7 ms·

More Open Source projects should adopt SSPL, or experiment with LLama 2 style limitations on the size of companies which may use the work for free (for example,

by jeswin 3y ago

More Open Source projects should adopt SSPL, or experiment with LLama 2 style limitations on the size of companies which may use the work for free (for example, Open Source but not if you're a multi-billion cloud megacorp). When individual developers contribute back, they weren't doing it to enable AWS to freeload. AWS of course is the single biggest reason why projects are flocking to more restrictive licenses. The right thing to do for AWS would have been to respect the work of the original authors (/company) and throw their weight behind an offering supported by the original developers. Instead, AWS builds a competing product when they see an OSS product succeeding. Third party vendors stand no chance after that due to the tighter integration and marketing muscle. Not to mention, Amazon and AWS give so little back to Open Source despite being a big (the biggest?) beneficiary. Google, Microsoft and even Oracle do more for Open Source than Amazon.

deleted 3y ago
[deleted]
jeltz 3y ago
I am fine with SSPL and AGPL as long as there is no CLA which makes me sign me rights over to someone else. I have never contributed to a project with a CLA and unless an employer pays me for it I do not think I ever will.
- elric 3y ago
  I certainly won't sign CLAs to entities like IBM (Eclipse/RHEL) or Oracle. But I did willingly sign a CLA for the Apache Software Foundation. I didn't enjoy doing it, but at least they're a force for good.
  - deleted 3y ago
    [deleted]
  - aragilar 3y ago
    But Apache I believe specifically is bound to offer code under the Apache licence?
  - ShaneCurcuru 3y ago
    If you simply believe "CLAs are bad", you're missing the point (unless you refuse all legal documents on principle, or something). The question is: WHO are you signing the CLA over to? If it's a for-profit company, well, then do you trust that company to follow through? If it's a non-profit, then look to see (in the US) if they're a 501(c)(3) public charity, which have legal restrictions on their governance, which typically require serving some larger public good. Also look at their history of past governance. I certainly hope (as an ASF peep) that we've shown who we are to be who we plan to be in the future; namely producing software for the public good. Key reasons the ASF uses a CLA are protecting the org from future IP issues, and partly simply to be able to fix some future typo or legal issue in our license if one ever comes up. But the ASF will always provide all of it's released software under a similar style permissive license to Apache-2.0, as long as the organization is around. If they're a 501(c)(6), then they're a business league, and might act more like a for-profit corporation, so...
    - elric 3y ago
      It's important to remember that FOSS contributions are on a voluntary basis. When I have to sign paperwork, things start to feel like unpaid work. Signing legal documents requires disclosure of personal information. Most CLAs require full legal names and often the names of employers. While Elric is my legal name, I prefer not to disclose my last name for a variety of reasons. Being able to commit to FOSS on a pseudonymous basis is impossible when CLAs are involved, which I think is a real shame. I understand that orgs want to protect themselves, but CLAs only protect orgs, and can potentially harm contributors. Now, I happen to trust the ASF, and I hope my personal information is safe with them.
      - anticensor 3y ago
        > Being able to commit to FOSS on a pseudonymous basis is impossible when CLAs are involved, which I think is a real shame. There is a solution to that in many jurisdictions: register your pseudonym as an "alternate name".
        3y ago
- jimjag 3y ago
  Not all CLAs are the same... for example, the CLA from the ASF is NOT a copyright assignment. Other CLAs _are_.
  - jeltz 3y ago
    Ok, that is a very valid point. It is CLAs with copy right assignments I am opposed to.
- orthoxerox 3y ago
  That's exactly my viewpoint: SSPL + no CLA: we don't want anyone to profit from the hard work of our volunteer contributors SSPL + CLA: we don't want anyone but us to profit from the hard work of our volunteer contributors If you want to dual-license your software, dual-license it from the people that helped write it, or treat their contributions as work-for-hire from the very beginning
elric 3y ago
Some time ago I tried to argue for a FOSS license that would disallow code from being used by AI. I got a lot of negative feedback saying that this wouldn't be FOSS because it imposes restrictions etc. The same is true for the SSPL. But for long term FOSS viability, I think we may need to impose some restrictions to protect ourselves from big bad megacorps who effectively exploit FOSS developers.
- andybak 3y ago
  I am still not entirely convinced that "disallowing code from being used by AI" is going to hurt megacorps in the long run - or the individual. I guess plenty of people have already made their own call on this matter but I'm still genuinely undecided. As much as the megacorps are rushing to rule the AI roost - it's possible it will turn out to be a universal solvent to some degree. But I'm also pretty lukewarm about AGPL and SSPL. I feel there's a huge amount of fragmentation in open source land and I'm often unable to use code in situations where I feel the original creator would probably have been ok with it.
  - elric 3y ago
    The phrasing "used by AI" was a bit simplistic. I agree that this is not a black/white situation. Maybe everyone will benefit eventually. But it would have been nice to have the option.
- satvikpendem 3y ago
  What does code being used by AI have to do with "big bad megacorps who effectively exploit FOSS developers?" I don't see any connection there, while I do see it for something like SSPL.
- marklar423 3y ago
  It's a semantic thing and I agree with the feedback - specifically with the "F" in FOSS. That sort of license would be Open Source but not completely Free (as in freedom, not beer).
dig1 3y ago
> AWS of course is the single biggest reason why projects are flocking to more restrictive licenses Don't forget that AWS is one of the biggest reasons so many OSS projects became popular. Redis, Mongo, ES, HashiCorp stuff, a complete big data ecosystem, got wider recognition through AWS's offering. Many people have yet to learn about dozens of obscure databases (that have been in development for years) simply because AWS or other big cloud providers have not pushed them. Also, many projects receive a lot of contributions (bug reports, PRs, patches) due to liberal licenses increasing their use and popularity. I'm not particularly eager to contribute to anything with SSPL/BSL/etc-like licenses simply because I don't want to waste my time on something I can't use liberally in the future.
- chasontherobot 3y ago
  ES was already huge before AWS made everyone think it was an Amazon product
- codedokode 3y ago
  Redis was popular enough long before clouds. Also, with AGPL-style license Redis will not become less popular. Anyone still will be able to use it as a cache, but not as a free work done by others that you can resell without contributing back.
  - aragilar 3y ago
    Raises eyebrows We're already having the discussion of what we should do about redis at work, given it's a cache, and the tooling we use allows for other caching tools, we'll likely switch away from redis fairly quickly...
    - ako 3y ago
      Postgres makes for a pretty decent key value cache in certain situations.
  - rascul 3y ago
    > Redis was popular enough long before clouds. Redis is newer than you think. Or the cloud is older.
that_guy_iain 3y ago
I think Sentry's Functional Source License is pretty good. That's what I've decided to use.
sofixa 3y ago
> The right thing to do for AWS would have been to respect the work of the original authors (/company) and throw their weight behind an offering supported by the original developers That's what they do in some cases - their managed Grafana and Prometheus are a cooperation with Grafana Labs. But it's the only one I'm aware of, practically all other ones (MongoDB, Redis, Memcached, MySQL, PgSQL, etc.) aren't.
- redwood 3y ago
  Look more closely and you'll see that they offer a competing service right next to it... it's about the most anti-competitive posture you can imagine as they slowly corrode their foundation
hintymad 3y ago
> AWS of course is the single biggest reason why projects are flocking to more restrictive licenses Should be general competition, including AWS, right? AWS does not host a Terraform service, yet HashiCorp feels the pressure from quite a number of competitors that offer Terraform as a service.
armchairhacker 3y ago
Open-source still has a long-term advantage. Long-term, either AWS goes out of business, “enshittifies” their “enhanced” version, and/or open-sources it themselves. Meanwhile, the open-source version never goes away or gets worse: at worst it will bitrot, but that’s only if nobody is using it enough to put in the bare minimum of maintenance (then when AWS inevitably degrades, there’s a good chance someone makes an open-source rewrite).
Spivak 3y ago
I guess but AWS is the one being a good steward of actual open source software. It's hard to say they're the evil ones when it's because of them we still have an OSS ElasticSearch for anyone to use as they please. No one forces you to make OSS, you can be closed source from the beginning and no one will fault you. But companies releasing OSS as a growth hack because it's seen as a donation to the software commons and then rug pulling deserve every fork coming to them. Debian and Fedora don't include JSMin (not that it's relevant anymore but still) because the license says you can't use it for evil making it not OSS. That's what OSS means -- everyone, even the worst person you know, especially the worst person you know, can use the software for anything they want.
Salgat 3y ago
People are forgetting that Redis became big exactly because of it being both free and open. If Redis came out with limitations similar to LLama 2 it would have been dead in the water since the main consumer is enterprise, while LLama 2's primary popularity is because it was one of the first to provide a high quality LLM to individuals for personal use. A KV store that's compatible with RESP is nothing particularly special, shoot Microsoft just released their own (garnet) under an MIT license. The value of Redis was always it being both free and open source and the community that supported it. As of now they just dropped the biggest reason to use Redis.

by jeswin 3y ago

deleted 3y ago

[deleted]

jeltz 3y ago

I am fine with SSPL and AGPL as long as there is no CLA which makes me sign me rights over to someone else. I have never contributed to a project with a CLA and unless an employer pays me for it I do not think I ever will.

elric 3y ago
I certainly won't sign CLAs to entities like IBM (Eclipse/RHEL) or Oracle. But I did willingly sign a CLA for the Apache Software Foundation. I didn't enjoy doing it, but at least they're a force for good.
- deleted 3y ago
  [deleted]
- aragilar 3y ago
  But Apache I believe specifically is bound to offer code under the Apache licence?
- ShaneCurcuru 3y ago
  If you simply believe "CLAs are bad", you're missing the point (unless you refuse all legal documents on principle, or something). The question is: WHO are you signing the CLA over to? If it's a for-profit company, well, then do you trust that company to follow through? If it's a non-profit, then look to see (in the US) if they're a 501(c)(3) public charity, which have legal restrictions on their governance, which typically require serving some larger public good. Also look at their history of past governance. I certainly hope (as an ASF peep) that we've shown who we are to be who we plan to be in the future; namely producing software for the public good. Key reasons the ASF uses a CLA are protecting the org from future IP issues, and partly simply to be able to fix some future typo or legal issue in our license if one ever comes up. But the ASF will always provide all of it's released software under a similar style permissive license to Apache-2.0, as long as the organization is around. If they're a 501(c)(6), then they're a business league, and might act more like a for-profit corporation, so...
  - elric 3y ago
    It's important to remember that FOSS contributions are on a voluntary basis. When I have to sign paperwork, things start to feel like unpaid work. Signing legal documents requires disclosure of personal information. Most CLAs require full legal names and often the names of employers. While Elric is my legal name, I prefer not to disclose my last name for a variety of reasons. Being able to commit to FOSS on a pseudonymous basis is impossible when CLAs are involved, which I think is a real shame. I understand that orgs want to protect themselves, but CLAs only protect orgs, and can potentially harm contributors. Now, I happen to trust the ASF, and I hope my personal information is safe with them.
    - anticensor 3y ago
      > Being able to commit to FOSS on a pseudonymous basis is impossible when CLAs are involved, which I think is a real shame. There is a solution to that in many jurisdictions: register your pseudonym as an "alternate name".
      - 3y ago
jimjag 3y ago
Not all CLAs are the same... for example, the CLA from the ASF is NOT a copyright assignment. Other CLAs _are_.
- jeltz 3y ago
  Ok, that is a very valid point. It is CLAs with copy right assignments I am opposed to.
orthoxerox 3y ago
That's exactly my viewpoint: SSPL + no CLA: we don't want anyone to profit from the hard work of our volunteer contributors SSPL + CLA: we don't want anyone but us to profit from the hard work of our volunteer contributors If you want to dual-license your software, dual-license it from the people that helped write it, or treat their contributions as work-for-hire from the very beginning

elric 3y ago

Some time ago I tried to argue for a FOSS license that would disallow code from being used by AI. I got a lot of negative feedback saying that this wouldn't be FOSS because it imposes restrictions etc. The same is true for the SSPL. But for long term FOSS viability, I think we may need to impose some restrictions to protect ourselves from big bad megacorps who effectively exploit FOSS developers.

andybak 3y ago
I am still not entirely convinced that "disallowing code from being used by AI" is going to hurt megacorps in the long run - or the individual. I guess plenty of people have already made their own call on this matter but I'm still genuinely undecided. As much as the megacorps are rushing to rule the AI roost - it's possible it will turn out to be a universal solvent to some degree. But I'm also pretty lukewarm about AGPL and SSPL. I feel there's a huge amount of fragmentation in open source land and I'm often unable to use code in situations where I feel the original creator would probably have been ok with it.
- elric 3y ago
  The phrasing "used by AI" was a bit simplistic. I agree that this is not a black/white situation. Maybe everyone will benefit eventually. But it would have been nice to have the option.
satvikpendem 3y ago
What does code being used by AI have to do with "big bad megacorps who effectively exploit FOSS developers?" I don't see any connection there, while I do see it for something like SSPL.
marklar423 3y ago
It's a semantic thing and I agree with the feedback - specifically with the "F" in FOSS. That sort of license would be Open Source but not completely Free (as in freedom, not beer).

dig1 3y ago

> AWS of course is the single biggest reason why projects are flocking to more restrictive licenses Don't forget that AWS is one of the biggest reasons so many OSS projects became popular. Redis, Mongo, ES, HashiCorp stuff, a complete big data ecosystem, got wider recognition through AWS's offering. Many people have yet to learn about dozens of obscure databases (that have been in development for years) simply because AWS or other big cloud providers have not pushed them. Also, many projects receive a lot of contributions (bug reports, PRs, patches) due to liberal licenses increasing their use and popularity. I'm not particularly eager to contribute to anything with SSPL/BSL/etc-like licenses simply because I don't want to waste my time on something I can't use liberally in the future.

chasontherobot 3y ago
ES was already huge before AWS made everyone think it was an Amazon product
codedokode 3y ago
Redis was popular enough long before clouds. Also, with AGPL-style license Redis will not become less popular. Anyone still will be able to use it as a cache, but not as a free work done by others that you can resell without contributing back.
- aragilar 3y ago
  Raises eyebrows We're already having the discussion of what we should do about redis at work, given it's a cache, and the tooling we use allows for other caching tools, we'll likely switch away from redis fairly quickly...
  - ako 3y ago
    Postgres makes for a pretty decent key value cache in certain situations.
- rascul 3y ago
  > Redis was popular enough long before clouds. Redis is newer than you think. Or the cloud is older.

that_guy_iain 3y ago

I think Sentry's Functional Source License is pretty good. That's what I've decided to use.

sofixa 3y ago

> The right thing to do for AWS would have been to respect the work of the original authors (/company) and throw their weight behind an offering supported by the original developers That's what they do in some cases - their managed Grafana and Prometheus are a cooperation with Grafana Labs. But it's the only one I'm aware of, practically all other ones (MongoDB, Redis, Memcached, MySQL, PgSQL, etc.) aren't.

redwood 3y ago
Look more closely and you'll see that they offer a competing service right next to it... it's about the most anti-competitive posture you can imagine as they slowly corrode their foundation

hintymad 3y ago

> AWS of course is the single biggest reason why projects are flocking to more restrictive licenses Should be general competition, including AWS, right? AWS does not host a Terraform service, yet HashiCorp feels the pressure from quite a number of competitors that offer Terraform as a service.

armchairhacker 3y ago

Open-source still has a long-term advantage. Long-term, either AWS goes out of business, “enshittifies” their “enhanced” version, and/or open-sources it themselves. Meanwhile, the open-source version never goes away or gets worse: at worst it will bitrot, but that’s only if nobody is using it enough to put in the bare minimum of maintenance (then when AWS inevitably degrades, there’s a good chance someone makes an open-source rewrite).

Spivak 3y ago

I guess but AWS is the one being a good steward of actual open source software. It's hard to say they're the evil ones when it's because of them we still have an OSS ElasticSearch for anyone to use as they please. No one forces you to make OSS, you can be closed source from the beginning and no one will fault you. But companies releasing OSS as a growth hack because it's seen as a donation to the software commons and then rug pulling deserve every fork coming to them. Debian and Fedora don't include JSMin (not that it's relevant anymore but still) because the license says you can't use it for evil making it not OSS. That's what OSS means -- everyone, even the worst person you know, especially the worst person you know, can use the software for anything they want.

Salgat 3y ago

People are forgetting that Redis became big exactly because of it being both free and open. If Redis came out with limitations similar to LLama 2 it would have been dead in the water since the main consumer is enterprise, while LLama 2's primary popularity is because it was one of the first to provide a high quality LLM to individuals for personal use. A KV store that's compatible with RESP is nothing particularly special, shoot Microsoft just released their own (garnet) under an MIT license. The value of Redis was always it being both free and open source and the community that supported it. As of now they just dropped the biggest reason to use Redis.