12 ms·

The Terraform Registry Terms of Service have been updated

294 points by yankcrime 3y ago

r053bud 3y ago
To me, this entire story was about HashiCorp updating their TOS without changing the "updated date" - which to me is reason enough to drop use of all products from a company. That being said, it does look like the updated date has been modified to reflect the change. So maybe it's not so "silent" anymore, or maybe they changed it because of the backlash here.
tehalex 3y ago
I wonder if there are some module authors who would like to pull their modules from the terraform registry as a result of this...
Igalze 3y ago
Changing ToS w/o even updating the "update date" - not to mention releasing some announcement... Who does that? No really? Feels like the show is being run by lawyers who don't know how Internet works.
solomatov 3y ago
I don't exactly understand how you could use it for commercial use in the original license quoted in the thread: >You may download or copy the Content (and other items displayed on the Services for download) for personal non-commercial use only, provided that you maintain all copyright and other notices contained in such Content. You shall not store any significant portion of any Content in any form. Does personal non-commercial use allow use for work purposes somehow? P.S. Just curious.
martypitt 3y ago
Not the OP, but I suspect HN has trimmed the anchor link. > https://github.com/opentffoundation/roadmap/issues/24#issuecomment-1699535216 https://github.com/opentffoundation/roadmap/issues/24#issuec... That's the comment that made the issue clear -- specifically TOS were amended for https://registry.terraform.io https://registry.terraform.io to state: > You may download providers, modules, policy libraries and/or other Services or Content from this website __solely for use with, or in support of, HashiCorp Terraform.__ ie., it looks like the intent is "You can't use OpenTF with registry.terraform.io". IMO, that feels a little petty. But, I guess if OpenTF is taking a position of "Use us instead of Terraform", then they shouldn't expect to get the usage of Hashicorps infra.
- benatkin 3y ago
  This is the same situation as with Microsoft, Visual Studio Code, and OpenVSX. It's covered in depth here: https://ghuntley.com/fracture/ https://ghuntley.com/fracture/
- Pet_Ant 3y ago
  How would they even know when the protocol is identical? I mean this is hardly the least unethical thing a company would do.
- dang 3y ago
  Ok, I've put the anchor back up there.
- sneak 3y ago
  Is this even enforceable given the ruling about scraping? I don't have any rights to dictate what browser you use to accsss my website.
- berniedurfee 3y ago
  Very petty. I’ve been a longtime advocate and evangelist for Hashicorp products, but jeez. I felt they were ‘one of the good ones’ making great tech just to make great tech. Success and profit followed making great tech. How the mighty have fallen. Long live Terrafork I guess. Hashifork all their other stuff too I suppose. Very disappointing.
- deleted 3y ago
  [deleted]
- paulgb 3y ago
  > But, I guess if OpenTF is taking a position of "Use us instead of Terraform", then they shouldn't expect to get the usage of Hashicorps infra. It’s totally something they can do, but it seems short-sighted. They had to know that this wouldn’t actually stop the momentum around OpenTF, but just result in HashiCorp giving up the control they have over the canonical namespace. As precedent, Docker allows Kubernetes and Podman to access its registry, for example.
milliams 3y ago
Even though this will likely prevent OpenTF from connecting to registry.terraform.io to get plugins, the source code for most (all?) plugins is still open source and actually stored on GitHub (e.g. https://github.com/terraform-provider-openstack/terraform-provider-openstack https://github.com/terraform-provider-openstack/terraform-pr...). More work for OpenTF to get up and running, but also feels reasonable that HashiCorp wouldn't allow connecting to their service.
- tyingq 3y ago
  >still open source and actually stored on GitHub I think that's true, but it's probably hard to recreate large parts of the index. I don't think there's any mandatory manifest or something like that where you can reliably identify a repo as something that appears in their registry. Probably some missing metadata too.
  - fishnchips 3y ago
    The publishing process for the public registry is very prescriptive, and there is indeed a manifest file involved - https://developer.hashicorp.com/terraform/registry/providers/publishing https://developer.hashicorp.com/terraform/registry/providers...
    - tyingq 3y ago
      That helps, but it reads like the manifest is optional.
      - fishnchips 3y ago
        Correct, the manifest is optional.
  - ashald 3y ago
    It's... effort consuming, but is doable and more like a 1-time effort. A while ago I built an alternative plugin manager for Terraform (https://github.com/paraterraform/para https://github.com/paraterraform/para) and explored the idea of distributed indices (where you just host a file in the repo as seen in https://github.com/ashald/terraform-provider-stateful/blob/master/provider.stateful.yaml https://github.com/ashald/terraform-provider-stateful/blob/m...). So at the end of the day, it's either about the effort to inventory the current registry and find sources that are available, or do this on an ongoing as-needed basis (eg something like para would allow an index to be hosted in a github repo managed with PRs).
Octabrain 3y ago
I had Hashicorp in my mind as a cool and respectful company. These recent events have made to reconsider and throw them into the same bag as Oracle. I find this pretty sad.
- aae42 3y ago
  They absolutely were at one point, this is why the BSL move was so upsetting, not because it necessarily stopped people from using it (unless they of course were offering competing services), but because it signaled that the phase of HashiCorp being a cool and respectful company are over. It's almost a capitalist gut punch. Chasing that dollar, companies will squeeze every last drop of altruism out of a company. It makes me think that the gov. should provide incentives to keep open source software backed by corporations going by figuring out how to offer a tax break on all of the "lost revenue"... We just need a good way of figuring out what the lost revenue is. :thinking:
- artyom 3y ago
  It actually was a respectable company. But the guy who started it all (Mitchell Hashimoto) isn't there anymore (at least not as a decision maker) so the corporate drones are taking over.
  - geerlingguy 3y ago
    It's sad too, mitchellh used to be fairly active in the HN community but it seems he is not able to for likely professional reasons after the BSL fiasco.
    - scrollaway 3y ago
      Mitchell is a wonderful hacker. He’s someone who gets what an open source company is/should be better than many who tried. I suspect he doesn’t feel great about what’s happening with the company…
      - jeremyjh 3y ago
jacquesm 3y ago
Companies want the benefits of open source (massive community contributions, lower development costs, better security, community exposure, marketshare) but don't like the downsides (from their perspective: forks, lack of control, freeloaders etc). TOS changes like this are fine, it's their garden, but ultimately all they'll do is put even more power behind forks and alternatives. Because the people that were motivated to use OpenTF are now also going to offer an alternative registry, which results in further loss of control and community contact and shifts attention away from HashiCorp's offering. It's very difficult to pull off this sort of dual stance without each move that you make impacting some aspect of your operation in a negative way. You need to think this through very well from day one because any change later on could easily be perceived as the beginnings of an attempt to squeeze the installed base and once that is the impression you will lose users rapidly.
- jeremyjh 3y ago
  I think this damages all commercial OSS projects. Because after Docker and Terraform, any effort to bring in some OSS project as a dependency will be met with "Sure, it's open source now, but what about when...".
  - charcircuit 3y ago
    Most businesses are not directly competing with the businesses making software they depend on
    - throw16180339 3y ago
      Some of them, however, may want to be acquired by companies that compete with HashiCorp.
      - sam_bristow 3y ago
        Or HashiCorp might acquire a company you compete with.
jrudolph 3y ago
Getting a lot of docker hub vibes from this one. HashiCorp is course within their rights. Can't be cheap to run the registry given the obscene size of some terraform providers. $ ls -lah terraform/providers/registry.terraform.io/hashicorp/aws/5.14.0/darwin_amd64/ total 368M Anyone have an idea of the reasons terraform needs a 370 MiB binary just to call REST APIs?
- mschuster91 3y ago
  > Anyone have an idea of the reasons terraform needs a 370 MiB binary just to call REST APIs? That's because Terraform fell for the Go trap. When space and bandwidth are cheap, why not go for an environment that only ships fully self contained binaries? Oh, and why not go for a language that attracts hipsters like fruits attract flies, but is a nightmare to develop in? Bloody ridiculous, it's a miracle Terraform got as far as it did. (Yes, I'm working with Terraform every day and it's pretty decent but I'd love to extend it for Atlassian Cloud stuff without having to add a sixth language to my already sized toolbelt. Why Atlassian doesn't offer Terraform integration on their own is beyond me in any case)
- paulddraper 3y ago
  https://github.com/hashicorp/terraform-provider-aws/issues/31345 https://github.com/hashicorp/terraform-provider-aws/issues/3... The size is what you get when you add every single AWS Go client into one binary. Each service client like 1-2MB. But when you have 200 services....
- skywhopper 3y ago
  The AWS Go SDK is the vast majority of that bulk. In general go binaries can get pretty big but AWS has hundreds of services with thousands of APIs and it’s all going to have to get included in the AWS provider.
  - candiddevmike 3y ago
    The AWS Go SDK is actually a case study on making everything into pointers
newsclues 3y ago
Corporations double down on stupid.
- justin_oaks 3y ago
  Which is a shame. If they backed down then only a little goodwill would be lost rather than the whole thing. So now they are probably going to lose goodwill AND market share. I'm hoping that OpenTF becomes the winning fork, just like Jenkins won over Hudson.
  - dpeckett 3y ago
    Yeh I thought Terraform might not have been a direct target of the BSL license change (vault/consul etc are bigger fish) but this makes it clear this is not the case.
cube2222 3y ago
Hey! Just wanted to say that this doesn't impact OpenTF too much. It's an extra step we need to take before a stable release, but long-term it'll make us more decoupled, which is great. As someone else commented, all providers and modules other than Hashicorp's are hosted on GitHub and the registry is just a "redirector". We'll do something similar, other than some special handling for Hashicorp's providers. Also, I know you want us to finally publish the repo - we're working very hard to make this happen and it should be a matter of days now. Disclaimer: Work at Spacelift, and currently temporary Technical Lead of the OpenTF Project, until it's committee-steered.
- yuppie_scum 3y ago
  I sure hope that opentf doesn’t just cause a fragmentation in the ecosystem that ruins the user experience, especially for the many people who are happily using unpaid TF and self hosted state stores.
  - cube2222 3y ago
    > opentf doesn’t just cause a fragmentation We're trying to remain as compatible on all fronts as possible, and our registry will too, so I wouldn't be attributing the fragmentation to OpenTF.
  - jitl 3y ago
    It’s Hashicorp’s license changes that are causing fragmentation, OpenTF is the effect not the cause.
  - candiddevmike 3y ago
    Why aren't you interested in switching to OpenTF?
    - yuppie_scum 3y ago
      I never said I wouldn’t. At the end of the day I’ll use whatever is the easiest/best. I’m just hoping not to have to do a bunch of rework.
rwmj 3y ago
What's the legal theory that allows HashiCorp to control the use of data after downloading it? Is it like if I offered MP4 files on my website that can be downloaded by anyone but added the condition you must view them in VLC only? (which I'm fairly sure would be unenforcible even if the MP4 files were proprietary content)
- tyingq 3y ago
  There's all sorts of them. Here's one example, in the EU: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A31996L0009 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A... The bigger thing, though, is that they don't necessarily need to be on completely solid legal ground. Just enough semi-plausible legal ground to out-spend you on the matter.
- ncallaway 3y ago
  I think the freedom to contract is the main legal theory. That, as long as there’s a proper contract that doesn’t contain unconscionable or otherwise illegal terms, then adults can enter into contracts with the consent of all parties, and the parties get to decide the terms of the agreement.
bloopernova 3y ago
The leadership at Hashicorp doesn't seem to "get" open source development, or at least doesn't seem to value the community of their customers. The change of license could have been attributed to them trying to protect their SaaS business if you squinted. But now they're saying "this is ours and you can't play", even though that hurts tf in the long run due to alienation of the community. I get that they need to generate revenue, but I don't understand how alienating their customers makes money even in the long term? Did leadership or ownership change recently?
- johnbellone 3y ago
  They're a public company now and they've been unable to get to profitability. This is HashiCorp building their moat.
m-p-3 3y ago
I mean it's reasonable for HashiCorp to limit who uses their infrastructure since they foot the bill for it. Google did a similar thing for the Chrome Web Store to download extensions when Microsoft released Edge, pushing Microsoft to host its own distribution channel.
- ThomasRooney 3y ago
  The registry is more similar to https://sum.golang.org/ https://sum.golang.org/ than the Chrome Web Store. It pretty much just stores a checksum database, a list of links to github (which actually hosts the cross-compiled binaries), a channel [Official, Partner, Community], some ownership metadata, and some static markdown per provider/module version for documentation. E.g. back-of-envelope for terraform providers this is: Metadata: 4KB JSON [0] * ~15 OS/arch combinations * ~50 versions * ~3000 providers = ~10GB in total Docs: ~700Kb [1] * ~50 versions * ~3000 providers = ~100GB in total In my mind the analagous behaviour would be if the golang checksum database added in license terms that stated "you need to abide by a BSL to use data from this service". What that actually would mean is so nebulous that it feels threatening. [0] Source: https://registry.terraform.io/v1/providers/airbytehq/airbyte/0.3.0/download/darwin/arm64 https://registry.terraform.io/v1/providers/airbytehq/airbyte... [1] Source: https://github.com/airbytehq/terraform-provider-airbyte/tree/main/docs https://github.com/airbytehq/terraform-provider-airbyte/tree... gzipped : ~300 resources, ~300 data sources (NB: in airbyte's case the TF Provider was generated from a ~150Kb OpenAPI spec via https://speakeasyapi.dev https://speakeasyapi.dev: implying docs could be compressed even more)
dreamcompiler 3y ago
Just another facet of the lovely enshittification diamond. Fortunately in OSS land, there's a deshittification tool called the fork.
- Coryodaniel 3y ago
  I love these new words that just entered my vocab
zaphar 3y ago
If I am a cloud provider and maintain a Terraform binding I now have a strong reason to target OpenTF over HashiTF as they inevitably begin to diverge. It's hard to see how Hashicorp survives trying to compete over a consortiom of companies for whom TF is a complement and not the product and are incentivized to use it as a free value add. Especially when those same companies are the primary targets for Terraform usage.
lucasfcosta 3y ago
This is such a terrible move for the ecosystem as a whole. So now it means individuals using tools like Layerform and Terragrunt cannot use the registry anymore even though the software hasn’t changed at all? How will they even enforce that?
- what-no-tests 3y ago
  The best way: through selective enforcement of an overly broad rule. Just like all tyrants have done.
- deleted 3y ago
  [deleted]
hk1337 3y ago
Silently infers they're trying to sneak something in without everyone knowing but the discussion has been going on for a few weeks now, iirc? They just finally made the change they said there going to make or is this something else?
- paulddraper 3y ago
  The modified date was supposedly not updated. (But now it is?)
jk563 3y ago
I've seen a lot about OpenTF and I applaud the (very large) effort to get a viable alternative in place in short order. Is anyone aware of corresponding projects for other tools in the HashiCorp suite?
- nobleach 3y ago
  Vault has been in use at several of my former companies. I haven't even considered what they might do.
  - ArchOversight 3y ago
    Vault is under the BSL now too: https://github.com/hashicorp/vault/blob/main/LICENSE https://github.com/hashicorp/vault/blob/main/LICENSE

294 points by yankcrime 3y ago

To me, this entire story was about HashiCorp updating their TOS without changing the "updated date" - which to me is reason enough to drop use of all products from a company. That being said, it does look like the updated date has been modified to reflect the change. So maybe it's not so "silent" anymore, or maybe they changed it because of the backlash here.

tehalex 3y ago

I wonder if there are some module authors who would like to pull their modules from the terraform registry as a result of this...

Igalze 3y ago

Changing ToS w/o even updating the "update date" - not to mention releasing some announcement... Who does that? No really? Feels like the show is being run by lawyers who don't know how Internet works.

solomatov 3y ago

I don't exactly understand how you could use it for commercial use in the original license quoted in the thread: >You may download or copy the Content (and other items displayed on the Services for download) for personal non-commercial use only, provided that you maintain all copyright and other notices contained in such Content. You shall not store any significant portion of any Content in any form. Does personal non-commercial use allow use for work purposes somehow? P.S. Just curious.

martypitt 3y ago

Not the OP, but I suspect HN has trimmed the anchor link. > https://github.com/opentffoundation/roadmap/issues/24#issuecomment-1699535216 https://github.com/opentffoundation/roadmap/issues/24#issuec... That's the comment that made the issue clear -- specifically TOS were amended for https://registry.terraform.io https://registry.terraform.io to state: > You may download providers, modules, policy libraries and/or other Services or Content from this website __solely for use with, or in support of, HashiCorp Terraform.__ ie., it looks like the intent is "You can't use OpenTF with registry.terraform.io". IMO, that feels a little petty. But, I guess if OpenTF is taking a position of "Use us instead of Terraform", then they shouldn't expect to get the usage of Hashicorps infra.

benatkin 3y ago
This is the same situation as with Microsoft, Visual Studio Code, and OpenVSX. It's covered in depth here: https://ghuntley.com/fracture/ https://ghuntley.com/fracture/
Pet_Ant 3y ago
How would they even know when the protocol is identical? I mean this is hardly the least unethical thing a company would do.
dang 3y ago
Ok, I've put the anchor back up there.
sneak 3y ago
Is this even enforceable given the ruling about scraping? I don't have any rights to dictate what browser you use to accsss my website.
berniedurfee 3y ago
Very petty. I’ve been a longtime advocate and evangelist for Hashicorp products, but jeez. I felt they were ‘one of the good ones’ making great tech just to make great tech. Success and profit followed making great tech. How the mighty have fallen. Long live Terrafork I guess. Hashifork all their other stuff too I suppose. Very disappointing.
deleted 3y ago
[deleted]
paulgb 3y ago
> But, I guess if OpenTF is taking a position of "Use us instead of Terraform", then they shouldn't expect to get the usage of Hashicorps infra. It’s totally something they can do, but it seems short-sighted. They had to know that this wouldn’t actually stop the momentum around OpenTF, but just result in HashiCorp giving up the control they have over the canonical namespace. As precedent, Docker allows Kubernetes and Podman to access its registry, for example.

milliams 3y ago

Even though this will likely prevent OpenTF from connecting to registry.terraform.io to get plugins, the source code for most (all?) plugins is still open source and actually stored on GitHub (e.g. https://github.com/terraform-provider-openstack/terraform-provider-openstack https://github.com/terraform-provider-openstack/terraform-pr...). More work for OpenTF to get up and running, but also feels reasonable that HashiCorp wouldn't allow connecting to their service.

tyingq 3y ago
>still open source and actually stored on GitHub I think that's true, but it's probably hard to recreate large parts of the index. I don't think there's any mandatory manifest or something like that where you can reliably identify a repo as something that appears in their registry. Probably some missing metadata too.
- fishnchips 3y ago
  The publishing process for the public registry is very prescriptive, and there is indeed a manifest file involved - https://developer.hashicorp.com/terraform/registry/providers/publishing https://developer.hashicorp.com/terraform/registry/providers...
  - tyingq 3y ago
    That helps, but it reads like the manifest is optional.
    - fishnchips 3y ago
      Correct, the manifest is optional.
- ashald 3y ago
  It's... effort consuming, but is doable and more like a 1-time effort. A while ago I built an alternative plugin manager for Terraform (https://github.com/paraterraform/para https://github.com/paraterraform/para) and explored the idea of distributed indices (where you just host a file in the repo as seen in https://github.com/ashald/terraform-provider-stateful/blob/master/provider.stateful.yaml https://github.com/ashald/terraform-provider-stateful/blob/m...). So at the end of the day, it's either about the effort to inventory the current registry and find sources that are available, or do this on an ongoing as-needed basis (eg something like para would allow an index to be hosted in a github repo managed with PRs).

Octabrain 3y ago

I had Hashicorp in my mind as a cool and respectful company. These recent events have made to reconsider and throw them into the same bag as Oracle. I find this pretty sad.

aae42 3y ago
They absolutely were at one point, this is why the BSL move was so upsetting, not because it necessarily stopped people from using it (unless they of course were offering competing services), but because it signaled that the phase of HashiCorp being a cool and respectful company are over. It's almost a capitalist gut punch. Chasing that dollar, companies will squeeze every last drop of altruism out of a company. It makes me think that the gov. should provide incentives to keep open source software backed by corporations going by figuring out how to offer a tax break on all of the "lost revenue"... We just need a good way of figuring out what the lost revenue is. :thinking:
artyom 3y ago
It actually was a respectable company. But the guy who started it all (Mitchell Hashimoto) isn't there anymore (at least not as a decision maker) so the corporate drones are taking over.
- geerlingguy 3y ago
  It's sad too, mitchellh used to be fairly active in the HN community but it seems he is not able to for likely professional reasons after the BSL fiasco.
  - scrollaway 3y ago
    Mitchell is a wonderful hacker. He’s someone who gets what an open source company is/should be better than many who tried. I suspect he doesn’t feel great about what’s happening with the company…
    - jeremyjh 3y ago

jacquesm 3y ago

Companies want the benefits of open source (massive community contributions, lower development costs, better security, community exposure, marketshare) but don't like the downsides (from their perspective: forks, lack of control, freeloaders etc). TOS changes like this are fine, it's their garden, but ultimately all they'll do is put even more power behind forks and alternatives. Because the people that were motivated to use OpenTF are now also going to offer an alternative registry, which results in further loss of control and community contact and shifts attention away from HashiCorp's offering. It's very difficult to pull off this sort of dual stance without each move that you make impacting some aspect of your operation in a negative way. You need to think this through very well from day one because any change later on could easily be perceived as the beginnings of an attempt to squeeze the installed base and once that is the impression you will lose users rapidly.

jeremyjh 3y ago
I think this damages all commercial OSS projects. Because after Docker and Terraform, any effort to bring in some OSS project as a dependency will be met with "Sure, it's open source now, but what about when...".
- charcircuit 3y ago
  Most businesses are not directly competing with the businesses making software they depend on
  - throw16180339 3y ago
    Some of them, however, may want to be acquired by companies that compete with HashiCorp.
    - sam_bristow 3y ago
      Or HashiCorp might acquire a company you compete with.

jrudolph 3y ago

Getting a lot of docker hub vibes from this one. HashiCorp is course within their rights. Can't be cheap to run the registry given the obscene size of some terraform providers. $ ls -lah terraform/providers/registry.terraform.io/hashicorp/aws/5.14.0/darwin_amd64/ total 368M Anyone have an idea of the reasons terraform needs a 370 MiB binary just to call REST APIs?

mschuster91 3y ago
> Anyone have an idea of the reasons terraform needs a 370 MiB binary just to call REST APIs? That's because Terraform fell for the Go trap. When space and bandwidth are cheap, why not go for an environment that only ships fully self contained binaries? Oh, and why not go for a language that attracts hipsters like fruits attract flies, but is a nightmare to develop in? Bloody ridiculous, it's a miracle Terraform got as far as it did. (Yes, I'm working with Terraform every day and it's pretty decent but I'd love to extend it for Atlassian Cloud stuff without having to add a sixth language to my already sized toolbelt. Why Atlassian doesn't offer Terraform integration on their own is beyond me in any case)
paulddraper 3y ago
https://github.com/hashicorp/terraform-provider-aws/issues/31345 https://github.com/hashicorp/terraform-provider-aws/issues/3... The size is what you get when you add every single AWS Go client into one binary. Each service client like 1-2MB. But when you have 200 services....
skywhopper 3y ago
The AWS Go SDK is the vast majority of that bulk. In general go binaries can get pretty big but AWS has hundreds of services with thousands of APIs and it’s all going to have to get included in the AWS provider.
- candiddevmike 3y ago
  The AWS Go SDK is actually a case study on making everything into pointers

newsclues 3y ago

Corporations double down on stupid.

justin_oaks 3y ago
Which is a shame. If they backed down then only a little goodwill would be lost rather than the whole thing. So now they are probably going to lose goodwill AND market share. I'm hoping that OpenTF becomes the winning fork, just like Jenkins won over Hudson.
- dpeckett 3y ago
  Yeh I thought Terraform might not have been a direct target of the BSL license change (vault/consul etc are bigger fish) but this makes it clear this is not the case.

cube2222 3y ago

Hey! Just wanted to say that this doesn't impact OpenTF too much. It's an extra step we need to take before a stable release, but long-term it'll make us more decoupled, which is great. As someone else commented, all providers and modules other than Hashicorp's are hosted on GitHub and the registry is just a "redirector". We'll do something similar, other than some special handling for Hashicorp's providers. Also, I know you want us to finally publish the repo - we're working very hard to make this happen and it should be a matter of days now. Disclaimer: Work at Spacelift, and currently temporary Technical Lead of the OpenTF Project, until it's committee-steered.

yuppie_scum 3y ago
I sure hope that opentf doesn’t just cause a fragmentation in the ecosystem that ruins the user experience, especially for the many people who are happily using unpaid TF and self hosted state stores.
- cube2222 3y ago
  > opentf doesn’t just cause a fragmentation We're trying to remain as compatible on all fronts as possible, and our registry will too, so I wouldn't be attributing the fragmentation to OpenTF.
- jitl 3y ago
  It’s Hashicorp’s license changes that are causing fragmentation, OpenTF is the effect not the cause.
- candiddevmike 3y ago
  Why aren't you interested in switching to OpenTF?
  - yuppie_scum 3y ago
    I never said I wouldn’t. At the end of the day I’ll use whatever is the easiest/best. I’m just hoping not to have to do a bunch of rework.

rwmj 3y ago

What's the legal theory that allows HashiCorp to control the use of data after downloading it? Is it like if I offered MP4 files on my website that can be downloaded by anyone but added the condition you must view them in VLC only? (which I'm fairly sure would be unenforcible even if the MP4 files were proprietary content)

tyingq 3y ago
There's all sorts of them. Here's one example, in the EU: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A31996L0009 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A... The bigger thing, though, is that they don't necessarily need to be on completely solid legal ground. Just enough semi-plausible legal ground to out-spend you on the matter.
ncallaway 3y ago
I think the freedom to contract is the main legal theory. That, as long as there’s a proper contract that doesn’t contain unconscionable or otherwise illegal terms, then adults can enter into contracts with the consent of all parties, and the parties get to decide the terms of the agreement.

bloopernova 3y ago

The leadership at Hashicorp doesn't seem to "get" open source development, or at least doesn't seem to value the community of their customers. The change of license could have been attributed to them trying to protect their SaaS business if you squinted. But now they're saying "this is ours and you can't play", even though that hurts tf in the long run due to alienation of the community. I get that they need to generate revenue, but I don't understand how alienating their customers makes money even in the long term? Did leadership or ownership change recently?

johnbellone 3y ago
They're a public company now and they've been unable to get to profitability. This is HashiCorp building their moat.

m-p-3 3y ago

I mean it's reasonable for HashiCorp to limit who uses their infrastructure since they foot the bill for it. Google did a similar thing for the Chrome Web Store to download extensions when Microsoft released Edge, pushing Microsoft to host its own distribution channel.

ThomasRooney 3y ago
The registry is more similar to https://sum.golang.org/ https://sum.golang.org/ than the Chrome Web Store. It pretty much just stores a checksum database, a list of links to github (which actually hosts the cross-compiled binaries), a channel [Official, Partner, Community], some ownership metadata, and some static markdown per provider/module version for documentation. E.g. back-of-envelope for terraform providers this is: Metadata: 4KB JSON [0] * ~15 OS/arch combinations * ~50 versions * ~3000 providers = ~10GB in total Docs: ~700Kb [1] * ~50 versions * ~3000 providers = ~100GB in total In my mind the analagous behaviour would be if the golang checksum database added in license terms that stated "you need to abide by a BSL to use data from this service". What that actually would mean is so nebulous that it feels threatening. [0] Source: https://registry.terraform.io/v1/providers/airbytehq/airbyte/0.3.0/download/darwin/arm64 https://registry.terraform.io/v1/providers/airbytehq/airbyte... [1] Source: https://github.com/airbytehq/terraform-provider-airbyte/tree/main/docs https://github.com/airbytehq/terraform-provider-airbyte/tree... gzipped : ~300 resources, ~300 data sources (NB: in airbyte's case the TF Provider was generated from a ~150Kb OpenAPI spec via https://speakeasyapi.dev https://speakeasyapi.dev: implying docs could be compressed even more)

dreamcompiler 3y ago

Just another facet of the lovely enshittification diamond. Fortunately in OSS land, there's a deshittification tool called the fork.

Coryodaniel 3y ago
I love these new words that just entered my vocab

zaphar 3y ago

If I am a cloud provider and maintain a Terraform binding I now have a strong reason to target OpenTF over HashiTF as they inevitably begin to diverge. It's hard to see how Hashicorp survives trying to compete over a consortiom of companies for whom TF is a complement and not the product and are incentivized to use it as a free value add. Especially when those same companies are the primary targets for Terraform usage.

lucasfcosta 3y ago

This is such a terrible move for the ecosystem as a whole. So now it means individuals using tools like Layerform and Terragrunt cannot use the registry anymore even though the software hasn’t changed at all? How will they even enforce that?

what-no-tests 3y ago
The best way: through selective enforcement of an overly broad rule. Just like all tyrants have done.
deleted 3y ago
[deleted]

hk1337 3y ago

Silently infers they're trying to sneak something in without everyone knowing but the discussion has been going on for a few weeks now, iirc? They just finally made the change they said there going to make or is this something else?

paulddraper 3y ago
The modified date was supposedly not updated. (But now it is?)

jk563 3y ago

I've seen a lot about OpenTF and I applaud the (very large) effort to get a viable alternative in place in short order. Is anyone aware of corresponding projects for other tools in the HashiCorp suite?

nobleach 3y ago
Vault has been in use at several of my former companies. I haven't even considered what they might do.
- ArchOversight 3y ago
  Vault is under the BSL now too: https://github.com/hashicorp/vault/blob/main/LICENSE https://github.com/hashicorp/vault/blob/main/LICENSE