Hacker News Reader

Comment by FridgeSeal | Hacker News Reader

> details about the project, dubbed OpenBao.

Oh interesting, I wonder who did it.

> co-founder and CEO of DevOps automation biz Scalr and one of the organizers of OpenTofu, a fork of Terraform

Yeah, alright then.

Does nobody else find it even slightly on-the-nose that the guy behind the TF fork just happens to also run a devops company himself?

> Blatantly take someone else’s work

> mobilise the community by calling them hostile because of licensing

> spin up a business to build on the community

> make bank

Now I’m not saying that what’s happened, but I am saying it sure does smell funny.

View on HN

What smells funny is hashicorp pretending to be open source to win market and mind share, and then doing a rug pull. Everything that follows is a reaction to that.

There was no rugpull. The product is MIT licensed up until the commit that introduced the BUSL license.

What is your definition of a rug pull?

lolwut

The license change is the very definition of "rugpull":

Use permissive license, build up a community of open source users and people who use your product because of its open code base.

Once it stops suiting your business desires, revoke that permissive license, and switch to one that excludes a (significant) portion of your code's user base.

The permissive license was not revoked. The license change is not retroactive. You can continue using the product under MPL license, up to the commit in which the license was changed.

Meanwhile, hashcorp gets to profit off the contributions of others, whilst denying everyone else the opportunity to do the same.

> profit off the contributions of others

But Hashicorp's business hasn't turned a profit to date. And they rarely merge external pull requests.

If the company maintained the previous ZIRP-era permissive license status quo and then eventually went bankrupt, wouldn't that be a worse outcome for everyone?

> But Hashicorp's business hasn't turned a profit to date. And they rarely merge external pull requests.

When they started out, they had enormous traction in the community because they were open source. People actively contributed to what they thought was an open ecosystem in a collaborative spirit. Without that, their products would just be another expensive, marginal proprietary piece of softwarewthat most people ignored.

Now they're trying to profit off that without reciprocating (their competence at being able actually show a profit is irrelevant).

> If the company maintained the previous ZIRP-era permissive license status quo and then eventually went bankrupt, wouldn't that be a worse outcome for everyone?

No. It'd be a worse outcome for Hashicorp's investors, sure, but the rest of us would have the code, the comunity, and a little less poison in the well.

> they had enormous traction in the community because they were open source.

People don't adopt software only because it is open source. It also has to be useful high-quality software. Attributing the entirety of their success to a permissive open source license is nonsensical.

> Now they're trying to profit off that without reciprocating

Their products are still free to use and you can still read the code. They continue to improve the products. In what way are they not reciprocating? And considering this is a publicly-traded for-profit enterprise, why shouldn't they be able to profit off their work?

Unless your business is directly competing with them, how does the license change directly affect you?

> the rest of us would have the code, the comunity, and a little less poison in the well

At the cost of losing the creator and primary contributor of these projects, which tends to be a death blow to the software's long-term viability!

> People don't adopt software only because it is open source. It also has to be useful high-quality software.

These things are symbiotic. It's a virtue circle. People find it useful, they contribute, other people then find it useful, it grows in popularity, people contribute etc. It's pretty clear that Hashicorp hoped to take advantage of this to build popularity when they open sourced their product code.

If you don't think this is true, why do you think they released it under an OSS license?

> In what way are they not reciprocating?

Reciprocating would mean allowing others to build businesses on software they have also contributed to.

> And considering this is a publicly-traded for-profit enterprise, why shouldn't they be able to profit off their work?

It's not all their own work.

No-one's saying it's not ok to profit from it, it's about screwing over and denying that right to others who built the product to what it is today.

> Unless your business is directly competing with them, how does the license change directly affect you?

The license is badly written, andtherefore risky for any business to use. For example, the word "competing" is not defined. If I build a system to store secrets in MySQL and put an API in front of it, am I competing with vault? What if I sell a managed database service and Oracle buys Hashicorp, am I now competing?

It's badly written on purpose, because Hashicorp don't want anyone (with $$ and a competent legal department) to take their silly license, they want to sell them a contract.

> At the cost of losing the creator and primary contributor of these projects, which tends to be a death blow to the software's long-term viability!

If it's useful high-quality software, history shows us that such projects continue to thrive regardless of the status of the 'creator' (e.g. Jenkins).

> If you don't think this is true, why do you think they released it under an OSS license?

I'm not familiar with Hashicorp's motivations for using a permissive license, and I believe this is tangential to the point being discussed (attributing Hashicorps' products success simply to being open source vs being useful software that solved problems in a novel way).

But I do know sometimes software is open-sourced (or at least made source-available) without accepting changes upstream at all, which clearly isn't done for reasons of wanting contributions. Or other times, authors will accept some outside contributions, but aren't outwardly seeking or encouraging them.

Nothing in any FOSS license requires the author to accept changes. Having the source be available is beneficial on its own for reasons of adoption and allowing users to trust the software.

> Reciprocating would mean allowing others to build businesses on software they have also contributed to.

Nothing prevents these companies from doing so via a fork of the last FOSS-licensed version, which is exactly what they've done, and is fine legally.

> It's not all their own work.

They own it. This is clear cut. It's copyrighted and has a CLA for third party contributions.

> it's about screwing over and denying that right to others

What "right" is that exactly, and what makes it a "right"? Legally you can't just make up "rights" based on feelings and assumptions.

Absolutely nothing in these permissive licenses requires future versions of the work to keep the same license.

> If it's useful high-quality software, history shows us that such projects continue to thrive regardless of the status of the 'creator' (e.g. Jenkins)

No, history shows it's quite a mixed bag, for example OpenSolaris/illumos has a minuscule amount of marketshare/mindshare compared to Solaris's heyday.

Also, Hashicorp very clearly created Vault, Terraform, etc and putting creator in quotes is a really gross way to minimize their clear achievement in designing useful and novel software that previously did not exist, and would not have existed if not for their efforts.

If OpenSSL was taken closed source, I'd still have access to the product under the previous open source license, but its utility would evaporate since it's a security product. I would have to migrate to something else, eventually.

Consider how happy this made me:

I wrote a PR to fix something in Vault, then nothing happened for a while, then I saw that hashicorp is changing their licensing, and soon after that, my fix was merged. My fix sat waiting until they changed their license, and then it was merged before I had time to consider if I wanted to contribute under that license.

(Incidentally, sentry also changed their license soon after I interacted with the project. Maybe it's me ruining the OSS world)

Can I send you a list of projects to not contribute to? ;) /s

This is why it’s important to check if an OSS project is also developed under an open governance model like at Apache or Linux Foundation.

So, we should check if OpenBAO is then..? I assume this means the assigned copyright holder is a trusted non-commercial body (Apache or Linux Foundation).

I saw a similar thing happen with another product recently. It made me realise even though the project was touting itself as open source you couldn't even build the open code into a useable product.

So the importance of assigning copyright to a suitable body crystallised for me.

> The product is MIT licensed up until the commit that introduced the rugpull<strike>BUSL license</strike>.

Fixed it for ya.

Care to elaborate?

>Does nobody else find it even slightly on-the-nose that the guy behind the TF fork just happens to also run a devops company himself?

Not even a little bit. Yours is a really strange take, in fact. Of course it's the DevOps ecosystem forking widely used OSS DevOps tools when those tools' owners decide to move to a non-OSS license.

>> Blatantly take someone else’s work

How does one "take" open source software?

>> mobilise the community by calling them hostile because of licensing

The license change caused that mobilization.

>> spin up a business to build on the community >> make bank

Again, what a strange take. TF and Vault are tools. These businesses are selling stuff built with/for these tools, not the tools themselves.

> Now I’m not saying that what’s happened, but I am saying it sure does smell funny.

Honestly it reads a lot like you are casting aspersions for no discernible reason.

This seems to ignore the first part of the story, where Hashicorp builds up a community around an open source project and relicenses the project. OpenTofu and now OpenBao wouldn't have happened if Hashicorp didn't relicense in the first place.

The license change wouldn't have happened without the leeches either

You don’t think that the licence changes were intended exactly these scenarios? Because it sure seems to me that they were.

The vast majority of users were, and are, completely unaffected by the licence changes. You’re really only affected if you are selling TF services commercially.

Welcome to Open Source, where being actually open is a competitive advantage!

If you want users of your software to have the brightest future, you need to accept the fact that others can make money and services with your code. If you try to shut that down, people will fork the most recent version of your code that has an OSI compatible license.

Of course, they could have chosen a license like AGPL in the first place, which prohibits services with non-AGPL changes. But then, the product would have been less likely to have the viral growth that HC products enjoyed.

“The vast majority of users were, and are, completely unaffected by the licence changes.”

Only true if you believe that the new license is safe to use, and that HC can be trusted to stop with this change. The license they adopted isn’t well understood and if I were a corporate lawyer I’d be hesitant to approve it.

Defining “competitive” use is basically up to HC, so that makes the license real iffy.

They’ve poisoned the well for contributions going forward, so HC as an upstream is much less attractive now.

I don’t really understand the critics here.

Just as Hashicorp should have understood that the license they chose allows people to use the code as they please, contributors should have understood that Hashicorp could change the license at any time.

If we decide that building companies on top of commercialized open source projects is moral, then we must agree that changing the license is too.

> Does nobody else find it even slightly on-the-nose that the guy behind the TF fork just happens to also run a devops company himself?

Needs way more context. You're basically asking if it's suspicious that a person with high interest in X invests in tools for X. No, it's not, unless there's something more to the story and the position is abused in some way.

I'd find it more suspicious if someone with no interest in DevOps/infra did it.

Is the code open source?

Then, please, use it according to the license, and if you don't want to do it yourself, now you can pay either this guy or HC.

What's the problem?

> Now I’m not saying that what’s happened

Even if it was what happened, it doesn't really matter.

Why do companies that pick open source licences get annoyed when someone else profits from their work?

I am all for open source, but it is a lot harder to profit from your own open source product when the bulk of the development cost is yours. It will be a lot easier for a third party to do so.

>make software open source

>people use it under the license

>"you're literally taking my work"

>change license

>people are mad that software isn't open source anymore

I really don't get these arguments that the businesses that supported OpenTofu "blatantly stole" Hashicorp's work, as if Terraform wasn't licensed under a permissive license

> as if Terraform wasn't licensed under a permissive license

It wasn't. MPL is a (relatively weak) copyleft license, not a permissive license. Also, forking under the original license (what OpenTofu did) in no way requires a permissive license anyway.

> Yeah, alright then.

As far as I'm aware, Scalr is not directly participating in or precipitating the fork at this time [0]. This was started by groups working on OpenHorizon and EdgeX Foundary (two Linux Foundation projects under the LF Edge umbrella) which both use Vault internally and are offered by other organizations commercially. This made them incompatible with the BUSL (for both open source and commercial variants) which necessitated the fork.

[0]: https://wiki.lfedge.org/display/OH/OpenBao+%28Hashicorp+Vaul...

> Does nobody else find it even slightly on-the-nose that the guy behind the TF fork just happens to also run a devops company himself?

Someone always has to pay for the development in the end.

Reply on news.ycombinator.com