21 ms·

Why we picked AGPL

267 points by philippemnoel 2y ago

PeterZaitsev 2y ago
First title is a bit misleading. ParadeDB is Open Core, which uses AGPL for Open Source version. When you talk about traction I wonder how many external contributors are you getting ?
- philippemnoel 2y ago
  We've had 35 contributors in total on ParadeDB thus far, with 5 of them being core team members. That said, we measure traction in terms of users of the product rather than in terms of contributors to the project. We welcome contributions but understand that this is primarily a project led by our company and don't expect any external contribution.
karmakaze 2y ago
> Elasticsearch alternative built on Postgres Without horizontal scaling it's more like a hosted/queryable Lucene.
- grobbyy 2y ago
  A key issue for me is API compatibility. It's nice to do simple and scalable, but you can't have both at once. API compatibility message I can run simple for small setups and scalable for large ones. That's nice and something I strive for in software I build.
  - nsonha 2y ago
    doesn't look like the case here as they don't even have an API (to be drop-in replacement for ES)
    - philippemnoel 2y ago
      We have some API-compatibility in faceted search. But yes, we are not (today) a drop-in replacement for ES. We have many migrations from ES/OpenSearch and users find that converting their code over is well worth the savings in maintenance, no-ETL and increased uptime, though. That said, we may one day add ES API compatibility if we can :)
      - nsonha 2y ago
        is there a place where I can read about what ParadeDB actually does? Surely you do more than just pre-install the extensions? Do you also develop the extensions yourself? Do you support RAG? The last question may not make sense as I am new to this space.
- philippemnoel 2y ago
  Blog author here. That's fair! We'll add horizontal scaling eventually, but for now, our customers (including some large brands!) have not needed it. Turns you single nodes are remarkably powerful nowadays
iaaan 2y ago
Every so often I run through the common set of licenses to double-check which one I want to personally use for my projects (both commercial and for fun), and I always end up back at AGPL. For me, it just strikes the right balance between open-source and restricting corporations from disproportionately profiting off of my labor.
- aaron695 2y ago
  > and restricting corporations from disproportionately profiting off of my labor. This is anti the ethos of GPL [1] And that's fine, you choose a list or rules that fitted with your wants, you don't have to respect A/GPL. But time and time again we see most people on HN not respecting the A/GPL ethos they clam to follow and not understanding what A/GPL will mean in practice. > disproportionately profiting Off Topic to GPL. Corporations have provided more value to the world than any person. Which is almost a tautology since corporations are just groups of people working together. "Disproportionately profiting off of my labor" would mean they are providing amazing resources to people who need them. You sound like you don't want others to succeed. Which is different to you need to make money to live. [1] The legal/logical issues we see with AGPL are from trying to get the license to match the ethos. It's commendable they did stick it out.
  - Dylan16807 2y ago
    It can't be anti and off topic at the same time. I think trying to prevent disproportionate profit by big companies is plenty compatible with the ethos. The ethos of GPL is all about the end user, after all. > would mean they are providing amazing resources No it doesn't mean that.
  - guappa 2y ago
    > Corporations have provided more value to the world than any person If by value you mean: "have increased gini coefficient", then yes, corporations have done that.
- thelastparadise 2y ago
  Do you intend for companies to use your software, just not resell it? Or do you not even want them to use it?
kazinator 2y ago
> The AGPL license permits free use, modification, and distribution of software, provided that distributed, derivative works of the software are released under the same license. Here is the rub: free software permits unconditional use. The GPL without the A, or MIT or BSD licenses are not EULAs; they place restrictions or conditions on redistribution, not on use. (With regard to use, they have only certain liability disclaimer clauses.) The AGPL restricts use; it is an EULA: end-user license agreement. The antithesis of free software.
- dafelst 2y ago
  Genuine question, how does AGPL restrict use? From my reading of it, it is only ensuring that any modifications to the source code must be made available if you "distribute" the software, where distribution now includes hosting it as a service. It seems more or less in the original spirit of GPLv2 but updated for a SaaS driven world. If you consider v3 restrictive then you must also consider v2 restrictive, just in a more narrow way.
  - kazinator 2y ago
    Running a program, as a service or not, isn't redistribution. It is use. The original spirit of the GPL is about identifying people doing bad things we don't like and trying to prevent them. All those bad things have to do with redistribution, not with using the program. The AGPL is still about identifying people doing bad things we don't like, except now those people are just running the program. This is no different from Adobe, Apple, Microsoft, ... identifying people using their software in ways they don't like, and crafting their EULA terms to turn those activities into a license violation. A free software license simply cannot dictate uses, like where and how you run the program, and who can access it from where. A free software license can only use copyright law, and only be concerned with copying. EULAs go beyond coypright; they try to connect non-copying activities to copyright by the doctrine that if the user engages in the forbidden activities, their license is terminated (and thus it becomes copyright infringement for them to continue to have a now unlicensed copy of the software).
    - 2y ago
keskival 2y ago
The point of an OSS license in these kinds of situations is pretty simple: They need to pick a license which is salty enough so that big corporations cannot use it, but have to buy a special license from the authors. Meanwhile they can support and benefit from the open source community without bureaucracy, and get a maximal userbase to create content on the web about this stack, and have a maximal number of people who know this stack and want to use it. AGPL is perfect for this.
- zelphirkalt 2y ago
  Where there is a will, there is a way. Big corporations could use the license and stick to its terms, but no, they don't want to. Better in their view to just take take take and never give. What they don't see however, and what is on no ones quarterly number sheet, is all the talent they don't attract.
  - k__ 2y ago
    Which is funny, as enterprise customers have no issue in buying closed source software, but the moment they see a GPL, they lose their mind.
    - hi-v-rocknroll 2y ago
      No, that's a gross mischaracterization based on ignorance. It only applies to AGPL because it prevents SaaS services. And because it can't be proven that an AGPL app isn't required as part of a SaaS service to function, then it can't be used anywhere in a MAANG shop.
    - dwaite 2y ago
      The most significant reason there is that the license must be taken under the strictest interpretation without a more specific business level agreement between the two. Apple for instance forbade GPLv3 because the anti-Novell clauses, which could be interpreted as "with a lost patent lawsuit, you can't merely license the technology but must secure and license the technology for all parties who may use or create a derivative of the original GPLv3 work". If you thought a court would agree with this interpretation, you'd be crazy to touch the software. AGPL takes the strictest interpretation of a derivative work that even content created using the AGPLed software internally for an administrative function (such as storing your business data in a database) is a derivative work, and that the output of your software thus has restrictions under it by AGPL. Before AGPL, the only times we would see statements as such was to assure businesses that such an interpretation would not be taken - standard C libraries, compiled output, and java code with classpath exceptions are three popular examples. I find the AGPL to run counter to the original purpose of the GPL, which I understand to be to protect the communities developing software from having their work superseded by commercial entities not giving back. The lack of examples of AGPL projects where contributors are not required to execute some form of CLA illustrates how it is often not being embraced to foster communities, but to protect against them and even exploit them.
PhilippGille 2y ago
They looked at 4 licenses (Apache, Business Source License, AGPL, Elastic License) representing different categories. I think the Mozilla Public License represents another category and should always be evaluated as well. (or the Eclipse Public License or CDDL are similar) They are less permissive than Apache in that they require contributing back (as in open sourcing changes under same license), but more permissive than AGPL in that you can statically link an MPL licensed library into your project without having to open source your project.
- graemep 2y ago
  LGPL also allows that. What MPL is missing AFAIK that AGPL does have is requiring making source/changes available when providing the software as a network service.
  - PhilippGille 2y ago
    No, LGPL has specific requirements for static linking. When your product is usually a Go binary that you can publish as is, using an LGPL library makes it tricky. And re network service, I don't see the MPL tying the requirement to making changes available to a method of distribution.
    - graemep 2y ago
      Good point. I am used to thinking in terms of thinks that are dynamically linked.
    - michaelsbradley 2y ago
      Static linking with LGPL is possible for proprietary software; the requirements are sometimes misunderstood: If you statically link against an LGPLed library, you must also provide your application in an object (not necessarily source) format, so that a user has the opportunity to modify the library and relink the application. https://www.gnu.org/licenses/gpl-faq.html#LGPLStaticVsDynamic https://www.gnu.org/licenses/gpl-faq.html#LGPLStaticVsDynami... So, relinkability is the key. For some platforms and toolchains that may be impractical but for others not so much.
JohannesSuenden 2y ago
I love the AGPL. I can't imagine it becoming popular for generic business functionality in library form, but for highly-specialized libraries (in my case scientific with industrial applications) it was everything I was looking for --- not least because automated license scanners flag it and scare potential parasites away. It's also a great choice for complete pieces of software (such as DBs, as in this case) to offer a free tier for communal benefit, provided you're genuinely willing to let the project develop a life of its own if the open source community finds reason to mobilize around it. For academic use AGPL compliance is a natural part of life anyway, for non-profits it's a little bit of effort but there's no fundamental objection, and when companies get involved it ensures that either my collaborators and I get a payout for SaaS-ification/proprietarization, or that it only gets used in internal tooling, which means that money gets redistributed to labor (often also to us via consulting fees or custom development arrangements anyway, since we know the code best). It's a model for software development that I can really get behind. Best of luck to you!
- philippemnoel 2y ago
  Blog author here. I couldn't agree more. Thank you for your kind words and for sharing the academic perspective of using the AGPL - super interesting!
  - mroche 2y ago
    I'm a fan of AGPL as well, but there's a point of possible confusion for GNU license variants I personally run in to and maybe others as well. It may be worth specifying which variant of the AGPL you are using, e.g. AGPL-3.0-only or AGPL-3.0-or-later.
    - philippemnoel 2y ago
      That's fair. We use AGPLv3. I haven't seen any AGPL project that wasn't using v3, so we decided to keep it short for readability, but you bring up a very good point.
- jillesvangurp 2y ago
Hamcha 2y ago
Correction: they chose AGPL with a poison pill (CLA) so they can benefit from it and take it away whenever they want more.
- tgma 2y ago
  This. The AGPL deception is you brand yourself as community-minded. As long as you don't rely on external contributions that's fair. But what the AGPL startups don't emphasize is they require you to either assign your copyright to them or give them extra privileges to your contributions to be able to relicense it under non AGPL (if they don't they don't know what they are doing). AGPL is also not considered a very safe license by large organizations even if you want to run it internally unmodified, alongside the rest of your application. Many big companies have blanket bans on AGPL.
  - jay_kyburz 2y ago
    What happens if you (the contributor) fork the project, make a really great feature in your own fork, make it available as the license requires, then the startup integrates changes from the fork back into their own project. Does this then prevent them from ever changing the license away from AGPL?
    - tgma 2y ago
      Yes. If they do it they will be able to license the form back as AGPL but that wouldn't let them license the new thing under their commercial license (effectively useless commercially). At that point they are a peer with you. Some startups may not know this or knowingly violate this.
    - goodpoint 2y ago
      > Does this then prevent them from ever changing the license away from AGPL? No, as long as they either remove the contributed code or distribute it in a way that is compatible with AGPL
  - lmm 2y ago
    > The AGPL deception is you brand yourself as community-minded. As long as you don't rely on external contributions that's fair. But what the AGPL startups don't emphasize is they require you to either assign your copyright to them or give them extra privileges to your contributions to be able to relicense it under non AGPL (if they don't they don't know what they are doing). There's nothing specific to the AGPL or startups here, it's a common model. The FSF themselves require copyright assignment if you want to contribute to FSF projects.
jay_kyburz 2y ago
I don't understand why they say "Future-Proof: Thanks to the copyleft provision, cloud vendors cannot easily resell our project without our consent. This gives us confidence in our ability to monetize without fear of predatory competition. ParadeDB just turned one year old, and we’ve already been contacted by four cloud providers who, had we not chosen the AGPL license, may have privately forked and distributed ParadeDB." Nothing in the license requires cloud vendors from reselling the project. They just need to make the source available? What am I missing?
- warkdarrior 2y ago
  I think AGPL requires the whole cloud stack that's used by a deployment of this SW to be AGPLed as well.
  - wavemode 2y ago
    This is a common misconception. Nothing in the text of the AGPL requires this whatsoever. But it's a common enough misconception that my personal recommendation tends to be to just steer clear anyway, if you're planning to run a closed-source business. It's better to not get sued at all, than to get sued by someone who's wrong. But for reference, the only text added to the AGPL in comparison to the GPL is section 13 here: https://www.gnu.org/licenses/agpl-3.0.en.html https://www.gnu.org/licenses/agpl-3.0.en.html In other words, if you run an AGPL database and modify it, you need to provide your users with the source of your modified version. Nothing remotely suggesting that the rest of your entire software stack becomes AGPL licensed. (In fact I often wonder how people are imagining that would even work. It would basically imply that you can't, for example, run AGPL software on a Windows server...)
    - jay_kyburz 2y ago
      I spent some time reading about static linking and dynamic linking. From the FAQ > "Linking a GPL covered work statically or dynamically with other modules is making a combined work based on the GPL covered work. Thus, the terms and conditions of the GNU General Public License cover the whole combination" If I had to guess, if you installed each application in your stack separately, and they simply interacted with each other through API calls, you could consider them "System Libraries" and therefore would not dragged into the AGPL. Example, The OS itself, Node, Postgres, and any other 3rd party applications. As long as you are not distributing them, I think they would count as System Libraries. > "To prevent unscrupulous distributors from trying to use the System Library exception as a loophole, the GPL says that libraries can only qualify as System Libraries as long as they're not distributed with the program itself. If you distribute the DLLs with the program, they won't be eligible for this exception anymore"
purpleidea 2y ago
The fact that they aren't mentioning their CLA which gives them extra rights that everyone in the community doesn't get means they're disingenuous in writing this article... As an analogy it's as if someone was selling you a new car, but neglected to tell you that it doesn't come with a steering wheel or tires. Be transparent and tell the whole story, don't be sneaky.
- jenadine 2y ago
  The analogy is a bit strong. You make it sound like the CLA is a limitation to the product. But the CLA doesn't't limit the product in any way.
- deleted 2y ago
  [deleted]
contrarian1234 2y ago
Is there some AGPL equivalent on top of GPLv2 instead of GPLv3 After reading the rational for v2 for the Linux kernel, Ive always found v3 a bit off putting.
- lmm 2y ago
  What rationale would that be? I doubt the FSF would write a version of the AGPL designed to let you use DRM to end-run around it if that's what you're getting at (you can always write such a license yourself, but, why?)
  - contrarian1234 2y ago
    I mean ... Not to rehash all the v2 VS v3 arguments ... But essentially you only care about the source code being shared and you don't care about tivoization and forcing additional hardware requirements or requirements that "used code" is changeable by endusers. The AGPL's extension just increases any modified code's availability. It's extending the principles behind v2 to networked devices. You gotta share your changes and you can't cleverly avoid it by doing a SaaS instead of selling software/hardware It doesn't extend the v3 principles (which increase end user's rights). That would be to force companies to allow users to modify and run modified code on the networked device/server (which would be the networked equivalent of a anti-tivoization). So the AGPL's idea pairs more naturally with v2 in my opinion
- globular-toast 2y ago
  The "Tivo-isation" clause? You'd want AGPL but without that bit? That would be strange. I doubt Linus likes AGPL either because, unfortunately, his relationship with the FSF is always going to be sour. He's one of most stubborn people on earth (for better or worse).
  - deleted 2y ago
    [deleted]
  - contrarian1234 2y ago
    As I say in the neighboring comment, I think the two compliment each other a lot more than v3. Linus would get even more code contributions .. I think he'd be happy
jan_g 2y ago
I don't know about ParadeDB, but this was very off-putting for me in case of Minio when they switched to AGPL. If you check their answers to various license questions, they are essentially this: if you use Minio in your stack/product (for profit), then we recommend our commercial license or consult with a lawyer if your use case is covered by AGPL or not. What me and I guess many others wanted was a simple yes/no to the following: if I use Minio in my stack without modifications (as a file server that my other services interact with via an API), do I have to AGPL all the stuff the touches Minio or not? And they do not want to answer this question. I do not understand why is it so hard to answer clearly. I understand that the majority of opinions is that it's fine to use without modifications, but I wanted a clear statement from authors of Minio. Failing that, I then decided to keep the pre-AGPL version for a while and have transitioned away from Minio since then.
- knorker 2y ago
  IANAL, but I'd also be worried that even if the project answers your question, maybe any one individual contributor to the project could sue you if they disagree. Only if the project doesn't have copyright reassignment, of course.
- camgunz 2y ago
  No, the whole idea of the AGPL is to make you release modifications even if you're not distributing (i.e. a web app). No modifications, no release.
  - dspillett 2y ago
    The question isn't about modifications to the library/service itself, but whether with other code linking to it in any way is what you have considered a derivative work that should also be covered by the AGPL. For a library I'd say that was a definite yes. For a service it is someone's less clear, some provide connective tissue (language bindings or other access modules) under less strict licenses which creates an obvious break in the chain, without that or very definite answers to the question on the post you replied to it is unclear how tightly coupled you need to be to need to use AGPL for your own work and I would err on the side of assuming (because it is GPL based) any coupling would have that effect. Not that this would put me off using LGPL, but it is just as disconcerting, if not more so, to commercial interests, as the GPL is.
Vonng 2y ago
I fully support ParadeDB's decision. For an open-source software company, AGPLv3 + Dual License is the most sensible choice. If you go with Apache 2.0, you're literally doing free work for cloud vendors.
codelion 2y ago
This resonated with us as well, we have also chosen AGPL as license for our open source project - https://github.com/patched-codes/patchwork https://github.com/patched-codes/patchwork
- max-privatevoid 2y ago
  Please do not use the AGPL as a marketing point when you have a CLA.
  - codelion 2y ago
    What's wrong in having a CLA? It allows you to re-license your project in future.
    - max-privatevoid 2y ago
      Q: What's wrong in having a CLA? A: It allows you to re-license your project in future. It gives the original author the right to relicense your contributions at a moment's notice, to a license you might not agree with. It effectively means that you cannot contribute to the project under fair terms. A CLA is similar to a EULA in the sense that most people don't care about it and blindly click "Agree", and as such are unaware of the potential consequences. Look at what happened when HashiCorp relicensed its projects. People were outraged. They agreed to the CLA, so they must have known that this could happen. But did they really take the time to understand what they were signing? As a contributor, you should never agree to a CLA. As the original author, requiring your contributors to sign a CLA sets an extremely bad precedent.
      - codelion 2y ago
        You have just listed the benefits of having a CLA. This post is about why projects should pick a license not how contributors should prioritise what they spend their time on. If you are trying to build something commercial and be open-source this is a good recommendation.
trallnag 2y ago
[dead]
jwildeboer 2y ago
Correct title would be „Why we picked dual licensing with AGPL and a commercial license“, IMHO. You can only contribute when you accept the CLA at [1] which gives them the right to license your contributions under said commercial license. [1] https://cla-assistant.io/paradedb/paradedb https://cla-assistant.io/paradedb/paradedb
- cowboylowrez 2y ago
  you can fork it tho. this way you don't need to accept the CLA, you're just obligated to publish your mods if need be.
1ilit 2y ago
I totally get this. I recently changed the license on my project from MIT to AGPL after getting a dm from someone interested in buying the project. I make absolutely no money at the moment, if anything I'm paying out of pocket for the domain, and don't think will any time soon. My only goal was to protect the project from getting commercialized by someone else. I've gotten questions about it and have been questioning whether I got too scared that someone might monetize what I worked so hard on.
- sneak 2y ago
  “protect”? What harm is done by more people using your software?
  - 1ilit 2y ago
    None. I made it for people to use and open sourced for people to see and contribute. I just don't want someone else to sell it. That's it.
braza 2y ago
Honest question: For the people not intending to "build a business on top of an open source library" but only intending to do something like "I just need this library to solve an issue in my work job" it's not simple to not touch it at all? I had read a lot of conversations, and to be honest it's quite confusing for me the risk acceptance to have AGPL code in my codebase.
- themacguffinman 2y ago
  Most major tech companies will ban it for any use because the virality of it isn't clearly bounded and legally it's untested [1]. The stakes are high at large tech companies with valuable IP, so downside is huge. For whatever reason, AGPL has never laid exclusive claim to particularly valuable projects (even in this project's case, it seems like they dual license so you can avoid the AGPL), so the upside isn't that high. So high downside + low upside means major players will just err on the side of "no". If your company has anything to lose, I'm sure it'll have a lawyer and you'll want to consult them on what their risk tolerance is. It's confusing because the license is actually ambiguous, most tech companies aren't willing to accept this ambiguity. [1] See this opinion by a Google lawyer: https://news.ycombinator.com/item?id=23968783 https://news.ycombinator.com/item?id=23968783
agpl3141592 2y ago
It's a shitty license. If you need to patch anything due to local requirements like the auth system you need to publish it which doesn't make sense at all.
- jcotton42 2y ago
  You only need to share those changes with anyone that has access to your modified version. If you modify an AGPL'd piece of software, but never distribute it outside your org, then your changes don't need to be released outside your org.
lukekim 2y ago
We chose Apache 2.0 for the Spice OSS runtime. TL;DR: Data-plane Apache 2.0, control-plane BSL. Being such a core component, we want developers to be completely comfortable integrating and deploying the Spice runtime in their applications and services, as well as running Spice in their own infrastructure. In addition, Spice OSS is built on other great open-source projects like DataFusion and Arrow, both Apache 2.0, and DuckDB (MIT), so being permissively licensed aligns with the fundamental technologies and communities it's built upon. We expect to release specific enterprise control-plane services, such as our Kubernetes Operator under a license such as BSL. [1] https://github.com/spiceai/spiceai https://github.com/spiceai/spiceai
mrwyz 2y ago
The AGPL is great, even for business. I make a living from AGPL software. Lots of people generally don't like it, because AGPL was not written to please the largest number of developers, but rather to protect the basic software freedoms of end-users. In a sense, the AGPL guarantees more freedoms, is more free, than other licenses such as MIT/BSD for end-users. But depends on the point of view. Many developers don’t like to have their freedom to steal to be restricted by such strong terms as those imposed by the AGPL. And that’s a good thing for you, my fellow maintainers. It’s also a great thing for you, dear end-users.
- baggy_trough 2y ago
  "freedom to steal"?
  - mrwyz 2y ago
    MIT/BSD and similar ones.
    - baggy_trough 2y ago
      I don't know what you mean.
      - mrwyz 2y ago
        BSD/MIT allows you to take code without any obligation to contribute back.
        baggy_trough 2y ago
        Using code that is freely given is not in any sense stealing.
        mrwyz 2y ago
        Only if you think taking the work of others and profiting from it without contributing anything back is fine.
laurencerowe 2y ago
I’ve been pretty involved in open source projects most of my career. The license you choose should reflect the community you are trying to create. But it probably only makes sense to protect application level code with a copyleft license. Most code has no real value beyond the time it saves you and its software developer contributors so it should be as liberally licensed as possible. You want to encourage contributions from the widest possible user base which includes developers of closed source software. They are already incentivised into upstreaming their changes to you on a liberal basis.
yencabulator 2y ago
It's AGPL for you but arbitrary relicensing at will for them: https://github.com/paradedb/paradedb/blob/dev/CONTRIBUTING.md#contributor-license-agreement https://github.com/paradedb/paradedb/blob/dev/CONTRIBUTING.m...
- the-grump 2y ago
  They put in the effort to create the product. It's their choice how to license it. Now it's up to you whether to sign that CLA to upstream your changes. You're welcome to maintain a fully AGPL fork if you don't like that.
  - yencabulator 2y ago
    ParadeDB seems to be thin glue over preexisting Postgres extensions and C / Rust libraries.
    - the-grump 2y ago
      They are free to license that glue however they please, within the legal limits.
yencabulator 2y ago
Software products they are using as part their AGPL product are all more permissive, but somehow they consider themselves worthy of monetizing all of this: - Postgres: similar to MIT and BSD license - Tantivy (via pg_search): MIT - pgvector: Postgres license, similar to MIT - DuckDB (via pg_analytics): MIT - CloudNativePG: Apache-2.0 - pg_cron: Postgres license, similar to MIT - pg_ivm: Postgres license, similar to MIT
- GuB-42 2y ago
  That's the point of permissive licences. To allow monetization and redistribution under more restrictive terms, usually proprietary, but also copyleft licenses like AGPL.
  - yencabulator 2y ago
    And when ParadeDB is harshly criticizing companies that would have otherwise perhaps used their software without paying them: > Thanks to the copyleft provision, cloud vendors cannot easily resell our project without our consent. This gives us confidence in our ability to monetize without fear of predatory competition. it seems they don't realize how ironic that stance is; they themselves are using all this software without paying for it.

267 points by philippemnoel 2y ago

First title is a bit misleading. ParadeDB is Open Core, which uses AGPL for Open Source version. When you talk about traction I wonder how many external contributors are you getting ?

philippemnoel 2y ago
We've had 35 contributors in total on ParadeDB thus far, with 5 of them being core team members. That said, we measure traction in terms of users of the product rather than in terms of contributors to the project. We welcome contributions but understand that this is primarily a project led by our company and don't expect any external contribution.

karmakaze 2y ago

> Elasticsearch alternative built on Postgres Without horizontal scaling it's more like a hosted/queryable Lucene.

grobbyy 2y ago
A key issue for me is API compatibility. It's nice to do simple and scalable, but you can't have both at once. API compatibility message I can run simple for small setups and scalable for large ones. That's nice and something I strive for in software I build.
- nsonha 2y ago
  doesn't look like the case here as they don't even have an API (to be drop-in replacement for ES)
  - philippemnoel 2y ago
    We have some API-compatibility in faceted search. But yes, we are not (today) a drop-in replacement for ES. We have many migrations from ES/OpenSearch and users find that converting their code over is well worth the savings in maintenance, no-ETL and increased uptime, though. That said, we may one day add ES API compatibility if we can :)
    - nsonha 2y ago
      is there a place where I can read about what ParadeDB actually does? Surely you do more than just pre-install the extensions? Do you also develop the extensions yourself? Do you support RAG? The last question may not make sense as I am new to this space.
philippemnoel 2y ago
Blog author here. That's fair! We'll add horizontal scaling eventually, but for now, our customers (including some large brands!) have not needed it. Turns you single nodes are remarkably powerful nowadays

iaaan 2y ago

Every so often I run through the common set of licenses to double-check which one I want to personally use for my projects (both commercial and for fun), and I always end up back at AGPL. For me, it just strikes the right balance between open-source and restricting corporations from disproportionately profiting off of my labor.

aaron695 2y ago
> and restricting corporations from disproportionately profiting off of my labor. This is anti the ethos of GPL [1] And that's fine, you choose a list or rules that fitted with your wants, you don't have to respect A/GPL. But time and time again we see most people on HN not respecting the A/GPL ethos they clam to follow and not understanding what A/GPL will mean in practice. > disproportionately profiting Off Topic to GPL. Corporations have provided more value to the world than any person. Which is almost a tautology since corporations are just groups of people working together. "Disproportionately profiting off of my labor" would mean they are providing amazing resources to people who need them. You sound like you don't want others to succeed. Which is different to you need to make money to live. [1] The legal/logical issues we see with AGPL are from trying to get the license to match the ethos. It's commendable they did stick it out.
- Dylan16807 2y ago
  It can't be anti and off topic at the same time. I think trying to prevent disproportionate profit by big companies is plenty compatible with the ethos. The ethos of GPL is all about the end user, after all. > would mean they are providing amazing resources No it doesn't mean that.
- guappa 2y ago
  > Corporations have provided more value to the world than any person If by value you mean: "have increased gini coefficient", then yes, corporations have done that.
thelastparadise 2y ago
Do you intend for companies to use your software, just not resell it? Or do you not even want them to use it?

kazinator 2y ago

> The AGPL license permits free use, modification, and distribution of software, provided that distributed, derivative works of the software are released under the same license. Here is the rub: free software permits unconditional use. The GPL without the A, or MIT or BSD licenses are not EULAs; they place restrictions or conditions on redistribution, not on use. (With regard to use, they have only certain liability disclaimer clauses.) The AGPL restricts use; it is an EULA: end-user license agreement. The antithesis of free software.

dafelst 2y ago
Genuine question, how does AGPL restrict use? From my reading of it, it is only ensuring that any modifications to the source code must be made available if you "distribute" the software, where distribution now includes hosting it as a service. It seems more or less in the original spirit of GPLv2 but updated for a SaaS driven world. If you consider v3 restrictive then you must also consider v2 restrictive, just in a more narrow way.
- kazinator 2y ago
  Running a program, as a service or not, isn't redistribution. It is use. The original spirit of the GPL is about identifying people doing bad things we don't like and trying to prevent them. All those bad things have to do with redistribution, not with using the program. The AGPL is still about identifying people doing bad things we don't like, except now those people are just running the program. This is no different from Adobe, Apple, Microsoft, ... identifying people using their software in ways they don't like, and crafting their EULA terms to turn those activities into a license violation. A free software license simply cannot dictate uses, like where and how you run the program, and who can access it from where. A free software license can only use copyright law, and only be concerned with copying. EULAs go beyond coypright; they try to connect non-copying activities to copyright by the doctrine that if the user engages in the forbidden activities, their license is terminated (and thus it becomes copyright infringement for them to continue to have a now unlicensed copy of the software).
  - 2y ago

keskival 2y ago

The point of an OSS license in these kinds of situations is pretty simple: They need to pick a license which is salty enough so that big corporations cannot use it, but have to buy a special license from the authors. Meanwhile they can support and benefit from the open source community without bureaucracy, and get a maximal userbase to create content on the web about this stack, and have a maximal number of people who know this stack and want to use it. AGPL is perfect for this.

zelphirkalt 2y ago
Where there is a will, there is a way. Big corporations could use the license and stick to its terms, but no, they don't want to. Better in their view to just take take take and never give. What they don't see however, and what is on no ones quarterly number sheet, is all the talent they don't attract.
- k__ 2y ago
  Which is funny, as enterprise customers have no issue in buying closed source software, but the moment they see a GPL, they lose their mind.
  - hi-v-rocknroll 2y ago
    No, that's a gross mischaracterization based on ignorance. It only applies to AGPL because it prevents SaaS services. And because it can't be proven that an AGPL app isn't required as part of a SaaS service to function, then it can't be used anywhere in a MAANG shop.
  - dwaite 2y ago
    The most significant reason there is that the license must be taken under the strictest interpretation without a more specific business level agreement between the two. Apple for instance forbade GPLv3 because the anti-Novell clauses, which could be interpreted as "with a lost patent lawsuit, you can't merely license the technology but must secure and license the technology for all parties who may use or create a derivative of the original GPLv3 work". If you thought a court would agree with this interpretation, you'd be crazy to touch the software. AGPL takes the strictest interpretation of a derivative work that even content created using the AGPLed software internally for an administrative function (such as storing your business data in a database) is a derivative work, and that the output of your software thus has restrictions under it by AGPL. Before AGPL, the only times we would see statements as such was to assure businesses that such an interpretation would not be taken - standard C libraries, compiled output, and java code with classpath exceptions are three popular examples. I find the AGPL to run counter to the original purpose of the GPL, which I understand to be to protect the communities developing software from having their work superseded by commercial entities not giving back. The lack of examples of AGPL projects where contributors are not required to execute some form of CLA illustrates how it is often not being embraced to foster communities, but to protect against them and even exploit them.

PhilippGille 2y ago

They looked at 4 licenses (Apache, Business Source License, AGPL, Elastic License) representing different categories. I think the Mozilla Public License represents another category and should always be evaluated as well. (or the Eclipse Public License or CDDL are similar) They are less permissive than Apache in that they require contributing back (as in open sourcing changes under same license), but more permissive than AGPL in that you can statically link an MPL licensed library into your project without having to open source your project.

graemep 2y ago
LGPL also allows that. What MPL is missing AFAIK that AGPL does have is requiring making source/changes available when providing the software as a network service.
- PhilippGille 2y ago
  No, LGPL has specific requirements for static linking. When your product is usually a Go binary that you can publish as is, using an LGPL library makes it tricky. And re network service, I don't see the MPL tying the requirement to making changes available to a method of distribution.
  - graemep 2y ago
    Good point. I am used to thinking in terms of thinks that are dynamically linked.
  - michaelsbradley 2y ago
    Static linking with LGPL is possible for proprietary software; the requirements are sometimes misunderstood: If you statically link against an LGPLed library, you must also provide your application in an object (not necessarily source) format, so that a user has the opportunity to modify the library and relink the application. https://www.gnu.org/licenses/gpl-faq.html#LGPLStaticVsDynamic https://www.gnu.org/licenses/gpl-faq.html#LGPLStaticVsDynami... So, relinkability is the key. For some platforms and toolchains that may be impractical but for others not so much.

JohannesSuenden 2y ago

I love the AGPL. I can't imagine it becoming popular for generic business functionality in library form, but for highly-specialized libraries (in my case scientific with industrial applications) it was everything I was looking for --- not least because automated license scanners flag it and scare potential parasites away. It's also a great choice for complete pieces of software (such as DBs, as in this case) to offer a free tier for communal benefit, provided you're genuinely willing to let the project develop a life of its own if the open source community finds reason to mobilize around it. For academic use AGPL compliance is a natural part of life anyway, for non-profits it's a little bit of effort but there's no fundamental objection, and when companies get involved it ensures that either my collaborators and I get a payout for SaaS-ification/proprietarization, or that it only gets used in internal tooling, which means that money gets redistributed to labor (often also to us via consulting fees or custom development arrangements anyway, since we know the code best). It's a model for software development that I can really get behind. Best of luck to you!

philippemnoel 2y ago
Blog author here. I couldn't agree more. Thank you for your kind words and for sharing the academic perspective of using the AGPL - super interesting!
- mroche 2y ago
  I'm a fan of AGPL as well, but there's a point of possible confusion for GNU license variants I personally run in to and maybe others as well. It may be worth specifying which variant of the AGPL you are using, e.g. AGPL-3.0-only or AGPL-3.0-or-later.
  - philippemnoel 2y ago
    That's fair. We use AGPLv3. I haven't seen any AGPL project that wasn't using v3, so we decided to keep it short for readability, but you bring up a very good point.
jillesvangurp 2y ago

Hamcha 2y ago

Correction: they chose AGPL with a poison pill (CLA) so they can benefit from it and take it away whenever they want more.

tgma 2y ago
This. The AGPL deception is you brand yourself as community-minded. As long as you don't rely on external contributions that's fair. But what the AGPL startups don't emphasize is they require you to either assign your copyright to them or give them extra privileges to your contributions to be able to relicense it under non AGPL (if they don't they don't know what they are doing). AGPL is also not considered a very safe license by large organizations even if you want to run it internally unmodified, alongside the rest of your application. Many big companies have blanket bans on AGPL.
- jay_kyburz 2y ago
  What happens if you (the contributor) fork the project, make a really great feature in your own fork, make it available as the license requires, then the startup integrates changes from the fork back into their own project. Does this then prevent them from ever changing the license away from AGPL?
  - tgma 2y ago
    Yes. If they do it they will be able to license the form back as AGPL but that wouldn't let them license the new thing under their commercial license (effectively useless commercially). At that point they are a peer with you. Some startups may not know this or knowingly violate this.
  - goodpoint 2y ago
    > Does this then prevent them from ever changing the license away from AGPL? No, as long as they either remove the contributed code or distribute it in a way that is compatible with AGPL
- lmm 2y ago
  > The AGPL deception is you brand yourself as community-minded. As long as you don't rely on external contributions that's fair. But what the AGPL startups don't emphasize is they require you to either assign your copyright to them or give them extra privileges to your contributions to be able to relicense it under non AGPL (if they don't they don't know what they are doing). There's nothing specific to the AGPL or startups here, it's a common model. The FSF themselves require copyright assignment if you want to contribute to FSF projects.

jay_kyburz 2y ago

I don't understand why they say "Future-Proof: Thanks to the copyleft provision, cloud vendors cannot easily resell our project without our consent. This gives us confidence in our ability to monetize without fear of predatory competition. ParadeDB just turned one year old, and we’ve already been contacted by four cloud providers who, had we not chosen the AGPL license, may have privately forked and distributed ParadeDB." Nothing in the license requires cloud vendors from reselling the project. They just need to make the source available? What am I missing?

warkdarrior 2y ago
I think AGPL requires the whole cloud stack that's used by a deployment of this SW to be AGPLed as well.
- wavemode 2y ago
  This is a common misconception. Nothing in the text of the AGPL requires this whatsoever. But it's a common enough misconception that my personal recommendation tends to be to just steer clear anyway, if you're planning to run a closed-source business. It's better to not get sued at all, than to get sued by someone who's wrong. But for reference, the only text added to the AGPL in comparison to the GPL is section 13 here: https://www.gnu.org/licenses/agpl-3.0.en.html https://www.gnu.org/licenses/agpl-3.0.en.html In other words, if you run an AGPL database and modify it, you need to provide your users with the source of your modified version. Nothing remotely suggesting that the rest of your entire software stack becomes AGPL licensed. (In fact I often wonder how people are imagining that would even work. It would basically imply that you can't, for example, run AGPL software on a Windows server...)
  - jay_kyburz 2y ago
    I spent some time reading about static linking and dynamic linking. From the FAQ > "Linking a GPL covered work statically or dynamically with other modules is making a combined work based on the GPL covered work. Thus, the terms and conditions of the GNU General Public License cover the whole combination" If I had to guess, if you installed each application in your stack separately, and they simply interacted with each other through API calls, you could consider them "System Libraries" and therefore would not dragged into the AGPL. Example, The OS itself, Node, Postgres, and any other 3rd party applications. As long as you are not distributing them, I think they would count as System Libraries. > "To prevent unscrupulous distributors from trying to use the System Library exception as a loophole, the GPL says that libraries can only qualify as System Libraries as long as they're not distributed with the program itself. If you distribute the DLLs with the program, they won't be eligible for this exception anymore"

purpleidea 2y ago

The fact that they aren't mentioning their CLA which gives them extra rights that everyone in the community doesn't get means they're disingenuous in writing this article... As an analogy it's as if someone was selling you a new car, but neglected to tell you that it doesn't come with a steering wheel or tires. Be transparent and tell the whole story, don't be sneaky.

jenadine 2y ago
The analogy is a bit strong. You make it sound like the CLA is a limitation to the product. But the CLA doesn't't limit the product in any way.
deleted 2y ago
[deleted]

contrarian1234 2y ago

Is there some AGPL equivalent on top of GPLv2 instead of GPLv3 After reading the rational for v2 for the Linux kernel, Ive always found v3 a bit off putting.

lmm 2y ago
What rationale would that be? I doubt the FSF would write a version of the AGPL designed to let you use DRM to end-run around it if that's what you're getting at (you can always write such a license yourself, but, why?)
- contrarian1234 2y ago
  I mean ... Not to rehash all the v2 VS v3 arguments ... But essentially you only care about the source code being shared and you don't care about tivoization and forcing additional hardware requirements or requirements that "used code" is changeable by endusers. The AGPL's extension just increases any modified code's availability. It's extending the principles behind v2 to networked devices. You gotta share your changes and you can't cleverly avoid it by doing a SaaS instead of selling software/hardware It doesn't extend the v3 principles (which increase end user's rights). That would be to force companies to allow users to modify and run modified code on the networked device/server (which would be the networked equivalent of a anti-tivoization). So the AGPL's idea pairs more naturally with v2 in my opinion
globular-toast 2y ago
The "Tivo-isation" clause? You'd want AGPL but without that bit? That would be strange. I doubt Linus likes AGPL either because, unfortunately, his relationship with the FSF is always going to be sour. He's one of most stubborn people on earth (for better or worse).
- deleted 2y ago
  [deleted]
- contrarian1234 2y ago
  As I say in the neighboring comment, I think the two compliment each other a lot more than v3. Linus would get even more code contributions .. I think he'd be happy

jan_g 2y ago

I don't know about ParadeDB, but this was very off-putting for me in case of Minio when they switched to AGPL. If you check their answers to various license questions, they are essentially this: if you use Minio in your stack/product (for profit), then we recommend our commercial license or consult with a lawyer if your use case is covered by AGPL or not. What me and I guess many others wanted was a simple yes/no to the following: if I use Minio in my stack without modifications (as a file server that my other services interact with via an API), do I have to AGPL all the stuff the touches Minio or not? And they do not want to answer this question. I do not understand why is it so hard to answer clearly. I understand that the majority of opinions is that it's fine to use without modifications, but I wanted a clear statement from authors of Minio. Failing that, I then decided to keep the pre-AGPL version for a while and have transitioned away from Minio since then.

knorker 2y ago
IANAL, but I'd also be worried that even if the project answers your question, maybe any one individual contributor to the project could sue you if they disagree. Only if the project doesn't have copyright reassignment, of course.
camgunz 2y ago
No, the whole idea of the AGPL is to make you release modifications even if you're not distributing (i.e. a web app). No modifications, no release.
- dspillett 2y ago
  The question isn't about modifications to the library/service itself, but whether with other code linking to it in any way is what you have considered a derivative work that should also be covered by the AGPL. For a library I'd say that was a definite yes. For a service it is someone's less clear, some provide connective tissue (language bindings or other access modules) under less strict licenses which creates an obvious break in the chain, without that or very definite answers to the question on the post you replied to it is unclear how tightly coupled you need to be to need to use AGPL for your own work and I would err on the side of assuming (because it is GPL based) any coupling would have that effect. Not that this would put me off using LGPL, but it is just as disconcerting, if not more so, to commercial interests, as the GPL is.

Vonng 2y ago

I fully support ParadeDB's decision. For an open-source software company, AGPLv3 + Dual License is the most sensible choice. If you go with Apache 2.0, you're literally doing free work for cloud vendors.

codelion 2y ago

This resonated with us as well, we have also chosen AGPL as license for our open source project - https://github.com/patched-codes/patchwork https://github.com/patched-codes/patchwork

max-privatevoid 2y ago
Please do not use the AGPL as a marketing point when you have a CLA.
- codelion 2y ago
  What's wrong in having a CLA? It allows you to re-license your project in future.
  - max-privatevoid 2y ago
    Q: What's wrong in having a CLA? A: It allows you to re-license your project in future. It gives the original author the right to relicense your contributions at a moment's notice, to a license you might not agree with. It effectively means that you cannot contribute to the project under fair terms. A CLA is similar to a EULA in the sense that most people don't care about it and blindly click "Agree", and as such are unaware of the potential consequences. Look at what happened when HashiCorp relicensed its projects. People were outraged. They agreed to the CLA, so they must have known that this could happen. But did they really take the time to understand what they were signing? As a contributor, you should never agree to a CLA. As the original author, requiring your contributors to sign a CLA sets an extremely bad precedent.
    - codelion 2y ago
      You have just listed the benefits of having a CLA. This post is about why projects should pick a license not how contributors should prioritise what they spend their time on. If you are trying to build something commercial and be open-source this is a good recommendation.

trallnag 2y ago

[dead]

jwildeboer 2y ago

Correct title would be „Why we picked dual licensing with AGPL and a commercial license“, IMHO. You can only contribute when you accept the CLA at [1] which gives them the right to license your contributions under said commercial license. [1] https://cla-assistant.io/paradedb/paradedb https://cla-assistant.io/paradedb/paradedb

cowboylowrez 2y ago
you can fork it tho. this way you don't need to accept the CLA, you're just obligated to publish your mods if need be.

1ilit 2y ago

I totally get this. I recently changed the license on my project from MIT to AGPL after getting a dm from someone interested in buying the project. I make absolutely no money at the moment, if anything I'm paying out of pocket for the domain, and don't think will any time soon. My only goal was to protect the project from getting commercialized by someone else. I've gotten questions about it and have been questioning whether I got too scared that someone might monetize what I worked so hard on.

sneak 2y ago
“protect”? What harm is done by more people using your software?
- 1ilit 2y ago
  None. I made it for people to use and open sourced for people to see and contribute. I just don't want someone else to sell it. That's it.

braza 2y ago

Honest question: For the people not intending to "build a business on top of an open source library" but only intending to do something like "I just need this library to solve an issue in my work job" it's not simple to not touch it at all? I had read a lot of conversations, and to be honest it's quite confusing for me the risk acceptance to have AGPL code in my codebase.

themacguffinman 2y ago
Most major tech companies will ban it for any use because the virality of it isn't clearly bounded and legally it's untested [1]. The stakes are high at large tech companies with valuable IP, so downside is huge. For whatever reason, AGPL has never laid exclusive claim to particularly valuable projects (even in this project's case, it seems like they dual license so you can avoid the AGPL), so the upside isn't that high. So high downside + low upside means major players will just err on the side of "no". If your company has anything to lose, I'm sure it'll have a lawyer and you'll want to consult them on what their risk tolerance is. It's confusing because the license is actually ambiguous, most tech companies aren't willing to accept this ambiguity. [1] See this opinion by a Google lawyer: https://news.ycombinator.com/item?id=23968783 https://news.ycombinator.com/item?id=23968783

agpl3141592 2y ago

It's a shitty license. If you need to patch anything due to local requirements like the auth system you need to publish it which doesn't make sense at all.

jcotton42 2y ago
You only need to share those changes with anyone that has access to your modified version. If you modify an AGPL'd piece of software, but never distribute it outside your org, then your changes don't need to be released outside your org.

lukekim 2y ago

We chose Apache 2.0 for the Spice OSS runtime. TL;DR: Data-plane Apache 2.0, control-plane BSL. Being such a core component, we want developers to be completely comfortable integrating and deploying the Spice runtime in their applications and services, as well as running Spice in their own infrastructure. In addition, Spice OSS is built on other great open-source projects like DataFusion and Arrow, both Apache 2.0, and DuckDB (MIT), so being permissively licensed aligns with the fundamental technologies and communities it's built upon. We expect to release specific enterprise control-plane services, such as our Kubernetes Operator under a license such as BSL. [1] https://github.com/spiceai/spiceai https://github.com/spiceai/spiceai

mrwyz 2y ago

The AGPL is great, even for business. I make a living from AGPL software. Lots of people generally don't like it, because AGPL was not written to please the largest number of developers, but rather to protect the basic software freedoms of end-users. In a sense, the AGPL guarantees more freedoms, is more free, than other licenses such as MIT/BSD for end-users. But depends on the point of view. Many developers don’t like to have their freedom to steal to be restricted by such strong terms as those imposed by the AGPL. And that’s a good thing for you, my fellow maintainers. It’s also a great thing for you, dear end-users.

baggy_trough 2y ago
"freedom to steal"?
- mrwyz 2y ago
  MIT/BSD and similar ones.
  - baggy_trough 2y ago
    I don't know what you mean.
    - mrwyz 2y ago
      BSD/MIT allows you to take code without any obligation to contribute back.
      - baggy_trough 2y ago
        Using code that is freely given is not in any sense stealing.
        mrwyz 2y ago
        Only if you think taking the work of others and profiting from it without contributing anything back is fine.

laurencerowe 2y ago

I’ve been pretty involved in open source projects most of my career. The license you choose should reflect the community you are trying to create. But it probably only makes sense to protect application level code with a copyleft license. Most code has no real value beyond the time it saves you and its software developer contributors so it should be as liberally licensed as possible. You want to encourage contributions from the widest possible user base which includes developers of closed source software. They are already incentivised into upstreaming their changes to you on a liberal basis.

yencabulator 2y ago

It's AGPL for you but arbitrary relicensing at will for them: https://github.com/paradedb/paradedb/blob/dev/CONTRIBUTING.md#contributor-license-agreement https://github.com/paradedb/paradedb/blob/dev/CONTRIBUTING.m...

the-grump 2y ago
They put in the effort to create the product. It's their choice how to license it. Now it's up to you whether to sign that CLA to upstream your changes. You're welcome to maintain a fully AGPL fork if you don't like that.
- yencabulator 2y ago
  ParadeDB seems to be thin glue over preexisting Postgres extensions and C / Rust libraries.
  - the-grump 2y ago
    They are free to license that glue however they please, within the legal limits.

yencabulator 2y ago

Software products they are using as part their AGPL product are all more permissive, but somehow they consider themselves worthy of monetizing all of this: - Postgres: similar to MIT and BSD license - Tantivy (via pg_search): MIT - pgvector: Postgres license, similar to MIT - DuckDB (via pg_analytics): MIT - CloudNativePG: Apache-2.0 - pg_cron: Postgres license, similar to MIT - pg_ivm: Postgres license, similar to MIT

GuB-42 2y ago
That's the point of permissive licences. To allow monetization and redistribution under more restrictive terms, usually proprietary, but also copyleft licenses like AGPL.
- yencabulator 2y ago
  And when ParadeDB is harshly criticizing companies that would have otherwise perhaps used their software without paying them: > Thanks to the copyleft provision, cloud vendors cannot easily resell our project without our consent. This gives us confidence in our ability to monetize without fear of predatory competition. it seems they don't realize how ironic that stance is; they themselves are using all this software without paying for it.