9 ms·

I am seeing parallels to the Amazon vs. ElasticSearch fiasco. Also interesting to mention that they haven't said a single word about CLAs. If this project woul

I am seeing parallels to the Amazon vs. ElasticSearch fiasco. Also interesting to mention that they haven't said a single word about CLAs. If this project would require a CLA (and copyright assignment) to contribute, then it doesn't matter that it's a foundation, they could also re-licence it easily, which is exactly what they are fighting against.

lars_francke 3y ago
You are technically correct but I do see a difference between signing a CLA with The Linux Foundation, Eclipse, ASF etc. and a purely commercial corporate entity.
- Pannoniae 3y ago
  You are entirely right; it's nowhere comparable. I'm just talking about the theoretical impacts. (after all, the re-licencing was also a theoretical problem, i.e. Hashicorp might abuse the non-compete clause so Terraform is not safe to use) I just find it interesting to mention - after all, the important details the ones which are not talked about.
  - hyperpape 3y ago
    For at least a few years now, companies relicensing their open source software has not been just a theoretical possibility, but a plausible thing that could happen any time. I don’t know what happens to the Linux Foundation when we’re all in the nursing home, but them relicensing everything is not currently plausible. It is a merely theoretical possibility.
- riku_iki 3y ago
  > signing a CLA with The Linux Foundation, Eclipse, ASF etc. what is the reason those require CLA? Why underlying license is not enough?
  - koolba 3y ago
    If there’s no intention of ever changing the license, then there is no need for a CLA. A CLA is required when the repo owner wants the ability to change the license down the road without contacting N contributors.
    - n42 3y ago
      yes, but it's not always malicious. one example is to dual license the code. for example, Qt is available under GPL (LGPL?) and has a CLA that allows them to commercially license your contributions to businesses. a good CLA in this instance would guarantee you that your code cannot be relicensed exclusively away from GPL. the software is still free as in freedom, but the organization can fund itself by courting businesses that would not touch GPL software.
      - lars_francke 3y ago
        Another example is OpenStreetMap which changed its license because we learned that the old one wasn't adequate for the purpose intended. We have no idea how today's licenses will be challenged in the future and I believe it's a good practice to keep a door open to being able to change the license going forward. That it's not done maliciously is a purpose for foundations which serve as trust anchors.
        freedomben 3y ago
        that's an interesting point, thanks. I'm still skeptical of a CLA for such a project since a ton (currently all) of the copyright is held by Hashicorp meaning they would have to consent to the future license change as well, regardless of the CLA or foundation membership. In general I think that makes a point for a CLA, but in this case I don't think it does.
      - riku_iki 3y ago
        > Qt is available under GPL (LGPL?) and has a CLA that allows them to commercially license your contributions to businesses. but that's exactly the case which happened in case of Hashi, so CLA allowed them to continue working on commercial product only, with all 3p contributions being under their proprietary license.
- ghaff 3y ago
  For what it's worth, the CNCF is not big on CLAs in general although, as far as I know, they don't specifically prohibit them. In general, they prefer to use a developer certificate of origin.
  - lars_francke 3y ago
    Doesn't Kubernetes require a CLA?
    - mdaniel 3y ago
      it does, they even have a label for it: https://github.com/kubernetes/kubernetes/pulls?q=label%3A%22cncf-cla%3A+yes%22 https://github.com/kubernetes/kubernetes/pulls?q=label%3A%22...
    - justincormack 3y ago
      Yes. A small number of CnCF projects do. Google originally had a CLA in k8s and this was kept.
  - pests 3y ago
    Are you sure of the CNCF not being big on CLAs? According to the link below: > Anyone who is contributing any code to any CNCF project must have the CLA signed. https://contribute.cncf.io/resources/glossary/#:~:text=Contributor%20License%20Agreement https://contribute.cncf.io/resources/glossary/#:~:text=Contr...
    - ghaff 3y ago
      That's a bit surprising to read because here's what @cra of the Linux Foundation said a couple years ago: It’s [a Developer Certificate of Origin] how the Linux kernel works, where basically it takes all the basic things that most CLAs do, which would be like, ‘Did I write this code? Did I not copy it elsewhere? Do I have the rights to give this to you, and you sign off on?’ It’s been a very successful model played out in the kernel and many other ecosystems. I’m generally not really supportive of having CLAs unless there’s a real strict business need." https://opensource.com/article/20/2/open-source-projects-governance https://opensource.com/article/20/2/open-source-projects-gov...
- sanderjd 3y ago
  Yeah this makes sense. "CLAs (or DCOs) assigning copyright to foundations are good, CLAs assigning copyright to corporate entities are questionable" does seem like a pretty good rule of thumb for contributors who care about this kind of thing (which I agree most people should).
arusahni 3y ago
They've already got more FTEs on this than Amazon seemingly put on OpenSearch.
- paxys 3y ago
  Companies saying "we will let some FTEs contribute to this project along with their regular work" is very different from Amazon paying a dedicated team to work on it full time.
  - fishnchips 3y ago
    Marcin here, co-founder of Spacelift, one of the members of the OpenTF initiative We provided a dedicated team on a temporary basis. Once the project is in the foundation, we will make a financial contribution, with which dedicated developers will be funded. At that point our devs will gradually hand over to the new, fully independent team. The other members of the initiative so far follow the same pattern but I can't speak on their behalf re: exact commitments.
    - bloopernova 3y ago
      Thank you for doing that correctly, I hope TF thrives! Do you know if the Terraform language server will also be forked? It has also suffered from Hashicorp's lack of attention. EDIT: oh you answered that question in a response to my top-level comment. Thank you!
softwaredoug 3y ago
It’s a bit different because OpenSearch is a project of and by Amazon, not a project where many companies participate equally under a foundation.
janosdebugs 3y ago
If they aim for making it a CNCF project, it may very well be a simple inbound=outbound licensing (everyone keeps their copyrights). The CNCF gives projects two options: DCO or CLA, where the CLA is a very simple formality. It being a foundation and not a for-profit company already makes licensing shenanigans unlikely.
fishnchips 3y ago
Ideally we would want to let people contribute freely without the need to sign anything extra. However, for the exact process we will defer to the Linux Foundation / CNCF. The ultimate goal is to ensure that a rug pull like this is never allowed to happen again. (Marcin here, co-founder of Spacelift, one of the members of the OpenTF initiative)
paxys 3y ago
CLAs are very misunderstood in the software industry. Every open source project should make its contributors sign CLAs, and you should be wary of using one that doesn't. Why? Because any single contributor can claim at any point in the future that the project is using their code illegally, and that you/your company should pay them for using their proprietary IP for all of these years. Can you prove that you audited every single line in the project you used and were sure of its copyright status? A CLA ensures exactly that. There's a reason why Linux Foundation, Apache, CNCF, Mozilla, heck even FSF all have strict CLA requirements. Relicensing is a completely separate conversation, and there are plenty of open source CLAs which don't have that provision.
- Pannoniae 3y ago
  This kind of trolling can easily be prevented by saying "Sure, we will remove your contributions. Name the exact line numbers affected"
  - jen20 3y ago
    The burden of ensuring license compliance falls to the consumer, not the producer.
- unmole 3y ago
  > Because any single contributor can claim at any point in the future that the project is using their code illegally So, you've never heard of a Developer Certificate of Origin? If it's good enough for Linux, it's good enough for me.
  - paxys 3y ago
    > The Developer Certificate of Origin (DCO) is a statement that a software developer agrees to, saying that the contributor is allowed to make the contribution and that the project has the right to distribute it under its license. So in other words, a CLA.
    - unmole 3y ago

lars_francke 3y ago

You are technically correct but I do see a difference between signing a CLA with The Linux Foundation, Eclipse, ASF etc. and a purely commercial corporate entity.

Pannoniae 3y ago
You are entirely right; it's nowhere comparable. I'm just talking about the theoretical impacts. (after all, the re-licencing was also a theoretical problem, i.e. Hashicorp might abuse the non-compete clause so Terraform is not safe to use) I just find it interesting to mention - after all, the important details the ones which are not talked about.
- hyperpape 3y ago
  For at least a few years now, companies relicensing their open source software has not been just a theoretical possibility, but a plausible thing that could happen any time. I don’t know what happens to the Linux Foundation when we’re all in the nursing home, but them relicensing everything is not currently plausible. It is a merely theoretical possibility.
riku_iki 3y ago
> signing a CLA with The Linux Foundation, Eclipse, ASF etc. what is the reason those require CLA? Why underlying license is not enough?
- koolba 3y ago
  If there’s no intention of ever changing the license, then there is no need for a CLA. A CLA is required when the repo owner wants the ability to change the license down the road without contacting N contributors.
  - n42 3y ago
    yes, but it's not always malicious. one example is to dual license the code. for example, Qt is available under GPL (LGPL?) and has a CLA that allows them to commercially license your contributions to businesses. a good CLA in this instance would guarantee you that your code cannot be relicensed exclusively away from GPL. the software is still free as in freedom, but the organization can fund itself by courting businesses that would not touch GPL software.
    - lars_francke 3y ago
      Another example is OpenStreetMap which changed its license because we learned that the old one wasn't adequate for the purpose intended. We have no idea how today's licenses will be challenged in the future and I believe it's a good practice to keep a door open to being able to change the license going forward. That it's not done maliciously is a purpose for foundations which serve as trust anchors.
      - freedomben 3y ago
        that's an interesting point, thanks. I'm still skeptical of a CLA for such a project since a ton (currently all) of the copyright is held by Hashicorp meaning they would have to consent to the future license change as well, regardless of the CLA or foundation membership. In general I think that makes a point for a CLA, but in this case I don't think it does.
    - riku_iki 3y ago
      > Qt is available under GPL (LGPL?) and has a CLA that allows them to commercially license your contributions to businesses. but that's exactly the case which happened in case of Hashi, so CLA allowed them to continue working on commercial product only, with all 3p contributions being under their proprietary license.
ghaff 3y ago
For what it's worth, the CNCF is not big on CLAs in general although, as far as I know, they don't specifically prohibit them. In general, they prefer to use a developer certificate of origin.
- lars_francke 3y ago
  Doesn't Kubernetes require a CLA?
  - mdaniel 3y ago
    it does, they even have a label for it: https://github.com/kubernetes/kubernetes/pulls?q=label%3A%22cncf-cla%3A+yes%22 https://github.com/kubernetes/kubernetes/pulls?q=label%3A%22...
  - justincormack 3y ago
    Yes. A small number of CnCF projects do. Google originally had a CLA in k8s and this was kept.
- pests 3y ago
  Are you sure of the CNCF not being big on CLAs? According to the link below: > Anyone who is contributing any code to any CNCF project must have the CLA signed. https://contribute.cncf.io/resources/glossary/#:~:text=Contributor%20License%20Agreement https://contribute.cncf.io/resources/glossary/#:~:text=Contr...
  - ghaff 3y ago
    That's a bit surprising to read because here's what @cra of the Linux Foundation said a couple years ago: It’s [a Developer Certificate of Origin] how the Linux kernel works, where basically it takes all the basic things that most CLAs do, which would be like, ‘Did I write this code? Did I not copy it elsewhere? Do I have the rights to give this to you, and you sign off on?’ It’s been a very successful model played out in the kernel and many other ecosystems. I’m generally not really supportive of having CLAs unless there’s a real strict business need." https://opensource.com/article/20/2/open-source-projects-governance https://opensource.com/article/20/2/open-source-projects-gov...
sanderjd 3y ago
Yeah this makes sense. "CLAs (or DCOs) assigning copyright to foundations are good, CLAs assigning copyright to corporate entities are questionable" does seem like a pretty good rule of thumb for contributors who care about this kind of thing (which I agree most people should).

arusahni 3y ago

They've already got more FTEs on this than Amazon seemingly put on OpenSearch.

paxys 3y ago
Companies saying "we will let some FTEs contribute to this project along with their regular work" is very different from Amazon paying a dedicated team to work on it full time.
- fishnchips 3y ago
  Marcin here, co-founder of Spacelift, one of the members of the OpenTF initiative We provided a dedicated team on a temporary basis. Once the project is in the foundation, we will make a financial contribution, with which dedicated developers will be funded. At that point our devs will gradually hand over to the new, fully independent team. The other members of the initiative so far follow the same pattern but I can't speak on their behalf re: exact commitments.
  - bloopernova 3y ago
    Thank you for doing that correctly, I hope TF thrives! Do you know if the Terraform language server will also be forked? It has also suffered from Hashicorp's lack of attention. EDIT: oh you answered that question in a response to my top-level comment. Thank you!

softwaredoug 3y ago

It’s a bit different because OpenSearch is a project of and by Amazon, not a project where many companies participate equally under a foundation.

janosdebugs 3y ago

If they aim for making it a CNCF project, it may very well be a simple inbound=outbound licensing (everyone keeps their copyrights). The CNCF gives projects two options: DCO or CLA, where the CLA is a very simple formality. It being a foundation and not a for-profit company already makes licensing shenanigans unlikely.

fishnchips 3y ago

Ideally we would want to let people contribute freely without the need to sign anything extra. However, for the exact process we will defer to the Linux Foundation / CNCF. The ultimate goal is to ensure that a rug pull like this is never allowed to happen again. (Marcin here, co-founder of Spacelift, one of the members of the OpenTF initiative)

paxys 3y ago

CLAs are very misunderstood in the software industry. Every open source project should make its contributors sign CLAs, and you should be wary of using one that doesn't. Why? Because any single contributor can claim at any point in the future that the project is using their code illegally, and that you/your company should pay them for using their proprietary IP for all of these years. Can you prove that you audited every single line in the project you used and were sure of its copyright status? A CLA ensures exactly that. There's a reason why Linux Foundation, Apache, CNCF, Mozilla, heck even FSF all have strict CLA requirements. Relicensing is a completely separate conversation, and there are plenty of open source CLAs which don't have that provision.

Pannoniae 3y ago
This kind of trolling can easily be prevented by saying "Sure, we will remove your contributions. Name the exact line numbers affected"
- jen20 3y ago
  The burden of ensuring license compliance falls to the consumer, not the producer.
unmole 3y ago
> Because any single contributor can claim at any point in the future that the project is using their code illegally So, you've never heard of a Developer Certificate of Origin? If it's good enough for Linux, it's good enough for me.
- paxys 3y ago
  > The Developer Certificate of Origin (DCO) is a statement that a software developer agrees to, saying that the contributor is allowed to make the contribution and that the project has the right to distribute it under its license. So in other words, a CLA.
  - unmole 3y ago