3 ms·

It should serve as a warning for companies who want to leverage the open source community but then do a rugpull

ohad1282 3y ago
I think it is reasonable for a company to start OSS and then change its license. But it indeed feels like a rugpull for all the contributors. That is why OpenTF is on its way to CNCF. To ensure it stays OSS forever. There is a difference between "true OSS" like K8s, OPA, etc and "temporary OSS" (backed by a company) like what Terraform used to be, Pulumi, GitLab ,etc. Those can be changed in the future. When developers chose OSS, they should consider if it is a CNCF OSS or a vendor backed OSS. What Hashi did is an important example. (disclaimer - env0 founder here, co-lead the OpenTF initiative)
- AaronFriel 3y ago
  > Pulumi is true open source, uses the Apache 2.0 license, and does not and never will depend on BSL-licensed software in any way, HashiCorp owned or otherwise. https://www.pulumi.com/blog/pulumi-hearts-opensource/ https://www.pulumi.com/blog/pulumi-hearts-opensource/ Disclaimer: the following is my own opinion as an engineer at Pulumi. Pulumi is true open source, with a relationship similar to git and the many SaaS services that layer on top of git to provide meaningful value. To contrast with our competitor, Pulumi relies on open source languages and protocols. We could not, even if we wanted to, change the Python license. Nor could we change our protocols without breaking our users and our growing ecosystem. That's the value of building on open protocols and standard languages.
  - ohad1282 3y ago
    fair point. makes sense.
res0nat0r 3y ago
I suspect this project is going to consist of a very loud minority of folks. I'm working for a very large company right now and they've been mandating us to move all of our TF code to Terraform Cloud for the last year, and I've not heard a peep about this licensing issue. I'm assuming they're going full steam ahead and don't care about this issue. As long as the TF Cloud service is easy to use, still a SaaS so it's TF's problem vs the companies, and they allow a robust login / access pattern via OAuth / SAML, all is well.
- joshpadnick 3y ago
  OpenTF core member here. If you're comfortable opting into an ecosystem where most of the key products are offered and supported by a single vendor (in this case, Hashicorp), then yes, there are no licensing issues to worry about and basically nothing needs to change for now. But our philosophy at OpenTF is that users would rather participate in an open ecosystem where multiple vendors compete for their business. If you're not happy with one vendor, you can easily switch to another; competition works to make all vendors better. When we look back at this comment a year from now, I'll wonder how your company will feel about the responsiveness and new features they're getting from Terraform Cloud when the primary incentive to stay is not because you think it's the best product available, but because switching costs are so painful.
  - res0nat0r 3y ago
    Honestly, I think when it comes to the large companies I've worked for, they care more than anything else revolves around "support". 15+ years ago the my previous company was all Sun Microsystems based, owned millions of dollars in 880s, 6800s and even an E10K. They said Linux was off limits because they couldn't blame/call anyone when they needed "support", even when Redhat was already around. Eventually they saw the writing on the wall and moved to Linux systems and replaced all of the hardware, and have an enterprise RHEL subscription that we could call when needed. I think the story is going to be the same with the current company, mainly "who can we blame if there is a security incident, or get me a Hashicorp person on the phone if we have some kind of Terraform related production issue." Having this in place seems to matter more than everything else honestly.
    - zeroimpl 3y ago
      I'm not sure companies care much about support for "simple" tools like Terraform, at least the non-hosted version. Operating systems have lots of dark corners, but if your Terraform deployment isn't working then the problem is likely your code.
- waynesonfire 3y ago
  Probably a good idea to continue with that initiative. OpenTF is new. However, your CTO should contribute to the OpenTF effort. I would like to see more companies that leverage open-source contribute back to the very community that enables their value creation.
sanderjd 3y ago
I think you're both right? I have come around to the idea that it's good to firmly discourage this kind of late-in-the-game license change. But I also think that, on net, this episode will lead to fewer businesses choosing the open source model for their software, from the start. It just seems like playing business on hard mode to try to build an open source or source available product, when you can just build a SaaS and charge for it. I think this is really bad (I have a strong preference to not be stuck with opaque SaaSes for most things), and I'm not sure what incentive there is to try to find new business models, when you risk becoming public enemy number one amongst a big chunk of your potential customer base.

I think it is reasonable for a company to start OSS and then change its license. But it indeed feels like a rugpull for all the contributors. That is why OpenTF is on its way to CNCF. To ensure it stays OSS forever. There is a difference between "true OSS" like K8s, OPA, etc and "temporary OSS" (backed by a company) like what Terraform used to be, Pulumi, GitLab ,etc. Those can be changed in the future. When developers chose OSS, they should consider if it is a CNCF OSS or a vendor backed OSS. What Hashi did is an important example. (disclaimer - env0 founder here, co-lead the OpenTF initiative)

AaronFriel 3y ago
> Pulumi is true open source, uses the Apache 2.0 license, and does not and never will depend on BSL-licensed software in any way, HashiCorp owned or otherwise. https://www.pulumi.com/blog/pulumi-hearts-opensource/ https://www.pulumi.com/blog/pulumi-hearts-opensource/ Disclaimer: the following is my own opinion as an engineer at Pulumi. Pulumi is true open source, with a relationship similar to git and the many SaaS services that layer on top of git to provide meaningful value. To contrast with our competitor, Pulumi relies on open source languages and protocols. We could not, even if we wanted to, change the Python license. Nor could we change our protocols without breaking our users and our growing ecosystem. That's the value of building on open protocols and standard languages.
- ohad1282 3y ago
  fair point. makes sense.

res0nat0r 3y ago

I suspect this project is going to consist of a very loud minority of folks. I'm working for a very large company right now and they've been mandating us to move all of our TF code to Terraform Cloud for the last year, and I've not heard a peep about this licensing issue. I'm assuming they're going full steam ahead and don't care about this issue. As long as the TF Cloud service is easy to use, still a SaaS so it's TF's problem vs the companies, and they allow a robust login / access pattern via OAuth / SAML, all is well.

joshpadnick 3y ago
OpenTF core member here. If you're comfortable opting into an ecosystem where most of the key products are offered and supported by a single vendor (in this case, Hashicorp), then yes, there are no licensing issues to worry about and basically nothing needs to change for now. But our philosophy at OpenTF is that users would rather participate in an open ecosystem where multiple vendors compete for their business. If you're not happy with one vendor, you can easily switch to another; competition works to make all vendors better. When we look back at this comment a year from now, I'll wonder how your company will feel about the responsiveness and new features they're getting from Terraform Cloud when the primary incentive to stay is not because you think it's the best product available, but because switching costs are so painful.
- res0nat0r 3y ago
  Honestly, I think when it comes to the large companies I've worked for, they care more than anything else revolves around "support". 15+ years ago the my previous company was all Sun Microsystems based, owned millions of dollars in 880s, 6800s and even an E10K. They said Linux was off limits because they couldn't blame/call anyone when they needed "support", even when Redhat was already around. Eventually they saw the writing on the wall and moved to Linux systems and replaced all of the hardware, and have an enterprise RHEL subscription that we could call when needed. I think the story is going to be the same with the current company, mainly "who can we blame if there is a security incident, or get me a Hashicorp person on the phone if we have some kind of Terraform related production issue." Having this in place seems to matter more than everything else honestly.
  - zeroimpl 3y ago
    I'm not sure companies care much about support for "simple" tools like Terraform, at least the non-hosted version. Operating systems have lots of dark corners, but if your Terraform deployment isn't working then the problem is likely your code.
waynesonfire 3y ago
Probably a good idea to continue with that initiative. OpenTF is new. However, your CTO should contribute to the OpenTF effort. I would like to see more companies that leverage open-source contribute back to the very community that enables their value creation.

sanderjd 3y ago

I think you're both right? I have come around to the idea that it's good to firmly discourage this kind of late-in-the-game license change. But I also think that, on net, this episode will lead to fewer businesses choosing the open source model for their software, from the start. It just seems like playing business on hard mode to try to build an open source or source available product, when you can just build a SaaS and charge for it. I think this is really bad (I have a strong preference to not be stuck with opaque SaaSes for most things), and I'm not sure what incentive there is to try to find new business models, when you risk becoming public enemy number one amongst a big chunk of your potential customer base.