11 ms·

Rug pulls, forks, and open-source feudalism

276 points by pabs3 1y ago

roenxi 1y ago
[flagged]
- delusional 1y ago
  You worldview is incredibly foreign to me, but I'll try to engage fairly with it. > the US right wing looked like it was about to build a complete alternative internet for a while there This would seem to imply that the established internet, what we had before this relenting, was somehow left wing. Is that an accurate description of your view? When did this relenting take place? > they just partially marginalised when the censorship backed off. Is it your position that Truth Social (the social network started by the current president of the united states) is currently a marginalized space? > That isn't how feudal revolts work in my understanding; typically peasants just got squished by better armed, armoured and organised soldier classes. I think it's interesting that you posit this as a fight between the "peasants" and the "soliders". I'm assuming, to make sense of your analogy, that the "peasants" in this case is the current president of the united states and Elon Musk. the "soliders" would then be "Jeff Bezos" and "Sundar Pichai"
  - palmfacehn 1y ago
    >This would seem to imply that the established internet, what we had before this relenting, was somehow left wing. I would omit the left-wing characterization as a debatable generalization. Perhaps it would be better described as the specific platforms being opposition partisans, rather than the Internet itself.
    - delusional 1y ago
      > Perhaps it would be better described as the specific platforms being opposition partisans I'm sympathetic to such an argument, but it does beg the question: Which platforms? The original comments choices of singling out Rumble and Truth Social, would imply that YouTube and Twitter would at least be _among_ those "specific platforms" but neither of those platforms are, at least according to the left, particularly left wing. Both platform have repeatedly been criticized for creating and propagating structures that lead people down what was called "the alt-right pipeline" and has, historically, hosted some of the most active alt-right figureheads. That's not to say either platform is or was right-wing either. I'm not the one making an argument. Though I'm not convinced they were particularly left-wing or partisan before the creation of Rumble and Truth Social.
      - roenxi 1y ago
        Just to be clear, I never said anything about the left wing. I don't think they were involved in that one. Suppressing speech is generally opposed by the leftists.
        gg82 1y ago
        Just compare X and Blue Sky. There may be some principled leftists who oppose suppressing speech, but in recent times, it has been the left that has been censoring/blocking peoples speech. Another comparison is what is actually censored. Of course there is a certain amount that would be censored by both sides - criticism of power.
  - roenxi 1y ago
    > This would seem to imply that the established internet, what we had before this relenting, was somehow left wing. Is that an accurate description of your view? When did this relenting take place? No, the left wing wasn't really involved. It looked from the outside like a pocket of authoritarians settled in the US intelligence services. Given the priorities of the Trump establishment on starting Term 2 when they moved very quickly to gut the US propaganda services I think Trump's people came to a similar view. And the relenting came when it was obvious that the companies involved were going to start suffering commercial consequences. Or, in cases like Twitter, got bought out by prominent right-wing figures. > Is it your position that Truth Social (the social network started by the current president of the united states) is currently a marginalized space? Yeah. It isn't really operating on the same scale as Twitter and it only exists because Twitter felt the obvious way to construe "To all of those who have asked, I will not be going to the Inauguration on January 20th." was as glorification of violence [0]. It's commercial wisdom is unclear. > I think it's interesting that you posit this as a fight between the "peasants" and the "soliders". I'm almost positing the opposite, NOT(it is a fight between peasants and soldiers). That is why I think the feudal meme is a mistake - this isn't a situation where the powers that be in the tech world can actually bring consequences down on a class of people. The people have freedom. [0] It was bizarre. I've kept a copy of Titter's announcement saved to disk as a reminder of how crazy groupthink can get. Anyone willing to state such a stupid theory in public has to believe it.
    - conartist6 1y ago
      I have 0 trouble understanding why Twitter didn't want to be whipping up fury against democracy using their power to do so. Six days before that ban Trump had definitively crossed the line over to full-blown treason with the Reffensperger call. Two days before the ban he sat quietly, waiting and hoping a mob of his supporters whipped up by his verbal diarrhea would sieze power for him, ending democracy. Make no mistake, Twitter did exactly what they had every legal and moral obligation to do.
      - hedora 1y ago
        I’ll just add that the quote in the comment you replied to was one of the least offensive things Trump said during that incident (if he even tweeted that). The news ran a video of him inciting a riot, etc, etc.
- BinaryIgor 1y ago
  Exactly; there are many mechanism in-place that allow us (anybody) to create alternatives if the currently dominant players start to misbehave too much; they just have not
  - throwawayqqq11 1y ago
    And there are mechanism that restrict you. The article states it too: There is a resource (for software, id add knowhow) asymmetry and market innertia at play here. Otherwise, im am really wishing for alternative payment processors ... could someone proove me wrong here please.
    - BinaryIgor 1y ago
      BTC ecosystem is growing strong :) Especially the Lightning Network
- rixed 1y ago
  > they're only sticky as long as they do a good job > Groups like AWS or Google are actually pretty vulnerable (...) build a complete alternative internet for a while there until the management in tech relented and allowed them to speak up in public The part of AWS or Google infrastructure necessary to "speak up in public", relative to their total infrastructure, is probably close to the tiniest number you can imagine. I can't see how an alternative web forum or short text message service, even if used and supported by many, could make AWS or Google vulnerable. And as a reminder, the public is not a customer for Google nor AWS. Or maybe by "the US right wing" you meant a handful of billionaires who would fund an alternative to Google and AWS? That still sounds naive to me. The estimated assets of Google or AWS in datacenters only is somewhere in the hundredth of billions, plus a good fraction of that every year for maintenance. Their current valuation is between $2 and $3 trillion. Having no exeprience about peasants revolts (yet ;)) I only meant to comment on that part of your message.
3np 1y ago
Building the software you rely on from source by default is one way to reduce the impact these events have on you and shift the power dynamic. If you're installing binaries/images from a vendor (free or otherwise), transitioning to a fork may be an undertaking and a sweaty risk-assessment. Switching your existing build-infra to sync sources from a new remote should be a snap. Also no major need to hound maintainers to ship a release or merge that neglected bugfix or feature you desperately need - just cherry-pick it.
- andersmurphy 1y ago
  Not sure why this is getting down votes but I agree. Also building from source doesn't have to be hard (see sqlite).
  - 3np 1y ago
    > Not sure why this is getting down votes Guessing unrelated to the comment itself, prolly got a minor downvote army on my back after a different recent comment on Gaza matters. Downvotes are just a noisy signal in general and I wouldn't read that much into a few here and there, it comes with the territory. Oh and yeah, this meta makes for tedious threads so site guidelines and all that.
- pjmlp 1y ago
  Depends on the actual software licence, many commercial vendors do provide source code, however the licence doesn't allow you to do whatever you feel like with code, even if technically it is possible to do so. This happens a lot in commercial products where scripting languages are used, for example. Or enterprise consulting as another example, where the code is delivered as part of the project, but it is bound to the agency for compiling purposes, unless the customer pays extra for that right.
  - anilgulecha 1y ago
    IMO if you're a technical decision maker, you should ignore fair source/business source stuff with extreme prejudice. These are fundamentally incompatible with the goal of having autonomy for your systems. Only pick these if they're non-critical, have a significantly higher RoI, or a high commodity item.
positron26 1y ago
[flagged]
OgsyedIE 1y ago
I believe there should be a broader family of terms besides rug pull for when the intentions of vendors and developers change over time to become extractive and negative. No, enshittification is not the right word.
- 01HNNWZ0MV43FF 1y ago
  "bait and switch" The FOSS license is the bait, and the CLA is evidence that they had ill intent from the start
  - sparkie 1y ago
    It's not ill intent. The CLA clearly states what the intent is. It says "You give the company permission to relicense your work". The intent is there from the beginning - they want to be able to monetize the work. If you dislike such intent, then you wouldn't sign the CLA. The concern is if they stop dual-licensing, and future releases don't come under a free license, but they only work on their proprietary relicensed version. You have the option to fork, under the same free license that it was originally under - you just won't get further updates from the company involved. I don't see the problem here: You aren't entitled to those updates just because you made some contributions.
evrennetwork 1y ago
[flagged]
palata 1y ago
> There is typically a spike in these clones after a relicensing event, suggesting that people are considering creating a hard fork of the project That, or maybe people make a "snapshot" just in case. I don't believe many people seriously consider leading the effort of maintaining a fork...
- jenadine 1y ago
  Or just the fact that the project is making the news means more people visit the GitHub page.
palata 1y ago
> Projects with CLAs more commonly are subject to rug pulls; projects using a developers certificate of origin do not have the same power imbalance and are less likely to be rug pulled. Would be worth explaining why: my understanding is that if you sign a CLA, you typically give a right to relicence to the beneficiary of the CLA. So you say "it is a GPL project, my contribution is GPL, but I allow you to relicence my contribution as you see fit". If the project uses a permissive licence already, honestly I don't really see a big impact with signing a CLA: anyone can just take the codebase and go proprietary with it. However, if it is a copyleft licence, then signing a CLA means that the beneficiary of the CLA doesn't play by the same rules and can go proprietary with the contributions! If you don't want a rug pull, you should use a copyleft licence and not sign a CLA: nobody can make Linux proprietary because the copyright is shared between so many people. If you use a permissive licence, then a rug pull is part of the deal.
- goodpoint 1y ago
  > If you use a permissive licence, then a rug pull is part of the deal. True. Yet CLAs do not always give away all rights.
- charcircuit 1y ago
  There is no such thing as a rug pull in regards to open source. A GPL copy of your code will exist forever.
  - zozbot234 1y ago
    Yes, it's a pretty weird notion. The only "rug pull" is wrt. ongoing maintenance of the project, but any maintainer may end up abandoning their own project for any reason or no reason at all. This is why essentially all FLOSS licenses have long provided for the right to fork the existing codebase under a new maintainership.
    - Spooky23 1y ago
      Unless you can sustain a fork, it is a rug pull if you’ve incorporated the software in other projects. Imagine if a non-trivial critical project like OpenSSL had this happen. Shitty behavior like this is more common with software both OSS and commercial than in the past. Treat any meaningful software engagement like a celebrity marriage.
tetha 1y ago
This is causing management at the current company to run in circles a bit as well. The company has been fairly adamant about having support contracts for systems, and it has encountered a number of these stunts. Opscode with chef a long time ago, CentOS exit, VMWare, Broadcom has a number of more ugly things available in Tanzu. And we were either paying these companies (looking at VMWare), or looked for quotes and intending to pay these companies. But suddenly, your configuration management is supposed to cost almost 6 digits per year. Very basic services should suddenly cost a mid-6-digit range per year for a basic suport contract. Sorry but what the fuck? And - again, looking at VMWare - even then we can't really rely on it? I've been recommending to instead sponsor foundations, or straight up paying maintainers and developers of OSS we use regularly. The giggles when suggesting that have been getting quieter. But I'd rather hire a Proxmox/qemu dev than start paying the next VMWare.
- rzr 1y ago
  Isn't it paradoxal, that those mentioned companies had set up an OSPO (to do OSS the right/community way... with the right/community minded people) I believe this kind of schizophrenia is the price to pay of (too) big organizations.
- pabs3 1y ago
  You have the right idea; audit all the software you run, including dependencies, and make sure that they are all viable, by contributing back with dev hours and funding, and advocate that other related companies do the same.
dig1 1y ago
> Contributors and maintainers often have less power than even the smaller companies, and users have less power yet. If contributors/maintainers are not happy with what the small company does, they can fork the project (assuming a liberal license) and continue in their own way. Valkey is a good example (with an interesting twist of license dynamics where Redis can use Valkey code now, but not the other way around). > We have built a world where it is often easiest to just use whatever a cloud provider offers And, IMHO, this is the major problem in the dev community these days - we've become lazy and focused on nonsense ("pretty"/unusable UIs, web gymnastics, llm, "productivity" etc.). We didn't have problems in the past to fork or reimplement OSes (various BSD instances), compilers (gcc versions), databases (MariaDB), and so on. There are tons of geniuses around hacking on cool stuff, but, sadly, the loudness of various hipsters and evangelists limits their visibility. > Those providers may not contribute back to the projects they turn into services, though, upsetting the smaller companies that are, The significant contribution that these providers (AWS, et al.) make to these projects is often overlooked - free advertisement. If I can remember correctly, ElasticSearch got popular when AWS started to offer it as a service. Additionally, cloud providers usually contribute (by employing core developers, shipping patches or testing) to the kernel, gcc or jdk, from which these small companies benefit significantly. In contrast, they themselves could do none of this. But it is easier to blame "big scary clouds" than to rethink your business model. Be honest, start closed; no one will touch that and no one will be standing in your way.
throwaway832338 1y ago
A lot of words without any mention of copyleft, protective licenses, GPL. Difficult to take the article seriously.
matheusmoreira 1y ago
I emailed Stallman about the ethics of using AGPLv3 with a CLA to allow selling exceptions. Here's his reply: https://news.ycombinator.com/item?id=42601846 https://news.ycombinator.com/item?id=42601846 I see what you mean. The original developer can engage in a practice that blocks coopertation. By contrast, using some other license, such as the ordinary GPL, would permitt ANY user of the program to engage in that practice. In a perverse sense that could seem more fair, but I think it is also more harmful. On balance, using the AGPL is better.
- jenadine 1y ago
  I'm confused. His answer doesn't seem to be about the CLA.
  - jraph 1y ago
    What I understand from RMS's answer is that he recognizes that the solution of using the AGPL + a CLA for allowing to sell exceptions creates an imbalance/unfair situation where only one entity can engage in the activity of selling exceptions, but ultimately he cares more about user freedom, and finds the solution of using the GPL to avoid the imbalance worse because anynody could modify the SaaS code without redistributing it, which means that the users freedoms are not respected. Basically, the GPL doesn't protect much the SaaS code and is somewhat similar to a permissive license in this setting. The AGPL protects the code better. RMS doesn't like the GPL for SaaS software for exactly the same reason they created the AGPL in the first place, and developer inconvenience is less of a concern than potential user freedom breach. The entity to which the exception is sold could itself close the software for its own users. But so could it if the code was released under a permissive licenses and this is, critically, why RMS finds this acceptable: he doesn't want to consider releasing software under permissive licenses unethical. This is a limit he doesn't want to cross. After all, one can't be blamed for all the sins in the world and it's the company closing the code that would be doing non-free software, not the original authors. AGPL+CLA doesn't enable more cases of users losing freedom than a permissive license, so this is okay for RMS. Now, it is a view strictly focused in terms of user freedom outcome and that's probably how anything RMS says should be interpreted by default. Nothing prevents you from considering that there are other aspects to consider and that the imbalance AGPL+CLA creates is unacceptable. On a side note, it makes me think of the Qt business model.
charcircuit 1y ago
[flagged]
- mtndew4brkfst 1y ago
  Why does her hair color matter to you? Why is open source longevity and viability not on-topic for LWN discussion? Dr Foster holds a PhD, did her dissertation about the Linux kernel, and has had a respectably long career in technology with a focus on open source and governance. The topic is literally straight in her professional wheelhouse.
  - charcircuit 1y ago
    [flagged]
    - deleted 1y ago
      [deleted]
    - mtndew4brkfst 1y ago
      "LWN.net is a reader-supported news site dedicated to producing the best coverage from within the Linux and free software development communities." FOSS beyond Linux itself is still explicitly on-topic by the site's own self-description. But we all know what this was about anyway. Good luck to you out there.
      - charcircuit 1y ago
        Yes, it's on topic, but there is still or at least should be a focus on Linux. I am expressing feedback that I don't want to see this kind of article.
- acdha 1y ago
  Why are you trying to distract from the content of the article? I don’t know why her hair color is so triggering for you but she has a couple decades working in open source, multiple relevant degrees, is on the CNCF Contributor Strategy TAG, and is talking about some real issues affecting a lot of projects. If you can’t get over her physical appearance long enough to engage with the topic, it’s healthier to leave the thread and do something else.
villgax 1y ago
Checks notes, RIP VibeVoice Large 7B https://arxiv.org/pdf/2508.19205 https://arxiv.org/pdf/2508.19205 https://github.com/microsoft/VibeVoice https://github.com/microsoft/VibeVoice Nice to have forks & downloadable models now 'innit
z3t4 1y ago
Why do we need to maximize profits? With current technology we shouldn't need to work 8 hours per day, maybe 2-3 hours max to maintain quality of living. Instead we should work to make everyone's life easier, including your own life of course.
- sparkie 1y ago
  There's a need to make money faster than the government & central bank dilute it. Need to fix the money before everything else can be fixed.
  - greyface- 1y ago
    Individuals in the U.S. holding this thesis (which I am sympathetic to) have had the ability to opt out of using government currency for savings since 2009 (bitcoin) or 1975 (gold). Yet, the problem persists.
    - kbolino 1y ago
      Neither exempts you from taxes, which not only must be paid but specifically must be paid in fiat.
      - greyface- 1y ago
        Neither is taxed at rest; only when spent, on its appreciated (nominal) value. At worst, this is double (real) taxation, which, while still objectionable to some, is not continuously dilutive as GGP suggests.
        kbolino 1y ago
        Then it's not money and so it's not really relevant. It has little to no bearing on the money supply or the value of money. The issue is not double taxation per se, it is the inability to pay taxes at all. In order to pay the tax you incur by actually putting the gold/BTC/etc to use, you must liquidate some more of the thing to turn it into something the government will accept. That is what makes fiat real money, and everything else not.
PeterStuer 1y ago
These days you just blindsight a project's community by instating a process heavy (you want the technical people to self-opt-out) 'board of governance', then put in place a draconian Orwellian regime in the name of 'safety', revoking project access from all that do not support the coup, or worse, still dare to speak out againt you.
api 1y ago
Oh stop. When someone gives you free stuff and then changes the terms a little that isn’t a “rug pull” and it’s not “feudalism.” If you contributed a little and voluntarily signed a CLA this is also not a “rug pull.” The whole reason for these “rug pulls” is abuse of the open source ethos by big companies using it as free labor for SaaS and giving nothing back. SaaS is more like feudalism than any other software model, yet the open source community seems committed to making sure the SaaS industry can continue its free ride. Part of why I’d hesitate to ever again make free (as in beer) software is this whole toxic shitty mentality. If I give you a ton of work for free, say thank you. If a bunch of investors fund that, say thank you. This entitlement mentality from a bunch of people with careers that mostly put them in or near the global 1% is gross. It’s not like you people need stuff for free. You ain’t poor.
evantbyrne 1y ago
It's not possible to rug pull an open-source project by just switching new work to a different license. The real issue with open-source is that we don't live in a utopia where you can publish all of your work for free and still live a quality of life comparable to working at an average developer job, and yet so many non-maintainers somehow feel they are owed future labor. Maintainers come and go. Without sponsorship, the half life on maintainers is going to be relatively short, and more developers are going to be pushed to publishing less permissively.
- Imustaskforhelp 1y ago
  I agree. Its an incentives issue if I am being honest. If I ever generate software, I would also prefer to open source it but there are mechanisms where either cloud providers or anybody can take my changes and earn over them without me getting anything in return... I mean, it is technically what it means to have a foss license but I just can't shake the feeling that we as a society are feeling so entitled that people are advocating against sspl licenses or etc. when I do think that if you are a dev and you wish to work on foss full time then something like sspl might be good in that regards. Open source Contributors just don't get paid for the work they are doing. They are sadly doing free labour. I feel like I personally might start coding stuff in sspl or maybe just source available licenses if they get more favourable. The whole terminology behind source available licenses is kinda weird in the sense that basically a single clause which is meant to stop big cloud providers from selling your service that you built can make something like agpl foss and sspl not foss/source available.
  - evantbyrne 1y ago
    You've touched on some interesting points here. I have also felt the entitlement, but while contemplating why it exists I came to the conclusion that it is due to a misplaced belief that open-source primarily benefits the individual and as such is a righteous crusade. While individuals may become beneficiaries in particular use-cases, I would argue that it is actually corporations that benefit the most, and not by a small margin. Just think of all that labor they get away with not having to pay for and all that specialized knowledge they don't have hire for. Then they also benefit from publishing libraries to end users so that their platforms may be more deeply integrated in customer's tech stacks. Meanwhile the guy maintaining the various open-source libraries that underpin those commercial services doesn't get anything at all. One might even be able to claim that open-source is predominantly an upwards transfer of wealth from engineers to executives.
skybrian 1y ago
For nearly all open source projects, we are free riders. We use them and don’t contribute anything back. Open source is not about fair exchange; it’s about gift-giving and copying other people’s homework. If you choose to give gifts to the world, that’s great, but you should go into it with your eyes open and not expect anything back. The world includes a lot of terrible people and you’re giving them gifts too. It’s okay to change your mind. Calling it a “rug pull” when a software vendor relicenses seems like biased language. We still have all the gifts they gave us. It’s unfortunate that they changed direction, but nothing lasts forever.
- jzb 1y ago
  “We use them and don’t contribute anything back.” This is not, strictly speaking, true. The example projects saw contribution in terms of code, testing, documentation, and - most importantly - marketing and evangelism. These projects are not things put up on GitHub as a convenience that people just happened to adopt: the companies in question spent great sums of money encouraging adoption, usually with developer evangelists on staff who’d preach the technical advantages and talk about benefits of the licensing to convince people to use them. It’s naive at best to position that as simple “gift culture” and claim it’s biased to call it what it really is: a rug pull. In the case of Redis the company promised explicitly it would always keep the license for Redis core: until it didn’t. That’s a rug pull, plain and simple. Accepting code and other contributions, encouraging other FOSS projects to rely on a project and then relicensing? Rug pull. Show me a project that was not aggressively marketed for adoption using open source as a selling point and I’ll agree that’s not a rug pull. If Acme Corp just happened to have a GitHub repo for something under a FOSS license and people organically found and adopted it, okay. I’m not aware of any such examples, though.
  - skybrian 1y ago
    "We didn't contribute anything" is mostly true for most of us. For people who do work on open source projects, it's still true for all the projects you don't work on, which far outnumber the ones where you do.
- pabs3 1y ago
cycomanic 1y ago
>Elasticsearch contributors were Elastic employees; that, unsurprisingly, did not change afterward. OpenSearch started with no strong contributor base, so had to build its community from scratch. As a result, the project has been dominated by Amazon contributors ever since So in a way the "rug pull" achieved what it wanted, amazon is now contributing to development. I think discussing these "rug pulls" without discussing the destructive habit of many large companies to only profit without giving back misses the mark. Any community where there is a large imbalance between the ones doing the work and the ones profiting will over the long run become unstable.
- preisschild 1y ago
  There are copyleft licenses like AGPL/GPL that basically require them to contribute back, without going to a proprietary license.
  - pabs3 1y ago
    AGPL/GPL require people to contribute forward to users, not back to maintainers. They also don't require any monetary compensation, which is what companies like Elastic are mainly after, not code contributions.
- thayne 1y ago
  It didn't achieve what Elastic wanted. It didn't lead to more people paying for Elastic licenses, it lead to users switching from Elasticsearch to a fork. And they eventually backpedaled and relicensed again under the AGPL. Now, it might be better for the Open/elasticsearch ecosystem, because AWS is contributing more, and possibly the competition drives both Opensearch and Elasticsearch to be better. But on the other hand, there is now a split between two incompatible products, and Elastic has certainly lost some trust.
  - dwood_dev 1y ago
    Elastic might be fine in the long run. But everyone I know(sample size <20 orgs) migrated to OpenSearch and never looked back. They were never interested in running Elastic in a separate cloud or running it themselves, and that's what a lot of these DbaaS providers have to overcome. It's already annoying to create your first terraform module for a new AWS managed service, but they then want the users to have the extra complexity of VPC peering/privatelink/vpn and then manage that lifecycle as well.
Arcuru 1y ago
I understand why users get annoyed at "rugpulls", but if a company that is doing the vast majority of the work to develop and maintain a project is not financially sustainable they don't have that many options. An article like this really needs to include info about the financials. I'm honestly curious since I've been considering how I license my large OSS projects lately [1], and I really do want to understand what would be "acceptable" here. Start more funding campaigns for the project? Work on it less? Sell merch? Openly communicate that they'll need to re-license without additional funding? [1] - https://jackson.dev/post/oss-licensing-sucks/ https://jackson.dev/post/oss-licensing-sucks/
- Arnavion 1y ago
  The hate comes from the company offering it under an OSS license and then taking it away. If they had started with a non-OSS license users wouldn't feel betrayed. Of course then they may not have had as many users, which is why they tried to be OSS to start with.
  - zem 1y ago
    I was fascinated by the reference to mimir forking into an SSPL version. that seems like the right way to do things.
- thayne 1y ago
  AFAIK, Mongo, Elastic, Redis, and Hashicorp were all doing fairly well financially when they did their "rug pulls". They maybe weren't doing as well as they wanted to, but they weren't on the verge of collapse either. In the case of Hashicorp, it was probably a strategy to sweeten the acquisition by IBM.
thayne 1y ago
I feel like the SSPL is almost a good open source license. I think there is a place for something a little stronger than the AGPL that is copyleft on necessary components even if they aren't directly linked. But it has a couple of major failings: 1. It's too vague about what is covered by it. This makes using such software risky in practice. Is the OS it runs on included? What about a log aggregator used to collect logs? Or a system backup system? The VM hypervisor and orchestration software for running the VMs that host it? I think it would be better if it was more clearly scoped to components that are specifically related to the service itself and not general purpose components of the hosting environment and/or things that could easily be substituted with other standard open source or off the shelf components. 2. It isn't compatible with AGPL or GPL. This is especially bad combined with 1. Does that mean you can't run the service on Linux? I don't think it could be compatible with AGPL code directly linked to it, but it could allow external components to be under most open source licenses. IANAL, and don't know exactly how to word a license that fixed those issues, but I think there could be something better than the SSPL, and maybe such a license has a better chance of getting OSI approval.
bawolff 1y ago
> But a fork is not a simple matter; it is a lot of work, and will fail without people and resources behind it Well yes. There is no free lunch. Open source only works if enough people are willing to give back. If your fork dies, that probably means the project had a lot of free riders. The main issue i have with rug pulls is its essentially false advertising. They grew their customer base by promising open source and reneged when it was no longer convinent. This feels morally gross to me. However i don't know that i actually am worried about the no longer making contributions aspect. Nobody is obliged to continue working on something forever. Its a totally normal thing for individuals to retire from a project, its fine for companies to stop too.
l___l 1y ago
On a side note, if you had a quality OS like Linux with access to the source code but had to pay a small amount to get it, would you not pay?

276 points by pabs3 1y ago

roenxi 1y ago

[flagged]

delusional 1y ago
You worldview is incredibly foreign to me, but I'll try to engage fairly with it. > the US right wing looked like it was about to build a complete alternative internet for a while there This would seem to imply that the established internet, what we had before this relenting, was somehow left wing. Is that an accurate description of your view? When did this relenting take place? > they just partially marginalised when the censorship backed off. Is it your position that Truth Social (the social network started by the current president of the united states) is currently a marginalized space? > That isn't how feudal revolts work in my understanding; typically peasants just got squished by better armed, armoured and organised soldier classes. I think it's interesting that you posit this as a fight between the "peasants" and the "soliders". I'm assuming, to make sense of your analogy, that the "peasants" in this case is the current president of the united states and Elon Musk. the "soliders" would then be "Jeff Bezos" and "Sundar Pichai"
- palmfacehn 1y ago
  >This would seem to imply that the established internet, what we had before this relenting, was somehow left wing. I would omit the left-wing characterization as a debatable generalization. Perhaps it would be better described as the specific platforms being opposition partisans, rather than the Internet itself.
  - delusional 1y ago
    > Perhaps it would be better described as the specific platforms being opposition partisans I'm sympathetic to such an argument, but it does beg the question: Which platforms? The original comments choices of singling out Rumble and Truth Social, would imply that YouTube and Twitter would at least be _among_ those "specific platforms" but neither of those platforms are, at least according to the left, particularly left wing. Both platform have repeatedly been criticized for creating and propagating structures that lead people down what was called "the alt-right pipeline" and has, historically, hosted some of the most active alt-right figureheads. That's not to say either platform is or was right-wing either. I'm not the one making an argument. Though I'm not convinced they were particularly left-wing or partisan before the creation of Rumble and Truth Social.
    - roenxi 1y ago
      Just to be clear, I never said anything about the left wing. I don't think they were involved in that one. Suppressing speech is generally opposed by the leftists.
      - gg82 1y ago
        Just compare X and Blue Sky. There may be some principled leftists who oppose suppressing speech, but in recent times, it has been the left that has been censoring/blocking peoples speech. Another comparison is what is actually censored. Of course there is a certain amount that would be censored by both sides - criticism of power.
- roenxi 1y ago
  > This would seem to imply that the established internet, what we had before this relenting, was somehow left wing. Is that an accurate description of your view? When did this relenting take place? No, the left wing wasn't really involved. It looked from the outside like a pocket of authoritarians settled in the US intelligence services. Given the priorities of the Trump establishment on starting Term 2 when they moved very quickly to gut the US propaganda services I think Trump's people came to a similar view. And the relenting came when it was obvious that the companies involved were going to start suffering commercial consequences. Or, in cases like Twitter, got bought out by prominent right-wing figures. > Is it your position that Truth Social (the social network started by the current president of the united states) is currently a marginalized space? Yeah. It isn't really operating on the same scale as Twitter and it only exists because Twitter felt the obvious way to construe "To all of those who have asked, I will not be going to the Inauguration on January 20th." was as glorification of violence [0]. It's commercial wisdom is unclear. > I think it's interesting that you posit this as a fight between the "peasants" and the "soliders". I'm almost positing the opposite, NOT(it is a fight between peasants and soldiers). That is why I think the feudal meme is a mistake - this isn't a situation where the powers that be in the tech world can actually bring consequences down on a class of people. The people have freedom. [0] It was bizarre. I've kept a copy of Titter's announcement saved to disk as a reminder of how crazy groupthink can get. Anyone willing to state such a stupid theory in public has to believe it.
  - conartist6 1y ago
    I have 0 trouble understanding why Twitter didn't want to be whipping up fury against democracy using their power to do so. Six days before that ban Trump had definitively crossed the line over to full-blown treason with the Reffensperger call. Two days before the ban he sat quietly, waiting and hoping a mob of his supporters whipped up by his verbal diarrhea would sieze power for him, ending democracy. Make no mistake, Twitter did exactly what they had every legal and moral obligation to do.
    - hedora 1y ago
      I’ll just add that the quote in the comment you replied to was one of the least offensive things Trump said during that incident (if he even tweeted that). The news ran a video of him inciting a riot, etc, etc.
BinaryIgor 1y ago
Exactly; there are many mechanism in-place that allow us (anybody) to create alternatives if the currently dominant players start to misbehave too much; they just have not
- throwawayqqq11 1y ago
  And there are mechanism that restrict you. The article states it too: There is a resource (for software, id add knowhow) asymmetry and market innertia at play here. Otherwise, im am really wishing for alternative payment processors ... could someone proove me wrong here please.
  - BinaryIgor 1y ago
    BTC ecosystem is growing strong :) Especially the Lightning Network
rixed 1y ago
> they're only sticky as long as they do a good job > Groups like AWS or Google are actually pretty vulnerable (...) build a complete alternative internet for a while there until the management in tech relented and allowed them to speak up in public The part of AWS or Google infrastructure necessary to "speak up in public", relative to their total infrastructure, is probably close to the tiniest number you can imagine. I can't see how an alternative web forum or short text message service, even if used and supported by many, could make AWS or Google vulnerable. And as a reminder, the public is not a customer for Google nor AWS. Or maybe by "the US right wing" you meant a handful of billionaires who would fund an alternative to Google and AWS? That still sounds naive to me. The estimated assets of Google or AWS in datacenters only is somewhere in the hundredth of billions, plus a good fraction of that every year for maintenance. Their current valuation is between $2 and $3 trillion. Having no exeprience about peasants revolts (yet ;)) I only meant to comment on that part of your message.

3np 1y ago

Building the software you rely on from source by default is one way to reduce the impact these events have on you and shift the power dynamic. If you're installing binaries/images from a vendor (free or otherwise), transitioning to a fork may be an undertaking and a sweaty risk-assessment. Switching your existing build-infra to sync sources from a new remote should be a snap. Also no major need to hound maintainers to ship a release or merge that neglected bugfix or feature you desperately need - just cherry-pick it.

andersmurphy 1y ago
Not sure why this is getting down votes but I agree. Also building from source doesn't have to be hard (see sqlite).
- 3np 1y ago
  > Not sure why this is getting down votes Guessing unrelated to the comment itself, prolly got a minor downvote army on my back after a different recent comment on Gaza matters. Downvotes are just a noisy signal in general and I wouldn't read that much into a few here and there, it comes with the territory. Oh and yeah, this meta makes for tedious threads so site guidelines and all that.
pjmlp 1y ago
Depends on the actual software licence, many commercial vendors do provide source code, however the licence doesn't allow you to do whatever you feel like with code, even if technically it is possible to do so. This happens a lot in commercial products where scripting languages are used, for example. Or enterprise consulting as another example, where the code is delivered as part of the project, but it is bound to the agency for compiling purposes, unless the customer pays extra for that right.
- anilgulecha 1y ago
  IMO if you're a technical decision maker, you should ignore fair source/business source stuff with extreme prejudice. These are fundamentally incompatible with the goal of having autonomy for your systems. Only pick these if they're non-critical, have a significantly higher RoI, or a high commodity item.

positron26 1y ago

[flagged]

OgsyedIE 1y ago

I believe there should be a broader family of terms besides rug pull for when the intentions of vendors and developers change over time to become extractive and negative. No, enshittification is not the right word.

01HNNWZ0MV43FF 1y ago
"bait and switch" The FOSS license is the bait, and the CLA is evidence that they had ill intent from the start
- sparkie 1y ago
  It's not ill intent. The CLA clearly states what the intent is. It says "You give the company permission to relicense your work". The intent is there from the beginning - they want to be able to monetize the work. If you dislike such intent, then you wouldn't sign the CLA. The concern is if they stop dual-licensing, and future releases don't come under a free license, but they only work on their proprietary relicensed version. You have the option to fork, under the same free license that it was originally under - you just won't get further updates from the company involved. I don't see the problem here: You aren't entitled to those updates just because you made some contributions.

evrennetwork 1y ago

[flagged]

palata 1y ago

> There is typically a spike in these clones after a relicensing event, suggesting that people are considering creating a hard fork of the project That, or maybe people make a "snapshot" just in case. I don't believe many people seriously consider leading the effort of maintaining a fork...

jenadine 1y ago
Or just the fact that the project is making the news means more people visit the GitHub page.

palata 1y ago

> Projects with CLAs more commonly are subject to rug pulls; projects using a developers certificate of origin do not have the same power imbalance and are less likely to be rug pulled. Would be worth explaining why: my understanding is that if you sign a CLA, you typically give a right to relicence to the beneficiary of the CLA. So you say "it is a GPL project, my contribution is GPL, but I allow you to relicence my contribution as you see fit". If the project uses a permissive licence already, honestly I don't really see a big impact with signing a CLA: anyone can just take the codebase and go proprietary with it. However, if it is a copyleft licence, then signing a CLA means that the beneficiary of the CLA doesn't play by the same rules and can go proprietary with the contributions! If you don't want a rug pull, you should use a copyleft licence and not sign a CLA: nobody can make Linux proprietary because the copyright is shared between so many people. If you use a permissive licence, then a rug pull is part of the deal.

goodpoint 1y ago
> If you use a permissive licence, then a rug pull is part of the deal. True. Yet CLAs do not always give away all rights.
charcircuit 1y ago
There is no such thing as a rug pull in regards to open source. A GPL copy of your code will exist forever.
- zozbot234 1y ago
  Yes, it's a pretty weird notion. The only "rug pull" is wrt. ongoing maintenance of the project, but any maintainer may end up abandoning their own project for any reason or no reason at all. This is why essentially all FLOSS licenses have long provided for the right to fork the existing codebase under a new maintainership.
  - Spooky23 1y ago
    Unless you can sustain a fork, it is a rug pull if you’ve incorporated the software in other projects. Imagine if a non-trivial critical project like OpenSSL had this happen. Shitty behavior like this is more common with software both OSS and commercial than in the past. Treat any meaningful software engagement like a celebrity marriage.

tetha 1y ago

This is causing management at the current company to run in circles a bit as well. The company has been fairly adamant about having support contracts for systems, and it has encountered a number of these stunts. Opscode with chef a long time ago, CentOS exit, VMWare, Broadcom has a number of more ugly things available in Tanzu. And we were either paying these companies (looking at VMWare), or looked for quotes and intending to pay these companies. But suddenly, your configuration management is supposed to cost almost 6 digits per year. Very basic services should suddenly cost a mid-6-digit range per year for a basic suport contract. Sorry but what the fuck? And - again, looking at VMWare - even then we can't really rely on it? I've been recommending to instead sponsor foundations, or straight up paying maintainers and developers of OSS we use regularly. The giggles when suggesting that have been getting quieter. But I'd rather hire a Proxmox/qemu dev than start paying the next VMWare.

rzr 1y ago
Isn't it paradoxal, that those mentioned companies had set up an OSPO (to do OSS the right/community way... with the right/community minded people) I believe this kind of schizophrenia is the price to pay of (too) big organizations.
pabs3 1y ago
You have the right idea; audit all the software you run, including dependencies, and make sure that they are all viable, by contributing back with dev hours and funding, and advocate that other related companies do the same.

dig1 1y ago

> Contributors and maintainers often have less power than even the smaller companies, and users have less power yet. If contributors/maintainers are not happy with what the small company does, they can fork the project (assuming a liberal license) and continue in their own way. Valkey is a good example (with an interesting twist of license dynamics where Redis can use Valkey code now, but not the other way around). > We have built a world where it is often easiest to just use whatever a cloud provider offers And, IMHO, this is the major problem in the dev community these days - we've become lazy and focused on nonsense ("pretty"/unusable UIs, web gymnastics, llm, "productivity" etc.). We didn't have problems in the past to fork or reimplement OSes (various BSD instances), compilers (gcc versions), databases (MariaDB), and so on. There are tons of geniuses around hacking on cool stuff, but, sadly, the loudness of various hipsters and evangelists limits their visibility. > Those providers may not contribute back to the projects they turn into services, though, upsetting the smaller companies that are, The significant contribution that these providers (AWS, et al.) make to these projects is often overlooked - free advertisement. If I can remember correctly, ElasticSearch got popular when AWS started to offer it as a service. Additionally, cloud providers usually contribute (by employing core developers, shipping patches or testing) to the kernel, gcc or jdk, from which these small companies benefit significantly. In contrast, they themselves could do none of this. But it is easier to blame "big scary clouds" than to rethink your business model. Be honest, start closed; no one will touch that and no one will be standing in your way.

throwaway832338 1y ago

A lot of words without any mention of copyleft, protective licenses, GPL. Difficult to take the article seriously.

matheusmoreira 1y ago

I emailed Stallman about the ethics of using AGPLv3 with a CLA to allow selling exceptions. Here's his reply: https://news.ycombinator.com/item?id=42601846 https://news.ycombinator.com/item?id=42601846 I see what you mean. The original developer can engage in a practice that blocks coopertation. By contrast, using some other license, such as the ordinary GPL, would permitt ANY user of the program to engage in that practice. In a perverse sense that could seem more fair, but I think it is also more harmful. On balance, using the AGPL is better.

jenadine 1y ago
I'm confused. His answer doesn't seem to be about the CLA.
- jraph 1y ago
  What I understand from RMS's answer is that he recognizes that the solution of using the AGPL + a CLA for allowing to sell exceptions creates an imbalance/unfair situation where only one entity can engage in the activity of selling exceptions, but ultimately he cares more about user freedom, and finds the solution of using the GPL to avoid the imbalance worse because anynody could modify the SaaS code without redistributing it, which means that the users freedoms are not respected. Basically, the GPL doesn't protect much the SaaS code and is somewhat similar to a permissive license in this setting. The AGPL protects the code better. RMS doesn't like the GPL for SaaS software for exactly the same reason they created the AGPL in the first place, and developer inconvenience is less of a concern than potential user freedom breach. The entity to which the exception is sold could itself close the software for its own users. But so could it if the code was released under a permissive licenses and this is, critically, why RMS finds this acceptable: he doesn't want to consider releasing software under permissive licenses unethical. This is a limit he doesn't want to cross. After all, one can't be blamed for all the sins in the world and it's the company closing the code that would be doing non-free software, not the original authors. AGPL+CLA doesn't enable more cases of users losing freedom than a permissive license, so this is okay for RMS. Now, it is a view strictly focused in terms of user freedom outcome and that's probably how anything RMS says should be interpreted by default. Nothing prevents you from considering that there are other aspects to consider and that the imbalance AGPL+CLA creates is unacceptable. On a side note, it makes me think of the Qt business model.

charcircuit 1y ago

[flagged]

mtndew4brkfst 1y ago
Why does her hair color matter to you? Why is open source longevity and viability not on-topic for LWN discussion? Dr Foster holds a PhD, did her dissertation about the Linux kernel, and has had a respectably long career in technology with a focus on open source and governance. The topic is literally straight in her professional wheelhouse.
- charcircuit 1y ago
  [flagged]
  - deleted 1y ago
    [deleted]
  - mtndew4brkfst 1y ago
    "LWN.net is a reader-supported news site dedicated to producing the best coverage from within the Linux and free software development communities." FOSS beyond Linux itself is still explicitly on-topic by the site's own self-description. But we all know what this was about anyway. Good luck to you out there.
    - charcircuit 1y ago
      Yes, it's on topic, but there is still or at least should be a focus on Linux. I am expressing feedback that I don't want to see this kind of article.
acdha 1y ago
Why are you trying to distract from the content of the article? I don’t know why her hair color is so triggering for you but she has a couple decades working in open source, multiple relevant degrees, is on the CNCF Contributor Strategy TAG, and is talking about some real issues affecting a lot of projects. If you can’t get over her physical appearance long enough to engage with the topic, it’s healthier to leave the thread and do something else.

villgax 1y ago

Checks notes, RIP VibeVoice Large 7B https://arxiv.org/pdf/2508.19205 https://arxiv.org/pdf/2508.19205 https://github.com/microsoft/VibeVoice https://github.com/microsoft/VibeVoice Nice to have forks & downloadable models now 'innit

z3t4 1y ago

Why do we need to maximize profits? With current technology we shouldn't need to work 8 hours per day, maybe 2-3 hours max to maintain quality of living. Instead we should work to make everyone's life easier, including your own life of course.

sparkie 1y ago
There's a need to make money faster than the government & central bank dilute it. Need to fix the money before everything else can be fixed.
- greyface- 1y ago
  Individuals in the U.S. holding this thesis (which I am sympathetic to) have had the ability to opt out of using government currency for savings since 2009 (bitcoin) or 1975 (gold). Yet, the problem persists.
  - kbolino 1y ago
    Neither exempts you from taxes, which not only must be paid but specifically must be paid in fiat.
    - greyface- 1y ago
      Neither is taxed at rest; only when spent, on its appreciated (nominal) value. At worst, this is double (real) taxation, which, while still objectionable to some, is not continuously dilutive as GGP suggests.
      - kbolino 1y ago
        Then it's not money and so it's not really relevant. It has little to no bearing on the money supply or the value of money. The issue is not double taxation per se, it is the inability to pay taxes at all. In order to pay the tax you incur by actually putting the gold/BTC/etc to use, you must liquidate some more of the thing to turn it into something the government will accept. That is what makes fiat real money, and everything else not.

PeterStuer 1y ago

These days you just blindsight a project's community by instating a process heavy (you want the technical people to self-opt-out) 'board of governance', then put in place a draconian Orwellian regime in the name of 'safety', revoking project access from all that do not support the coup, or worse, still dare to speak out againt you.

api 1y ago

Oh stop. When someone gives you free stuff and then changes the terms a little that isn’t a “rug pull” and it’s not “feudalism.” If you contributed a little and voluntarily signed a CLA this is also not a “rug pull.” The whole reason for these “rug pulls” is abuse of the open source ethos by big companies using it as free labor for SaaS and giving nothing back. SaaS is more like feudalism than any other software model, yet the open source community seems committed to making sure the SaaS industry can continue its free ride. Part of why I’d hesitate to ever again make free (as in beer) software is this whole toxic shitty mentality. If I give you a ton of work for free, say thank you. If a bunch of investors fund that, say thank you. This entitlement mentality from a bunch of people with careers that mostly put them in or near the global 1% is gross. It’s not like you people need stuff for free. You ain’t poor.

evantbyrne 1y ago

It's not possible to rug pull an open-source project by just switching new work to a different license. The real issue with open-source is that we don't live in a utopia where you can publish all of your work for free and still live a quality of life comparable to working at an average developer job, and yet so many non-maintainers somehow feel they are owed future labor. Maintainers come and go. Without sponsorship, the half life on maintainers is going to be relatively short, and more developers are going to be pushed to publishing less permissively.

Imustaskforhelp 1y ago
I agree. Its an incentives issue if I am being honest. If I ever generate software, I would also prefer to open source it but there are mechanisms where either cloud providers or anybody can take my changes and earn over them without me getting anything in return... I mean, it is technically what it means to have a foss license but I just can't shake the feeling that we as a society are feeling so entitled that people are advocating against sspl licenses or etc. when I do think that if you are a dev and you wish to work on foss full time then something like sspl might be good in that regards. Open source Contributors just don't get paid for the work they are doing. They are sadly doing free labour. I feel like I personally might start coding stuff in sspl or maybe just source available licenses if they get more favourable. The whole terminology behind source available licenses is kinda weird in the sense that basically a single clause which is meant to stop big cloud providers from selling your service that you built can make something like agpl foss and sspl not foss/source available.
- evantbyrne 1y ago
  You've touched on some interesting points here. I have also felt the entitlement, but while contemplating why it exists I came to the conclusion that it is due to a misplaced belief that open-source primarily benefits the individual and as such is a righteous crusade. While individuals may become beneficiaries in particular use-cases, I would argue that it is actually corporations that benefit the most, and not by a small margin. Just think of all that labor they get away with not having to pay for and all that specialized knowledge they don't have hire for. Then they also benefit from publishing libraries to end users so that their platforms may be more deeply integrated in customer's tech stacks. Meanwhile the guy maintaining the various open-source libraries that underpin those commercial services doesn't get anything at all. One might even be able to claim that open-source is predominantly an upwards transfer of wealth from engineers to executives.

skybrian 1y ago

For nearly all open source projects, we are free riders. We use them and don’t contribute anything back. Open source is not about fair exchange; it’s about gift-giving and copying other people’s homework. If you choose to give gifts to the world, that’s great, but you should go into it with your eyes open and not expect anything back. The world includes a lot of terrible people and you’re giving them gifts too. It’s okay to change your mind. Calling it a “rug pull” when a software vendor relicenses seems like biased language. We still have all the gifts they gave us. It’s unfortunate that they changed direction, but nothing lasts forever.

jzb 1y ago
“We use them and don’t contribute anything back.” This is not, strictly speaking, true. The example projects saw contribution in terms of code, testing, documentation, and - most importantly - marketing and evangelism. These projects are not things put up on GitHub as a convenience that people just happened to adopt: the companies in question spent great sums of money encouraging adoption, usually with developer evangelists on staff who’d preach the technical advantages and talk about benefits of the licensing to convince people to use them. It’s naive at best to position that as simple “gift culture” and claim it’s biased to call it what it really is: a rug pull. In the case of Redis the company promised explicitly it would always keep the license for Redis core: until it didn’t. That’s a rug pull, plain and simple. Accepting code and other contributions, encouraging other FOSS projects to rely on a project and then relicensing? Rug pull. Show me a project that was not aggressively marketed for adoption using open source as a selling point and I’ll agree that’s not a rug pull. If Acme Corp just happened to have a GitHub repo for something under a FOSS license and people organically found and adopted it, okay. I’m not aware of any such examples, though.
- skybrian 1y ago
  "We didn't contribute anything" is mostly true for most of us. For people who do work on open source projects, it's still true for all the projects you don't work on, which far outnumber the ones where you do.
pabs3 1y ago

cycomanic 1y ago

>Elasticsearch contributors were Elastic employees; that, unsurprisingly, did not change afterward. OpenSearch started with no strong contributor base, so had to build its community from scratch. As a result, the project has been dominated by Amazon contributors ever since So in a way the "rug pull" achieved what it wanted, amazon is now contributing to development. I think discussing these "rug pulls" without discussing the destructive habit of many large companies to only profit without giving back misses the mark. Any community where there is a large imbalance between the ones doing the work and the ones profiting will over the long run become unstable.

preisschild 1y ago
There are copyleft licenses like AGPL/GPL that basically require them to contribute back, without going to a proprietary license.
- pabs3 1y ago
  AGPL/GPL require people to contribute forward to users, not back to maintainers. They also don't require any monetary compensation, which is what companies like Elastic are mainly after, not code contributions.
thayne 1y ago
It didn't achieve what Elastic wanted. It didn't lead to more people paying for Elastic licenses, it lead to users switching from Elasticsearch to a fork. And they eventually backpedaled and relicensed again under the AGPL. Now, it might be better for the Open/elasticsearch ecosystem, because AWS is contributing more, and possibly the competition drives both Opensearch and Elasticsearch to be better. But on the other hand, there is now a split between two incompatible products, and Elastic has certainly lost some trust.
- dwood_dev 1y ago
  Elastic might be fine in the long run. But everyone I know(sample size <20 orgs) migrated to OpenSearch and never looked back. They were never interested in running Elastic in a separate cloud or running it themselves, and that's what a lot of these DbaaS providers have to overcome. It's already annoying to create your first terraform module for a new AWS managed service, but they then want the users to have the extra complexity of VPC peering/privatelink/vpn and then manage that lifecycle as well.

Arcuru 1y ago

I understand why users get annoyed at "rugpulls", but if a company that is doing the vast majority of the work to develop and maintain a project is not financially sustainable they don't have that many options. An article like this really needs to include info about the financials. I'm honestly curious since I've been considering how I license my large OSS projects lately [1], and I really do want to understand what would be "acceptable" here. Start more funding campaigns for the project? Work on it less? Sell merch? Openly communicate that they'll need to re-license without additional funding? [1] - https://jackson.dev/post/oss-licensing-sucks/ https://jackson.dev/post/oss-licensing-sucks/

Arnavion 1y ago
The hate comes from the company offering it under an OSS license and then taking it away. If they had started with a non-OSS license users wouldn't feel betrayed. Of course then they may not have had as many users, which is why they tried to be OSS to start with.
- zem 1y ago
  I was fascinated by the reference to mimir forking into an SSPL version. that seems like the right way to do things.
thayne 1y ago
AFAIK, Mongo, Elastic, Redis, and Hashicorp were all doing fairly well financially when they did their "rug pulls". They maybe weren't doing as well as they wanted to, but they weren't on the verge of collapse either. In the case of Hashicorp, it was probably a strategy to sweeten the acquisition by IBM.

thayne 1y ago

I feel like the SSPL is almost a good open source license. I think there is a place for something a little stronger than the AGPL that is copyleft on necessary components even if they aren't directly linked. But it has a couple of major failings: 1. It's too vague about what is covered by it. This makes using such software risky in practice. Is the OS it runs on included? What about a log aggregator used to collect logs? Or a system backup system? The VM hypervisor and orchestration software for running the VMs that host it? I think it would be better if it was more clearly scoped to components that are specifically related to the service itself and not general purpose components of the hosting environment and/or things that could easily be substituted with other standard open source or off the shelf components. 2. It isn't compatible with AGPL or GPL. This is especially bad combined with 1. Does that mean you can't run the service on Linux? I don't think it could be compatible with AGPL code directly linked to it, but it could allow external components to be under most open source licenses. IANAL, and don't know exactly how to word a license that fixed those issues, but I think there could be something better than the SSPL, and maybe such a license has a better chance of getting OSI approval.

bawolff 1y ago

> But a fork is not a simple matter; it is a lot of work, and will fail without people and resources behind it Well yes. There is no free lunch. Open source only works if enough people are willing to give back. If your fork dies, that probably means the project had a lot of free riders. The main issue i have with rug pulls is its essentially false advertising. They grew their customer base by promising open source and reneged when it was no longer convinent. This feels morally gross to me. However i don't know that i actually am worried about the no longer making contributions aspect. Nobody is obliged to continue working on something forever. Its a totally normal thing for individuals to retire from a project, its fine for companies to stop too.

l___l 1y ago

On a side note, if you had a quality OS like Linux with access to the source code but had to pay a small amount to get it, would you not pay?