6 ms·

That's pretty disappointing. I personally haven't used much beyond vault (I've used but not enjoyed or built anything on terraform), but this is pretty diametri

That's pretty disappointing. I personally haven't used much beyond vault (I've used but not enjoyed or built anything on terraform), but this is pretty diametrically opposed to what I appreciated most about hashicorp products. Heck, I've even contributed a chunk of the code I use the most from vault (Cert management) and now I'm going to have to reevaluate whether I can attempt to use that service for customers going forward, and whether I will contribute ever again. It definitely feels like the whole era of VC drying up is bringing out the worst possible future for some of these non GPL/similar licenses. Which is unfortunate for any of us who have deliberately learned only OSS and operations around it, giving back the whole time, with dreams of building services that leverage that knowledge someday as a chance to be our own boss while also utilizing and giving back to the OSS that got us this far.

randmeerkat 3y ago
> That's pretty disappointing. From the article: “End users can continue to copy, modify, and redistribute the code for all non-commercial and commercial use, except where providing a competitive offering to HashiCorp.” Literally nothing has changed, this isn’t disappointing, it’s smart, they’re protecting themselves against cloud providers that have repeatedly abused the goodwill of the open source community.
- ugh123 3y ago
  > they’re protecting themselves against cloud providers that have repeatedly abused the goodwill of the open source community. e.g. AWS -> Elasticsearch.
  - nostrebored 3y ago
    Absurd. Providing a managed instance of open source software that’s complicated to manage is fine. It’s not AWS’s fault that Elastic did a bad job of selling into AWS accounts. They should have worked on their value prop.
    - ericb 3y ago
      > They should have worked on their value prop. AWS customers like that there's one bill and one account. Who wants to deal with multiple vendors if they don't have to? It isn't a level playing field when Amazon offers a service. Amazon could have chosen a cooperative, long-term, strategy and shared some revenue with the authors for some quid-pro-quo, and the world and Amazon, would be better for it. Instead, Amazon chose to cook the goose that lays the golden eggs, now they have to figure it out themselves, and whole ecosystems of services they could have hosted are running away from them.
      - jen20 3y ago
        The reason historically it hasn’t been a level playing field is because Amazon have: - The ability to invent new infrastructure to suit a need. For example, multi legged ENIs that provide the EKS control plane are simply not available to others, - The ability to integrate with IAM natively, - The ability to build common network architectures without outrageous costs (traffic over peering links being a good example since that is what basically all vendors have to do).
        sanderjd 3y ago
        This is overthinking it. For nearly every given service, Amazon can just slap together a managed version and it will be the easiest one for people to discover and use if they are already using AWS. It doesn't require any of that special sauce fanciness. Most of their managed offerings are mediocre also-ran versions of things, but they are just easier to use within the existing ecosystem, so they win.
    - sanderjd 3y ago
      What I find absurd is the perspective that it is 1. a giant no no breach of the spirit of open source software to provide software with open source code but a license that restricts commercial resale, and 2. it's totally great for megacorporations to reap the vast majority of the rewards that accrue to popular mature open source software services. I honestly can't fathom this worldview or how so many people here seem to be so sure it is the one that makes sense. If you win this battle for mindshare, people will just stop making open source services like these. Every service will just be fully closed source SaaS. Amazon can't just re-sell that no matter what, and people just crap on you if you make it open source (edit: re-reading this, should have said "source available" here), so why would anyone bother? Increasingly people who make open source software services are damned if they do and damned if they don't, and if that is how it's gonna be, people are going to just stop bothering with it.
  - adrr 3y ago
    Elasticsearch is based off lucene so they are making money off another open source project.
    - paulddraper 3y ago
      Technically true, but practically different. Lucene is the core piece but %-wise the minority of the ES product. There's no Lucene "competitor" to Elasticsearch.
      - Xylakant 3y ago
        > There's no Lucene "competitor" to Elasticsearch. Apache Solr, which existed long before Elasticsearch was conceived.
        paulddraper 3y ago
        Solr is a separate product. It is also an Apache project, though so are a million other projects. It also doesn't even have a commercial offering; Elasticsearch in no way affects any financial ambitions.
- andrewstuart2 3y ago
  Maybe you missed my last sentence. I've been hacking on and off for a couple years on a side project I'd like to monetize, to capture some of my value add, while also giving back. (It's sorta "if you build it they will come" at this point tbh so I don't necessarily expect it to work). My project is sort of "OSS platform as a service" only I just deploy it for you and teach you to run it yourself, while jumping on a call occasionally if you need SRE for it, and continuing to iterate on tooling as well as make PRs to the tools as it makes sense. Vault and consul (as a vault backend only) are components I've used for that (via cert-manager so they're replaceable tbh) and I'm no longer sure if that's viable. And generally as a contributor to the vault codebase, however small, I'm not thrilled they want to capture more value from it themselves while not offering me a miniscule chunk of that. The whole cloud provider argument really feels a lot like Displaced Aggression. You're probably punishing the people smaller than you a lot more than you are the billion dollar cloud providers who can afford both expensive lawyers and can very easily afford to fork your codebases as we see with OpenSearch vs ElasticSearch.
  - vmatsiiako 3y ago
    If so, you can check out Infisical (https://github.com/Infisical/infisical https://github.com/Infisical/infisical) as an open source alternative to Vault. The absolute majority of our codebase is licensed under MIT and we have no intentions to change that. Disclaimer: I'm one of the founders.
    - andrewstuart2 3y ago
      I'll definitely check it out. That said, I'm starting to feel a lot more skeptical of the ability for even founders to manage stuff like this. I would say the same of my own OSS as a "founder," but if my company controls it in some way then I'm not sure there's a reasonable way for me to ensure that continues in perpetuity. At least not via a split model like a lot of these recent news stories have revolved around. From what I've seen of Mitchell as well, at least in the past, I kind of doubt this is something he would have gone through with on his own.
      - deleted 3y ago
- mindB 3y ago
  >Literally nothing has changed This is super disingenuous in a world where things like the GPL exist and any other license that prevents you from putting further restrictions on the combined product.
- jchw 3y ago
  >Literally nothing has changed. Uhm, yeah, something DID change: the license and terms. I don't understand what kind of argument this is.
- thayne 3y ago
  > they’re protecting themselves against cloud providers that have repeatedly abused the goodwill of the open source community This seems a lot more likely to be targeting other startups that build on terraform like spacelift, env0, maybe pulumi (although I think they interface with providers directly, so this might not affect them as much), etc. And maybe there are similar companies for their other offerings, although I'm less familiar with those.
- kmeisthax 3y ago
  Adding a non-compete clause to your license is not "literally nothing" - in fact, it might be extremely problematic for a large number of downstream users. As for "abusing the goodwill of the open source community", that's kind of the point of FOSS. Free riding is not stealing. That's proprietary world logic, and everyone saying we need to stop people from free riding FOSS is calling for the enclosure of the commons. Let me be perfectly clear: there is no license condition you can put on software that will let everyone use it as if it were in the commons but prevent Amazon Web Services from hosting it.
  - piaste 3y ago
    > Let me be perfectly clear: there is no license condition you can put on software that will let everyone use it as if it were in the commons but prevent Amazon Web Services from hosting it. "The following licence is granted to everyone except the following entities: Amazon, Alphabet, Apple, Microsoft, Meta, Oracle"
    - arlcode 3y ago
      "Today Amazon introduces the AWS Partnered Software Supplier Programm. Selected companies are invited to offer their products as deeply integrated AWS services. The first announced Parter are: Not-at-all-amazon-for-hashicorp inc, Not-at-all-amazon-for-mariadb inc."
- growse 3y ago
  For me, bait-and-switching their code contributors is almost the textbook definition of "abusing the goodwill of the open source community".
j1elo 3y ago
The huge difference is where the copyright of the code lays. OSS projects that require contributors to assign their copyright away, should not be trusted, and should not receive goodwill contributions to begin with. Otherwise, what today is Apache 2.0, tomorrow can become Commercial, while asking nobody for permission, because the maintainers have ownership of 100% of the code. Not that OSS projects backed by commercial-driven entities usually receive any meaningful amount of contributions from external people... but still, an important detail to think about OSS.
- andrewstuart2 3y ago
  It's super frustrating, because I want to assume the best, but I'm starting to agree more and more with this perspective as stuff like this makes me more cautious/cynical. Unless my CLA assigns copyright to a foundation, in which case I am more likely to believe it will be kept in line with the foundation's charter, e.g.
- lima 3y ago
  This is incorrect, this can happen with any permissive license (BSD, Apache 2...) regardless of copyright assignments.
  - ec109685 3y ago
    No, it’s correct. BSD at least allows anyone to create a restrictive fork of the code. With a CLA, it grants Hashicorp rights to your contribution no other corporation has.
  - j1elo 3y ago
    The rule is simple: If you want to relicense a project, then you need approval from all the individual copyright holders. It does not matter if you are relicensing between permissive OSS licenses such as, for example, from Apache 2.0 to MIT. They are different licenses, so you need permission for the change. That's why OSS is commonly called a "Community". The software's copyright belongs to the hands of all the community of developers who have written and contributed code. What a CLA usually does is grant perpetual permission to do anything with the code, including to relicense without asking. Practically speaking, CLAs grant full control to a single hand. Thus, OSS projects with such CLAs are not part of any so-called "Open Source Community" in any meaningful way. EDIT: Changed "CLAs grant full ownership" -> "CLAs grant full control", to avoid misunderstandings.
JohnMakin 3y ago
I read the rest of your comments on this topic and I’m sorry this happened to you. I have extensive experience with enterprise vault, implementing and managing it across a company infrastructure to manage application secrets, and during the few years we implemented vault and was in negotiations about our contract, I noticed the sales engineers would 1) be dishonest or misleading about features “needed” for our user case or make long-term promises they couldn’t possibly keep about features. standard salesmanship stuff but was very aggressive. 2) encouraged an integration style that would make migrating out of vault practically impossible, if not outrightly dangerous 3) continually rug pulled features we thought would be free forever (okta/mfa login being the biggest one I can think of). You can’t pass any serious compliance without that, and they realized anyone heavily relying on vault for secrets management would absolutely have to pay for this feature. Basically it just seemed like hard core vendor lock in and every year our bill would be a lot higher for essentially the same or fewer features. Not to mention nonsensical pricing that even their own engineers can’t explain and changes constantly and arbitrarily. So all this to say sorry this happened to you and for Vault specifically I am not surprised and would personally not rely on it for anything serious, even though I personally consider it fantastic software - I simply lost trust in hashicorp.
- chucky_z 3y ago
  3 is a confusing one but understandable. You should be using the OIDC login method most of the time for MFA, and not their built-in MFA. I’m unsure if the equivalent software is worth the price when compared to Vault and not sure I can seriously suggest anything else even if I hate this new license.
  - JohnMakin 3y ago
    You can use a mix of secrets manager and certificate manager products in AWS and accomplish essentially the same things Vault promises for much cheaper (and easier to manage). I’m underselling of course the vast capabilities of vault. but most companies don’t need those advanced features, and they don’t really sell them, they sell and lock you into features that once you implement are going to become an extraodinary hurdle to migrate out of. On the oidc - yes we were using okta as that. but at some point mid-contract the “okta” management features that connected to it became enterprise only, and we had reasoned that if we didnt need more advanced features (dr, replication) we could go back to OSS when we wanted. In fact that was even told to us, until that was no longer the case.

randmeerkat 3y ago

> That's pretty disappointing. From the article: “End users can continue to copy, modify, and redistribute the code for all non-commercial and commercial use, except where providing a competitive offering to HashiCorp.” Literally nothing has changed, this isn’t disappointing, it’s smart, they’re protecting themselves against cloud providers that have repeatedly abused the goodwill of the open source community.

ugh123 3y ago
> they’re protecting themselves against cloud providers that have repeatedly abused the goodwill of the open source community. e.g. AWS -> Elasticsearch.
- nostrebored 3y ago
  Absurd. Providing a managed instance of open source software that’s complicated to manage is fine. It’s not AWS’s fault that Elastic did a bad job of selling into AWS accounts. They should have worked on their value prop.
  - ericb 3y ago
    > They should have worked on their value prop. AWS customers like that there's one bill and one account. Who wants to deal with multiple vendors if they don't have to? It isn't a level playing field when Amazon offers a service. Amazon could have chosen a cooperative, long-term, strategy and shared some revenue with the authors for some quid-pro-quo, and the world and Amazon, would be better for it. Instead, Amazon chose to cook the goose that lays the golden eggs, now they have to figure it out themselves, and whole ecosystems of services they could have hosted are running away from them.
    - jen20 3y ago
      The reason historically it hasn’t been a level playing field is because Amazon have: - The ability to invent new infrastructure to suit a need. For example, multi legged ENIs that provide the EKS control plane are simply not available to others, - The ability to integrate with IAM natively, - The ability to build common network architectures without outrageous costs (traffic over peering links being a good example since that is what basically all vendors have to do).
      - sanderjd 3y ago
        This is overthinking it. For nearly every given service, Amazon can just slap together a managed version and it will be the easiest one for people to discover and use if they are already using AWS. It doesn't require any of that special sauce fanciness. Most of their managed offerings are mediocre also-ran versions of things, but they are just easier to use within the existing ecosystem, so they win.
  - sanderjd 3y ago
    What I find absurd is the perspective that it is 1. a giant no no breach of the spirit of open source software to provide software with open source code but a license that restricts commercial resale, and 2. it's totally great for megacorporations to reap the vast majority of the rewards that accrue to popular mature open source software services. I honestly can't fathom this worldview or how so many people here seem to be so sure it is the one that makes sense. If you win this battle for mindshare, people will just stop making open source services like these. Every service will just be fully closed source SaaS. Amazon can't just re-sell that no matter what, and people just crap on you if you make it open source (edit: re-reading this, should have said "source available" here), so why would anyone bother? Increasingly people who make open source software services are damned if they do and damned if they don't, and if that is how it's gonna be, people are going to just stop bothering with it.
- adrr 3y ago
  Elasticsearch is based off lucene so they are making money off another open source project.
  - paulddraper 3y ago
    Technically true, but practically different. Lucene is the core piece but %-wise the minority of the ES product. There's no Lucene "competitor" to Elasticsearch.
    - Xylakant 3y ago
      > There's no Lucene "competitor" to Elasticsearch. Apache Solr, which existed long before Elasticsearch was conceived.
      - paulddraper 3y ago
        Solr is a separate product. It is also an Apache project, though so are a million other projects. It also doesn't even have a commercial offering; Elasticsearch in no way affects any financial ambitions.
andrewstuart2 3y ago
Maybe you missed my last sentence. I've been hacking on and off for a couple years on a side project I'd like to monetize, to capture some of my value add, while also giving back. (It's sorta "if you build it they will come" at this point tbh so I don't necessarily expect it to work). My project is sort of "OSS platform as a service" only I just deploy it for you and teach you to run it yourself, while jumping on a call occasionally if you need SRE for it, and continuing to iterate on tooling as well as make PRs to the tools as it makes sense. Vault and consul (as a vault backend only) are components I've used for that (via cert-manager so they're replaceable tbh) and I'm no longer sure if that's viable. And generally as a contributor to the vault codebase, however small, I'm not thrilled they want to capture more value from it themselves while not offering me a miniscule chunk of that. The whole cloud provider argument really feels a lot like Displaced Aggression. You're probably punishing the people smaller than you a lot more than you are the billion dollar cloud providers who can afford both expensive lawyers and can very easily afford to fork your codebases as we see with OpenSearch vs ElasticSearch.
- vmatsiiako 3y ago
  If so, you can check out Infisical (https://github.com/Infisical/infisical https://github.com/Infisical/infisical) as an open source alternative to Vault. The absolute majority of our codebase is licensed under MIT and we have no intentions to change that. Disclaimer: I'm one of the founders.
  - andrewstuart2 3y ago
    I'll definitely check it out. That said, I'm starting to feel a lot more skeptical of the ability for even founders to manage stuff like this. I would say the same of my own OSS as a "founder," but if my company controls it in some way then I'm not sure there's a reasonable way for me to ensure that continues in perpetuity. At least not via a split model like a lot of these recent news stories have revolved around. From what I've seen of Mitchell as well, at least in the past, I kind of doubt this is something he would have gone through with on his own.
    - deleted 3y ago
mindB 3y ago
>Literally nothing has changed This is super disingenuous in a world where things like the GPL exist and any other license that prevents you from putting further restrictions on the combined product.
jchw 3y ago
>Literally nothing has changed. Uhm, yeah, something DID change: the license and terms. I don't understand what kind of argument this is.
thayne 3y ago
> they’re protecting themselves against cloud providers that have repeatedly abused the goodwill of the open source community This seems a lot more likely to be targeting other startups that build on terraform like spacelift, env0, maybe pulumi (although I think they interface with providers directly, so this might not affect them as much), etc. And maybe there are similar companies for their other offerings, although I'm less familiar with those.
kmeisthax 3y ago
Adding a non-compete clause to your license is not "literally nothing" - in fact, it might be extremely problematic for a large number of downstream users. As for "abusing the goodwill of the open source community", that's kind of the point of FOSS. Free riding is not stealing. That's proprietary world logic, and everyone saying we need to stop people from free riding FOSS is calling for the enclosure of the commons. Let me be perfectly clear: there is no license condition you can put on software that will let everyone use it as if it were in the commons but prevent Amazon Web Services from hosting it.
- piaste 3y ago
  > Let me be perfectly clear: there is no license condition you can put on software that will let everyone use it as if it were in the commons but prevent Amazon Web Services from hosting it. "The following licence is granted to everyone except the following entities: Amazon, Alphabet, Apple, Microsoft, Meta, Oracle"
  - arlcode 3y ago
    "Today Amazon introduces the AWS Partnered Software Supplier Programm. Selected companies are invited to offer their products as deeply integrated AWS services. The first announced Parter are: Not-at-all-amazon-for-hashicorp inc, Not-at-all-amazon-for-mariadb inc."
growse 3y ago
For me, bait-and-switching their code contributors is almost the textbook definition of "abusing the goodwill of the open source community".

j1elo 3y ago

The huge difference is where the copyright of the code lays. OSS projects that require contributors to assign their copyright away, should not be trusted, and should not receive goodwill contributions to begin with. Otherwise, what today is Apache 2.0, tomorrow can become Commercial, while asking nobody for permission, because the maintainers have ownership of 100% of the code. Not that OSS projects backed by commercial-driven entities usually receive any meaningful amount of contributions from external people... but still, an important detail to think about OSS.

andrewstuart2 3y ago
It's super frustrating, because I want to assume the best, but I'm starting to agree more and more with this perspective as stuff like this makes me more cautious/cynical. Unless my CLA assigns copyright to a foundation, in which case I am more likely to believe it will be kept in line with the foundation's charter, e.g.
lima 3y ago
This is incorrect, this can happen with any permissive license (BSD, Apache 2...) regardless of copyright assignments.
- ec109685 3y ago
  No, it’s correct. BSD at least allows anyone to create a restrictive fork of the code. With a CLA, it grants Hashicorp rights to your contribution no other corporation has.
- j1elo 3y ago
  The rule is simple: If you want to relicense a project, then you need approval from all the individual copyright holders. It does not matter if you are relicensing between permissive OSS licenses such as, for example, from Apache 2.0 to MIT. They are different licenses, so you need permission for the change. That's why OSS is commonly called a "Community". The software's copyright belongs to the hands of all the community of developers who have written and contributed code. What a CLA usually does is grant perpetual permission to do anything with the code, including to relicense without asking. Practically speaking, CLAs grant full control to a single hand. Thus, OSS projects with such CLAs are not part of any so-called "Open Source Community" in any meaningful way. EDIT: Changed "CLAs grant full ownership" -> "CLAs grant full control", to avoid misunderstandings.

JohnMakin 3y ago

I read the rest of your comments on this topic and I’m sorry this happened to you. I have extensive experience with enterprise vault, implementing and managing it across a company infrastructure to manage application secrets, and during the few years we implemented vault and was in negotiations about our contract, I noticed the sales engineers would 1) be dishonest or misleading about features “needed” for our user case or make long-term promises they couldn’t possibly keep about features. standard salesmanship stuff but was very aggressive. 2) encouraged an integration style that would make migrating out of vault practically impossible, if not outrightly dangerous 3) continually rug pulled features we thought would be free forever (okta/mfa login being the biggest one I can think of). You can’t pass any serious compliance without that, and they realized anyone heavily relying on vault for secrets management would absolutely have to pay for this feature. Basically it just seemed like hard core vendor lock in and every year our bill would be a lot higher for essentially the same or fewer features. Not to mention nonsensical pricing that even their own engineers can’t explain and changes constantly and arbitrarily. So all this to say sorry this happened to you and for Vault specifically I am not surprised and would personally not rely on it for anything serious, even though I personally consider it fantastic software - I simply lost trust in hashicorp.

chucky_z 3y ago
3 is a confusing one but understandable. You should be using the OIDC login method most of the time for MFA, and not their built-in MFA. I’m unsure if the equivalent software is worth the price when compared to Vault and not sure I can seriously suggest anything else even if I hate this new license.
- JohnMakin 3y ago
  You can use a mix of secrets manager and certificate manager products in AWS and accomplish essentially the same things Vault promises for much cheaper (and easier to manage). I’m underselling of course the vast capabilities of vault. but most companies don’t need those advanced features, and they don’t really sell them, they sell and lock you into features that once you implement are going to become an extraodinary hurdle to migrate out of. On the oidc - yes we were using okta as that. but at some point mid-contract the “okta” management features that connected to it became enterprise only, and we had reasoned that if we didnt need more advanced features (dr, replication) we could go back to OSS when we wanted. In fact that was even told to us, until that was no longer the case.