7 ms·
For what it's worth, I understand this concern. However, I want to emphasize that pyx is intentionally distinct from Astral's tools. From the announcement post:
by woodruffw 1y ago
For what it's worth, I understand this concern. However, I want to emphasize that pyx is intentionally distinct from Astral's tools. From the announcement post:
> Beyond the product itself, pyx is also an instantiation of our strategy: our tools remain free, open source, and permissively licensed — forever. Nothing changes there. Instead, we'll offer paid, hosted services that represent the "natural next thing you need" when you're already using our tools: the Astral platform.
Basically, we're hoping to address this concern by building a separate sustainable commercial product rather than monetizing our open source tools.
- pbowyer 1y agoThis is the way it's worked for PHP's composer packages, and it's worked well.
- o11c 1y agoThe entire reason people choose "permissive licenses" is so that it won't last forever. At best, the community can fork the old version without any future features. Only viral licenses are forever.
- woodruffw 1y agoI don't think this is true -- a license's virality doesn't mean that its copyright holders can't switch a future version to a proprietary license; past grants don't imply grants to future work under any open source license.
- notpushkin 1y agoCorrect; however, without a CLA and assuming there are outside contributors, relicensing the existing code would be mildly painful, if not downright impossible.
- woodruffw 1y agoYou're saying that would be more painful in a viral license setting, right? If so I agree, although I think there's a pretty long track record of financially incentivized companies being willing to take that pain. MongoDB's AGPL transition comes to mind. But, to refocus on the case at hand: Astral's tools don't require contributors to sign a CLA. I understand (and am sympathetic) to the suspicion here, but the bigger picture here is that Astral wants to build services as a product, rather than compromising the open source nature of its tools. That's why the announcement tries to cleanly differentiate between the two.
- stackskipton 1y agoThey have no need to, current repos show everything is under MIT/Apache. They could close the source at any time and not worry about CLA. >bigger picture here is that Astral wants to build services as a product What services? pyx? Looks nice but I doubt my boss is going to pay for it. More likely they just say "Whatever, package is in PyPi, use that." UV, Ruff, Ty. Again, maybe they can get some data/quant firm who REALLY cares about speed to use their products. Everyone else will emit a long sigh, grab pip/poetry, black and mypy and move on.
- pepoluan 1y agoIt ultimately depends on a company's risk appetite. Some companies specify that packages need to be hosted on their internal repository/artifactory, and for these companies, pyx might be a good tool.
- jamespo 1y agoExactly, allowing employees to install pypi packages from the internet isn't different to allowing them to install any software from the internet.
- pxc 1y ago> I think there's a pretty long track record of financially incentivized companies being willing to take that pain. MongoDB's AGPL transition comes to mind. MongoDB had a CLA from the start, didn't it? > Astral's tools don't require contributors to sign a CLA. That's a pretty vital difference!
- krupan 1y agoI think you are making a good point, but please don't use the old Steve Baller FUD term, "viral." Copyleft is a better term
- Muromec 1y agoThe word "left" is now very charged too, maybe even more than "viral".
- HiPhish 1y agoEvery word is charged now, so you might as well use it. "Copyleft" is a fine pun on "copyright".
- neutronicus 1y agoCareful, or you'll get the copyleftists calling you a neo-libre-al.
- knowitnone2 1y agothey call everybody a nazi so by definition, they like living in a nazi country
- ameliaquining 1y agoI don't think the connotation these days is particular negative, in the sense it's being used here. See, e.g., "viral video".
- codethief 1y agoPolitics aside, "copyleft" originates from a pun and is hardly self-explanatory, whereas "viral" is.
- actinium226 1y agoBy viral, do you mean licenses like GPL that force those who have modified the code to release their changes (if they're distributing binaries that include those changes)? Because FWIW CPython is not GPL. They have their own license but do not require modifications to be made public.
- thayne 1y agoOr they want to get more people to use it.
- bigstrat2003 1y agoThis is just plain false and honestly close-minded. People choose permissive licenses for all sorts of reasons. Some might want to close it off later, but lots of people prefer the non-viral nature of permissive licenses, because it doesn't constrain others' license choice in the future. Still others think that permissive licenses are more free than copyleft, and choose them for that reason. Please don't just accuse vast groups of people of being bad-faith actors just because you disagree with their license choice.
- zemo 1y ago> Basically, we're hoping to address this concern by building a separate sustainable commercial product rather than monetizing our open source tools. jfrog artifactory suddenly very scared for its safety
- zahlman 1y agoWill pyx describe a server protocol that could be implemented by others, or otherwise provide software that others can use to host their own servers? (Or maybe even that PyPI can use to improve its own offering?) That is, when using "paid, hosted services like pyx", is one paying for the ability to use the pyx software in and of itself, or is one simply paying for access to Astral's particular server that runs it?
- woodruffw 1y agoI might not be following: what would that protocol entail? pyx uses the same PEP 503/691 interfaces as every other Python index, but those interfaces would likely not be immediately useful to PyPI itself (since it already has them). > or is one simply paying for access to Astral's particular server that runs it? pyx is currently a service being offered by Astral. So it's not something you can currently self-host, if that's what you mean.
- zahlman 1y ago> pyx uses the same PEP 503/691 interfaces as every other Python index ... Then how can it make decisions about how to serve the package request that PyPI can't? Is there not some extension to the protocol so that uv can tell it more about the client system?
- woodruffw 1y agoThe repository API allows server-driven content negotiation[1], so pyx can service specialized requests while also honoring the normal 503/691 ones. [1]: https://packaging.python.org/en/latest/specifications/simple-repository-api/#version-format-selection https://packaging.python.org/en/latest/specifications/simple...
- happymellon 1y agoAh. > honoring the normal 503/691 ones. Embrace > pyx can service specialized requests Extend ... ;)
- abdullahkhalids 1y agoI believe that you are sincere and truthful in what you say. Unfortunately, the integrity of employees is no guard against the greed of investors. Maybe next year investors change the CEO and entire management and they start monetizing the open source tools. There is no way of knowing. But history tells us that there is a non-trivial chance of this happening.
- dandellion 1y agoYes, at every company I have been with investors, sooner or later they make the calls, what the founders wanted never has much weight a few years in.
- adr1an 1y agoA week later a fork appears and everyone is happy (except those investors, CEO, and management, but it never was about their happiness so...)
- BrenBarn 1y agoIt makes sense, but the danger can come when non-paying users unwittingly become dependent on a service that is subsidized by paying customers. What you're describing could make sense if pyx is only private, but what if there is some kind of free-to-use pyx server that people start using? They may not realize they're building on sand until the VC investors start tightening the screws and insist you stop wasting money by providing the free service. (Even with an entirely private setup, there is the risk that it will encourage too much developer attention to shift to working within that silo and thus starve the non-paying community of support, although I think this risk is less, given Python's enormous breadth of usage across communities of various levels of monetization.)
- physicsguy 1y agoConda said all this as well, and solved the same issues you’re trying to - namely precompiled versions of difficult to build packages. It then went commercial. In the HPC space there are already Easybuild and Spack which make all the compiler tool chain and C and Fortran library dependency stuff very easy. They just haven’t taken off outside as they aim to solve cluster management problems but Spack is easy to self serve.
- igortg 1y agoYes, it went commercial. But Conda is still free. And the community had built conda-forge to maintain packages. Conda + conda-forge can completly replace Anaconda for most people. So even though they went commercial, they left pretty good things behind for the Open source community.
- wrasee 1y agoThe uncertainly over a future rug pull is always real, but in reality I wonder if the actual reason for people's hesitancy is more than just that. In reality I suspect it's closer to one of simply identity and the ownership model itself. Just the very idea that core tooling you depend on is in the hands of a commercial company is enough to many back off in a way one might not be when the tooling is in the hands of a broader community that one can support on more equal terms. @woodruffw I love your quote above that commits you to your open source base and I'm rooting for you. But how about an approach that commits you to this sentence in a more rigorous and legal way, and spin off your open source tooling to a separate community-based entity? Of course, upon that you can continue to maintain sufficient representation to make Astral's commercial products the natural progression and otherwise the model remains the same. That would be a significant transfer of control, but it is that very transfer that would get a overwhelming response from the community and could really unblock these great tools for massive growth. I work a lot with LLVM/Clang and whilst i know Apple and Google are significant contributors I feel confident that LLVM itself exists outside of that yet accept that e.g. Apple's contributions afford them weight to steer the project in ways that match their interests in e.g. Swift and Apple tooling.
- threatofrain 1y agoThe hosting and administration part is what’s expensive and can’t be free and open source except when someone pays for it. So is npm open source? Whether it is or isn't doesn't matter as much as whether Microsoft continues to pay the bill.
- dataflow 1y agoI think the only way you can alleviate people's concerns here is by legally binding the company in a way that would adequately address those concerns. Which I don't recall ever seeing any company attempt in such a scenario, probably because it obviously devalues the company as it restricts what a potential future buyer could do with it. Which is exactly why some people don't buy such pinky promises.