire EL ecosystem and mean I have to support those distros less in the future. (In a DevOps capacity, I'm not a contributor.) There is a lot of back and forth as to why RedHat is employing this footgun now. It comes down to them feeling, in part, that they are footing the development labor bill while rebuilders (Oracle Linux, Rocky Linux, Alma Linux) reap the rewards and undercut them on support contracts. The other part is enterprises and SMB running thousands of CentOS/non-subscription EL variants and having a token number of RHEL subscriptions to use for support any time they get into trouble. The real solution to the second problem is to explicitly forbid it within the RHEL support contracts and enforce that. You are either a RHEL shop or you are not. Make it a binary decision. This weird tactic of trying to kill off the customer alternatives is going to just kill off the EL ecosystem in the end. I know I abandoned the EL ecosystem entirely when CentOS Stream became the thing.

op00to 3y ago
The second is not a concern at all. If there is an odor of subscription abuse worth investigating, Red Hat’s Subscription Enforcment team will audit your systems. By signing the enterprise agreement you give them permission to do so whenever they want.
raincom 3y ago
Redhat should have stopped rebuilders seven years ago, when many large enterprises signed up site-wide contracts with Oracle. Maybe, they want to keep the EL ecosystem grow, then cut it off.
emptysongglass 3y ago
I think Red Hat was fully in the right and that the internet drama around their decision reeks of privilege. If you want the sources, go get them, they're in Stream but Red Hat won't be gift wrapping it for shops competing to offer support. They've been, and continue to be, fantastic stewards of the Linux ecosystem. I use many of their inventions today on my Linux workstation and my experience would be decidedly worse without. I am grateful for their continued pledge to OSS: it's so much further ahead of any other big tech company with their revenue, you'd think they were the loonies. Most companies are doing a mix of OSS and closed source with OSS the core that's dressed up in proprietary services you can't do without. It's the Microsoft strategy, the Docker strategy, the VMware strategy, and on and on and on until most conference showfloors are ghastly apparitions of OSS fun with the real party in their "special sauce". When Red Hat buys a company's tech stack, they take the time to open source all of its components. We are truly living in the most insane times of privilege when we blow up in the most petulant outrage for a company saying, "here's the sources, you prep it if you want to sell it". Rocky and AlmaLinux are not ethical paragons here, in the least.
- geerlingguy 3y ago
  > I think Red Hat was fully in the right I think the reason for the initial uproar was this[1]: Q: Will the source code for Red Hat Enterprise Linux continue to appear on git.centos.org? A: Yes, the source code for Red Hat Enterprise Linux will continue to be published on git.centos.org. Nothing will change about how the source code is published. This change is only related to the binaries the CentOS Project is building and how they are published. They struck that answer and replaced it with: A: June 2023 Update: CentOS Stream is now the location for public RHEL source code, sources will no longer be published to git.centos.org. The problem is for any downstream users (not just the 'freeloaders' or 'license abusers'), the main reason they remained in the RHEL ecosystem after the great CentOS to Stream migration was because free clones (Rocky and Alma) appeared in the wake of that decision. Timing is important here. Companies and individuals were working on migration from CentOS 7 to 8 when CentOS 8 was killed off 2 years into a planned 10 year cycle. Then once companies and individuals started migrating from Rocky/Alma 8 to Rocky/Alma 9, in the middle of the next 10 year support cycle of offering git.centos.org code dumps, Red Hat rugpulled the second time in as many release cycles. Red Hat is within their rights, but I don't think they are 'in the right' either in the way they announced the change, or in the timing. And IMO in the way they are treating the response ("we do so much good, so it's okay for us to have a EULA which is against the spirit of FOSS/GPL"). Also, the discourse started getting weird when there were implications by Red Hat leadership someone did something so bad to trigger this sudden change, yet nobody will say who it was. I admittedly don't know much about the Rocky/Alma situation, but it would be great if instead of vague accusations, someone would speak up because right now, for downstream users, it is annoying to have Red Hat imply one of these two orgs (maybe both?) is doing something nefarious, but to not know which one. [1] https://www.centos.org/distro-faq/ https://www.centos.org/distro-faq/
  - rhaway84773 3y ago
    > Also, the discourse started getting weird when there were implications by Red Hat leadership someone did something so bad to trigger this sudden change, yet nobody will say who it was. No company is gonna open itself up to libel lawsuits by naming a company that did something “bad” when they didn’t even need to state the fact that something bad happened in the first place. Don’t expect Red Hat to name a company here.
type0 3y ago
> This weird tactic of trying to kill off the customer alternatives is going to just kill off the EL ecosystem in the end. This is going to be a slow death, they are cutting out people who also contribute to different projects upstream. They don't know how to grow any-more; RH used to do some goodwill, now they think that badwill will work better. We should expect that "not invented here" syndrome of RH will only get stronger.

TimSchumann 3y ago

Kudos to Jeff for being willing to issue a public correction like this.

lowbloodsugar 3y ago

>4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. I don't know the whole situation, but it sounds like RedHat has created additional licensing terms for their GPL covered software, which would fall foul of 4 above, meaning that RedHat itself may not use any or distribute any of the GPL software it currently distributes?

jmole 3y ago
RedHat basically said: if you redistribute our code, we’re not going to be your friend anymore. And only our friends can get our latest code. There is no clause in the GPL that says, “if you get one version of the software, you have the right to all future versions”
- geerlingguy 3y ago
  The concern is mostly a moral one, not a legal one. The idea that someone can take GPLv2-licensed code, build a platform/product on top of it, then coerce people to not share the source code after becoming a customer through a threat of ending their business relationship... that's what people take issue with. I do too, though as I said in the OP, I agree it seems they're in the clear, legally-speaking.
  - gary_0 3y ago
    We got the GPLv3 to close the TiVo loophole, I wonder if we'll get the GPLv4 to close the Red Hat loophole.
    - mindslight 3y ago
      Don't forget AGPL to close the SaaS loophole. FWIW it's arguable whether GPL3 was even needed to close the Tivo loophole, since GPL2 includes "the scripts used to control compilation and installation of the executable". It's unfortunate that none of the major kernel copyright holders are willing to litigate This whole GPL with contractual restrictions was tried before by Sveasoft (WRT54G firmware). They ended up failing and becoming a footnote in history, but Redhat is obviously much larger and more significant to the overall ecosystem.

mistrial9 3y ago

from a different version of this, re Alma and Rocky the loaded words "freeloader" and to a lesser extent "copycats" .. misses an important aspect of the real lifecycle of GNU/Linux software.. maybe you have heard of a book about tech markets called "crossing the chasm".. one part of that book says that there are easily four layers to participation and customers with tech in some markets.. you can imagine those four yourself because there is more than one valid diagram, but basically developers and their employment or income is innermost, their immediate dependencies for inputs, and their most rabid consumers are second, most customers and business relations of varying flavors third, and then "the Chasm" .. a catchy term to say that getting to those outside the regular channels, is very challenging. So in the RedHat so-called "copycat" case, the immediate downstream fill an important role in getting to the fourth+ layer.. there are more informal, unexpected, temporary or otherwise oddball cases than anyone can imagine. So in a growing and evolving network, the full, paid product from the original brand name source is aided and abetted by these immediate downstream distros. That's not the same as simply counterfeit on black markets. Neither is it low effort, since these two distros Alma and Rocky, show long-term commitment and good skill levels. Those are valuable growth themselves. What this "squeezeplay on the copycats" does is remove growth at the edges for lots of people, and consolidate revenue in the center, at RedHat. This is common knowledge among MBAs, and they do it all the time.

Woodi 3y ago
And buying RH by IBM was removing single serious seed of potential hi-quality hardware & software vendor. Hi-quality like in military hw - redundant (double or triple) power lines, multi-socket boards, high IO throughput, etc, etc. This is what RH could be. But few B's just before inflation did the job :>

noizejoy 3y ago

I wish Alma, Rocky - or preferably both — would just fork. i.e. create a roughly parallel stable distribution in the approximate style of RHEL. For my use case, I’d just be interested in the server side stuff, but I don’t know how important desktops are for the RHEL styled distros. But just in case, I’ve started practicing on Debian 12.

rhaway84773 3y ago
If they’d “just fork” they’d actually have to invest money into building credibility for their forks. The whole point is to essentially freeload off the money Red Hat is investing instead. There’s probably a great business to build on a RH fork, but the Rocky Linux one isn’t it.
- noizejoy 3y ago
  > The whole point is to essentially freeload off the money Red Hat is investing instead. With bug for bug compatibility, that’s indeed an accusation that will linger. A fork would arguably re-establish moral high ground. I for one would enjoy a Debian stable alternative in the rpm/dnf eco-system.

unmole 3y ago

The original post got a lot of traction on HN and the number of commenters who were convinced that Red Had was violating the GPL was really incredible. Good on Jeff for writing this.

musicale 3y ago

> This doesn't restrict your right to share the source code that has been previously provided, since you are still free to do so. You're perfectly free to share the source code. By the way, nice business you have there; shame if something were to happen to it.

geerlingguy 3y ago
Yeah, shady and definitely against the intention of GPLv2 at least, but... legal.
- matricaria 3y ago
  Hey Jeff! Love your work and your videos! Good luck to you!

solarkraft 3y ago

Dunno, seems like a pretty big restriction to me.

geerlingguy 3y ago
Morally and logically, yes. Legally, no.