Hacker News Reader

Comment by INTPenis | Hacker News Reader

License ethics discussion aside, this is going to cause mayhem! :D

I know of at least one massive global company using vault in production, for free as a backend to their own password manager frontend.

My own $dayjob was just going to set it up actually, I guess we'll have to re-evaluate that now.

I can't even imagine how many companies use vault in production.

View on HN

But the license prohibits competitive use, not commercial use, right? So using Vault in production is no problem if you're using it as part of the infrastructure of a company that isn't competing with Hashicorp.

Using it as a backend for a password manager... more of a grey area, but Hashicorp doesn't offer a password manager.

The very first lines of the license text say that you're permitted to use the software for "non-production use".

https://github.com/hashicorp/vault/blob/main/LICENSE#L8-L11

Clearly states that you can use it in a production setup.

Thanks for pointing that out, so this must have been added by Hashicorp then.

That's the point of the BUSL. It defaults to non-production, use, but the licensor adds an Additional Use Grant that allows production use, which typically covers everything except competing with the licensor's cloud offering.

But what if they do in X years? Suddenly that company is out of compliance with the BSL.

Oh, for sure, and if you're a developer tooling/devopsy-stuff company that would give me pause (or convince me to plan a migration, or to use an alternative, etc.)

But if you're, say, fashion retail, or something, then the risk is pretty low.

> then the risk is pretty low

And then Amazon buys Hashicorp.

On the plus side they don't need to panic, they can keep using the last open source version and patch it themselves if needed.

Reply on news.ycombinator.com