Hacker News Reader

Comment by yed | Hacker News Reader

Looking at your license, it looks like it limits production use to "internal business purposes" and does not allow providing "access to the Licensed Work to a third party." To me that reads that this is not at all usable as open source for a production SaaS app serving external customers, only for internal intranet apps. I don't think it's appropriate to advertise this as "Open-source" with such a restrictive license.

View on HN

So the intent of the license is to prevent copy-cats from using Osso's source to run a competing business. We certainly intend for you to be able to authenticate external customers in a SAAS app. IANAL but the license text hsa been vetted by an attorney.

Is our intent with the license enough for you to consider it appropriate for us to call this open source?

Absolutely not, contract law cares most about what is written in the actual contract, not what you say you intended by it. There is no way I can risk using this in a commercial SaaS app given the license as written. In comparison, Sentry's BSL license (which you mentioned in another comment) does not have the same flaw. I can use open source Sentry to monitor my commercial SaaS app no problem based on how their license is written.

I didn't mean for you to take my comment as a guarantee, but if you're more than curious I'd have your counsel read the license, as we are under the impression the use you describe is well within the rights granted by the current license. Put another way, do you consider Sentry "open source"?

Armin from Sentry here: obviously biased but the term I like the most to describe BSL as used by Sentry is: eventually Open Source.

The BSL upgrades automatically to Apache 2, so the only thing that it does is establishing a time window where there are some restrictions on the code.

A theoretical version is one where you just only release code with a large delay under the Apache 2 license and keep the rest closed source. That's also still technically open source but I would argue that's not a particular good version.

So if understood correctly, sentry entire source code is open source and can be used to monitor my backend/saas etc.

It is only a business cant build a competing service using it ?

Basically.

> Basically (can't reply to your other reply)

That is so good. How are the contributions managed from community ? is there a CLA that they need to agree. Couldn't find that in repo.

They aren't in our case. Open Source doesn't have to mean community built, and Sentry (the product) is built almost exclusively by our company. Our philosophy is something along the lines of: Pull Requests are nice, but we'd rather you just give us open feedback and support the project in other ways.

We do accept PRs, and do have a large contributor community, but its primarily things like SDKs or documentation. The core product is complex enough that making a significant change - even if its one we agree with - is a hurdle.

> How are the contributions managed from community?

Depends. Many places where the community contributes are just flat out open source licenses. For instance all our SDKs or certain backend services like our symbolicator service.

We don't have a lot of contributions going to the BSL licensed content for this to be much of a concern at the moment.

Thank you both (Zeeg and Armin).

How does fork changes work ? do they have to open source it as well.

And is the license same as MariaDB license too ?

I don't want to get into a philosophical debate about what is "open source," but I have no issues with how Sentry advertises and documents their licensing or in how their custom terms are actually written.

Fair enough. I stand by our interpretation of the current license though - the usage you describe is fair use, but let us know if your attorney disagrees as we'd definitely want to fix that.

I think you dont know what the term fair use means.

Commercial use of a copyrighted work in a way that directly competes with the purpose the work is being sold for is almost certainly not fair use. Hell its almost the definition of what something not covered by fair use would be.

IANAL

Perhaps. Let's use plain English as neither of us are lawyers.

Allowed:

Deploy your own Osso instance and use it in applications you own and operate.

Not allowed:

You use Osso to start a business where your primary business is in helping other companies implement SAML SSO in the applications they own.

If that's not what our license says then we will change the license text.

Reply on news.ycombinator.com