Moving Apollo Federation 2 to the Elastic License v2 | Hacker News Reader

Moving Apollo Federation 2 to the Elastic License v2

apollographql.com

57 pointscjcenizal67 comments

This means this project is abandoning open source and free software, as the Elastic License is not an open source license.

> The Apollo developer community is at the heart of everything we do. As stewards of our community, we have a responsibility to prevent harm from anyone who intends to exploit our work without contributing back. We want to continue serving you by funding the development of important open-source graph technology for years to come. To honor that commitment, we’re moving Apollo Federation 2 to the Elastic License v2 (ELv2).

One of these things can't be true.

It's really disheartening to see fake-open-source projects like this tout "the community" without realizing that taking software freedoms away (which is what this not-open-source license does) is ultimately an antisocial move. Being able to run a business off of a private fork of the software you gave away is not a bug, it's a feature. It's not exploiting anyone.

There are lot of fake open source people and companies around now. Docker Desktop, for example, isn't even source available.

Similarly, I personally view the AGPL as a nonfree license, although it's being pushed by anticapitalist zealots at the FSF who of course invented the notion of software freedom in the first place so my classification is, of course, controversial.

As I understand it, it was never about developer's freedom at all. FSF puts user's freedom first and foremost. From that point of view, AGPL makes a lot of sense (even if in practice it is almost exclusively used as a poison pill to sell proprietary licenses).

I believe that is right, AGPL is great for users.

AGPL is a license, a contract between developers of software and users of that software. It gives certain rights to both parties.

I think it is often implied that AGPL is somehow more "ethical" than other software licenses. I don't know why some people may think so and would like to hear the main arguments behind that. Is all copyright evil as well?

The AGPL requires contributing back more code which can be interpreted as providing more benefits to users.

Plenty of software freedom advocates do believe that copyright is evil and copyleft is essentially using copyright against itself as a temporary stopgap until copyright can be abolished completely.

If you take any two software licenses they probably differ in some detail about what benefits they provide to users.

What I don't get is why it is considered more ethical to provide more benefits to the users? Wouldn't Public Domain then be the most ethical license of all?

The hardcore free software position is that proprietary software is unethical, and while permissively licensed free software (or public domain) per se is fine, they allow such software to be co-opted to produce proprietary software. And thus copyleft licenses are better as they remove that temptation.

Right proprietary software is the root of all evil, I get it, is some people's position. But what are the arguments that made them believe so, that proprietary software is unethical? How and why (do they believe) "proprietary software" is unethical?

Well, I've been around FOSS my entire career, I've read a lot of RMS's writings, contributed to GNU projects, and to be honest, I don't know. Except that RMS got really really mad for not being able to fix a printer driver. I'm not sure free software philosophy would stand up to serious scrutiny from a moral philosophy perspective.

One could argue that society as a whole would be better off if zero marginal cost things like software or poetry, or information in general, would be freely available to everyone [1]. But that raises the question how such public goods ought to be financed. In today's capitalistic society it doesn't seem like a very serious proposition. In today's world, the choice is often not between proprietary software for solving problem X vs. free software for solving problem X, but between proprietary software for solving X and no software that solves X. And I don't think society as a whole is better off by not solving problem X unless we have a FOSS solution.

[1] Even that has limits. We probably don't want detailed instructions for making, say, biological warfare agents publicly available.

Makes sense what you say. If we declare that nobody can own (and sell) copyrights then we are very close to saying that nobody can own anything. Then who would get the "goods"? The strongmen, those with biggest guns and most selfish and cruel characters. Jesse James?

Only by uniting and making laws, including contract-law, can the weaker actors, the majority, guarantee a fair and better society for everybody.

I do like the GNU copyleft licenses I think that is a great idea. But then to say that because I released my software under copyleft everybody else must do the same, or I call them unethical, sounds self-serving.

I don't believe that society would be better if "zero marginal cost things like software or poetry, or information in general, would be freely available". Is there any evidence of that?

Human nature is that people will produce what benefits them --and others-- the most,. Therefore they choose to grow crops that give them the biggest profits. Think about pharmaceuticals who invest billions in research for new medicines only because patent-laws exist. That does not mean we should give them unlimited power to exploit their patents. We can make a law that progressively taxes exploitative pricing, however that is defined.

nope. AGPL has no clause to say you have to contribute back. you only have to PROVIDE source to your users. thats all it does.

How is contributing back different from providing the source?

you can keep your fork independent from upstream meaning you can decide to not give your "contributions" to upstream. providing source means if you do not do the changes in your fork to upstream, any of "your" users can take the changes and push it upstream provided they accept that PR but you are under no obligation to do so, just give the source.

contributing back would mean whatever change you put in your fork must reflect in upstream which is not something all upstream users would accept always but its not a requirement.

I don't see how that's practical. If a project requires "contributing back" and then doesn't accept the changes, the fork can't exist?

i said, AGPL does not require contributing back. there is no clause demanding that. a fork can be independent of changes to upstream as long as they provide source to its customers/users.

You are only required to provide the source to your users, not to the original developers.

Copyleft licenses like GPL are about user freedom, permissive licenses like BSD/MIT/Apache are about developer freedom, and COSS licenses like Elastic and SSPL are about freedom from competition.

aptly put .... freedom from competition license are pernicious and against "open source" whatever definition you adhere to. Just a wolf in sheep's clothing.

Elastic and SSPL are essentially source-available evaluation licenses for proprietary software. Which per se is fine. If that's the best business model for you, sure, go ahead and all the best to you.

Just don't go and try to eat the cake and keep it too, by claiming you have some kind of 'open source community' driving your growth.

SSPL is a free software license, just like AGPL but slightly stricter.

Disclosure: I work for AWS, but I am not paid by AWS to comment on HN on Free Software matters, on which I have my own personal opinions.

SSPLv1 is not a free software license. It is constructed to have unsatisfiable obligations that, in practice, restrict how the program can be used for completely legitimate, legal, and ethical purposes. Because the obligations cannot be satisfied, the license restricts the freedom of the user, thus software licensed with SSPLv1 is not Free Software.

See also the blog post from Bradley M. Kuhn, one of the main Free Software organizers who led the work to draft the Affero GPL and AGPLv3 licenses. [1]

Additional disclosure: I (personally) am a Software Freedom Conservancy Sustainer [2]. Consider donating if believe in fighting for digital rights, including rights to repair and improve software.

[1] https://sfconservancy.org/blog/2020/jan/06/copyleft-equality...

[2] https://sfconservancy.org/sponsors/

Kuhn's post seems to be based solely on ideological arguments and seems to be mostly critisizing the company's actions rather than the license. I will personally disagree regarding the unsatisfiable obligations part. As for restrict how the program can be used for completely legitimate, legal, and ethical purpose I have also heard it about AGPL :p

The defects in SSPLv1 were raised by the community during the review process when it was submitted by MongoDB for comment. It would be redundant to re-enumerate them in a blog post like Bradley's, which already tend to be on the long side. ;-)

MongoDB acknowledged that there were improvements needed by drafting a v2 that attempted to address a number of them. But that draft was never finalized, or put into use on any software provided under SSPL license today.

From this I can only conclude that the goal is to use a maximally defective license (since there is an objectively better version proposed), with the expectation that no one who works diligently to work within the license requirements will touch it.

When does a developer stop being a user? If I want to use an open source IDE to write some commercial software, is that user freedom or developer freedom? Is it within a user's freedoms to use a software for any kind of monetary benefit at all even if it has nothing to do with software development, like for example using an open source text editor to write documents for work? If so then what's the difference?

User of the software vs developer of the software

As the user of an IDE, I should be able to develop my own modifications for it. Any users of my modifications should also have that same right.

read up on free software movement vs open source thing. you are only looking at "open source" when the argument being that the software should be free for users, not the developers in the middle. when i write AGPL code, i expect "end users" to be given source of that code in whatever circumstance they might get to use the software. now here comes a developer who uses my code, puts it in a private fork in your words and denies his/her users access to source code, what happened to my giving that dev license to use the code?

what you are referring to us those MIT/BSD license where the developer is expected to heartlessly work to build software which can be forked by anyone, used in a proprietary code and users cant do anything about it. you are talking about freedom of the "developer" while free software people talk about freedom of end users.

obviously "fake open source" is there because something like SSPL is not a "open source license" but it is in essense the superset of AGPL and that is what Free software guys want. you use this code, the users MUST get source, the dev has no say in that

I’m not really buying the notion that SSPL isn’t open source, and the more I read the discourse around free software and the intentions thereof (_user_ freedom), I fail to see how it doesn’t count. I know a lot of folks love to quip that the OSI won’t accept SSPL, but they don’t get to control the use of the term since it was never theirs to begin with, and the source is absolutely open and available. The stipulation is that you can’t pull an Amazon where you get to play “I’m not touching you” games with the software by wrapping the service with value adds via proxy to escape having to contribute back. That feels in line with the intentions that classical distributed software like GPL intended, for that the emergence of SaaS enabled barn-door-wide loopholes.

You don't understand the difference of Open Source and Free Software

I believe that they do.

This attack is unwaranted and without substance or explanation.

The way I understand it is that the spirit of Free Software is _user_ freedom - they are free to use the software in any way they wish without restrictions. SSPL meets this bar no differently than any other license with provisions requiring open sourcing code. Open Source, per the OSI, has a particular point of view, in one clause they feel SSPL fails the test: their interpreted ambiguity of what triggers related code to also require the same license felt like it was too infectious — i.e. it could not live harmoniously in an ecosystem of deployed software because of their fear that mere interactions could be considered a triggering event. The reality is that is not true. Not only does the license very clearly outline the condition (basically it eliminates the proxy loophole AWS has historically used), the creators of the license also created an accompanying FAQ providing further clarifications of intent. I find the strong emotional reaction people get when someone asks why SSPL doesn’t count is quite odd. I find the fact that literally nobody (besides the OSI in extremely weak argumentation that the license self-clarifies on, the authors repeatedly clarified on, and the accompanying FAQ removes all doubt) can provide a coherent argument in opposition even more strange. If I want to provide an equally vitriolic remark, I think the reality of why OSI rejected it, and why some people feel so strongly opposed, is ironically the same suspicions they casted on the genesis of the license (MongoDB has a business interest in this license): look at the members of the OSI — there are a number of IaaS people, who of course would be opposed to recognizing a license that stops their grift.

As an occasional OSS contributor and maintainer of a few minor Github projects; being able to give my users and contributors the freedom to do as they want rather than as I want is precisely why I prefer MIT style permissive licenses.

I'm under no pressure by anyone to give them that freedom. If somebody finds a use for code that I wrote, more power to them! Exactly what I want. And yes, I put some thought into this and definitely read up on this.

For me the AGPL is actually the least free OSS license. I avoid depending on any software that uses it because I don't want to have to consult a lawyer when dealing with dependencies. I mistrust companies wielding it to be perceived as open when in reality all they want is for you to buy their software under a different license.

In a way what Elastic does is more honest. They are simply saying, this software is ours and this is what you are allowed to do with it (i.e. it's a permissive license). But it's straightforward to understand and it seems many of their non paying users are OK to continue to use their software under that license. As a very infrequent contributor, I of course regret the license change though.

IMHO the true value in OSS communities is joint copyright ownership of the developers working on it. If there are enough copyright holders, it precludes licensing changes. That combined with a permissive enough license lets people innovate freely. Anything with widely enough distributed ownership is almost impossible to restrict the usage off commercially as long as the license is permissive enough.

The lack of distributed ownership is how Elastic was able to re-license and it is why Linux is such a success. Unintentionally (Richard Stallman definitely did not like the form this success took), GPLv2 provided enough freedom through some loopholes in the license that companies could use it to build proprietary products. Products like Android, which are mostly closed source and worth quite a lot.

Attempts to prevent further commercial success in the form of GPLv3 and the AGPL never really affected Linux because by the time those came into existence, re-licensing was already a mission impossible even if Linus Torvalds would have wanted to; which as I understand it he was never really that much of a proponent of to begin with.

> Similarly, I personally view the AGPL as a nonfree license, although it's being pushed by anticapitalist zealots at the FSF who of course invented the notion of software freedom in the first place so my classification is, of course, controversial.

I don't think that world should be licensed with A/GPL all over, but I don't think A/GPL is the second coming of Evil, either.

I like the virality and values which GPL family of licenses stand for, and I personally support them. I license all of my software with GPL, and open source it like that. Why? I don't my code, intended to be open and free for everyone, to be modified and locked up for somewhere for profit, that's all. In other words, if I put out something on my free time, for leisure, I want it to be free for everyone.

For profit work is different. I'm not a fan of capitalism, but I'm not an anticapitalist zealot either. I'd license my work with most permissive license the circumstances allow, and try to open source it with all the power I have, but it's not always feasible, I know. So it can be Apache/MIT, whatever in that circumstances.

So, that's my point of view. Horses for courses, and I refuse to give my honest/hobby work to someone just because it's convenient for someone to integrate it to something closed source or for profit, regardless of usefulness/quality of the software.

> is not an open source license

To be honest, this is disingenuous. "Open source" has several definitions, and even though some people would like _their_ definition to be the "official" one, I'm pretty sure most reasonable people would still definitely agree that this project is open source, seeing that the entirety of the code is on GitHub.

Source available != open source.

I have the source to Windows, that doesn't make it open source.

There are lots of projects with full source on GitHub that don't have a LICENSE at all, which means that despite having access to the source code you have no rights to store or use them at all (under copyright law).

The definition of what counts as free software/open source was settled a long time ago. This isn't some pet crusade.

AGPL is both capitalist and socialist at the same time, depending on the developer. "Oh, you want to use my software for a nonfree internet service? Sure! You just got to negotiate a license with me :)"

I can't see anything anticapitalist here.

Hi from the Apollo team! We're not abandoning open-source software. Excluding our Federation 2 libraries, nearly all of the 100+ public repositories in the Apollo GitHub organization are MIT-licensed. Our most popular projects, including Apollo Client (Web/iOS/Android), Apollo Server, apollo-rs, and Rover, remain MIT-licensed.

Federation 2, the component of our platform that is licensed under ELv2, is most interesting to large enterprises. Apollo has built a successful business that helps developers at large enterprises adopt a unified graph at scale. These enterprise subscriptions fund the development of important open-source projects like Apollo Client and Apollo Server that benefit the entire graph ecosystem.

> Similarly, I personally view the AGPL as a nonfree license

Is GPL a free license?

What’s the factor that makes AGPL nonfree in the way that GPL isn’t?

I used to be a Copyleft zealot. Thanks to the emergence of AWS and GCP, I’ve come around to being OK with licenses like Elastic, and if I start a software company in the future, I wouldn’t rule out protecting myself by licensing critical parts of my code with Elastic or a similar license.

I don’t even agree that these kinds of licenses are inherently “anti-FOSS”, but I do object to them being portrayed as actual FOSS licenses. “Source-available” is a reasonably well-defined term that should be used more often in these kinds of situations.

Edit: “You’re either with us or against us” is corrosive whether it’s in war, politics, software licensing, or any other realm.

There's another HN submission [0] of Drew Devault's take [1] on the license change: "Breaking down Apollo Federation's anti-FOSS corporate gaslighting".

[0] https://news.ycombinator.com/item?id=29116938

[1] https://drewdevault.com/2021/11/05/Apollo-federation-2-gasli...

Here are 2 MIT alternatives: https://github.com/jensneuse/graphql-go-tools, written in Go, I'm the author. https://github.com/mercurius-js/mercurius, written in NodeJS. Here's a benchmark comparing the two with Apollo: https://wundergraph.com/blog/benchmark_apollo_federation_gat...

Nice to see you here jensneuse. It seems there v2 implementation uses a fair amount of rust too for parsing at least so it is not pure JS.

I was a bit worried that they changed the license of the spec but it doesn't seem like it, only the code so that is good.

Like I suggested a while ago, splitting this go module would probably help drive adoption specially with this announcement.

We're planning on doing exactly this! Here's the starting point: https://github.com/graphql-alliance

Also see @graphql-tools/schema-stitching [0] and its handbook [1] with examples. Note the stitching gateway approach is slightly different than Apollo Federation. We are (lightly) using schema-stitching and happy with it so far – but haven't pushed it much yet.

[0] https://www.graphql-tools.com/docs/schema-stitching/stitch-c...

[1] https://github.com/gmac/schema-stitching-handbook

> A call for a standard open license

If Elastic wants to see this sustainable licensing model adopted as the norm, it's in their interest to rename the license so it's not branded to a single company.

I wonder could they do that? Doesn't ElasticSearch own the copyright to that license? Is it even legal to copy it without their permission?

> own the copyright to that license?

should the text of the license itself be copyright-able at all?

I'm not a lawyer but I think any unique text you write you own the copyright to by default. It's a different question whether this should be so or not.

Could part of text be a release of the inherent copyright stemming from creation?

Sure. If you want your text to be as close to public domain as possible, the Creative Commons No Rights Reserved license (AKA CC0) should work: https://creativecommons.org/share-your-work/public-domain/cc...

I don’t see any disclaimer of copyright for the license text. If another organization took that license text and promoted it as if it were their own, would Creative Commons have grounds to pursue infringement against that other organization?

https://creativecommons.org/publicdomain/zero/1.0/legalcode

My guess is they could, unless they state somewhere that the license text is licensed with the Creative Commons License or some other permissive license

GPL begins with following:

> GNU GENERAL PUBLIC LICENSE

> Version 3, 29 June 2007

> Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.

This is one reason I think SSPL is bit problematic as afaik it's just AGPL with changes, something that is explicitly forbidden.

https://www.gnu.org/licenses/gpl-faq.html#ModifyGPL

It is allowed.

You're not allowed to change a GPL license's terms and conditions and still call it GPL. But if you call it something else you can use some of their terms and add/remove whatever you want.

Anyone could do it, but Elastic should do it since it's in everyone's collective best interests to standardize behind a single sustainable license model with shared goals but that can't happen if it stays branded.

MongoDB and Elastic are likely the biggest companies with licenses of similar goals, but I don't ever see Mongo adopting a commercially branded license, they both need to come together to unify behind a single one to lead the way for others to adopt it.

Check this out: https://www.reddit.com/r/elasticsearch/comments/mv9vxw/can_i...

I read that and it’s hilarious. “Hey Sally, can some other company use our license?” “Sure Bob, tell them no sweat.” <time passes> Corp press release: to protect our biz model and IP . . .

The Apache License is branded to a single organization and that's doing fine.

Kind of missing the detail that it's Apache Software Foundation (a non-profit that's community driven), where as Elastic is a publicly traded company?

Does that actually matter?

One of them operates as a collaborative group to maintain open source software and is well known for that within the development community with decades of proof.

The other is a publicly traded company known for a single product (suite), and the licencing troubles they have faced when dealing with hyperscalers like AWS providing their product to their customers.

I didn't ask what the difference between the two were, I asked if the difference somehow actually matters when discussing the license.

And so are the Eclipse License, The Mozilla Public License and probably a few others.

Of course those licenses are generally understood to be open source licenses under the careful definitions and criteria that the free software foundation uses for this. The Elastic license isn't open enough to meet those criteria.

The only reasonable commercial license to have on an open source friendly project is the Business Source License which MariaDB created and which eg. Sentry has adopted as well.

That license will always to resolve to a GPL-compatible license after at most 4 years after release, ensuring that even if the creator goes out of business, the code will always be forkable eventually.

More info: https://perens.com/2017/02/14/bsl-1-1/

Indeed. At least BSL licensed software will eventually be FLOSS.

But this? The Elastic Licence? Apollo is now indefinitely proprietary software, disingenuously masquerading as open source.

It's interesting to me that the BSL is something like, "copyright, with a reasonable term".

> Many successful companies built on open-source technology (such as Elastic, MongoDB, and Confluent) have followed the path we’re taking to protect their communities

I'm pretty sure Confluent's licensing isn't to protect the Kafka community.

Aka the anti AWS licensing.

Reply on news.ycombinator.com