4 ms·

Maybe you missed my last sentence. I've been hacking on and off for a couple years on a side project I'd like to monetize, to capture some of my value add, whil

Maybe you missed my last sentence. I've been hacking on and off for a couple years on a side project I'd like to monetize, to capture some of my value add, while also giving back. (It's sorta "if you build it they will come" at this point tbh so I don't necessarily expect it to work). My project is sort of "OSS platform as a service" only I just deploy it for you and teach you to run it yourself, while jumping on a call occasionally if you need SRE for it, and continuing to iterate on tooling as well as make PRs to the tools as it makes sense. Vault and consul (as a vault backend only) are components I've used for that (via cert-manager so they're replaceable tbh) and I'm no longer sure if that's viable. And generally as a contributor to the vault codebase, however small, I'm not thrilled they want to capture more value from it themselves while not offering me a miniscule chunk of that. The whole cloud provider argument really feels a lot like Displaced Aggression. You're probably punishing the people smaller than you a lot more than you are the billion dollar cloud providers who can afford both expensive lawyers and can very easily afford to fork your codebases as we see with OpenSearch vs ElasticSearch.

vmatsiiako 3y ago
If so, you can check out Infisical (https://github.com/Infisical/infisical https://github.com/Infisical/infisical) as an open source alternative to Vault. The absolute majority of our codebase is licensed under MIT and we have no intentions to change that. Disclaimer: I'm one of the founders.
- andrewstuart2 3y ago
  I'll definitely check it out. That said, I'm starting to feel a lot more skeptical of the ability for even founders to manage stuff like this. I would say the same of my own OSS as a "founder," but if my company controls it in some way then I'm not sure there's a reasonable way for me to ensure that continues in perpetuity. At least not via a split model like a lot of these recent news stories have revolved around. From what I've seen of Mitchell as well, at least in the past, I kind of doubt this is something he would have gone through with on his own.
  - deleted 3y ago
    [deleted]
  - civilitty 3y ago
    I think the easiest way to manage it is essentially to do nothing. Accept open source contributions without a contributor license agreement and their copyright locks in future maintainers, yourself included. Extricating those contributions eventually becomes impossible without a cleanroom rewrite that is usually economically impractical and way too risky to a business with revenue.
    - nyanpasu64 3y ago
      This requires a copyleft license, and can be bypassed if all contributors agree to sign away their code to a company trying to relicense and monetize the code (as the Audacity contributors did for some reason).
- Operyl 3y ago
  I am absolutely a huge fan of your company providing 30 minute walk throughs of the codebase for new contributors, I have never seen that before!
- thayne 3y ago
  > we have no intentions to change that I suspect that Hashicorp would have said the same thing a couple years ago.
  - rizky05 3y ago
    [dead]
- brunoqc 3y ago
  > The absolute majority of our codebase is licensed under MIT What is not MIT licensed? When you self-host, do you have access to every features for free?
TheRealPomax 3y ago
But your contributions stopped being "your" contributions the moment you signed off on them being merged into the vault codebase. Why would they owe you anything when you already indicated you were cool with the fact that you didn't want anything in return by contributing? This change protects the project from getting outright shut down because huge companies use it to extract value without some of that value going into guaranteeing the project stays supported. If you contributed to it, the minuscule chunk you get is "it keeps existing and you get to keep using it" instead of "this is not worth our time, we're sunsetting this".
- andrewstuart2 3y ago
  I guess you can chalk that up to naivety on my part. I've always assumed there is a social contract on top of the CLA I probably signed, that the software I wrote would continue to be available and maintained via contributions from both the company and community. And since they very obviously benefit from a plethora of OSS themselves, including the language they've used to build their products and the platforms they undoubtedly run on. I guess I'm always free to fork the codebase I care about under its current license and try to build a community around that. But I think we all know that's not as viable. Anyway, I'll just be reconsidering my use of software open sourced by companies, I guess, regardless of how permissively it's licensed. The free lunches I thought we collectively agreed were awesome and ought to keep helping each other provide, are apparently ending as money gets tight.
  - tedivm 3y ago
    Just because they have the legal right doesn't make it ethical, and even if someone makes the argument that it is ethical that doesn't change that it's a bit of a slap in the face to the open source community. You're allowed to be annoyed by this.
  - hughesjj 3y ago
    So, I don't understand -- had you known that this license change to prevent competitor use of their product, would you not have bothered to add the functionality you contributed?
38 3y ago
> I've been hacking on and off for a couple years on a side project I'd like to monetize OK so you want to use their software, make money off it, and give nothing back. if thats the case, you cant do that any more. you can either stick to personal use, or purchase a commercial license from them.
- andrewstuart2 3y ago
  Seems like you missed the part where I literally typed "giving back." Or that I literally contributed part of the hashicorp codebase, specifically vault. And it's been hard continuing to do that at $DAYJOB consistently, so I've hacked on a side project in my spare time (also open sourcing plenty of useful tools during that hacking) as a means to the end of eventually finding ways to keep giving back directly and teaching others to do the same.
  - 38 3y ago
    with all due respect, unless "giving back" means giving them money, its probably not worth what you think its worth. I maintain some small projects, and most of the people "giving back" contribute such a tiny amount of code that its almost not worth mentioning. that might not be your situation, but I know as a maintainer, in most cases I would much prefer a monetary contribution than a pull request. edit, 2015, ouch: https://github.com/hashicorp/vault/commits?author=andrewstuart https://github.com/hashicorp/vault/commits?author=andrewstua...
    - andrewstuart2 3y ago
      > edit, 2015, ouch: > https://github.com/hashicorp/vault/commits?author=andrewstuart https://github.com/hashicorp/vault/commits?author=andrewstua... Not sure what you're getting at with your edit. I'll try to assume positive intent. I maintain quite a few projects as well, also pretty small. Code to me means a great deal more than a small amount of money. The money is nothing compared to what I've made in my career thanks almost entirely to the code that exists publicly and my ability to run and modify it as needed to learn. I am glad to get code because it tells me something is useful enough for someone else to bother, which to me is what giving back is all about.
bootsmann 3y ago
You can ask them to license vault to you under different terms, they go quite in-depth about this in their FAQ. Don't know how much will come of it, but it is worth a shot.

vmatsiiako 3y ago

If so, you can check out Infisical (https://github.com/Infisical/infisical https://github.com/Infisical/infisical) as an open source alternative to Vault. The absolute majority of our codebase is licensed under MIT and we have no intentions to change that. Disclaimer: I'm one of the founders.

andrewstuart2 3y ago
I'll definitely check it out. That said, I'm starting to feel a lot more skeptical of the ability for even founders to manage stuff like this. I would say the same of my own OSS as a "founder," but if my company controls it in some way then I'm not sure there's a reasonable way for me to ensure that continues in perpetuity. At least not via a split model like a lot of these recent news stories have revolved around. From what I've seen of Mitchell as well, at least in the past, I kind of doubt this is something he would have gone through with on his own.
- deleted 3y ago
  [deleted]
- civilitty 3y ago
  I think the easiest way to manage it is essentially to do nothing. Accept open source contributions without a contributor license agreement and their copyright locks in future maintainers, yourself included. Extricating those contributions eventually becomes impossible without a cleanroom rewrite that is usually economically impractical and way too risky to a business with revenue.
  - nyanpasu64 3y ago
    This requires a copyleft license, and can be bypassed if all contributors agree to sign away their code to a company trying to relicense and monetize the code (as the Audacity contributors did for some reason).
Operyl 3y ago
I am absolutely a huge fan of your company providing 30 minute walk throughs of the codebase for new contributors, I have never seen that before!
thayne 3y ago
> we have no intentions to change that I suspect that Hashicorp would have said the same thing a couple years ago.
- rizky05 3y ago
  [dead]
brunoqc 3y ago
> The absolute majority of our codebase is licensed under MIT What is not MIT licensed? When you self-host, do you have access to every features for free?

TheRealPomax 3y ago

But your contributions stopped being "your" contributions the moment you signed off on them being merged into the vault codebase. Why would they owe you anything when you already indicated you were cool with the fact that you didn't want anything in return by contributing? This change protects the project from getting outright shut down because huge companies use it to extract value without some of that value going into guaranteeing the project stays supported. If you contributed to it, the minuscule chunk you get is "it keeps existing and you get to keep using it" instead of "this is not worth our time, we're sunsetting this".

andrewstuart2 3y ago
I guess you can chalk that up to naivety on my part. I've always assumed there is a social contract on top of the CLA I probably signed, that the software I wrote would continue to be available and maintained via contributions from both the company and community. And since they very obviously benefit from a plethora of OSS themselves, including the language they've used to build their products and the platforms they undoubtedly run on. I guess I'm always free to fork the codebase I care about under its current license and try to build a community around that. But I think we all know that's not as viable. Anyway, I'll just be reconsidering my use of software open sourced by companies, I guess, regardless of how permissively it's licensed. The free lunches I thought we collectively agreed were awesome and ought to keep helping each other provide, are apparently ending as money gets tight.
- tedivm 3y ago
  Just because they have the legal right doesn't make it ethical, and even if someone makes the argument that it is ethical that doesn't change that it's a bit of a slap in the face to the open source community. You're allowed to be annoyed by this.
- hughesjj 3y ago
  So, I don't understand -- had you known that this license change to prevent competitor use of their product, would you not have bothered to add the functionality you contributed?

38 3y ago

> I've been hacking on and off for a couple years on a side project I'd like to monetize OK so you want to use their software, make money off it, and give nothing back. if thats the case, you cant do that any more. you can either stick to personal use, or purchase a commercial license from them.

andrewstuart2 3y ago
Seems like you missed the part where I literally typed "giving back." Or that I literally contributed part of the hashicorp codebase, specifically vault. And it's been hard continuing to do that at $DAYJOB consistently, so I've hacked on a side project in my spare time (also open sourcing plenty of useful tools during that hacking) as a means to the end of eventually finding ways to keep giving back directly and teaching others to do the same.
- 38 3y ago
  with all due respect, unless "giving back" means giving them money, its probably not worth what you think its worth. I maintain some small projects, and most of the people "giving back" contribute such a tiny amount of code that its almost not worth mentioning. that might not be your situation, but I know as a maintainer, in most cases I would much prefer a monetary contribution than a pull request. edit, 2015, ouch: https://github.com/hashicorp/vault/commits?author=andrewstuart https://github.com/hashicorp/vault/commits?author=andrewstua...
  - andrewstuart2 3y ago
    > edit, 2015, ouch: > https://github.com/hashicorp/vault/commits?author=andrewstuart https://github.com/hashicorp/vault/commits?author=andrewstua... Not sure what you're getting at with your edit. I'll try to assume positive intent. I maintain quite a few projects as well, also pretty small. Code to me means a great deal more than a small amount of money. The money is nothing compared to what I've made in my career thanks almost entirely to the code that exists publicly and my ability to run and modify it as needed to learn. I am glad to get code because it tells me something is useful enough for someone else to bother, which to me is what giving back is all about.

bootsmann 3y ago

You can ask them to license vault to you under different terms, they go quite in-depth about this in their FAQ. Don't know how much will come of it, but it is worth a shot.