47 ms·

HashiCorp adopts Business Source License

• Sparkyte 3y ago
  CEO: Let's do a business license to profit off community contributions over these past 10 years. Employee A: But what about the community? Employee B: ..Aaand it's gone!
• rantthrowaway69 3y ago
  [flagged]
• selfmodruntime 3y ago
  I love hashicorp's software. I just wish their enterprise licensing models weren't so outlandishly expensive for small to medium companies. I wouldn't go so far as to call their vault pricing outright predatory, but it comes close.
  • JohnMakin 3y ago
    Particularly when they yanked the okta/mfa feature from OSS, that was pretty hostile.
• CSDude 3y ago
  Inevitable end for every open source company since the free money ended. What bothers me is that wording is vague enough. > HashiCorp considers a competitive offering to be a product or service provided to users or customers outside of your organization that has significant overlap with the capabilities of HashiCorp’s commercial products or services. So, consider there is no cost estimate service and you built a thing that got popular (https://github.com/infracost/infracost https://github.com/infracost/infracost). Then after 2 years Terraform Cloud catches up. What happens? Are you out of business?
  • sytse 3y ago
    "Inevitable end for every open source company since the free money ended." I think the only way to prevent this is changing the company charter https://opencoreventures.com/blog/2022-10-preventing-the-bait-and-switch-open-core/ https://opencoreventures.com/blog/2022-10-preventing-the-bai... "Then after 2 years Terraform Cloud catches up" Really good point, company scopes change.
    • wmf 3y ago
      So if a company is losing money they should just fail with no chance to change direction?
      • ec109685 3y ago
        Hashicorp has a billion dollars in the bank and is growing 48% YoY, so they aren’t in danger of failing. They may be in danger of not justifying their $5 billion valuation.
  • klabb3 3y ago
    > Inevitable end for every open source company since the free money ended. Yeah. It seems like the Apache/MIT route has been working “well” to support a suite of libraries. But for bigger “business-critical” full-on products, like databases etc, you see much more weird contortions, including making self-hosting difficult and feature-gating essentials. Better than closed source, but not ideal. I’ve been thinking for a while that licensing is likely the pragmatic way out. But it’s important that it’s broadly understood, fair and clear. > […] a product or service provided to users or customers outside of your organization that has significant overlap Ouch, judging by the language it seems like it’s (1) unclear and (2) the authority on that ambiguity leans in favor of the company, which paves the way for selective enforcement. “Don’t worry, we aren’t going to come after anyone” is not convincing when legal documents are being signed. Hoarding soft- or future powers is a huge red flag in contracts, imo. What do others think about this license in particular?
• hashtag-til 3y ago
  I’m a full time engineer, working on OSS for more than a decade. As much as I love open-souce, I get the point that there are a bunch of freeloaders using stuff and not contributing back.
  • Exuma 3y ago
    Out of curiosity what is your definition of a freeloader? Is someone who’s been coding but hasn’t made a single OSS commit a freeloader ?
    • wmf 3y ago
      It sounds like there are companies selling Terraform with a wrapper on top and not paying Hashicorp anything.
      • yellowapple 3y ago
        I know of precisely zero such companies, and I can't imagine how such a company would even have customers in the first place when Terraform already has a $0 pricetag. I could maybe understand this for Consul or Vault, since those are actual hostable services that could probably be resold - but I don't know of anyone reselling those, either.
        • chunk_waffle 3y ago
          Maybe Gruntwork.io, makers of Terragrunt, I think? I always just stuck to vanilla Terraform but recall coming across them at some point.
          • yellowapple 3y ago
            I wouldn't call them a competitor by any stretch; more like a partner. A Terragrunt codebase just wraps Terraform, with the same exact backends (including Hashicorp's SaaS offerings) and the same exact providers and everything.
• adoxyz 3y ago
  Nothing wrong with this imo. I actually hope more open source projects start with a business source license if their ultimate goal is to become a SaaS platform. I think we've seen time and time again large enterprises abusing the spirit of open source for their own monetary gain, contributing nothing back, and just acting in bad faith.
  • toenail 3y ago
    Abusing the spirit of open source, what? If somebody doesn't want any competitors they should have read the licenses and understood them, and not simply used open source as a buzzword for marketing purposes.
    • Barrin92 3y ago
      A lot of people start open source businesses under the good faith assumption that competitors will be fair and that the people who do the actual work capture the value, and that people genuinely contribute back. License technicalities don't matter. If people use permissive licenses as an excuse to justify an ecosystem that is parasitic any such system will die out, it cannot sustain itself.
      • toenail 3y ago
        If your business can't succeed using an open source license you made poor business choices. Own it, don't blame the license or the open source community.
        • Barrin92 3y ago
          If I have to pay developers, operate a business, allocate time and money to create value and take the risk that comes with it, and you come and take my work unchanged, strip all atribution and mereley resell it, then I can't succeed by definition. The most talented businessman on earth cannot. If that's what you think open source is, it'll vanish. No commercial system can exist like that and it should not because it effectively means distributing resources from people who do everything to people who do nothing.
• bithavoc 3y ago
  I wonder how this affects Pulumi
  • yellowapple 3y ago
    It makes it a lot more attractive, as long as they don't hop on the same BUSL bandwagon.
    • rantthrowaway69 3y ago
      [flagged]
    • rnmkr 3y ago
      It's just a matter of time. They're Apache 2.0 for now. But they can pull out at any moment just like Hashicorp, Grafana, Mongo any many others..
      • yellowapple 3y ago
        Indeed they can. Until they do so, however, I'm inclined to give it a second look.
  • danw1979 3y ago
    Your line of thinking was that Pulumi uses terraform providers under the hood, right ? It’s a good question. I suspect several forks might be happening as we speak.
    • wlonkly 3y ago
      I believe providers are still OSS-licensed.
      • danw1979 3y ago
        Correct, according to the Hashicorp license change FAQ - https://www.hashicorp.com/license-faq#How-does-this-impact-the-licensing-of-Terraform-providers https://www.hashicorp.com/license-faq#How-does-this-impact-t... And I checked the contribution guide for the aws provider, no mention of a CLA there. I wonder if Hashicorp would be able to pull the providers under the same BSL in future ?
• riku_iki 3y ago
  how this works from the point of view of current license? They can't just take MPL code and modify license terms in my reading of FAQ (Q9 in https://www.mozilla.org/en-US/MPL/2.0/FAQ/ https://www.mozilla.org/en-US/MPL/2.0/FAQ/)?..
  • jabbany 3y ago
    > on all future releases of HashiCorp products Anything before the change is still MPL and can be forked and built on top of freely.
    • riku_iki 3y ago
      > Anything before the change is still MPL and can be forked and built on top of freely. per my reading of FAQ if you fork and modify old MPL it still have to be MPL, so if hashicorp fork old MPL code they need to release it under MPL.
      • klardotsh 3y ago
        Which does not disclaim "be forked and built on top of freely", especially given that Hashicorp products (in the modern era, at least) are written in Go and MPL is a file-level license: creating a new file in the same module under a non-MPL license and shipping it beside the MPL code as one broader unit is, I believe, fair game. But even still: MPL is a legitimate open source license that just asks that you give your changes back to the community. Seems like a fair trade to me.
        • riku_iki 3y ago
          > creating a new file in the same module under a non-MPL license and shipping it beside the MPL code as one broader unit is but they are not saying they will be adding new files under business license keeping old files under MPL, they are saying future releases of products will be shipped under business license.
          • 3y ago
• yellowapple 3y ago
  > As a result, we believe commercial open source models need to evolve for the ecosystem to continue providing open, freely available software. To imply that a non-open-source license like the BUSL is part of such an evolution of "open source" models (commercial or otherwise) betrays either severe confusion or a deliberate attempt to mislead. Like, has anyone of any significance used a Hashicorp product to meaningfully compete with Hashicorp?
  • jrsdav 3y ago
    I haven't looked to see what licenses are involved, but Pulumi makes liberal use of Terraform providers[1]. And I would definitely consider them to be a Hashicorp competitor. [1]: https://www.pulumi.com/docs/concepts/vs/terraform/#:~:text=Using%20Terraform%20Providers,Providers%20ecosystem%20using%20Pulumi%20programs https://www.pulumi.com/docs/concepts/vs/terraform/#:~:text=U.... > Pulumi is able to adapt any Terraform Provider for use with Pulumi, enabling management of any infrastructure supported by the Terraform Providers ecosystem using Pulumi programs.
    • reilly3000 3y ago
      They used to do that but now also have their own providers created by API catalog introspection.
      • arianvanp 3y ago
        Which terraform then copied with the AWS Native provider...
    • arianvanp 3y ago
      But they don't out-compete them in any shape or form. I'd call it healthy competition. Pulumi made Hashicorp build Terraform CDK. Which is a great result. And the only reason Hashicorp was able to build CDK quickly is because they built it on top of Amazon's open source Amazon CDK. Another competitor.
      • 3y ago
• theLiminator 3y ago
  Did they have to get signoff from all contributors to relicense? I can't imagine this was a popular move for the people who contributed outside of hashicorp.
  • jamestanderson 3y ago
    I believe they require contributors to sign their CLA: https://cla.hashicorp.com/ https://cla.hashicorp.com/ That CLA grants HashiCorp full license over your Copyright, and explicitly allows them to sublicense your contributions[1]. Drew Devault's blog posts[2][3] on this topic are extremely relevant. [1] > Grant of Copyright License. Subject to the terms and conditions of this Agreement, You hereby grant to HashiCorp and to recipients of software distributed by HashiCorp a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Your Contributions and such derivative works. [2] https://drewdevault.com/2018/10/05/Dont-sign-a-CLA.html https://drewdevault.com/2018/10/05/Dont-sign-a-CLA.html [3] https://drewdevault.com/2023/07/04/Dont-sign-a-CLA-2.html https://drewdevault.com/2023/07/04/Dont-sign-a-CLA-2.html
    • theLiminator 3y ago
      Sounds like contributors should create a community fork then. Yeah, it sure does give away a lot of your rights when you sign a CLA...
    • buzer 3y ago
      I don't know if they have required old commiters to sign it. I commited to one library that is now under Hashicorp back in 2015 and did not need to sign anything but it was MIT licensed back then. They have also rewritten affected lines as part of larger rewrite.
      • Macha 3y ago
        If it's MIT licensed then they don't need your consent as long as they include the text of the MIT license while your contributions are included. It's stuff in the MPL period that is more questionable if they don't have contributor sign off.
• theLiminator 3y ago
  Anyone know if a community fork is underway?
  • lijok 3y ago
    Of which product?
    • theLiminator 3y ago
      Of everything
      • lijok 3y ago
        Why would you want to fragment the ecosystem like that, in response to a license change that is a non-event unless you're profiteering off of Hashicorps work?
• nezirus 3y ago
  Dunno about others, but I always ask myself where these companies would be if their software was under non free license from the start. This is hostile to end users, small people an companies, not just big megacorps wanting the "steal" the code and run it as a service. Be successful in running and using Hashicorp's software, and they decide to shut you down if you are deemed a competitor.
  • manojlds 3y ago
    From what I know about BSL, nothing changes for me, except some notion what "true open source spirit" is and what not.
    • candiddevmike 3y ago
      Depends on the conditions of the BSL and whether your legal department is OK with them.
    • light_hue_1 3y ago
      Everything changes. At any moment for any reason they can declare that you your use or your business in some way competes with them and cut you off. You have no recourse. They don't need to explain it. They can even add a product remotely like what you're building or misunderstand your product and you are screwed. The BSL carries with it immense legal risk.
  • rnmkr 3y ago
    > where these companies would be if their software was under non free license from the start. Yep open source is used as a marketing. I doubt they'd gain much adoption if it started with BSL at first place.
    • mdaniel 3y ago
      > I doubt they'd gain much adoption if it started with BSL at first place Adoption is one risk, https://github.com/hashicorp/terraform/graphs/contributors https://github.com/hashicorp/terraform/graphs/contributors is an entirely different risk
• jamestanderson 3y ago
  All that I get from this is that HashiCorp is no longer an open source company. > However, there are other vendors who take advantage of pure OSS models, and the community work on OSS projects, for their own commercial goals, without providing material contributions back. We don’t believe this is in the spirit of open source. This is 100% in the spirit of open source. If this is a problem for them, why not adopt an open source license that compels developers to open source their code instead, like the AGPL? This is purely a way for HashiCorp to ensure they are the only ones who can commercialize these formerly open source projects. Which is fine. But just go closed source, then, and own that, instead of trying to have it both ways.
  • toomuchtodo 3y ago
    Ideology is great until people need to eat. That’s what revenue is for. High level, times have changed. Source should be (my two cents, ymmv) about a mutually beneficial partnership between builders and users, not “give it all away for free or you’re not legit.” Users get to understand and extend what they’re running (via source), while the project steward/maintainer/owner can continue to do so. It is a balance to be maintained in tension, not an equilibrium to be reached.
    • version_five 3y ago
      > Ideology is great until people need to eat. That’s what revenue is for That sounds like what the GP comment is saying. If someone said "turns out open source doesn't work for our business model" it's hard to argue with. If instead they talk about "evolving open source models" and whatnot, it feels like they want the best of both worlds. It's been happening a lot recently that companies pretend they are "open sourcing" something for the PR but really use a much more restrictive license.
      • toomuchtodo 3y ago
        I argue the window is moving as to what “open source” means out of survival. Source available is the new open source, and what young technologists will grow up grinding on. You’ll have folks complain about it during the transition (as happens with any Overton window sort of event), but they’ll move on eventually and a new crop of tech industry will grow up with this as the new normal. Change is inevitable, broadly speaking.
• deleted 3y ago
  [deleted]
• Pet_Ant 3y ago
  From https://www.couchbase.com/blog/couchbase-adopts-bsl-license/ https://www.couchbase.com/blog/couchbase-adopts-bsl-license/ it says: > BSL provides a Change Date usually between one to four years in which the BSL license converts to a Change License that is open source, which can be GNU General Public License (GPL), GNU Affero General Public License (AGPL), Apache, etc. So to me the most important question is what is the change license and how long does it take? If it's 1 year then it goes MPS 2.0: okay that's fine. But if it's much longer and more restrictive than it's a real about face and means the opensource version is really not workable as it's too far behind the head. --- EDIT: > 4 years, MPL 2.0 https://www.hashicorp.com/license-faq#What's-the-difference-between-the-BSL-and-others-such-as-AGPL-SSPL-or-the-addition-of-Common-Clause-to-agreements-that-HashiCorp-could-have-chosen https://www.hashicorp.com/license-faq#What's-the-difference-... 4 years is basically "of historical interest" only especially when security is involved.
  • malyonsus 3y ago
    https://www.hashicorp.com/license-faq#What's-the-difference-between-the-BSL-and-others-such-as-AGPL-SSPL-or-the-addition-of-Common-Clause-to-agreements-that-HashiCorp-could-have-chosen https://www.hashicorp.com/license-faq#What's-the-difference-... Four years, MPL2.0
• peppermint_gum 3y ago
  It is important to understand that there are two kinds of open-source software: - Software made by startups that are precious to HN. In this case, building a business on top of them is "freeloading" and it's deeply immoral. Examples: Elastic, HashiCorp, Mongo - "Public good software", there's nothing wrong with profiting from it, in fact, it's encouraged. Examples: Linux, Postgres, Nginx, Apache
  • arianvanp 3y ago
    I don't think nginx is a good example though. They have a lot of features they refuse to get contributed as they want them paywalled in nginx-plus Like service discovery and better load balancing algorithms.
    • gabeio 3y ago
      Isn’t it though? Nginx (org) allows companies like Kong (org) to exist? I honestly think that’s a better relationship, kong basically advertises nginx (seems that nginx also talks about kong openly)… and yet both have enterprise services. They may not be in direct competition but they do have overlap. That’s what good competition looks like. Edit: I do not know if kong pays nginx.
  • wmf 3y ago
    Or another way to look at it: software that volunteers can't/won't develop and thus will only exist if a company can sustain itself vs. software that volunteers can and will develop.
    • 015a 3y ago
      Open source software, by and large, is not maintained by volunteers, and I think the view of it is harmful to understanding how open source works. The vast, vast, vast majority of open source software was created by engineers at for-profit companies where, through their line of work, they faced a problem, and after solving it had the insight "hey, other companies may have this problem". On the flip side, the vast majority of maintainers are engineers at for-profit companies who face new problems related to the software every day, and share their solutions back so we can all benefit from everyone else's work. Its not the old fable of the greybeard in his basement tirelessly maintaining some internet-critical piece of software (though, those definitely exist). Its: "Hey, your business uses Kubernetes and derives millions in revenue either directly or indirectly from it? Mind helping keep it going?" This is critical to understand because: Vault and Terraform could absolutely have been sustained and grown by the community of its users. There is zero doubt in my mind of this. List the top 50 websites by traffic volume, and every single one of those companies uses both of these products, extensively; many of the companies have engineers devoting effort toward projects like Linux, Kubernetes, Javascript, or Postgres. Vault and Terraform aren't even close to a situation of "but who maintains it"; Hashicorp just refused to let anyone have power in the project that wasn't on their payroll. Far more open source projects die due to this than a lack of interest in maintenance. The root problem isn't profit motive; its venture capital. To some degree, it is also: projects created to solve the problems of their users before their creators actually have the same problem.
• deleted 3y ago
  [deleted]
• Pet_Ant 3y ago
  I always thought that OSS was supposed to be a loss-leader. By being the author you have more credibility for offering services. Sure someone else can do it, but are they really gonna know how to offer support in some rare crazy edge case that is blowing up production right now?
  • madeofpalk 3y ago
    loss-leader for what?
    • Pet_Ant 3y ago
      For support contracts, services, consulting, and customisation.
      • wmf 3y ago
        That doesn't generate enough revenue to sustain development.
        • jsnell 3y ago
          Here's Hashicorp's financials: https://ir.hashicorp.com/news-releases/news-release-details/hashicorp-announces-first-quarter-financial-results-fiscal-0 https://ir.hashicorp.com/news-releases/news-release-details/... They made $102M of revenue from support in the latest quarter. Their cost for providing the support was $15M, and their entire R&D costs were $54M. (Professional services was a tiny amount of revenue in comparison, and at break-even.) Clearly support and services could easily generate enough revenue to sustain development. What it can't currently sustain is their $91M / quarter of sales and marketing.
          • wmf 3y ago
            They need $91M of S&M to get $102M of revenue though, so the $11M net doesn't cover $54M R&D.
      • 3y ago
• nonameiguess 3y ago
  This one is interesting to me. I've been a big fan of Hashicorp ever since the only thing they had was Vagrant over a decade ago. The core of my usage has remained all of the CLI tooling, i.e. Packer, Terraform. It's more or less impossible to create any kind of competitors by trying to steal from these as they're free to begin with, plus they provide virtually no value on their own and rely on a universe of a providers and plugins to actually do anything, some of which are created by Hashicorp, but many of which are not. One of the more extensive foolaround tools I ever made was vaguely inspired by Packer, years ago when there wasn't a plugin to support Hyper-V and I wanted automate creating machine images for my Windows laptop to run various flavors of Linux so I could work on Linux from Scratch over and over without having to copy/paste everything at the command line. It was only "architecturally" inspired, though. I didn't even look at their source code and wrote everything from scratch entirely in Powershell since it was only for personal use and only intended to run on Windows. I guess the signal here is they care more about and have pivoted business-wise to their own hosted offerings. I admit I'm not entirely sure what those are. I don't anyone that uses Terraform Cloud, but I guess someone must. So I guess Consul, Nomad, and Vault, but again, does anyone use the hosted versions of these? The big sell to me has always been all of their products can be self-hosted. Professionally, my use has mostly been with defense and intelligence customers offering behind an air gap who couldn't use the cloud offerings if they wanted to. By far the biggest value add has always seemed to be Vault. Consul and Nomad have very clear competitors that still command more mindspace, but Vault seems to reign supreme if you want to self-host a secrets manager. On this front, though, as great of a product as it is, how much of that is even due to Hashicorp itself? The security is provided by implementations of open encryption algorithms, Shamir secret sharing, fips modules in the OS, and HSM support, but they don't make the HSMs. HA is provided by the Raft implementation of the Paxos family of consensus voting, but again, they didn't invent that. The fact this product exists at all is because they stood on the shoulders of giants who did all the heavy lifting in creating these secure and robust algorithms in the first place, and then shared them and allowed others to build commercial offerings on top of them. Your entire company exists because of other people's open source efforts, and then you close off and say no one else can build on top of your work, when if the OGs had done that, your product would never have been a viable business.
• danw1979 3y ago
  I’m really loosing faith in Hashicorp recently. Moving away from the easy-to-predict flat rate Team pricing and to a new model based on number of managed resources ($0.000004 per resource per month or something like that) was just wacky… … and now this “you can’t make money from the software you helped write” BS.
• A1kmm 3y ago
  I don't know if I've ever seen so many useful Open Source software products go proprietary at once; Vault, Consul, Terraform are all useful parts of many people's stacks, that they chose specifically because of their licence. Hopefully they all get forked (or existing forks take off), and it is just a matter of the community converging on the winner that we all use in the future.
  • lijok 3y ago
    Not possible, at least for vault and terraform The way the architecture works, any fork would have an impossible task to take off and maintain compatibility
    • yjftsjthsd-h 3y ago
      Why would that be impossible? Take the last OSS version, make changes in a backwards-compatible way, deploy them.
• buzer 3y ago
  Actual full license seems to be here: https://github.com/hashicorp/terraform/blob/e94ce2dd3877096b945309e38f3321b921f95b56/LICENSE https://github.com/hashicorp/terraform/blob/e94ce2dd3877096b...
• vmatsiiako 3y ago
  All this implies is that Hashicorp is no longer an open source company. Many of Hashicorp's actions like this one run completely against the nature of open source software. Another example is `Hashicorp Vault Secrets` - which they just launched as a closed-source SaaS only tool. I'm obviously very biased, but take a look at Infisical as an open source alternative to Vault: https://github.com/Infisical/infisical https://github.com/Infisical/infisical (we run under MIT + some enterprise features).
• deleted 3y ago
  [deleted]
• swyx 3y ago
  > Why is HashiCorp making this change? > > We strongly believe in the value of openly sharing source code and enabling practitioners to solve their problems, building communities, and creating transparency. HashiCorp provides feature-rich products to the community for free, and that development is made possible by our commercial customers who partner with us. By shifting to this license, HashiCorp can better manage commercial uses of our source code and continue to invest in our thriving community of practitioners, many of whom are contributors, in a manner that will not impede their work. i strongly appreciate the FAQ but this part felt weak/not the whole truth. What is not being said? who is hashicorp afraid of? there wasnt a doubt in my mind before and now there is. indeed i just saw a startup demo today show off a feature that they admitted was just Vault in a wrapper (they even called their thing Vault haha) and that was it, but i would not have thought Hashicorp would mind them at all (its a very new startup)
  • nine_k 3y ago
    Why, quite clearly: > Organizations providing competitive offerings to HashiCorp will no longer be permitted to use the community edition products free of charge under our BSL license. Commercial licensing terms are available and can enable use cases beyond the BSL limitations. Looks to me very similar to (A)GPL + commercial dual licensing, for instance.
    • tedivm 3y ago
      I wish they'd just use the AGPL then.
      • sneak 3y ago
        There are many of us who regard the AGPL as a nonfree license, just like the BSL.
    • ec109685 3y ago
      Quite clearly? That is extremely vague and leaves up to Hashicorp’s interpretation and could change as Hashicorp’s portfolio expands.
• lucasfcosta 3y ago
  It’s really interesting when someone takes contributions under the MPL license for years only to relicense later under a restrictive license. IMO they should just avoid open-sourcing the cloud platform if they want to sell it. Also, why not just have gone with GPL since the beginning to at least benefit from the repackaging too?
  • nine_k 3y ago
    > On a specified Change Date, or the fourth anniversary of the first publicly available distribution of the code under the BSL, whichever comes first, the code automatically becomes available under the Change License. Our current Change License for HashiCorp projects is MPL 2.0. I wonder if whatever MPL 2.0-licensed contributions were made less than 4 years ago.
  • jen20 3y ago
    The cloud platform is not and never has been open source.
  • kam 3y ago
    They didn't take contributions under the MPL. They required their CLA too, giving them the rights to do this. Contributors should consider it as a red flag when a project isn't willing to accept inbound contributions under the same terms as they grant to others.
• ris 3y ago
  Luckily I've just remembered I don't need to maintain or contribute to terraform providers anymore.
  • hardwaresofton 3y ago
    Write them for Pulumi!
    • ris 3y ago
      Firstly I don't have any particular faith in them either given their business model appears to be sending them towards a similar path. Secondly, I think encouraging people to write their infra configuration in a general purpose imperative language is quite possibly the worst idea I've ever encountered. As botched an attempt Hashicorp made at designing HCL, they at least had the good sense to make it declarative.
      • jen20 3y ago
        > I think encouraging people to write their infra configuration in a general purpose imperative language is quite possibly the worst idea I've ever encountered. Good news: Pulumi is also entirely declarative. The model is what matters in this regard, not the syntax used to express it.
        • hardwaresofton 3y ago
          Perfectly put. To add to this, having the full expressive power of a programming language for syntax is the way to go. When you have to add explicit looping in your DSL, it’s time to not use a DSL. HCL is my least favorite part of the hashicorp ecosystem. Also it’s not like you have to take my word for it — the trend towards CDKs shows that pulumis approach was right. They were just early
        • ris 3y ago
          This doesn't wash. The DOM is a declarative model, but that doesn't mean that a javascript program can't be a horror story of side effects and improperly grasped execution order.
• benatkin 3y ago
  Since Vagrant is currently under the MIT license rather than the MPL, does that mean it won't be changed? It says "All Products".
  • mdaniel 3y ago
    You are misinformed: https://github.com/hashicorp/vagrant/blob/main/LICENSE https://github.com/hashicorp/vagrant/blob/main/LICENSE I actually went to look that up because "who, exactly, are they envisioning making a hosted copy of Vagrant?!" FFS I hope these contributors yank their PRs https://github.com/hashicorp/vagrant/pulls https://github.com/hashicorp/vagrant/pulls
    • benatkin 3y ago
      Now my comment is wrong, haha https://github.com/hashicorp/vagrant/commit/a7135c000b55fbc2a346baf1dbf8169beedccf0f https://github.com/hashicorp/vagrant/commit/a7135c000b55fbc2...
• deleted 3y ago
  [deleted]
• andrewstuart2 3y ago
  That's pretty disappointing. I personally haven't used much beyond vault (I've used but not enjoyed or built anything on terraform), but this is pretty diametrically opposed to what I appreciated most about hashicorp products. Heck, I've even contributed a chunk of the code I use the most from vault (Cert management) and now I'm going to have to reevaluate whether I can attempt to use that service for customers going forward, and whether I will contribute ever again. It definitely feels like the whole era of VC drying up is bringing out the worst possible future for some of these non GPL/similar licenses. Which is unfortunate for any of us who have deliberately learned only OSS and operations around it, giving back the whole time, with dreams of building services that leverage that knowledge someday as a chance to be our own boss while also utilizing and giving back to the OSS that got us this far.
  • randmeerkat 3y ago
    > That's pretty disappointing. From the article: “End users can continue to copy, modify, and redistribute the code for all non-commercial and commercial use, except where providing a competitive offering to HashiCorp.” Literally nothing has changed, this isn’t disappointing, it’s smart, they’re protecting themselves against cloud providers that have repeatedly abused the goodwill of the open source community.
    • ugh123 3y ago
      > they’re protecting themselves against cloud providers that have repeatedly abused the goodwill of the open source community. e.g. AWS -> Elasticsearch.
      • nostrebored 3y ago
        Absurd. Providing a managed instance of open source software that’s complicated to manage is fine. It’s not AWS’s fault that Elastic did a bad job of selling into AWS accounts. They should have worked on their value prop.
        • 3y ago
• moderation 3y ago
  Boost Software License 1.0 - BSL-1.0 [0] Business Source License 1.1 - BUSL-1.1 [1] 0. https://spdx.org/licenses/BSL-1.0.html https://spdx.org/licenses/BSL-1.0.html 1. https://spdx.org/licenses/BUSL-1.1.html https://spdx.org/licenses/BUSL-1.1.html
• INTPenis 3y ago
  License ethics discussion aside, this is going to cause mayhem! :D I know of at least one massive global company using vault in production, for free as a backend to their own password manager frontend. My own $dayjob was just going to set it up actually, I guess we'll have to re-evaluate that now. I can't even imagine how many companies use vault in production.
  • tensor 3y ago
    On the plus side they don't need to panic, they can keep using the last open source version and patch it themselves if needed.
  • wlonkly 3y ago
    But the license prohibits competitive use, not commercial use, right? So using Vault in production is no problem if you're using it as part of the infrastructure of a company that isn't competing with Hashicorp. Using it as a backend for a password manager... more of a grey area, but Hashicorp doesn't offer a password manager.
    • deadbunny 3y ago
      But what if they do in X years? Suddenly that company is out of compliance with the BSL.
      • wlonkly 3y ago
        Oh, for sure, and if you're a developer tooling/devopsy-stuff company that would give me pause (or convince me to plan a migration, or to use an alternative, etc.) But if you're, say, fashion retail, or something, then the risk is pretty low.
        • iavael 3y ago
          > then the risk is pretty low And then Amazon buys Hashicorp.
    • 3y ago
• paxys 3y ago
  At this point if you are actively spending time and effort contributing to any open source project while not being affiliated with (and getting paid by) the company that manages it, know that you are being taken for a ride. Your contributions are eventually going to be moved under a non-open license so the company in question can secure their revenue stream and you can do nothing about it.
  • Terretta 3y ago
    Or, unlike closed products, you're getting to bet on a product that can be made to the way you need it to, as literally as possible. Think how difficult it is to get most companies to listen to your needs, much less ship what you need, versus being able to contribute your own pull request and have it merged. Why should this mean the source owner deserves any less of a product revenue than the company that won't let you add your own features? It shouldn't. If you get your feature merged at the long end of a customer relationship / product manager interaction, do you expect that means you should get paid for your feature request or get to keep it? If you write the spec for your feature in code instead of a PowerPoint or Word doc, so it does what you need exactly right, you're still asking them to ship a feature you need, just better specified and delivered sooner. It lowers the overhead both firms waste, which lowers your licensing cost and your cost of delay. From the viewpoint of a CTO of a mega enterprise -- a vendor that lets me make things work is worth more per month to me than a vendor that won't, and no, I don't expect my enterprise get paid for the vendor accepting the fix that scratches my particular itch.
    • whimsicalism 3y ago
      Sure but then just go with the BSL from the start. Relicensing where you know ahead of time you are going to is icky
  • PoignardAzur 3y ago
    > Your contributions are eventually going to be moved under a non-open license so the company in question can secure their revenue stream and you can do nothing about it. I think what you say is factually correct, but maybe misrepresents the situation a bit. The license automatically converts to full open-source after 4 years. Maybe this isn't ideal, but it isn't "big company takes your code and locks it away forever" either.
• deleted 3y ago
  [deleted]
• hardwaresofton 3y ago
  I fully support hashicorp’s prerogative to be paid for their hard work, but I am also glad I did not enter the ecosystem. Looks like it stays k8s + pulumi + ansible for me. I do think they’ll be able to benefit from this though — serious businesses that derive value from their offerings should be comfortable paying more/something for the value they’re receiving.
  • tedivm 3y ago
    Pulumi uses Terraform providers under the hood. You're in their ecosystem.
    • hardwaresofton 3y ago
      I'm using their ecosystem indirectly, not locked into it, with an option to leave whenever I want, with a superior computation model (in the case of Pulumi), that's the point. If Hashicorp changes all the licenses of the providers they maintained, then that's fine -- I have no right to demand free work from them. I would be worrying a lot more if all my automation was built on Terraform, Consul, and Nomad, though -- and I'm glad I didn't do that.
• candiddevmike 3y ago
  It's funny/sad that they require Terraform providers to be FOSS.
  • mdaniel 3y ago
    I was curious to find where they said that, and the specifics, and the closest I came was https://developer.hashicorp.com/terraform/tutorials/providers/provider-release-publish#prerequisites https://developer.hashicorp.com/terraform/tutorials/provider... which just states > To release and publish the HashiCups provider to the Terraform Registry, you must publicly host the source code in a GitHub repository you own. without the FOSS part. Do you have a different link?
    • candiddevmike 3y ago
      https://developer.hashicorp.com/terraform/docs/partnerships#provider-license https://developer.hashicorp.com/terraform/docs/partnerships#...
      • mdaniel 3y ago
        Ah, just for Partner certification. Still, yes, that's some "for thee not me" hypocrisy for sure also, for future generations, the permalink(?) is https://github.com/hashicorp/terraform-docs-common/blob/e4cce96ebb3a98837b0a68886fb7430c3cff9dd9/website/docs/docs/partnerships.mdx#L105-L123 https://github.com/hashicorp/terraform-docs-common/blob/e4cc...
• Patrickmi 3y ago
  [dead]
• candiddevmike 3y ago
  BSL Conditions: You may make production use of the Licensed Work, provided such use does not include offering the Licensed Work to third parties on a hosted or embedded basis which is competitive with HashiCorp's products.
• mqus 3y ago
  > However, there are other vendors who take advantage of pure OSS models, and the community work on OSS projects, for their own commercial goals, without providing material contributions back. Vendors like Hashicorp, that take advantage of contributors who give away their work(PRs) under the MPL, only to then have this work relicensed to a different license? Hashicorp could just request the source code from those "vendors" (after all, the MPL has copyleft) and integrate their changes. (They have to be users first but this shouldn't be that big of a problem). I wonder who the freeloader really is. CLAs should not be accepted. Ever.
• scrps 3y ago
  Another week, another rugpull.
• CrLf 3y ago
  Over the years, I think most people came to understand "open source" as something closer to "free software". However, that's clearly not the case for projects controlled by a single entity that require copyright assignments from contributors. Copyright assignments are put in place for exactly this (allowing a single entity to relicense the whole codebase unilaterally based on their own interests), and we should maybe come up with a better term than "open source" for projects in this situation.
  • Galanwe 3y ago
    Why? "Open source" has a clear meaning: the source code is open. It does not imply that the source is free to see, free to modify or free to fork. I'm pro open source, but I also have no problem that said source is not copyable, redistributable, etc. To me open source is about _knowledge_ of how something is done. Period.
    • ploxiln 3y ago
      There's a pretty good Open Source definition that's over 20 years old: https://en.wikipedia.org/wiki/The_Open_Source_Definition https://en.wikipedia.org/wiki/The_Open_Source_Definition "Business Source License" is not Open Source. You don't have to release your software as Open Source if you don't want to, I certainly write a lot of non-open-source software for a living. But people/companies want to take advantage of the good-will/reputation that comes from calling their software Open Source, and associating it with really Open Source software, without really making it Open Source. That's sleazy.
      • Galanwe 3y ago
        It does definitely count as open source. I don't care what a California-based "Open Source Initiative" group try to define as "Open Source Definition". That is all lobbying to me. If I can see the source, then it's open source. The rest is just play on words which only purpose is to entertain sterile debates of zealot groups attempting vocabulary appropriation in a power struggle. I don't want to fuel these groups' debates around "free software" vs "open source", Linux vs GNU/Linux or whatnot.
• voganmother42 3y ago
  Wonder what this means for gitlab-managed terraform state
  • mdaniel 3y ago
    IANAL but I believe this change applies only to Hashicorp source code and not API compatible endpoints. So, had (and for clarity, they for sure did not) GitLab used terraform source code to implement such a state provider, yes, they'd run afoul and have to fork or relinquish their license of the source But similar to the GitLab Sentry backend API (e.g. https://gitlab.com/gitlab-org/gitlab/-/blob/v15.0.0-ee/lib/api/error_tracking/collector.rb#L71 https://gitlab.com/gitlab-org/gitlab/-/blob/v15.0.0-ee/lib/a... ) the Terraform state endpoints are also in Rails, just like all the rest of the Internet facing GitLab API: https://gitlab.com/gitlab-org/gitlab/-/blob/v15.0.0-ee/lib/api/terraform/state.rb#L34 https://gitlab.com/gitlab-org/gitlab/-/blob/v15.0.0-ee/lib/a... as an additional "FWIW," the TF docs even claim they welcome alternative implementations of registry.terraform.io although I'm guessing one quick git commit and that language could disappear, too: https://github.com/hashicorp/terraform-docs-common/blob/e4cce96ebb3a98837b0a68886fb7430c3cff9dd9/website/docs/registry/private.mdx#L23-L25 https://github.com/hashicorp/terraform-docs-common/blob/e4cc...
• skybrian 3y ago
  Example license (for Vagrant) here: https://github.com/hashicorp/vagrant/blob/main/LICENSE https://github.com/hashicorp/vagrant/blob/main/LICENSE Looks like it converts to the Mozilla Public License after four years: > Effective on the Change Date, or the fourth anniversary of the first publicly available distribution of a specific version of the Licensed Work under this License, whichever comes first, the Licensor hereby grants you rights under the terms of the Change License, and the rights granted in the paragraph above terminate.
• Aeolun 3y ago
  I want a MIT/Apache license that guarantees it’s not going to be modified in the future.
• metadat 3y ago
  Funny how @mitchellh has decided not to join the conversation. Pretty sure he had the ultimate input on this decision, and historically he's engaged with HN directly. Hmm. Overall it seems like a loser move. Look what happened to Elasticsearch - to me and most others, ES no longer exists. I've happily moved on to OpenSearch and not looked back at poor kimchi. Due to their own actions, Elasticsearch is no longer relevant. Will Hashicorp's move spur a similar effort to fork the last open-source license version of Terraform and other Hashicorp tools? What other choice is there when the creator gets petty and insecure, and goes hostile against the open source community that helped create it? Extremely disappointed with the Hashicorp leadership team. MitchellH and your little sidekick Armon Dadgar - you owe your community better than this. I interviewed with Hashicorp back in 2016 and ended up turning down the job. I used to have a small amount of regret about this decision, but now that true colors have been revealed, I know I made the right call. What's that saying about trust? Trust takes years to build, seconds to break, and forever to repair. It's surprising to learn that people I thought were so smart could turn out to be this dumb!
  • koolba 3y ago
    Does anybody even pay for terraform? Outside the “workspace” hosted product, it’s all free as in beer for all the providers.
    • metadat 3y ago
      Irrelevant in the grand scheme of things, at this scale of developer community it's all about mindshare. They could've created a compelling paid support or other product offerings, but haven't, or maybe took too much funding and the VCs forced their hand. Regardless, it's a 1-trick pony. Even though they have other cool shit, Terraform is the golden goose, and they just strangled it. Now someone will fork it to "Terrafoam" or whatever and that'll be it. MitchellH's vision and expertise is no longer critical to the project.
    • glenngillen 3y ago
      Yes, check some of the previous HashiConf keynotes to see the types of customers that are paying for it and which products they use. Also HashiCorp's financials are public, although without a per-product breakout. You'll have to connect the dots between some of these things to try and get into the rough ballpark.
• Coryodaniel 3y ago
  If GitHub lets someone run "terraform apply" in a GitHub action. Is GitHub a competitor?
• throwawaaarrgh 3y ago
  Quick reminder that open source is not a business model. If you can't compete on service, you will always end up doing this to try to slow down your competitors. On an unrelated note, I've always loathed their antagonistic approach to users and hope their company dies so the industry can standardize on less crappy cloud configuration management tool. But unfortunately incumbents take a very long time to defeat.
• glenngillen 3y ago
  I've had this conversation a few times with people today so I may as well have it publicly here now too. I feel especially privileged to have lead the Heroku Add-ons/Ecosystem team at a pretty pivotal time in devtools history. There was a sudden emergence of people/companies inventing entirely new things (e.g., databases, logging systems, telemetry, etc.) and so much of it was OSS. The overwhelming majority of these companies took the approach of "we'll make this thing free and successful, and we'll build a business off the back of enterprise support contracts and maybe some feature discrimination in a private 'enterprise' version" (e.g., clustering/HA support). I think in part it was because back then the only open source success story anybody had as a reference was RedHat, and cloud adoption wasn't as ubiquitous as it is today. Certainly not in the enterprise segment. So in the vacuum that was left emerged a whole industry of smaller startups that would provide said technology as a managed service. Go check out the Heroku Add-ons Marketplace circa 2012-2015 to see what I mean. Belatedly the creators of these technologies realised the enterprise support contract business was a terrible business to be in, and realised managed services was where they should have been all along. Absolutely none of these companies had any problem muscling in on the ecosystem of managed providers that had contributed to their success in a meaningful way. Some of the startups got acquisition offers on pretty lowball terms, others were essentially forced to accept partner terms that were so onerous it was doubtful they could ever turn what they'd built into a successful high growth business now. Many saw the writing on the wall and found an exit at a larger cloud/platform company that could roll them into their broader product portfolio. Fast-forward a few years and AWS starts offering some of these technologies as a managed offering (disclaimer: I later worked at AWS for a couple of years). Suddenly these same companies don't like having similar market pressure exerted on them, and so begins the slow trend of license changing away from APL/MIT/whatever towards something that is trying to neutralise a legitimate competitor. Rules for thee, not rules for me. My time at AWS gave me some new perspective on this whole sorry saga though, some things I'd observed but couldn't quite articulate why it didn't feel right. AWS taught me that at a certain level of scale almost everything ultimately becomes a logistics challenge. Trying to ensure that the infrastructure that's supporting tens of thousands of customers globally is constantly running, highly available, able to support the continued growth, etc.? It's as much a problem of capacity planning and co-ordination as one of software. And the more successful you get the less the problem becomes the specific nuances of running a given OSS product and the more it skews towards just knowing how to coordinate millions of anything. What this surfaced for me is that in the vast majority of cases that I was personally familiar with, the companies in question barely used their own products. I don't mean in way that suggests they didn't believe in their value. It's just that their day-to-day needs of building said product very rarely intersected with the need to be the most sophisticated user of said product. They had very limited experience at operating it at scale, they all had customers (or managed service partners) who had orders of magnitude more experience about the realities of operating it. And high on their own hubris they'd decided that because they'd invented the technology they were now suddenly expected to be the world leaders at running it. They weren't. And they were never going to be, because the moment you hit that inflection point of success AWS/Microsoft/Google/so many others are better at running software than you are... and a license isn't going to change that reality. The "we'll run this for you" is just a bad business to be in. A better business is "we'll provide you a UX and workflow and features _on top_ of that thing that makes it even better". There's a whole industry of companies who exist solely to make your AWS bill comprehensible, because AWS are organisationally incapable of providing good UX for most things. In it's most reductive and cynical take Heroku is "just" a UX on top of the core AWS commodities, one that has been largely unchanged for 5-10 years depending on who you want to ask (the slow decline there is a whole separate topic). Which is why I was excited to take on a product leadership role at HashiCorp to help launch Terraform Cloud a few years ago (I left last year). Here you had an OSS product with a big community, and a set of features and capabilities that extended that to try and make it even better. Especially in situations where you're having to work with other people or across multiple teams. The fact that Spacelift, Scala, Harness, Pulumi, Terrateam, etc. existed didn't bother me much. If they copied what we were doing it was often good validation, if we lost a customer to them it was a good data point for things we were lacking or needed to fix, in some cases they just had wildly different takes on fundamental things which were a great reason for some self-reflection and to question why our conviction on a different way was so strong... were we right? How did we know? OSS is good for so many reasons, but as a product person one of the things I loved most was the way it could help shape what the product could be in the future. Because of the ecosystem that erupts around it. You've already got such a huge advantage as the steward of the project, the most recognised brand in the ecosystem you created, the brand recognition in an enterprise conversation, and so with all of that head start I felt like we should just win on our merits. And if you can't win given all of that advantage then maybe you don't deserve to.
• akamenskiy 3y ago
  While I do understand the reasoning in their FAQ on the subject (https://www.hashicorp.com/license-faq https://www.hashicorp.com/license-faq). I however failed to noticed those intentions in their license text (https://github.com/hashicorp/nomad/commit/b3e30b1dfa185d9437a25830522da47b91f78816 https://github.com/hashicorp/nomad/commit/b3e30b1dfa185d9437...). Specifically the part in FAQ which says "internal production use is fine", but then license says that "non-production use only" and then "You may make production use of the Licensed Work, provided such use does not include offering the Licensed Work to third parties on a hosted or embedded basis which is competitive with HashiCorp's products.". IANAL, but even to me this statement is full loopholes. WHO do we consider 3rd party? WHAT do we consider "hosted or embedded basis"? WHEN do we consider it "competitive with Hashicorps products"?
• gregdek 3y ago
  Meh. Sure, it's hard to make money in open source. I spent 20 years doing it. It ain't easy. But here's the thing: open source also helps you accelerate a business you might not otherwise be able to build. You get market validation by giving away a free thing, and then you hope to be able to collect some revenue on the backend once you've got a large enough user base, a proven product, and maybe even some contributors. Maybe even a whole ecosystem. You think VCs would have thrown all that money at a thing with no users? Want to throw it all out? Fine. That's your right. But it's not gonna stop companies from forking the last open source licensed codebase and taking your cookies. Open core is a thing. You can be good at it, and users understand and respect it. You would think that Mitchell would have learned after his failure to monetize Packer that he needed an actual proprietary value prop to build around before he built Hashi. Guess not. You can't have it both ways.
• easterncalculus 3y ago
  The so-called "Business Source License" always seemed like a huge crock of shit. What criteria is used to determine if another project is competitive with Hashicorp? Ansible modules exist to create cloud resources, and they exist in an actually open ecosystem without being built on terrible DSLs. To be honest I'm not a huge fan of the wringing about the OSI definition, but it exists for a reason. This whole article is just another example of corporate gaslighting. If you don't define this and prevent that definition from being acquired, you're going to keep having CEOs define open source on how they 'feel', and you won't have the 'spirit' of open source at all. I mean it's literally the BS License. You really can't even make that up.
• steve_mcdougall 3y ago
  [dead]
• softwaredoug 3y ago
  This happens because our companies basically want vendors with open code, not open source. Open source implies a model of collaboration between different organizations. A single vendor, even with an OSI license, does not an open source project make. And we have only ourselves to blame. Most companies can’t spare their developers for open source development - it’s time consuming and frankly open source is the outlier in how we think about code ownership and development. It’s hard to be a good steward. It’s hard to pitch the upside of such an abstract investment. In the end, actually want vendors, strongly opinionated solutions, managed by a single entity, but vendors we hire to let us treat their code as open and extensible. I wonder if this era of single-vendor “open source” will be looked at not because it redefined open source but because it changes how we think about vendors, expecting certain types of code access and transparency.
• alance 3y ago
  The licensing changes seem to imply that if they have a service and you also build a similar service, but offer it for cheaper, then (if they want to) they can price you out of the market with licensing fees. One of my weekend projects https://tfstate.com https://tfstate.com is intended to aid with statefile configuration drift detection. Which (I've since discovered) is also something that Hashicorp offers as a service. I feel worried.
• martey 3y ago
  HashiCorp's CLA page from two months ago (https://web.archive.org/web/20230610041432/https://www.hashicorp.com/cla https://web.archive.org/web/20230610041432/https://www.hashi...): "We require our external contributors to sign a Contributor License Agreement ("CLA") in order to ensure that our projects remain licensed under Free and Open Source licenses such as MPL2 while allowing HashiCorp to build a sustainable business. HashiCorp is committed to having a true Free and Open Source Software ("FOSS") license for our non-commercial software. A CLA enables HashiCorp to safely commercialize our products while keeping a standard FOSS license with all the rights that license grants to users: the ability to use the project in their own projects or businesses, to republish modified source, or to completely fork the project." It's disappointing that the non-legal text on the page repeatedly suggested that signing a CLA would help keep HashiCorp projects open source when the actual text of the license agreement made no such claims.
  • candiddevmike 3y ago
    > The CLA does not change the terms of the standard open source license used by our software such as MPL2 or MIT. You are still free to use our projects within your own projects or businesses, republish modified source, and more. Please reference the appropriate license for the project you're contributing to to learn more. Someone should try challenging the CLA when the pretext of it changes (their contributions being relicensed to non-FOSS). Most CLAs are very dry but HashiCorp may be in trouble with all the proclamations in theirs.
    • gabeio 3y ago
      I would agree except it seems that the Legal Terms and Agreement doesn't even mention any of that (even if the marketing part of that page does). > You hereby grant to HashiCorp and to recipients of software distributed by HashiCorp a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Your Contributions and such derivative works. This pretty much covers anything they'd need. (I'm not a lawyer.)
  • sneak 3y ago
• NathanFlurry 3y ago
  We built our OSS company (Apache 2.0) with Nomad at its core. We provide game server orchestration with a handful of services around it, which could be misconstrued to be considered providing a "competitive offering to HashiCorp." Needless to say, we'll be freezing our Nomad version at the last MPL version because of how vague the license is (intentionally). We also use CockroachDB which uses BSL, but we're not providing a remotely competitive offering. I'll likely continue to recommend HashiCorp products (Nomad, Consul, Terraform, and Packer) to anyone who asks my advice, but it's disappointing to hear this change. We maintain a rudimentary SBOM for anyone curious: https://github.com/rivet-gg/rivet/blob/main/docs/infrastructure/SBOM.md https://github.com/rivet-gg/rivet/blob/main/docs/infrastruct...
  • schmichael 3y ago
    Please reach out to me: schmichael at hashicorp. I’m the Nomad Eng Lead and while licensing is out of my control we have a lot of users in a similar position to you: not knowing what might someday could be construed competition. I can’t make any promises but will do whatever I can to give you confidence that Nomad is still the right tool for your job.
    • scrollaway 3y ago
      It sounds to me like GP thinks Nomad still IS the right tool if they’re freezing its version. Problem is with the license not the tool. It’s nice that you’re trying to do what you can, but it’s like trying to sell roof insurance to a homeless person.
    • thenaturalist 3y ago
      Clearly you have good intentions and offer your support voluntarily, but > I can’t make any promises... really sums it all up in light of these big changes, and simply put the big picture (aka licensing) is what people build and bet their professional lives on.
  • miraculixx 3y ago
    My thought too. But it won't last for long. Security bugs will show up. What then?
• roschdal 3y ago
  Someone should fork and maintain Vagrant with an MPL open source license: https://github.com/hashicorp/vagrant https://github.com/hashicorp/vagrant
• solatic 3y ago
  Bought HCP at the IPO, took a massive paper loss when the tech bubble in the market burst, but held onto the stock as a long-term hold because I believed in the core of the company. Fuck this, I'm selling just as soon as the market opens. It's clear that Hashicorp's internal culture has moved 180 degrees away from where they were in the Terraform 0.x days.
• Coryodaniel 3y ago
  Locked them comments down quick on the PR: https://github.com/hashicorp/terraform/pull/33661 https://github.com/hashicorp/terraform/pull/33661
• speedgoose 3y ago
  Well, that simplifies a lot the choice between Nomad and Kubernetes.
  • personomas 3y ago
    Nomad is a dead product. I think Terraform has hope though
    • sgt 3y ago
      Why do you say that? I've been considering Nomad recently and I didn't perceive it as dead at all. Their community seems pretty vibrant too.
      • personomas 3y ago
        TBH I don't know anything about Nomand. Feel free to use it. That might be good for you, I certainly don't want to deter you. All I meant was that I didn't think Nomad would survive in the Long Term a change of license from MIT to BSL, when there also exists Kubernetes. On the contrary, I think Terraform will survive in form or another. Either the BSL license will be lenient enough or people will fork Terraform and support it.
        • sgt 3y ago
          Your statement was "Nomad is a dead product" without knowing anything about the product. That's something to consider next time you make such statements.
          • personomas 3y ago
            I think I know enough to make the statement, actually. I don't know enough to tell some random person not use it. Think about that. I at least uphold the integrity to be honest with you!
            • 3y ago
• thrillgore 3y ago
  > However, there are other vendors who take advantage of pure OSS models, and the community work on OSS projects, for their own commercial goals, without providing material contributions back. We don’t believe this is in the spirit of open source. There's a license that actively prevents this. It's called the GNU GPL. Has anyone here identified any forks that predate the license change?
• thallavajhula 3y ago
  >We don’t believe this is in the spirit of open source. Open source seems to be evolving from being truly open source to being a variant with financially driven contingencies. HashiCorp have created great OSS over the years and am grateful for it. I understand their intention behind this move, but having a financially driven motive drive their OSS is not a good thing. I'd rather they not open source any of their code than put such limitations on it with these licenses.
  • thenaturalist 3y ago
    Ahem... Welcome to VC-fueled hypergrowth-capitalism!
• preisschild 3y ago
  Bait and switch. Don't sign CLAs. https://drewdevault.com/2023/07/04/Dont-sign-a-CLA-2.html https://drewdevault.com/2023/07/04/Dont-sign-a-CLA-2.html
• laserbeam 3y ago
  This is the first time I hear of BSL. So here's my problems with it (and the article). 1. The article doesn't link to the actual text of the BSL in use. Link it please! 2. In my understanding, all BSL 1.1 are different, and differ by 2 factors: Additional Use Grant and Change Date. Those are both reasonable ideas but I wish they went a step further and the license would be formatted like Creative Comons. That one also provides versions that differ from use to use but you can instantly tell from the title which version is applied. I wish there was an official "BSL 1.1 4year non-compete" name for this with a good general definition of "non-compete" (and a few other common commercial uses to be granted).
• _cenw 3y ago
  Honestly, I've been pretty disappointed with HashiStack for a while. It always seemed like they didn't really take any minor contributions unless requested from a customer (i've been waiting for terraform to support a 2-3 year old vault PKI keys for a while). They also dark patterned their website recently to make download links and documentation hard to find. I've seen one quote when we wanted to buy Vault Enterprise for peace of mind (we did not need namespaces), and well, it was completely out of reach. Moon prices. No wonder people turn to someone else hosting these products for them.
• mnahkies 3y ago
  Feels like this could be a big issue for companies like https://www.scalr.com/ https://www.scalr.com/ - I wonder if they have a commercial license already. I've been tempted to try and put together a terraform cloud alternative myself - whilst I enjoy using it, the pricing is pretty expensive if you have many state files.
• xinayder 3y ago
  As others have pointed out, businesses should just ditch FL/OSS licenses as a whole and be a closed source product from the start. There's a pattern here that, person builds an open source product, gets corporate sponsoring, funds a company, then suddenly the open source product steers away from open source because it's upsetting the corporate sponsors. If you're so bothered by others using your work and not giving back (something that is ENTIRELY allowed by FL/OSS licenses), why make it open in the first place? It kinda passes the image that these companies want to benefit from free work, but the moment someone uses their product for free and doesn't give back, it's just a nuisance for them. as always, the hobbyist linux hacker is the problem (/s)
• leg100 3y ago
  I've built an open source clone* of terraform cloud. Will it contravene BSL? 1. Under the hood, it runs the terraform binary. 2. Receives API calls from the terraform binary. 3. Uses a modicum of code from the terraform cloud SDK. I think I've answered my own question with (1), which may constitute "hosting" or "embedding" a Hashicorp product. * https://github.com/leg100/otf https://github.com/leg100/otf
• bayindirh 3y ago
  Honestly speaking, I'm not surprised, not because it's HashiCorp, because they are moving away from BSD/MIT style license to a much more restrictive source-available style license. "Open Source" software always have been loved by companies because it provided extreme flexibility (closed forks, forks for customers, secret sauce addition, etc.), plus announced the message that their code is free for all, given there's no warranties. These companies have skipped more nuanced licenses such as Apache, MPL, EPL even GPL in some cases, trusting that every actor in the software landscape is rational and ethical. The idea was nice, but it involved humans. After a couple high caliber forks, HashiCorp indeed felt the pain, and reflexively they moved to BSL. What they forgot is their initial license has been designed to allow this in the first place. MIT/BSD/Expat is not suitable for monolithic code bases of this size, but people won't listen. On the other hand, the code is HashiCorp's. They can do whatever they want with the code they write and put out there. They decided to change the terms they share their license, and nobody can say anything about it. Is it ethical? No. Were the forks were ethical? Depends on motivation. These things happen when you choose a license without much consideration for the future. Maybe we shouldn't abuse Open Source software this much and embrace "Free Software" more, but this is just me. So, at the end, "market forces" abused HashiCorp and, HashiCorp reacted. This is a normal impact/response event. Nothing extraordinary. Edit: While one may argue that this is also similar with RedHat/IBM, The impact of the change, the number of broken promises, ecosystem dynamics and the motivation behind it make it different, yet I don't want to double the size of this comment.
• getcrunk 3y ago
  I think there should be a foss license that acknowledges trillion or billion dollar companies are a threat to freedom and so it’s okay to exclude certain commercial uses (revenue or user count over 9 digits)
• deleted 3y ago
  [deleted]
• Ttrilf 3y ago
  How do you interpret their Additional Use Grant? https://github.com/hashicorp/terraform/blob/main/LICENSE#L8-L11 https://github.com/hashicorp/terraform/blob/main/LICENSE#L8-...
• deleted 3y ago
  [deleted]
• elnygren 3y ago
  Why are people so hostile towards BSL? Paying/asking money for great products is fine and if the product's source code is in git, the better. Not everything has to be _free_. The major benefit of OSS for many is that you can read the source code. The major benefit of paid SaaS is that things just work and you pay for that. BSL can be the perfect combination of these.
  • acatton 3y ago
    I can't speak for other people. I'm not hostile to the BSL, if a company wants to license their products under BSL, I don't care, I will just not use it. The main issue I have with the BSL is opensource-washing were companies basically release an open source product which become popular because it is open source, and then do a bait-and-switch and relicense it under the BSL restrictive license, but still claim "it is open source" which is a lie.
  • growse 3y ago
    They're not hostile to the BSL. Other projects that started out under the BSL (e.g. Cockroach) don't draw the ire. The anger is at a company that trades on the benefits of open source, and then shuts that down when it becomes inconvenient. People think they're free-loading on the contributions of others.
• _odey 3y ago
  Considering this change I want to remove consul from my adoption strategy but I would still like to know of a replacement. Does anyone know of a similar tool? I'm interested only in the ability to manage environment variables with a web UI, and have processes restart gracefully on change, everything else consul provides is not of use to me. Any suggestions?
  • orange-mentor 3y ago
    Etcd + one of the etcd desktop clients. There are a few template+restart tools as well. confd was one such project, iirc. You'll end up writing some glue code.
• cultureulterior 3y ago
  Yeah, time to fork terraform. I'd contribute.
• heipei 3y ago
  What's idiotic is that even Nomad was licensed as BSL but Hashicorp doesn't even offer Nomad as a managed cloud service...
• stevehipwell 3y ago
  AFAIK the official Crossplane providers for AWS, GCP & Azure are built on the respective Hashicorp owned Terraform providers; so I'm not sure how this is going to impact them?
  • leg100 3y ago
    Do they not autogenerate the code for their providers? A recall a big thing being made of that a while back.
• yevpats 3y ago
  IMO Terraform providers should've never been free. It should've been open-core, whether you are running on prem or on the cloud. There are multi-billion dollars companies using Terraform and pay exactly 0$ (yes, some that are generous are paying for support, great but you don't build a business on charity). Maintaining 3000 APIs for GCP, AWS, and Azure is costing at the very list $20M/year - trying to drive everyone to the cloud offering instead of charging for whatever people already use is the wrong way around imo. You can charge less but charging nothing doesn't gonna work. Heck, even a restaurant is charging a bit less for food and then charges more on beverage but it never gives the food for free.
  • rirze 3y ago
    I doubt this. Have you gone through AWS Provider source code? You're telling me that's a multi-million dollar repository? Their schema is horrible, badly documented and barely automated. Maybe the new effort is going into AWS native provider but I really doubt the default AWS provider is getting enough attention.
• Hrun0 3y ago
  It is surprising to see so many people here being shocked that a publicly traded company operates its projects for profit rather than altruism.
  • sneak 3y ago
    It's the hypocrisy of pretending to be open source (which is an ideology) and while shipping nonfree software. Microsoft does it too but they don't pretend to care about software freedoms.
    • Hrun0 3y ago
      Why would you believe a company's supposed ideology in the first place?
• reacharavindh 3y ago
  It’s a pity that it has become a business model. 1. Build a nice product, scream open source everywhere. 2. Get users to buy in on all the niceties, perhaps even nice contributions in terms of integrations and such(that people probably would not have cared for if it was some niche closed source product with much fewer users) 3. Once they are established enough, and people have gotten used to the learning curve, change the license and try to lock in as many users as they can and ignore the loud few who scream foul. Some other product comes out to fill the void and they do the same as above..
• thedougd 3y ago
  HashiCorp’s problem is not competition. I started using Terraform Cloud three years ago for my small department. Prior, I had introduced Terraform Enterprise at a large company. I was initially excited at how much easier it was to get going on TFC than TFE. Of course, that’s often the way of Saas. For the next two years, HashiCorp provided virtually no enhancements to TFC except cosmetic changes. I submitted feature requests for small and large challenges. Sometimes I was even met with argument. Meanwhile, several competing services were born, likely out of necessity of their own founders. Ultimately I had to switch and about halfway out the TFC door they announced their bizarre pricing model changes. HashiCorp had years and years to build a quality commercial product on top of Terraform but squandered the opportunity. At first this reminded me of the Docker arc but it may be more like Chef.
• pachico 3y ago
  Well, the timing is right: env0 just raised 35m in CV and now Hashicorp says you cannot offer something similar to Terraform Cloud anymore.
• voidmain 3y ago
  > You may make production use of the Licensed Work, provided such use does not include offering the Licensed Work to third parties on a hosted or embedded basis which is competitive with HashiCorp's products. Having your use of something important hinge on this one awkward sentence seems kind of scary. It's unclear to me whether, if you use (say) terraform for production infra, and someday HashiCorp releases a new product competitive with yours or merges with your competitor, your use of TF is then in violation of the license. "Offering the Work" is not defined and seems like it could be interpreted in different ways.
• aantti 3y ago
  This is very sad but also not very surprising. It's notoriously hard to sell an 'open core' product (mostly, against yourself OSS) and structure the entire GTM and the org properly for scale. Having built a successful 'open core' company before & judging from the first-hand experience - this looks like an extremely desperate move, indeed. (Btw, we never changed the license, but discussed it often, ofc.) It's also all very disruptive, destructive and hostile to the community - it's 'we aren't open source anymore,' so I'm surprised they are trying to convince people otherwise (gaslighting, eh?) I'd expect the 'open core' enthusiasm of the past few years to decrease dramatically, and I wouldn't recommend an 'open core' path to anyone who's trying to build an actual big company around their OSS. I remember the time when 'open core' was a taboo word, post-MySQL/Oracle. I was doing the company launch and accidentally told a reporter we were doing [something like] open core - that didn't work nicely :) It's ironic and sad, BSL comes from the very same folks who basically invented 'open core', then spoiled it forever. It's been also always thought-provoking to me, too, those folks never build more - or differently - after MySQL.
• lproven 3y ago
  Also see: GlobeNewswire report... https://news.ycombinator.com/item?id=37082263 https://news.ycombinator.com/item?id=37082263 And... https://news.ycombinator.com/item?id=37086136 https://news.ycombinator.com/item?id=37086136 https://news.ycombinator.com/item?id=37086031 https://news.ycombinator.com/item?id=37086031 https://news.ycombinator.com/item?id=37085382 https://news.ycombinator.com/item?id=37085382
• SebastianStadil 3y ago
  Scalr Founder/CEO here. There are a few realistic paths forward from here, to be confirmed when Hashi releases the full license they intend to use. 1. The Terraform community is large and talented, and we care intensely about open source. There will be a fork that remains open, and I'm hoping we can get all the commercial vendors and interested parties to be joint custodians of it. Like joeduffy says, their arguments are disingenuous, and their taking down of previous videos on their open source philosophy is too. 2. There is likely a Bring-Your-Own Terraform path, letting users supply their own Terraform for executing their code, and a commercial ecosystem that dispatches code and processes response with their own secret sauce. Just like you'd do with GitHub Actions. 3. Meanwhile, Terraform up to 1.5.5 is still open source, it's still amazing, and can still be used with the dozens of commercial tools out there.
• purpleidea 3y ago
  I don't think it's good news, but why is anyone surprised? Nobody wants to pay for open source. Companies want it for free, and individuals don't have enough luxury time to be able to do it themselves. Prove me wrong and help patch or fund https://github.com/purpleidea/mgmt/ https://github.com/purpleidea/mgmt/ and you'll have an even better replacement for terraform!
• chanwitkaewkasi 3y ago
  We're the folks behind tf-controller, a nifty GitOps tool bridging Flux and Terraform. We just wanted to clear the air that our tf-controller project happily coexists alongside HashiCorp's offerings, with no intention to compete. More here: https://www.weave.works/blog/statement-for-terraform-hashicorp-license-changes https://www.weave.works/blog/statement-for-terraform-hashico...
• ptdorf 3y ago
  I like how the Hashicorp staff is addressing concerns here /s
• advaitruia 3y ago
  Most of the comments on this thread make it appear that everyone will be affected by this change. The vast majority wont be affected at all. This only affects people who are directly competing with hashicorp using hashicorps code. That sounds like a reasonable thing to want to prohibit. Why should hashicorp have to spend tens of millions on product development only for a competitor to spend zero but be able to offer the same product? That sounds like a net negative for the whole industry as it disincentivizes R&D
• vmatsiiako 3y ago
  Published an article about the new Hashicorp's BSL license that combines some the thoughts in this thread: https://infisical.com/blog/hashicorp-new-bsl-license https://infisical.com/blog/hashicorp-new-bsl-license
• miraculixx 3y ago
  The weird part is that Hashicorp doesn't have a single core product that is valuable by itself. Their stuff is infrastructure built to enable an ecosystem. It's a hub, all the plugins, providers etc. are the spokes. The real value, the wheel so to speak, comes from building on top of all of that. If they can't compete on that level, well, so be it. Now forcing everyone to pay them for building the hub, the core part, means the ecosystem will crumble. No hub, no spokes. Also it makes Hashicorp the villant, not their competitors.
• miraculixx 3y ago
  This shows a problem in today's open source ecosystem: we have too many who profit from other people's work without giving back. In particular large corps should not be allowed to do that, and in fact by their very own Code of Conducts they are required to do the ethically right thing - to contribute and/or pay back to the community. That is especially true when they earn money by providing OSS as a service.
• xfz 3y ago
  The last four companies I worked at have spent a fortune on SaaS, not just AWS but a host of providers for observability, management etc. They've all used Terraform extensively but always rolled their own means of deploying IaC, with solutions more clunky than CloudFormation which let's face it isn't brilliant. Why did Hashicorp fail to win this business? I think their pricing just seems too outlandish and is based on paying for the value of software they've already open sourced rather than being tied to the cost of providing a good service plus reasonable margin. Their strategy appears to have failed, exacerbated by the macroeconomic landscape. I doubt their chosen solution - Microsoftification of their open source project - is going to do them any favours.
• riemannzeta 3y ago
  Somebody should point out to them that there's an error in their Parameters: https://www.hashicorp.com/bsl https://www.hashicorp.com/bsl The "Licensed Work" parameter should refer to what they are licensing. Right now it reads "The Licensed Work is (c) 2023 HashiCorp, Inc." I don't see how a corporation itself is copyrightable content to which a license may be granted.