Hacker News Reader

Comment by jeswin | Hacker News Reader

More Open Source projects should adopt SSPL, or experiment with LLama 2 style limitations on the size of companies which may use the work for free (for example, Open Source but not if you're a multi-billion cloud megacorp). When individual developers contribute back, they weren't doing it to enable AWS to freeload.

AWS of course is the single biggest reason why projects are flocking to more restrictive licenses. The right thing to do for AWS would have been to respect the work of the original authors (/company) and throw their weight behind an offering supported by the original developers. Instead, AWS builds a competing product when they see an OSS product succeeding. Third party vendors stand no chance after that due to the tighter integration and marketing muscle.

Not to mention, Amazon and AWS give so little back to Open Source despite being a big (the biggest?) beneficiary. Google, Microsoft and even Oracle do more for Open Source than Amazon.

View on HN

I am fine with SSPL and AGPL as long as there is no CLA which makes me sign me rights over to someone else. I have never contributed to a project with a CLA and unless an employer pays me for it I do not think I ever will.

I certainly won't sign CLAs to entities like IBM (Eclipse/RHEL) or Oracle. But I did willingly sign a CLA for the Apache Software Foundation. I didn't enjoy doing it, but at least they're a force for good.

But Apache I believe specifically is bound to offer code under the Apache licence?

If you simply believe "CLAs are bad", you're missing the point (unless you refuse all legal documents on principle, or something).

The question is: WHO are you signing the CLA over to?

If it's a for-profit company, well, then do you trust that company to follow through?

If it's a non-profit, then look to see (in the US) if they're a 501(c)(3) public charity, which have legal restrictions on their governance, which typically require serving some larger public good. Also look at their history of past governance. I certainly hope (as an ASF peep) that we've shown who we are to be who we plan to be in the future; namely producing software for the public good.

Key reasons the ASF uses a CLA are protecting the org from future IP issues, and partly simply to be able to fix some future typo or legal issue in our license if one ever comes up. But the ASF will always provide all of it's released software under a similar style permissive license to Apache-2.0, as long as the organization is around.

If they're a 501(c)(6), then they're a business league, and might act more like a for-profit corporation, so...

It's important to remember that FOSS contributions are on a voluntary basis. When I have to sign paperwork, things start to feel like unpaid work.

Signing legal documents requires disclosure of personal information. Most CLAs require full legal names and often the names of employers. While Elric is my legal name, I prefer not to disclose my last name for a variety of reasons. Being able to commit to FOSS on a pseudonymous basis is impossible when CLAs are involved, which I think is a real shame.

I understand that orgs want to protect themselves, but CLAs only protect orgs, and can potentially harm contributors. Now, I happen to trust the ASF, and I hope my personal information is safe with them.

> Being able to commit to FOSS on a pseudonymous basis is impossible when CLAs are involved, which I think is a real shame.

There is a solution to that in many jurisdictions: register your pseudonym as an "alternate name".

Which defeats the purpose, because then your pseudonym is legally tied to your IRL identity in a way that may, depending on jurisdiction, be public or semi-public record.

There are, roughly speaking, two types of countries when it comes to names. One kind (like the UK) where you decide on your name and the government has to comply with it (after minimal paperwork and minimal expense). And the other kind (where I live) where your name is more or less set in stone after your birth, where it is subject to the whims of the approving official, where it is difficult and expensive to change at best, and sometimes impossible to change.

I'll refrain from going off on a naming tangent, but that stuff is wild.

> the ASF will always provide all of it's released software under a similar style permissive license to Apache-2.0, as long as the organization is around.

What makes you think that? What stops a few "evil" people from getting on the board and changing the mission in some way and then changing the license so that it is no longer permissive?

I've never been clear on what stops the above attack. Many people have setup foundations on their death that are now promoting things the person was clearly against in their life. Martin Luther King Jr's "I have a dream" speech is now property of his heirs who milk that copyright for all the dollars they can get - I believe this is not what he would have wanted. There are plenty of other examples.

Personally I know it since I've been volunteering there since 1999 and know how elections work and know most of the membership. But that probably doesn't help much if you don't know me.

Practically, I know it because the ASF is a Membership organization, meaning there are hundreds of individual Members who have been elected by their peers inside the ASF. The Membership is the group who elects the board. The ASF has only individuals as Members (never corporations), and quite a lot of folks have made their careers about their ASF project work, while hopping between multiple jobs at various vendors.

So to mount an attack like that, you'd need to "evil-ise" a over a hundred Members to get them to vote for your hand-picked candidates who would be shunned by basically everyone else involved in the ASF.

https://apache.org/foundation/governance/members.html

Vendor neutrality and our permissive license are baked very, very deeply into everything the ASF does.

A fair number of 501(c)(3) foundations are similarly membership corporations, where the board is elected from the set of people who've been volunteering there for years, so they are unlikely to change direction like that. Some (c)(3)s are not, but still have a good track history. (c)(6) organizations are a mixed bag, since some explicitly allow sponsors to pay for board seats - a very different world.

Not all CLAs are the same... for example, the CLA from the ASF is NOT a copyright assignment. Other CLAs _are_.

Ok, that is a very valid point. It is CLAs with copy right assignments I am opposed to.

That's exactly my viewpoint:

SSPL + no CLA: we don't want anyone to profit from the hard work of our volunteer contributors

SSPL + CLA: we don't want anyone but us to profit from the hard work of our volunteer contributors

If you want to dual-license your software, dual-license it from the people that helped write it, or treat their contributions as work-for-hire from the very beginning

Some time ago I tried to argue for a FOSS license that would disallow code from being used by AI. I got a lot of negative feedback saying that this wouldn't be FOSS because it imposes restrictions etc. The same is true for the SSPL. But for long term FOSS viability, I think we may need to impose some restrictions to protect ourselves from big bad megacorps who effectively exploit FOSS developers.

I am still not entirely convinced that "disallowing code from being used by AI" is going to hurt megacorps in the long run - or the individual.

I guess plenty of people have already made their own call on this matter but I'm still genuinely undecided. As much as the megacorps are rushing to rule the AI roost - it's possible it will turn out to be a universal solvent to some degree.

But I'm also pretty lukewarm about AGPL and SSPL. I feel there's a huge amount of fragmentation in open source land and I'm often unable to use code in situations where I feel the original creator would probably have been ok with it.

The phrasing "used by AI" was a bit simplistic. I agree that this is not a black/white situation. Maybe everyone will benefit eventually. But it would have been nice to have the option.

What does code being used by AI have to do with "big bad megacorps who effectively exploit FOSS developers?" I don't see any connection there, while I do see it for something like SSPL.

It's a semantic thing and I agree with the feedback - specifically with the "F" in FOSS. That sort of license would be Open Source but not completely Free (as in freedom, not beer).

> AWS of course is the single biggest reason why projects are flocking to more restrictive licenses

Don't forget that AWS is one of the biggest reasons so many OSS projects became popular. Redis, Mongo, ES, HashiCorp stuff, a complete big data ecosystem, got wider recognition through AWS's offering. Many people have yet to learn about dozens of obscure databases (that have been in development for years) simply because AWS or other big cloud providers have not pushed them.

Also, many projects receive a lot of contributions (bug reports, PRs, patches) due to liberal licenses increasing their use and popularity. I'm not particularly eager to contribute to anything with SSPL/BSL/etc-like licenses simply because I don't want to waste my time on something I can't use liberally in the future.

Redis was popular enough long before clouds.

Also, with AGPL-style license Redis will not become less popular. Anyone still will be able to use it as a cache, but not as a free work done by others that you can resell without contributing back.

Raises eyebrows We're already having the discussion of what we should do about redis at work, given it's a cache, and the tooling we use allows for other caching tools, we'll likely switch away from redis fairly quickly...

Postgres makes for a pretty decent key value cache in certain situations.

> Redis was popular enough long before clouds.

Redis is newer than you think. Or the cloud is older.

ES was already huge before AWS made everyone think it was an Amazon product

That’s highly unlike my experience: each of those tools was popular first - the AWS offerings were recognizing widespread customer use. You couldn’t go to a meetup without someone handing out ES or MongoDB stickers by the time AWS decided that was a market worth being in.

I do agree there’s some value in wider use but developers have to get paid. If users are paying someone who doesn’t contribute much to the upstream codebase at some point the project is going to founder. I don’t love the change as someone who’s been using open source for decades but the maintainer problem is real and won’t go away without structural changes.

> got wider recognition through AWS's offering.

Other commentators have already pointed out that this is probably not true.

But MongoDB relicensed before Amazon could launch a direct hosted offering and it is the biggest of all these projects. It did not want nor did it need Amazon launching a hosted variant.

Aws not offering it does indeed make it harder to adopt, especially if you have to have additional billing contracts with an additional business party, have to validate their certifications (soc2, etc), customer data sharing agreements, etc.

There’s a difference between developer popularity, and ability to actually use it in commercial product. If AWS provides a commercial alternative out of the box available within existing contracts and certifications, adopting that is low friction.

People are forgetting that Redis became big exactly because of it being both free and open. If Redis came out with limitations similar to LLama 2 it would have been dead in the water since the main consumer is enterprise, while LLama 2's primary popularity is because it was one of the first to provide a high quality LLM to individuals for personal use. A KV store that's compatible with RESP is nothing particularly special, shoot Microsoft just released their own (garnet) under an MIT license. The value of Redis was always it being both free and open source and the community that supported it. As of now they just dropped the biggest reason to use Redis.

> The right thing to do for AWS would have been to respect the work of the original authors (/company) and throw their weight behind an offering supported by the original developers

That's what they do in some cases - their managed Grafana and Prometheus are a cooperation with Grafana Labs. But it's the only one I'm aware of, practically all other ones (MongoDB, Redis, Memcached, MySQL, PgSQL, etc.) aren't.

Look more closely and you'll see that they offer a competing service right next to it... it's about the most anti-competitive posture you can imagine as they slowly corrode their foundation

> AWS of course is the single biggest reason why projects are flocking to more restrictive licenses

Should be general competition, including AWS, right? AWS does not host a Terraform service, yet HashiCorp feels the pressure from quite a number of competitors that offer Terraform as a service.

I think Sentry's Functional Source License is pretty good. That's what I've decided to use.

Open-source still has a long-term advantage. Long-term, either AWS goes out of business, “enshittifies” their “enhanced” version, and/or open-sources it themselves. Meanwhile, the open-source version never goes away or gets worse: at worst it will bitrot, but that’s only if nobody is using it enough to put in the bare minimum of maintenance (then when AWS inevitably degrades, there’s a good chance someone makes an open-source rewrite).

I guess but AWS is the one being a good steward of actual open source software. It's hard to say they're the evil ones when it's because of them we still have an OSS ElasticSearch for anyone to use as they please.

No one forces you to make OSS, you can be closed source from the beginning and no one will fault you. But companies releasing OSS as a growth hack because it's seen as a donation to the software commons and then rug pulling deserve every fork coming to them. Debian and Fedora don't include JSMin (not that it's relevant anymore but still) because the license says you can't use it for evil making it not OSS.

That's what OSS means -- everyone, even the worst person you know, especially the worst person you know, can use the software for anything they want.

Reply on news.ycombinator.com