Hacker News Reader

Hacker News

Comment by throwaway129472 | Hacker News Reader

Parent Full thread

throwaway129472

Hardly surprising that IBM is doing this as they've been commercializing Vault for some time [0].

[0] - https://www.ibm.com/products/secrets-manager

Disclosure - I work for HashiCorp and IBM has been mentioned by name in relation to the license change.

View on HN

Care to comment anymore on this? I'm curious what the sentiment is within hashicorp

There's no overall consensus within engineering about the change itself.

What is amusing is that most of the public response has been aimed at Terraform whilst internally Terraform wasn't the concern. Gruntworks and the others were not mentioned internally.

It was Vault. It was IBM.

I don't think this is a valid take. Some, like myself, have left over this issue. Many discussions happened in private for various obvious reasons.

But your reasoning at the end was not my understanding.

That said, I have nothing but respect for my former colleagues there. Some of the best engineers have I worked with are still at Hashicorp. :-)

Disclaimer: Views my own, not that of any past, present, or future employer.

Interesting. I'm curious, was it fear of IBM or was there a concrete threat from IBM which was already eating Hashicorp's lunch and was an existential threat?

I have a hard time imagining why anyone would choose IBM's offering over Hashicorp's offering unless they would already be up until their necks into IBM stuff. I also wouldn't really expect the IBM and Hashicorp customer base to overlap much?

IBM has lots of old enterprise mindshare. Existing relationships are the value. Selling Vault just becomes another line item in your IBM contract.

Very similar how AWS just repackages open source products and sells them themselves (Elastic). If you don’t protect yourself from these entrenched enterprise marketing machines, you’re dead.

(Brought Vault into an old, stodgy org, was a schlep)

There’s even a whole cottage business around getting your app on the AWS marketplace and handling billing through AWS. Once it’s on the marketplace it becomes much more appealing to a set of B2B customers because it’s way easier internally to just add some $X,000 line item to your AWS ‘cloud’ bill than to go though the lengthy procurement and approval process of onboarding a new vendor

“Application Modernization” is a huge deal in enterprise. In practice this means some combination of “make it slightly easier to get production traffic to new Java apps” and “deploy a lot of Kubernetes clusters.” Really they want the former but the k8s became a proxy for the capability. It’s why IBM bought RedHat.

Hashicorp products are a very big part of this world. I’d expect that basically every IBM customer also uses Hashicorp products, but they may or may not have a commercial relationship with Hashicorp.

> why anyone would choose IBM's offering over Hashicorp's offering

Because everyone know IBM and mostly only devs know about Hashicorp. There is that saying "No one ever got fired for buying IBM".

How would you feel if your products were forked by a big business that had already been commercializing your open source code (legally, admittedly) while making no contributions back?

Don't release your products under permissive open source licenses if you're not happy when that happens.

That’s smart today. But it was always my perception that up until a couple of years ago, when all this ElasticSearch v AWS drama began, that it was historically part of some kind of social contract in open source tooling to use permissive licenses. This was just my perception of consumers of open sourced tooling, so your mileage may vary. Very recently it seems there’s been a surge of people noting acceptance of less permissive licenses, and in this landscape I think it’s more likely that a young Hashicorp would have opted for a license that didn’t allow IBM to eat their lunch.

I'd be thrilled with this. This is free marketing to a much broader customer base than I could achieve. Some customers would circle back for more in-depth knowledge and support from the original author/company.

Take, for example, ElasticSearch. They got wider recognition after AWS started "shipping" ES as a service, but sadly, their investors thought they could compete with AWS.

Also, as others mentioned, you should consider a license in advance. And remember that many of these companies benefited from big companies: HashiCorp is getting golang, libraries, OS, and tooling for free, ES is getting JDK for free and etc.

Quick reminder that when HashiCorp chose Go, there were basically no libraries for it, and Mitchell’s libraries appear to this day in a lot of the more serious Go projects.

Not to question Mitchell's generous contributions, but most of his libraries I've seen were convenience wrappers and other creature comforts (eg. go-getter), not foundational work. Happy to be corrected.

By that measure, anything outside of assembly could be defined as “creature comforts” instead of foundational work. I understand why it would be convenient for you if it were true, though.

One of the complaints about Hashicorp products was that they were not accepting any/many contributions from outsiders. Not sure if that was the case with vault.

It’s generally proper etiquette to discuss a contribution with repository maintainers within an Issue before writing the code. That’s just people putting themselves in awkward situations, in my opinion.

The more mature a product company gets the more strict they start getting, too, out of necessity, for code standards and styles. Enforcing styles on community contributions is often a difficult balance between keeping consistency and seeming like a jerk. Sadly, people aren’t always as thoughtful with their contributions as you’d sometimes like them to be.

Anyway, I’m sure I’ll get some flack for saying this, but I help maintain some popular repositories and this has just been some of my observations. Especially with people not checking with the maintainers in an Issue before writing the code.

I find this so confusing... I would feel exactly as I felt when I was picking a license and imagining all the different scenarios my choice might lead to.

Fine, I guess, if the license I'd chosen allowed that? Certainly there are other licenses I could choose (licenses that still retain a good deal of openness) that would protect against that if that was a concern.

Would the product have been widely used and such a success if it wasn't open source in the first place?

That is the main question before you pull the rug of the open source license once you start to be successful thanks to the community...

Reply on news.ycombinator.com