5 ms·

VC backed database company with a CLA on their "open source" project. Red flag. Is there a community fork yet?

by eikenberry 2y ago

zhouzhao 2y ago
Thank you for the warning. Whats the source on the VC part?
- russell_h 2y ago
  I don't share OP's hostility to VC-funded databases, but PingCAP is definitely VC-funded: https://www.pingcap.com/press-release/pingcap-the-company-behind-tidb-raises-270-million-in-series-d-funding/ https://www.pingcap.com/press-release/pingcap-the-company-be...
  - eikenberry 2y ago
    The VC part isn't 100% negative but it generally comes with the strings attached that highly incentivizes fast growth. Fast growth kills any company culture you have and converts you into yet another company that views all employees as cost-centers. IE. it destroys companies as good places to work. If you could get VCs to fund companies to grow slowly into stable, small to mid-sized companies I would have no problem with them. A side aspect of this is that they also destroy any motivation for developing free software other than as a marketing tool, a way to drive growth. While that is perfectly fine for companies to do this, it has long term consequences that lead to bad behavior that mean you should be extra wary of relying on them.
hbbio 2y ago
How would you fund the open source development of a database? TiDB is Apache licensed, that should be enough no? Because if we ban all projects from VC-backed startups, you're going to clear your tech stack pretty quickly.
- foota 2y ago
  I think the concern is that the company would relicense future versions, as allowed by the CLA, under pressure from VCs.
  - maxloh 2y ago
    Open software licenses are generally non-revokable (unless you violate them). They can only change the license of future versions. I'm afraid that they can always do that with or without a CLA. Apache is quite a permissive license.
    - foota 2y ago
      I'm not an expert in licenses, but my understanding is that if someone makes a contribution under one license, then any program including that code needs to obey the terms of that license. The CLA allows them to choose any license (well, depending on the specifics of the CLA) they would like to distribute that code under in the future (although they'd likely need to continue to make available past source to meet the terms of previously released versions. So if I make a contribution under some very restrictive license, but sign a CLA allowing relicensing, all bets for the future are off.
      - maxloh 2y ago
        Apache license doesn't forbid anyone to integrate your code and release the combination under proprietary licenses. The only requirements are to keep the license file and the copyright notice intact, and to state changes if you choose to publish the modified source code. Therefore, it doesn't make a difference to have a CLA or not. What you trying to avoid is already allowed as per the license. However, some CLAs require you to declare the originality and ownership of your contributions. Maybe that's why they require a CLA to be signed for contributions.
- eikenberry 2y ago
  > How would you fund the open source development of a database? I think the best way would be something similar to the Linux Foundation. Companies in need of a certain type of database would pool resources to develop and maintain it. PostgreSQL was a community developed database that was funded in something approaching this way as most of the developers were either students or worked for someone who paid them while they worked on it. > TiDB is Apache licensed, that should be enough no? It's good enough to use it with the knowledge that it isn't truly free (libre) because the CLA gives the owning company the right to change that at any time. So you can use it but don't build a business around it or make it a critical part of your infrastructure as they might pull the rug out from under you.
benatkin 2y ago
With it under the Apache 2 license, misuse of a CLA to get free contributions from the community that aren't shared back to the community isn't currently a problem.
rpaik 2y ago
Is your main issue with the VC funding, the CLA, or the combination of both. Doesn’t Kubernetes (hosted by the Linux Foundation) also have a CLA?
hodgesrm 2y ago
CLAs are not necessarily a bad thing. In fact, they are pretty much necessary for software companies. We have one for our open source projects. It has language to ensure there's no dispute about our right to the code. That's important, because we indemnify our customers against IP infringement. It's a standard part of contracts for software and services.
- cube2222 2y ago
  IANAL but you can have that without getting yourself a full copyright license to all contributions - as CLAs generally do, and what enables license changes. A popular more lightweight solution is the DCO[0]. [0]: https://developercertificate.com/ https://developercertificate.com/

VC backed database company with a CLA on their "open source" project. Red flag. Is there a community fork yet?

zhouzhao 2y ago

Thank you for the warning. Whats the source on the VC part?

russell_h 2y ago
I don't share OP's hostility to VC-funded databases, but PingCAP is definitely VC-funded: https://www.pingcap.com/press-release/pingcap-the-company-behind-tidb-raises-270-million-in-series-d-funding/ https://www.pingcap.com/press-release/pingcap-the-company-be...
- eikenberry 2y ago
  The VC part isn't 100% negative but it generally comes with the strings attached that highly incentivizes fast growth. Fast growth kills any company culture you have and converts you into yet another company that views all employees as cost-centers. IE. it destroys companies as good places to work. If you could get VCs to fund companies to grow slowly into stable, small to mid-sized companies I would have no problem with them. A side aspect of this is that they also destroy any motivation for developing free software other than as a marketing tool, a way to drive growth. While that is perfectly fine for companies to do this, it has long term consequences that lead to bad behavior that mean you should be extra wary of relying on them.

hbbio 2y ago

How would you fund the open source development of a database? TiDB is Apache licensed, that should be enough no? Because if we ban all projects from VC-backed startups, you're going to clear your tech stack pretty quickly.

foota 2y ago
I think the concern is that the company would relicense future versions, as allowed by the CLA, under pressure from VCs.
- maxloh 2y ago
  Open software licenses are generally non-revokable (unless you violate them). They can only change the license of future versions. I'm afraid that they can always do that with or without a CLA. Apache is quite a permissive license.
  - foota 2y ago
    I'm not an expert in licenses, but my understanding is that if someone makes a contribution under one license, then any program including that code needs to obey the terms of that license. The CLA allows them to choose any license (well, depending on the specifics of the CLA) they would like to distribute that code under in the future (although they'd likely need to continue to make available past source to meet the terms of previously released versions. So if I make a contribution under some very restrictive license, but sign a CLA allowing relicensing, all bets for the future are off.
    - maxloh 2y ago
      Apache license doesn't forbid anyone to integrate your code and release the combination under proprietary licenses. The only requirements are to keep the license file and the copyright notice intact, and to state changes if you choose to publish the modified source code. Therefore, it doesn't make a difference to have a CLA or not. What you trying to avoid is already allowed as per the license. However, some CLAs require you to declare the originality and ownership of your contributions. Maybe that's why they require a CLA to be signed for contributions.
eikenberry 2y ago
> How would you fund the open source development of a database? I think the best way would be something similar to the Linux Foundation. Companies in need of a certain type of database would pool resources to develop and maintain it. PostgreSQL was a community developed database that was funded in something approaching this way as most of the developers were either students or worked for someone who paid them while they worked on it. > TiDB is Apache licensed, that should be enough no? It's good enough to use it with the knowledge that it isn't truly free (libre) because the CLA gives the owning company the right to change that at any time. So you can use it but don't build a business around it or make it a critical part of your infrastructure as they might pull the rug out from under you.

benatkin 2y ago

With it under the Apache 2 license, misuse of a CLA to get free contributions from the community that aren't shared back to the community isn't currently a problem.

rpaik 2y ago

Is your main issue with the VC funding, the CLA, or the combination of both. Doesn’t Kubernetes (hosted by the Linux Foundation) also have a CLA?

hodgesrm 2y ago

CLAs are not necessarily a bad thing. In fact, they are pretty much necessary for software companies. We have one for our open source projects. It has language to ensure there's no dispute about our right to the code. That's important, because we indemnify our customers against IP infringement. It's a standard part of contracts for software and services.

cube2222 2y ago
IANAL but you can have that without getting yourself a full copyright license to all contributions - as CLAs generally do, and what enables license changes. A popular more lightweight solution is the DCO[0]. [0]: https://developercertificate.com/ https://developercertificate.com/