Hacker News Reader

Comment by woodruffw | Hacker News Reader

For what it's worth, I understand this concern. However, I want to emphasize that pyx is intentionally distinct from Astral's tools. From the announcement post:

> Beyond the product itself, pyx is also an instantiation of our strategy: our tools remain free, open source, and permissively licensed — forever. Nothing changes there. Instead, we'll offer paid, hosted services that represent the "natural next thing you need" when you're already using our tools: the Astral platform.

Basically, we're hoping to address this concern by building a separate sustainable commercial product rather than monetizing our open source tools.

View on HN

I believe that you are sincere and truthful in what you say.

Unfortunately, the integrity of employees is no guard against the greed of investors.

Maybe next year investors change the CEO and entire management and they start monetizing the open source tools. There is no way of knowing. But history tells us that there is a non-trivial chance of this happening.

Yes, at every company I have been with investors, sooner or later they make the calls, what the founders wanted never has much weight a few years in.

A week later a fork appears and everyone is happy (except those investors, CEO, and management, but it never was about their happiness so...)

The uncertainly over a future rug pull is always real, but in reality I wonder if the actual reason for people's hesitancy is more than just that. In reality I suspect it's closer to one of simply identity and the ownership model itself. Just the very idea that core tooling you depend on is in the hands of a commercial company is enough to many back off in a way one might not be when the tooling is in the hands of a broader community that one can support on more equal terms.

@woodruffw I love your quote above that commits you to your open source base and I'm rooting for you. But how about an approach that commits you to this sentence in a more rigorous and legal way, and spin off your open source tooling to a separate community-based entity? Of course, upon that you can continue to maintain sufficient representation to make Astral's commercial products the natural progression and otherwise the model remains the same. That would be a significant transfer of control, but it is that very transfer that would get a overwhelming response from the community and could really unblock these great tools for massive growth.

I work a lot with LLVM/Clang and whilst i know Apple and Google are significant contributors I feel confident that LLVM itself exists outside of that yet accept that e.g. Apple's contributions afford them weight to steer the project in ways that match their interests in e.g. Swift and Apple tooling.

It makes sense, but the danger can come when non-paying users unwittingly become dependent on a service that is subsidized by paying customers. What you're describing could make sense if pyx is only private, but what if there is some kind of free-to-use pyx server that people start using? They may not realize they're building on sand until the VC investors start tightening the screws and insist you stop wasting money by providing the free service.

(Even with an entirely private setup, there is the risk that it will encourage too much developer attention to shift to working within that silo and thus starve the non-paying community of support, although I think this risk is less, given Python's enormous breadth of usage across communities of various levels of monetization.)

Conda said all this as well, and solved the same issues you’re trying to - namely precompiled versions of difficult to build packages. It then went commercial.

In the HPC space there are already Easybuild and Spack which make all the compiler tool chain and C and Fortran library dependency stuff very easy. They just haven’t taken off outside as they aim to solve cluster management problems but Spack is easy to self serve.

Yes, it went commercial. But Conda is still free. And the community had built conda-forge to maintain packages. Conda + conda-forge can completly replace Anaconda for most people.

So even though they went commercial, they left pretty good things behind for the Open source community.

The entire reason people choose "permissive licenses" is so that it won't last forever. At best, the community can fork the old version without any future features.

Only viral licenses are forever.

I don't think this is true -- a license's virality doesn't mean that its copyright holders can't switch a future version to a proprietary license; past grants don't imply grants to future work under any open source license.

Correct; however, without a CLA and assuming there are outside contributors, relicensing the existing code would be mildly painful, if not downright impossible.

You're saying that would be more painful in a viral license setting, right? If so I agree, although I think there's a pretty long track record of financially incentivized companies being willing to take that pain. MongoDB's AGPL transition comes to mind.

But, to refocus on the case at hand: Astral's tools don't require contributors to sign a CLA. I understand (and am sympathetic) to the suspicion here, but the bigger picture here is that Astral wants to build services as a product, rather than compromising the open source nature of its tools. That's why the announcement tries to cleanly differentiate between the two.

They have no need to, current repos show everything is under MIT/Apache. They could close the source at any time and not worry about CLA.

>bigger picture here is that Astral wants to build services as a product

What services? pyx? Looks nice but I doubt my boss is going to pay for it. More likely they just say "Whatever, package is in PyPi, use that."

UV, Ruff, Ty. Again, maybe they can get some data/quant firm who REALLY cares about speed to use their products. Everyone else will emit a long sigh, grab pip/poetry, black and mypy and move on.

It ultimately depends on a company's risk appetite.

Some companies specify that packages need to be hosted on their internal repository/artifactory, and for these companies, pyx might be a good tool.

Exactly, allowing employees to install pypi packages from the internet isn't different to allowing them to install any software from the internet.

> I think there's a pretty long track record of financially incentivized companies being willing to take that pain. MongoDB's AGPL transition comes to mind.

MongoDB had a CLA from the start, didn't it?

> Astral's tools don't require contributors to sign a CLA.

That's a pretty vital difference!

>> Astral's tools don't require contributors to sign a CLA.

> That's a pretty vital difference

Not really when the license is MIT/Apache. They can create a closed source fork and continue development there.

Ah yeah, whoops. Either a CLA or permissive license is enough on its own to facilitate such a license change.

Yeah, only the (viral license + no CLA) combo has this effect of preventing you from changing license down the road. In your case (permissive license, no CLA) you still can relicense uv or Ruff. Not saying that you will do it, of course :-)

I do like your strategy, hope it works out!

yeah? who's going to court for multiple years to fight giants? Maybe they'll pull a RedHat and put the code behind a subscription service. Still OSS right?

I think you are making a good point, but please don't use the old Steve Baller FUD term, "viral." Copyleft is a better term

The word "left" is now very charged too, maybe even more than "viral".

Every word is charged now, so you might as well use it. "Copyleft" is a fine pun on "copyright".

Careful, or you'll get the copyleftists calling you a neo-libre-al.

they call everybody a nazi so by definition, they like living in a nazi country

I don't think the connotation these days is particular negative, in the sense it's being used here. See, e.g., "viral video".

Politics aside, "copyleft" originates from a pun and is hardly self-explanatory, whereas "viral" is.

By viral, do you mean licenses like GPL that force those who have modified the code to release their changes (if they're distributing binaries that include those changes)?

Because FWIW CPython is not GPL. They have their own license but do not require modifications to be made public.

Or they want to get more people to use it.

This is just plain false and honestly close-minded. People choose permissive licenses for all sorts of reasons. Some might want to close it off later, but lots of people prefer the non-viral nature of permissive licenses, because it doesn't constrain others' license choice in the future. Still others think that permissive licenses are more free than copyleft, and choose them for that reason. Please don't just accuse vast groups of people of being bad-faith actors just because you disagree with their license choice.

> Basically, we're hoping to address this concern by building a separate sustainable commercial product rather than monetizing our open source tools.

jfrog artifactory suddenly very scared for its safety

Only a matter of time before someone makes something better than Artifactory. It’s a low bar to hit imho.

They've been the only game in town for a while, and their pricing reflects it. But this project is only for Python (for now?) so JFrog is not _immediately_ in danger.

Will pyx describe a server protocol that could be implemented by others, or otherwise provide software that others can use to host their own servers? (Or maybe even that PyPI can use to improve its own offering?) That is, when using "paid, hosted services like pyx", is one paying for the ability to use the pyx software in and of itself, or is one simply paying for access to Astral's particular server that runs it?

I might not be following: what would that protocol entail? pyx uses the same PEP 503/691 interfaces as every other Python index, but those interfaces would likely not be immediately useful to PyPI itself (since it already has them).

> or is one simply paying for access to Astral's particular server that runs it?

pyx is currently a service being offered by Astral. So it's not something you can currently self-host, if that's what you mean.

> pyx uses the same PEP 503/691 interfaces as every other Python index

... Then how can it make decisions about how to serve the package request that PyPI can't? Is there not some extension to the protocol so that uv can tell it more about the client system?

The repository API allows server-driven content negotiation[1], so pyx can service specialized requests while also honoring the normal 503/691 ones.

[1]: https://packaging.python.org/en/latest/specifications/simple...

Ah.

> honoring the normal 503/691 ones.

Embrace

> pyx can service specialized requests

Extend

... ;)

Snark aside, you're missing the part where pyx doesn't compete with PyPI. It's a private service.

How does it being private mean it doesn't compete with PyPI?

Its purpose is to serve as a repo for stuff that was never going to go on PyPI, whether or not PYX exists.

Oh, I see, I misunderstood the use of the word "private" there.

Interesting. I'll have to look into this further. (I've bookmarked the entire thread for reference, especially since I'm a bit attached to some of my other comments here ;) )

The hosting and administration part is what’s expensive and can’t be free and open source except when someone pays for it. So is npm open source? Whether it is or isn't doesn't matter as much as whether Microsoft continues to pay the bill.

I think the only way you can alleviate people's concerns here is by legally binding the company in a way that would adequately address those concerns. Which I don't recall ever seeing any company attempt in such a scenario, probably because it obviously devalues the company as it restricts what a potential future buyer could do with it. Which is exactly why some people don't buy such pinky promises.

This is the way it's worked for PHP's composer packages, and it's worked well.

Reply on news.ycombinator.com