13 ms·

CodeCov is now Open Source

143 points by yla92 3y ago

V0rtexV0xter 3y ago
What can I do with this being open source if I cant use it for a competing service? Run an inhouse instance?
- jckahn 3y ago
  Yep. And that's great!
- paulddraper 3y ago
  Yes, personal/in-house use.
stevefan1999 3y ago
But how does that compare to SonarQube's code coverage?
- jerrod 3y ago
  My [very biased] $0.02: If you need only coverage on the most recent git diff / patch + looking at the repo level coverage on the head of a branch, both do a reasonable job. Codecov's focus on code coverage largely branches off on: -- Tracking the git tree (comparing base to head of a PR) --> e.g., how much did test coverage change on this branch / PR -- Supporting monorepos: Demarcating by test type ("Flags") and team/module ("Components") so you can focus only what you care about vs. the full repo. -- Supporting partial test runs: Codecov lets you run only some of your tests and still show accurate overall coverage data.
- Aeolun 3y ago
  Considering this is a service completely focused on it, pretty well I imagine.
- zeeg 3y ago
  If you find something they do better, let us know!
stsewd 3y ago
Not really open source, they are releasing their code under the BSL (Business Source License https://github.com/codecov/self-hosted/blob/main/LICENSE https://github.com/codecov/self-hosted/blob/main/LICENSE). But still great, and they use Django :D It's also interesting that they will no longer offer a commercial self-hosted solution. > As a part of this shift, we are offering a new self-hosted repo that makes it easy to run Codecov in a minimal docker-compose based setup for proof-of-concept and small volume deployments. We are end-of-lifing our commercial self-hosted offering, but will continue to provide support to existing customers who are running Codecov on-prem.
- mhh__ 3y ago
  N.B. BSL already refers to boost
  - mlinksva 3y ago
    Yeah BUSL or better yet BUSL-1.1 is the right way to refer to the Business Source License https://spdx.org/licenses/BUSL-1.1.html https://spdx.org/licenses/BUSL-1.1.html BSL or better yet BSL-1.0 is indeed Boost https://spdx.org/licenses/BSL-1.0.html https://spdx.org/licenses/BSL-1.0.html
    - zeeg 3y ago
      Noted! We’ve messed this up in the past and I have a vague recollection of this same confusion. Hasn’t helped that others (possibly also partly due to us) have made the same mistake. We’ll work to correct this usage.
      - whit537 3y ago
        FYI we have a follow-up at https://blog.sentry.io/lets-talk-about-open-source/ https://blog.sentry.io/lets-talk-about-open-source/. > Yesterday we announced that Codecov is now “Open Source”, and we messed up in two ways: > - We wrongly used the term Open Source; while unintentional, we should have known better > - We let our emotions get the best of trying to explain our position, rather than stepping back and addressing the problem > I want to talk about both of these, how we made the mistake, why it’s important to us, and what we plan to do about this to improve the conversation in the future. HN post: https://news.ycombinator.com/item?id=36990036 https://news.ycombinator.com/item?id=36990036
dmm 3y ago
"I've decided to become vegetarian. From now on I only eat meat on Wednesdays." "That's not what vegetarian means!" BSL is not open source.
- danpalmer 3y ago
  To extend the metaphor though... only eating meat on Wednesdays is much better than eating it every day, and releasing the source and accepting contributions, even if under a licence not recognised as meeting the full open-source standards, is still much of the value.
  - LapsangGuzzler 3y ago
    Completely agree, and if BSL allows the project to continue making enough money to sustain itself instead of being turned completely over to the community and risk becoming abandoned, then I’m all for it.
  - yjftsjthsd-h 3y ago
    Sure it's better, but if you do that and then call yourself a vegetarian people are still going to call you a liar. Nobody's objecting to the change, just the dishonesty.
    - danpalmer 3y ago
      Colloquially, almost all of the perceived value of "open source" code is that the source is available. Terms like "shared source" are unclear and not useful. I think the constructive criticism is useful here, but for all but the most in-the-know this is open source as they see it, and describing it as such is just using terminology in the way that society has decided it should be used. If you feel that the term "open source" has become meaningless as a result, I'd recommend using the term "free software" instead to mean software that is both source-available and licenced in a way that supports software freedom.
      - yjftsjthsd-h 3y ago
YPCrumble 3y ago
People often claim that open source is more secure, which is implied in this release. But the CodeCov breach that leaked any secrets provided to CI/CD pipelines [1] was done via a bash script available to anyone to read the code. The breach wasn't complex at all. It was just that nobody noticed for a long time that the bash uploader script sent all secrets to a random IP address. It makes me wonder what the benefit really is to being open source. Is it just marketing? https://about.codecov.io/security-update/ https://about.codecov.io/security-update/
- zeeg 3y ago
  It’s not about security for us, but about accessibility of technology. Open source lifts the barriers on who can use software (eg outside of politics, compliance, etc), and enables knowledge share. It’s - from Sentrys angle - how we enable any developer to take advantage of our technology, hopefully enabling them to solve other problems and grow the industry.
  - YPCrumble 3y ago
    So cool to see the CTO of Sentry here! This makes some sense to me - I'm actually following an issue with Sentry I had recently and although it's not being fixed anytime soon at least I know the status. https://github.com/getsentry/sentry-python/issues/370 https://github.com/getsentry/sentry-python/issues/370 I'd love to believe that one day someone will crack the nut of "Sentry puts a bounty on this issue and YPCrumble decides to make a PR because it's something he's experiencing AND he'd get some experience working on the Sentry codebase which would be a learning opportunity, and he feels like he's getting paid for his time."
    - zeeg 3y ago
      Will make sure folks see this internally. Thanks for the feedback!
- twleo 3y ago
  Open source does not magically make your software more secure. Community needs to audit the code if they are going to use it instead of trusting blindly.
Aeolun 3y ago
Well, that puts a damper on my plans to release an alternative OS coverage service. Now I can just use CodeCov.
solarkraft 3y ago
> The code is available now for you to run for yourself, study, modify, and redistribute in original and modified form. The BSL means you can’t sell hosting, but after a period of time the code reverts to the OSI-approved Apache 2.0 license. That's pretty good, to be honest. Congratulations!
- whit537 3y ago
  Thanks! I wrote that part, referring of course to https://www.gnu.org/philosophy/free-sw.en.html#four-freedoms https://www.gnu.org/philosophy/free-sw.en.html#four-freedoms and trying to be as straightforward as I could.
  - cosmojg 3y ago
    And yet you couldn't change the title to be less deceptive? "Open Source" means unhindered distribution, including for commercial use. Given that you're citing GNU, you should know better.
jsiepkes 3y ago
After a couple of decades of development I must say I personally find integration tests more useful than unit tests I mostly only do unit tests for things which are very "logic intensive" like a parser and such things. I think a good rule of thumb is if writing unit tests during development actually helps me with development the tests are probably also useful during the development cycle.
- arp242 3y ago
  I agree, and with integration tests I find coverage reports even more useful, because it's not always immediately obvious what is and isn't tested from a high level.
tedivm 3y ago
I am so freaking sick of companies lying and exploiting open source. This is Embrace, Extend, Extinguish at it's finest. By calling closed source software open source they're moving the window and confusing the entire concept of open source. I would have rather see CodeCov stay completely closed than see them pollute and damage the open source community like this. Frankly, this abusive nonsense means I will stop using CodeCov and stop recommending them to anyone- which is what I did when Sentry went closed source as well.
- zeeg 3y ago
  What’s abusive about it? 80% of Sentrys source code is licensed under Apache-2.0 (and is how Codecov will be in a few years) which is far more than what everyone’s favorite open core companies have done. Is it abusive to stop companies like AWS or GitLab from taking your work and selling it? Is it abusive to try to let as many people as possible use your software? I’ll tell you what’s abusive - people thinking they have the rights to other peoples work unconditionally, or that they can profiteer off it without contributing back.
  - tedivm 3y ago
    The abusive part is the lie, especially the lie that is literally trying to change the definition of open source. There are sentry employees in this very thread trying to argue that "BSL is open source". If CodeCov said "We are releasing our software under a shared source model" they would still be accomplishing all of the stuff you're saying (preventing AWS and Gitlab from using their product), but they wouldn't be lying about it. That's the major difference here. The fact that this lie has damage beyond just their company is what's important. If we continue to shift the definition of "open" to include more and more cases of "closed" then the entire concept of open source loses it's meaning. Microsoft tried this in the 90s/2000s, and it's really disappointing to see companies that claim to be promoting open source attempting this today.
    - zeeg 3y ago
      I created the Sentry project, am the CTO, and represent one of the strongest voices in our company for why this opinion of open source must change or open source will continue to be unsustainable. I disagree with your sentiment here, as I see plenty of negative effects from unfunded open source, from low ethics companies, and from proprietary softwares deterrent to progress. BSL is allowing us to give $500,000 to other open source projects this year, in addition to allowing any team in the world to use our software. What other open source company is putting their money where their mouth is? Nothing obligates us to make any of these decisions. We need to evolve our irrational views of idealism and find common ground that allows sustainability if we want open source to thrive.
cosmojg 3y ago
Correction: "CodeCov is now Source-Available for Noncommercial Use" Literally the first line of the BSL: "The Business Source License (this document, or the "License") is not an Open Source license."
Pannoniae 3y ago
Oh come on. You are being angry at the wrong target. If you become angry about this technically not being "open source" (by the OSI definition) you are just helping the rent-extracting monopolies in Big Tech to steal more. The OSI definition was accepted due to corporate lobbying and I imagine this probably also includes astroturfing to apply pressure on companies who don't go "all the way" and basically subsidise their competitors for free. This gives me strong ElasticSearch vibes - everyone got mad at Elastic for changing the licence, and no one gave a damn about Amazon building a moat around the technology, profiting massively from it yet leaving the burden of maintenance to Elastic. Anti-disclaimer: I have zero affiliation towards this project or company.
- tedivm 3y ago
  Sentry is one of the rent extracting companies. They want to extract value from the open source community, including marketing value, without actually being open source.
  - that_guy_iain 3y ago
    How so? You can use it for free without paying rent. You just can't compete with them without paying.
    - zeeg 3y ago
      Not to mention any reasonable competitor is using our FOSS-licensed code to compete against us (such as our symbolification services). There is nuance and people don’t care about that. We will keep shipping.
  - Pannoniae 3y ago
    Where is the "extracting value" part? If you mean "calling their product open source while you think it is actually not" that is a really weak justification. By extracting value I literally mean using open source code as a SaaS model then not contributing back anything. Getting angry over names is not seeing the forest from the trees...
yjftsjthsd-h 3y ago
Hey, I think I thought of a way to make everyone happy here: Why not dual-license it as AGPL / BSL-Apache? That way it is Open Source right now, but under the AGPL so AWS won't touch it, and then in 3 years it also becomes available under the more permissive Apache license.
- zeeg 3y ago
  Personally most of us at Sentry who made these decisions don’t like the invasive open source licenses. It was between this and allowing others to sell our software (which is very demoralizing), but we didn’t want to limit adoption and some companies won’t run GPL software due to the risks.
  - yjftsjthsd-h 3y ago
    Right, so dual license it to allow both
    - zeeg 3y ago
      We explicitly _do not_ want to promote GPL as we do not believe in it as the right tool. It’s not exclusively around protecting ourselves, but also how we do it. Decisions like this are more rooted in what we think is right for the world than a business demand (tho BSL for us, the decision to move off BSD, was triggered by what some companies were doing).
    - tedivm 3y ago
      If you look at it from a high level, Sentry wants to have their cake and eat it too. They don't want to promote GPL/AGPL open source development because it's harder for them to profit off of it, but they don't want others to profit off of their work which is why they're sticking with a "source available" license.
      - zeeg 3y ago
        I’m not sure why you’re 20 comments deep on HN, but we forbid (like most companies) GPL software. It’s no harder to profit off GPL than it is Apache, but GPL is a disease that plagues the technology world. There’s a reason we convert our code (and release most code) under Apache and that’s because it’s true FOSS. GPL has strings attached just like BSL. Clearly we hurt your feelings somewhere on the past, but let’s not go around spreading falsehoods.
zeeg 3y ago
We have updated the language on our blog post to the more commonly accepted “open-source” terminology. I’d encourage everyone who cares about OSS to participate and consider the changes happening in the broader technology sector. Sustainability is more important now than ever in the ecosystem, and we need to evolve our thinking and tolerance. We need to look deeply at the goals of open source and how we can continue to achieve them, and that isn’t going to be arguing about what once was. Many of the Sentry folks who have chimed in here (including myself) are not here because they work for Sentry, but because they have contributed to open source for the better part of their careers, and many of us in very significant ways (certainly with software you’ve used). We care about improving and protecting the ecosystem. It does no one any good when this community is hostile towards the folks trying to help.
- cxr 3y ago
  > We have updated the language on our blog post to the more commonly accepted “open-source” terminology. What are you talking about? That doesn't fix anything. It'd have been closer to the truth (and physically easier) to update it to say, "Codecov is not Open Source". "Open Source" and "open-source"[1] are not two different things. You're just rearranging the deck chairs. Using the latter form doesn't soften the transgression. In an earlier comment[2], you insisted "Our goal is not to argue about proper nouns". Yet... here you are. Why? Just fix your mistake. 1. <https://en.wikipedia.org/wiki/Open-source_software https://en.wikipedia.org/wiki/Open-source_software> 2. <https://news.ycombinator.com/item?id=36973452 https://news.ycombinator.com/item?id=36973452>
  - zeeg 3y ago
    Open Source, as a proper noun, is generally considered associated with the OSD from OSI. We are trying to clarify that what we’re representing is not that definition, but are representing what we feel is the spirit of open source software.
    - cxr 3y ago
      I fear this is an instance of that old Upton Sinclair/H. L. Mencken quip—never be so foolish as to waste your breath believing that you can get a man to understand something which his salary requires him not to understand. Engage with the argument you are being confronted with. There is no difference between "Open Source" and "open-source". The former is generally associated with the OSD, and the latter is generally associated with people who insist on hyphenating* things—but are referring to the same thing; there is no "open-source" definition that is more relaxed than the "Open Source" definition. You are lying if you want to pretend that there is a widely recognized difference. There isn't. The problem never was that you're using the Business Software License. The problem is that you are _lying_. So stop lying. It's that easy. * EDIT: And removing the hyphen[1] doesn't fix anything. You have been through no fewer than four different variations of the title at this point[2][3][4]. The hyphen is not the problem. The problem is that you are lying. Try just not doing that. 1. <https://archive.is/XJz9r https://archive.is/XJz9r> 2. <https://archive.is/aSH9K https://archive.is/aSH9K> 3. Unarchived version that used lowercase "open-source" with a hyphen, cf <https://news.ycombinator.com/item?id=36974314 https://news.ycombinator.com/item?id=36974314> 4. <https://archive.is/XJz9r https://archive.is/XJz9r>
zeeg 3y ago
After reviewing the feedback (some of it from yall here), we recognize the challenges with using the term Open Source. We've posted a statement about this mistake and are working on improving things going forward: https://blog.sentry.io/lets-talk-about-open-source/ https://blog.sentry.io/lets-talk-about-open-source/ For the folks who provided constructive criticism, we thank you.
thayne 3y ago
I think we need a new term for licenses like these that are not quite open source. Saying it is open source is deceptive and erodes the meaning of open source, but they are also more open/free than just "source available" where the source code is available but you have no rights to do anything with it (although I've seen cases where even that is advertised as "open source").
whit537 3y ago
FYI we have a follow-up at https://blog.sentry.io/lets-talk-about-open-source/ https://blog.sentry.io/lets-talk-about-open-source/. > Yesterday we announced that Codecov is now “Open Source”, and we messed up in two ways: > - We wrongly used the term Open Source; while unintentional, we should have known better > - We let our emotions get the best of trying to explain our position, rather than stepping back and addressing the problem > I want to talk about both of these, how we made the mistake, why it’s important to us, and what we plan to do about this to improve the conversation in the future. HN post: https://news.ycombinator.com/item?id=36990036 https://news.ycombinator.com/item?id=36990036

143 points by yla92 3y ago

V0rtexV0xter 3y ago

What can I do with this being open source if I cant use it for a competing service? Run an inhouse instance?

jckahn 3y ago
Yep. And that's great!
paulddraper 3y ago
Yes, personal/in-house use.

stevefan1999 3y ago

But how does that compare to SonarQube's code coverage?

jerrod 3y ago
My [very biased] $0.02: If you need only coverage on the most recent git diff / patch + looking at the repo level coverage on the head of a branch, both do a reasonable job. Codecov's focus on code coverage largely branches off on: -- Tracking the git tree (comparing base to head of a PR) --> e.g., how much did test coverage change on this branch / PR -- Supporting monorepos: Demarcating by test type ("Flags") and team/module ("Components") so you can focus only what you care about vs. the full repo. -- Supporting partial test runs: Codecov lets you run only some of your tests and still show accurate overall coverage data.
Aeolun 3y ago
Considering this is a service completely focused on it, pretty well I imagine.
zeeg 3y ago
If you find something they do better, let us know!

stsewd 3y ago

Not really open source, they are releasing their code under the BSL (Business Source License https://github.com/codecov/self-hosted/blob/main/LICENSE https://github.com/codecov/self-hosted/blob/main/LICENSE). But still great, and they use Django :D It's also interesting that they will no longer offer a commercial self-hosted solution. > As a part of this shift, we are offering a new self-hosted repo that makes it easy to run Codecov in a minimal docker-compose based setup for proof-of-concept and small volume deployments. We are end-of-lifing our commercial self-hosted offering, but will continue to provide support to existing customers who are running Codecov on-prem.

mhh__ 3y ago
N.B. BSL already refers to boost
- mlinksva 3y ago
  Yeah BUSL or better yet BUSL-1.1 is the right way to refer to the Business Source License https://spdx.org/licenses/BUSL-1.1.html https://spdx.org/licenses/BUSL-1.1.html BSL or better yet BSL-1.0 is indeed Boost https://spdx.org/licenses/BSL-1.0.html https://spdx.org/licenses/BSL-1.0.html
  - zeeg 3y ago
    Noted! We’ve messed this up in the past and I have a vague recollection of this same confusion. Hasn’t helped that others (possibly also partly due to us) have made the same mistake. We’ll work to correct this usage.
    - whit537 3y ago
      FYI we have a follow-up at https://blog.sentry.io/lets-talk-about-open-source/ https://blog.sentry.io/lets-talk-about-open-source/. > Yesterday we announced that Codecov is now “Open Source”, and we messed up in two ways: > - We wrongly used the term Open Source; while unintentional, we should have known better > - We let our emotions get the best of trying to explain our position, rather than stepping back and addressing the problem > I want to talk about both of these, how we made the mistake, why it’s important to us, and what we plan to do about this to improve the conversation in the future. HN post: https://news.ycombinator.com/item?id=36990036 https://news.ycombinator.com/item?id=36990036

dmm 3y ago

"I've decided to become vegetarian. From now on I only eat meat on Wednesdays." "That's not what vegetarian means!" BSL is not open source.

danpalmer 3y ago
To extend the metaphor though... only eating meat on Wednesdays is much better than eating it every day, and releasing the source and accepting contributions, even if under a licence not recognised as meeting the full open-source standards, is still much of the value.
- LapsangGuzzler 3y ago
  Completely agree, and if BSL allows the project to continue making enough money to sustain itself instead of being turned completely over to the community and risk becoming abandoned, then I’m all for it.
- yjftsjthsd-h 3y ago
  Sure it's better, but if you do that and then call yourself a vegetarian people are still going to call you a liar. Nobody's objecting to the change, just the dishonesty.
  - danpalmer 3y ago
    Colloquially, almost all of the perceived value of "open source" code is that the source is available. Terms like "shared source" are unclear and not useful. I think the constructive criticism is useful here, but for all but the most in-the-know this is open source as they see it, and describing it as such is just using terminology in the way that society has decided it should be used. If you feel that the term "open source" has become meaningless as a result, I'd recommend using the term "free software" instead to mean software that is both source-available and licenced in a way that supports software freedom.
    - yjftsjthsd-h 3y ago

YPCrumble 3y ago

People often claim that open source is more secure, which is implied in this release. But the CodeCov breach that leaked any secrets provided to CI/CD pipelines [1] was done via a bash script available to anyone to read the code. The breach wasn't complex at all. It was just that nobody noticed for a long time that the bash uploader script sent all secrets to a random IP address. It makes me wonder what the benefit really is to being open source. Is it just marketing? https://about.codecov.io/security-update/ https://about.codecov.io/security-update/

zeeg 3y ago
It’s not about security for us, but about accessibility of technology. Open source lifts the barriers on who can use software (eg outside of politics, compliance, etc), and enables knowledge share. It’s - from Sentrys angle - how we enable any developer to take advantage of our technology, hopefully enabling them to solve other problems and grow the industry.
- YPCrumble 3y ago
  So cool to see the CTO of Sentry here! This makes some sense to me - I'm actually following an issue with Sentry I had recently and although it's not being fixed anytime soon at least I know the status. https://github.com/getsentry/sentry-python/issues/370 https://github.com/getsentry/sentry-python/issues/370 I'd love to believe that one day someone will crack the nut of "Sentry puts a bounty on this issue and YPCrumble decides to make a PR because it's something he's experiencing AND he'd get some experience working on the Sentry codebase which would be a learning opportunity, and he feels like he's getting paid for his time."
  - zeeg 3y ago
    Will make sure folks see this internally. Thanks for the feedback!
twleo 3y ago
Open source does not magically make your software more secure. Community needs to audit the code if they are going to use it instead of trusting blindly.

Aeolun 3y ago

Well, that puts a damper on my plans to release an alternative OS coverage service. Now I can just use CodeCov.

solarkraft 3y ago

> The code is available now for you to run for yourself, study, modify, and redistribute in original and modified form. The BSL means you can’t sell hosting, but after a period of time the code reverts to the OSI-approved Apache 2.0 license. That's pretty good, to be honest. Congratulations!

whit537 3y ago
Thanks! I wrote that part, referring of course to https://www.gnu.org/philosophy/free-sw.en.html#four-freedoms https://www.gnu.org/philosophy/free-sw.en.html#four-freedoms and trying to be as straightforward as I could.
- cosmojg 3y ago
  And yet you couldn't change the title to be less deceptive? "Open Source" means unhindered distribution, including for commercial use. Given that you're citing GNU, you should know better.

jsiepkes 3y ago

After a couple of decades of development I must say I personally find integration tests more useful than unit tests I mostly only do unit tests for things which are very "logic intensive" like a parser and such things. I think a good rule of thumb is if writing unit tests during development actually helps me with development the tests are probably also useful during the development cycle.

arp242 3y ago
I agree, and with integration tests I find coverage reports even more useful, because it's not always immediately obvious what is and isn't tested from a high level.

tedivm 3y ago

I am so freaking sick of companies lying and exploiting open source. This is Embrace, Extend, Extinguish at it's finest. By calling closed source software open source they're moving the window and confusing the entire concept of open source. I would have rather see CodeCov stay completely closed than see them pollute and damage the open source community like this. Frankly, this abusive nonsense means I will stop using CodeCov and stop recommending them to anyone- which is what I did when Sentry went closed source as well.

zeeg 3y ago
What’s abusive about it? 80% of Sentrys source code is licensed under Apache-2.0 (and is how Codecov will be in a few years) which is far more than what everyone’s favorite open core companies have done. Is it abusive to stop companies like AWS or GitLab from taking your work and selling it? Is it abusive to try to let as many people as possible use your software? I’ll tell you what’s abusive - people thinking they have the rights to other peoples work unconditionally, or that they can profiteer off it without contributing back.
- tedivm 3y ago
  The abusive part is the lie, especially the lie that is literally trying to change the definition of open source. There are sentry employees in this very thread trying to argue that "BSL is open source". If CodeCov said "We are releasing our software under a shared source model" they would still be accomplishing all of the stuff you're saying (preventing AWS and Gitlab from using their product), but they wouldn't be lying about it. That's the major difference here. The fact that this lie has damage beyond just their company is what's important. If we continue to shift the definition of "open" to include more and more cases of "closed" then the entire concept of open source loses it's meaning. Microsoft tried this in the 90s/2000s, and it's really disappointing to see companies that claim to be promoting open source attempting this today.
  - zeeg 3y ago
    I created the Sentry project, am the CTO, and represent one of the strongest voices in our company for why this opinion of open source must change or open source will continue to be unsustainable. I disagree with your sentiment here, as I see plenty of negative effects from unfunded open source, from low ethics companies, and from proprietary softwares deterrent to progress. BSL is allowing us to give $500,000 to other open source projects this year, in addition to allowing any team in the world to use our software. What other open source company is putting their money where their mouth is? Nothing obligates us to make any of these decisions. We need to evolve our irrational views of idealism and find common ground that allows sustainability if we want open source to thrive.

cosmojg 3y ago

Correction: "CodeCov is now Source-Available for Noncommercial Use" Literally the first line of the BSL: "The Business Source License (this document, or the "License") is not an Open Source license."

Pannoniae 3y ago

Oh come on. You are being angry at the wrong target. If you become angry about this technically not being "open source" (by the OSI definition) you are just helping the rent-extracting monopolies in Big Tech to steal more. The OSI definition was accepted due to corporate lobbying and I imagine this probably also includes astroturfing to apply pressure on companies who don't go "all the way" and basically subsidise their competitors for free. This gives me strong ElasticSearch vibes - everyone got mad at Elastic for changing the licence, and no one gave a damn about Amazon building a moat around the technology, profiting massively from it yet leaving the burden of maintenance to Elastic. Anti-disclaimer: I have zero affiliation towards this project or company.

tedivm 3y ago
Sentry is one of the rent extracting companies. They want to extract value from the open source community, including marketing value, without actually being open source.
- that_guy_iain 3y ago
  How so? You can use it for free without paying rent. You just can't compete with them without paying.
  - zeeg 3y ago
    Not to mention any reasonable competitor is using our FOSS-licensed code to compete against us (such as our symbolification services). There is nuance and people don’t care about that. We will keep shipping.
- Pannoniae 3y ago
  Where is the "extracting value" part? If you mean "calling their product open source while you think it is actually not" that is a really weak justification. By extracting value I literally mean using open source code as a SaaS model then not contributing back anything. Getting angry over names is not seeing the forest from the trees...

yjftsjthsd-h 3y ago

Hey, I think I thought of a way to make everyone happy here: Why not dual-license it as AGPL / BSL-Apache? That way it is Open Source right now, but under the AGPL so AWS won't touch it, and then in 3 years it also becomes available under the more permissive Apache license.

zeeg 3y ago
Personally most of us at Sentry who made these decisions don’t like the invasive open source licenses. It was between this and allowing others to sell our software (which is very demoralizing), but we didn’t want to limit adoption and some companies won’t run GPL software due to the risks.
- yjftsjthsd-h 3y ago
  Right, so dual license it to allow both
  - zeeg 3y ago
    We explicitly _do not_ want to promote GPL as we do not believe in it as the right tool. It’s not exclusively around protecting ourselves, but also how we do it. Decisions like this are more rooted in what we think is right for the world than a business demand (tho BSL for us, the decision to move off BSD, was triggered by what some companies were doing).
  - tedivm 3y ago
    If you look at it from a high level, Sentry wants to have their cake and eat it too. They don't want to promote GPL/AGPL open source development because it's harder for them to profit off of it, but they don't want others to profit off of their work which is why they're sticking with a "source available" license.
    - zeeg 3y ago
      I’m not sure why you’re 20 comments deep on HN, but we forbid (like most companies) GPL software. It’s no harder to profit off GPL than it is Apache, but GPL is a disease that plagues the technology world. There’s a reason we convert our code (and release most code) under Apache and that’s because it’s true FOSS. GPL has strings attached just like BSL. Clearly we hurt your feelings somewhere on the past, but let’s not go around spreading falsehoods.

zeeg 3y ago

We have updated the language on our blog post to the more commonly accepted “open-source” terminology. I’d encourage everyone who cares about OSS to participate and consider the changes happening in the broader technology sector. Sustainability is more important now than ever in the ecosystem, and we need to evolve our thinking and tolerance. We need to look deeply at the goals of open source and how we can continue to achieve them, and that isn’t going to be arguing about what once was. Many of the Sentry folks who have chimed in here (including myself) are not here because they work for Sentry, but because they have contributed to open source for the better part of their careers, and many of us in very significant ways (certainly with software you’ve used). We care about improving and protecting the ecosystem. It does no one any good when this community is hostile towards the folks trying to help.

cxr 3y ago
> We have updated the language on our blog post to the more commonly accepted “open-source” terminology. What are you talking about? That doesn't fix anything. It'd have been closer to the truth (and physically easier) to update it to say, "Codecov is not Open Source". "Open Source" and "open-source"[1] are not two different things. You're just rearranging the deck chairs. Using the latter form doesn't soften the transgression. In an earlier comment[2], you insisted "Our goal is not to argue about proper nouns". Yet... here you are. Why? Just fix your mistake. 1. <https://en.wikipedia.org/wiki/Open-source_software https://en.wikipedia.org/wiki/Open-source_software> 2. <https://news.ycombinator.com/item?id=36973452 https://news.ycombinator.com/item?id=36973452>
- zeeg 3y ago
  Open Source, as a proper noun, is generally considered associated with the OSD from OSI. We are trying to clarify that what we’re representing is not that definition, but are representing what we feel is the spirit of open source software.
  - cxr 3y ago
    I fear this is an instance of that old Upton Sinclair/H. L. Mencken quip—never be so foolish as to waste your breath believing that you can get a man to understand something which his salary requires him not to understand. Engage with the argument you are being confronted with. There is no difference between "Open Source" and "open-source". The former is generally associated with the OSD, and the latter is generally associated with people who insist on hyphenating* things—but are referring to the same thing; there is no "open-source" definition that is more relaxed than the "Open Source" definition. You are lying if you want to pretend that there is a widely recognized difference. There isn't. The problem never was that you're using the Business Software License. The problem is that you are _lying_. So stop lying. It's that easy. * EDIT: And removing the hyphen[1] doesn't fix anything. You have been through no fewer than four different variations of the title at this point[2][3][4]. The hyphen is not the problem. The problem is that you are lying. Try just not doing that. 1. <https://archive.is/XJz9r https://archive.is/XJz9r> 2. <https://archive.is/aSH9K https://archive.is/aSH9K> 3. Unarchived version that used lowercase "open-source" with a hyphen, cf <https://news.ycombinator.com/item?id=36974314 https://news.ycombinator.com/item?id=36974314> 4. <https://archive.is/XJz9r https://archive.is/XJz9r>

zeeg 3y ago

After reviewing the feedback (some of it from yall here), we recognize the challenges with using the term Open Source. We've posted a statement about this mistake and are working on improving things going forward: https://blog.sentry.io/lets-talk-about-open-source/ https://blog.sentry.io/lets-talk-about-open-source/ For the folks who provided constructive criticism, we thank you.

thayne 3y ago

I think we need a new term for licenses like these that are not quite open source. Saying it is open source is deceptive and erodes the meaning of open source, but they are also more open/free than just "source available" where the source code is available but you have no rights to do anything with it (although I've seen cases where even that is advertised as "open source").

whit537 3y ago

FYI we have a follow-up at https://blog.sentry.io/lets-talk-about-open-source/ https://blog.sentry.io/lets-talk-about-open-source/. > Yesterday we announced that Codecov is now “Open Source”, and we messed up in two ways: > - We wrongly used the term Open Source; while unintentional, we should have known better > - We let our emotions get the best of trying to explain our position, rather than stepping back and addressing the problem > I want to talk about both of these, how we made the mistake, why it’s important to us, and what we plan to do about this to improve the conversation in the future. HN post: https://news.ycombinator.com/item?id=36990036 https://news.ycombinator.com/item?id=36990036