4 ms·

That's another company that feels like they don't want to be an OSS company after all. After Elastic, I pay more attention to contributor agreements. Basically

That's another company that feels like they don't want to be an OSS company after all. After Elastic, I pay more attention to contributor agreements. Basically I consider any project that requires transfer of copyright for OSS contributions as likely to change their license at some point. It's fine; I'm not against that sort of thing and I sometimes pay for software. But I like to know what I'm getting into before and I don't appreciate the bait and switch. It also guides decisions as to what I contribute to actively. I do a simple sanity check with any OSS software before using it: - Make sure there is no contributor agreement requirements. This is a gigantic red flag that the license can and probably will be changed at some point. - Make sure the license is not overly restrictive (like AGPL). I appreciate people have good reasons for picking this license; but it comes with some serious restrictions in a commercial environment. And like it or not, a lot of companies have active policies against this. Either way, I avoid anything with this license. - Make sure the project is actively maintained. You don't want to get stuck with unmaintained software. Replacing dependencies is a PITA. - Make sure the project is not overly dependent on VC funding. Startups fail all the time at which point anything they worked on turns into abandon ware. - Ideally, make sure the project has a healthy diverse group of committers. Healthy here means more than one company is involved. Most projects that fail one or more of the above tests usually aren't very healthy in this sense.

mplanchard 2y ago
tbf I think both GNU and Linux require copyright assignment, and I don't think that either of those are likely to swap licenses any time soon
- orra 2y ago
  FYI, you're right about GNU (by and large), but mistaken about Linux.
  - ddtaylor 2y ago
    GNU has contributor agreements?
    - rpdillon 2y ago
      Absolutely! They want to have standing in court so they can defend infringers, and that's materially easier to establish with copyright assignment agreements. https://www.gnu.org/licenses/why-assign.en.html https://www.gnu.org/licenses/why-assign.en.html So while I agree with other commenters that a CLA is a clear indication that the entity seeking to have copyright assigned wants to reserve the right to take some kind of legal action at some point (like changing the license), it also applies in cases where the legal action is benevolent rather than malevolent (like defending the copyright).
  - mplanchard 2y ago
    Whoops, you're right! I thought there was some kind of sign off in there. My mistake.
- jillesvangurp 2y ago
  Neither of those licenses require copyright ownership transfer. It's what makes Linux completely bullet proof against license changes. You'd have to track down every copyright holder (everyone that contributed, even if it's just a 1 line change) to get their permission for re-licensing their contribution. Which in the case of Linux is literally tens of thousands of individuals and companies, if not more.
  - arp242 2y ago
    Most GNU projects require a copyright assignment. For example, GNU coreutils: "note that non trivial changes require copyright assignment to the FSF as detailed in the “Copyright Assignment” section of the Coreutils HACKING notes." (from: https://www.gnu.org/software/coreutils/coreutils https://www.gnu.org/software/coreutils/coreutils). As far as I know, this is case for most GNU projects. Linux only requires a confirmation that you wrote the patch; previous poster was mistaken about that, but they were correct about GNU.
    - znpy 2y ago
      This is a trust point, though: assigning copyright to the free software foundation allows code to be relicensed under new versions of the gpl.
      - shagie 2y ago
        https://www.gnu.org/licenses/gpl-3.0.en.html https://www.gnu.org/licenses/gpl-3.0.en.html - section 14 The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License “or any later version” applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation. Note the "or any later version" verbiage in there. If the software is licensed under "GPLv3 or any later version" - no permission is required or assignment of copyright. And so when you see things like https://directory.fsf.org/wiki/Coreutils https://directory.fsf.org/wiki/Coreutils Note also the "if you used the GPL without a version number, you can relicense it under any version" --- The "why they require a CLA" is for enforcement. https://www.gnu.org/licenses/why-assign.en.html https://www.gnu.org/licenses/why-assign.en.html In order to make sure that all of our copyrights can meet the recordkeeping and other requirements of registration, and in order to be able to enforce the GPL most effectively, FSF requires that each author of code incorporated in FSF projects provide a copyright assignment, and, where appropriate, a disclaimer of any work-for-hire ownership claims by the programmer's employer.
orra 2y ago
> That's another company that feels like they don't want to be an OSS company after all TBH that's nothing new for Cockroach. Even back when they were open core, the core was so restricted it didn't include backup & restore. I think that may have changed, but only when they changed the license of the core to BSL, that is making the core non open source for three years.
- dilyevsky 2y ago
  Correction - backup and restore was there, just not incremental backups. Which, yes, on very large DBs = no backup.
mixmastamyk 2y ago
AGPL + commercial license is a solution for keeping a project open while avoiding the situation where profit goes to cloud hosting. Is there a better solution?
- jillesvangurp 2y ago
  Unfortunately you can't do commercial licenses unless you take full ownership of each and every source contribution. So, it means there is zero guarantees the project stays open. AGPL without that is a non starter for commercial usage.
  - tsimionescu 2y ago
    Some of the most popular database and database related projects & products have been or are AGPL. MongoDB became massively successful as AGPL from the start. Grafana has been AGPL for 3+ years. The AGPL is absolutely viable in commercial contexts. There are a handful of companies that have hangups about it, but the industry overall has long since realized that it is almost identical to the GPL for most practical purposes.
    - johannes1234321 2y ago
      Mi d that those companies do dual licensing. All companies which worry about AGPL got to buy the commercial license to be on the safe side. While only the original vendor is able to do that, creating an imbalance between what they can do and an external contributor can do. (While external contributions are of limited interest for vendors who want to control a roadmap etc. and treat open source as marketing vehicle anyways)
- OutOfHere 2y ago
  LGPL is friendlier for commercial use. Keep the core LGPL, and the enterprise version proprietary.
- tsimionescu 2y ago
  This one is not a solution. The first of these open source companies to switch to a closed source license because the big bad cloud was eating their lunch was MongoDB, which was already AGPL. The AGPL, by design, doesn't stop anyone from offering your code: it merely makes sure that they provide the source code and installation instructions to anyone who is using the service. Amazon is only to happy to provide this, and they always have for all of the services they offer (that require it). They even contribute to some of these projects. Also, from the perspective of the free software movement at least, there is nothing to solve here. The whole point of the GPLs is that you don't get to have any special power over the code that you create: everyone who gets a copy has the exact same rights to it that you do, including the right to run your company under the ground if they can outcompete you.
bityard 2y ago
CockroachDB hasn't been an open source project in more than 5 years. They took down the blog post (I'd be curious to know why), but here is the announcement: https://web.archive.org/web/20190604173131/https://www.cockroachlabs.com/blog/oss-relicensing-cockroachdb/ https://web.archive.org/web/20190604173131/https://www.cockr... What started as a neat project with a vibrant and enthusiastic community is now just another dull beige enterprise vendor.
- zachmu 2y ago
  The BSL doesn't make it closed source, it prevents a competitor from running their own DBaaS business using Cockroach as the backend. This has happened to various open source projects, AWS started selling their technology and ate their lunch. BSL is a totally fair compromise for commercial open source licensing imho. If you see BSL as the first step to an announcement like today's, that's a fair criticism. Not sure how often that happens. But BSL doesn't disqualify software from being open source.
  - jen20 2y ago
    The BSL is not an OSI-approved license, so it’s certainly not “open source” by the commonly used definition. I agree it’s a reasonable license. But it’s not an open source license.
    - LtdJorge 2y ago
      It even says it is not an open source license right in the license
    - immibis 2y ago
      The OSI is a consortium of cloud platform vendors (really - check for yourself). Of course they'll define open source in a way that excludes licenses that restrict them from turning your work into closed-source cloud platforms. The good news is that we're not beholden to their definition as they have no official status whatsoever. We don't have to believe them just because they put the words Open Source in their company name. The BSL is clearly not open source since it requires approval from the licensor in certain applications, but the OSI also rejected the SSPL, which is just an extended AGPL that requires source code publication in even more cases, and is clearly open source because of that.

mplanchard 2y ago

tbf I think both GNU and Linux require copyright assignment, and I don't think that either of those are likely to swap licenses any time soon

orra 2y ago
FYI, you're right about GNU (by and large), but mistaken about Linux.
- ddtaylor 2y ago
  GNU has contributor agreements?
  - rpdillon 2y ago
    Absolutely! They want to have standing in court so they can defend infringers, and that's materially easier to establish with copyright assignment agreements. https://www.gnu.org/licenses/why-assign.en.html https://www.gnu.org/licenses/why-assign.en.html So while I agree with other commenters that a CLA is a clear indication that the entity seeking to have copyright assigned wants to reserve the right to take some kind of legal action at some point (like changing the license), it also applies in cases where the legal action is benevolent rather than malevolent (like defending the copyright).
- mplanchard 2y ago
  Whoops, you're right! I thought there was some kind of sign off in there. My mistake.
jillesvangurp 2y ago
Neither of those licenses require copyright ownership transfer. It's what makes Linux completely bullet proof against license changes. You'd have to track down every copyright holder (everyone that contributed, even if it's just a 1 line change) to get their permission for re-licensing their contribution. Which in the case of Linux is literally tens of thousands of individuals and companies, if not more.
- arp242 2y ago
  Most GNU projects require a copyright assignment. For example, GNU coreutils: "note that non trivial changes require copyright assignment to the FSF as detailed in the “Copyright Assignment” section of the Coreutils HACKING notes." (from: https://www.gnu.org/software/coreutils/coreutils https://www.gnu.org/software/coreutils/coreutils). As far as I know, this is case for most GNU projects. Linux only requires a confirmation that you wrote the patch; previous poster was mistaken about that, but they were correct about GNU.
  - znpy 2y ago
    This is a trust point, though: assigning copyright to the free software foundation allows code to be relicensed under new versions of the gpl.
    - shagie 2y ago
      https://www.gnu.org/licenses/gpl-3.0.en.html https://www.gnu.org/licenses/gpl-3.0.en.html - section 14 The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License “or any later version” applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation. Note the "or any later version" verbiage in there. If the software is licensed under "GPLv3 or any later version" - no permission is required or assignment of copyright. And so when you see things like https://directory.fsf.org/wiki/Coreutils https://directory.fsf.org/wiki/Coreutils Note also the "if you used the GPL without a version number, you can relicense it under any version" --- The "why they require a CLA" is for enforcement. https://www.gnu.org/licenses/why-assign.en.html https://www.gnu.org/licenses/why-assign.en.html In order to make sure that all of our copyrights can meet the recordkeeping and other requirements of registration, and in order to be able to enforce the GPL most effectively, FSF requires that each author of code incorporated in FSF projects provide a copyright assignment, and, where appropriate, a disclaimer of any work-for-hire ownership claims by the programmer's employer.

orra 2y ago

> That's another company that feels like they don't want to be an OSS company after all TBH that's nothing new for Cockroach. Even back when they were open core, the core was so restricted it didn't include backup & restore. I think that may have changed, but only when they changed the license of the core to BSL, that is making the core non open source for three years.

dilyevsky 2y ago
Correction - backup and restore was there, just not incremental backups. Which, yes, on very large DBs = no backup.

mixmastamyk 2y ago

AGPL + commercial license is a solution for keeping a project open while avoiding the situation where profit goes to cloud hosting. Is there a better solution?

jillesvangurp 2y ago
Unfortunately you can't do commercial licenses unless you take full ownership of each and every source contribution. So, it means there is zero guarantees the project stays open. AGPL without that is a non starter for commercial usage.
- tsimionescu 2y ago
  Some of the most popular database and database related projects & products have been or are AGPL. MongoDB became massively successful as AGPL from the start. Grafana has been AGPL for 3+ years. The AGPL is absolutely viable in commercial contexts. There are a handful of companies that have hangups about it, but the industry overall has long since realized that it is almost identical to the GPL for most practical purposes.
  - johannes1234321 2y ago
    Mi d that those companies do dual licensing. All companies which worry about AGPL got to buy the commercial license to be on the safe side. While only the original vendor is able to do that, creating an imbalance between what they can do and an external contributor can do. (While external contributions are of limited interest for vendors who want to control a roadmap etc. and treat open source as marketing vehicle anyways)
OutOfHere 2y ago
LGPL is friendlier for commercial use. Keep the core LGPL, and the enterprise version proprietary.
tsimionescu 2y ago
This one is not a solution. The first of these open source companies to switch to a closed source license because the big bad cloud was eating their lunch was MongoDB, which was already AGPL. The AGPL, by design, doesn't stop anyone from offering your code: it merely makes sure that they provide the source code and installation instructions to anyone who is using the service. Amazon is only to happy to provide this, and they always have for all of the services they offer (that require it). They even contribute to some of these projects. Also, from the perspective of the free software movement at least, there is nothing to solve here. The whole point of the GPLs is that you don't get to have any special power over the code that you create: everyone who gets a copy has the exact same rights to it that you do, including the right to run your company under the ground if they can outcompete you.

bityard 2y ago

CockroachDB hasn't been an open source project in more than 5 years. They took down the blog post (I'd be curious to know why), but here is the announcement: https://web.archive.org/web/20190604173131/https://www.cockroachlabs.com/blog/oss-relicensing-cockroachdb/ https://web.archive.org/web/20190604173131/https://www.cockr... What started as a neat project with a vibrant and enthusiastic community is now just another dull beige enterprise vendor.

zachmu 2y ago
The BSL doesn't make it closed source, it prevents a competitor from running their own DBaaS business using Cockroach as the backend. This has happened to various open source projects, AWS started selling their technology and ate their lunch. BSL is a totally fair compromise for commercial open source licensing imho. If you see BSL as the first step to an announcement like today's, that's a fair criticism. Not sure how often that happens. But BSL doesn't disqualify software from being open source.
- jen20 2y ago
  The BSL is not an OSI-approved license, so it’s certainly not “open source” by the commonly used definition. I agree it’s a reasonable license. But it’s not an open source license.
  - LtdJorge 2y ago
    It even says it is not an open source license right in the license
  - immibis 2y ago
    The OSI is a consortium of cloud platform vendors (really - check for yourself). Of course they'll define open source in a way that excludes licenses that restrict them from turning your work into closed-source cloud platforms. The good news is that we're not beholden to their definition as they have no official status whatsoever. We don't have to believe them just because they put the words Open Source in their company name. The BSL is clearly not open source since it requires approval from the licensor in certain applications, but the OSI also rejected the SSPL, which is just an extended AGPL that requires source code publication in even more cases, and is clearly open source because of that.