Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MongoDB removed from RHEL 8 beta due to license

access.redhat.com

Post reply on HN
Print view View original

31–40 of 231 posts

Re: MongoDB removed from RHEL 8 beta due to license

#31

Post by [deleted] »

tinus_hn wrote: post #19
mikekchar wrote: post #18

Earlier quoted context omitted.

It's really not clear to me as he kind of backtracked in the next message by saying that he was writing under the role in the FTP team, rather than as Project Leader of Debian. My interpretation of that is that it is his opinion, but not a statement of policy. I'd be pretty surprised if they allow SSPL in Debian, but I don't think this is the statement that disallows it.

The FTP team performs a license check before a package is moved into the archive, so they do get to decide what goes in and what doesn’t.

[deleted]

Re: MongoDB removed from RHEL 8 beta due to license

#32

Post by xellisx »

giancarlostoro wrote: post #22

It seems[0] the new MongoDB license is basically non-free and it would make no sense to include it in RHEL8. I hope Debian and other distros follow suit as a result if they come in agreement. It's sad that the license change all resorts to greed basically, as if Oracle took over MongoDB. If I were to ever use a NoSQL database for a new project I'd aim for MIT / 2-clause BSD based projects instead. PostgreSQL has no i…

I had hopes for MongoDB back 10 years ago, but it just let me down.

I'm thinking of trying out ArangoDB next. OrientDB is just riddled with bug and their docs are lack luster.

Re: MongoDB removed from RHEL 8 beta due to license

#33

Post by geofft »

mikekchar wrote: post #18
vbezhenar wrote: post #10

Earlier quoted context omitted.

If I understood that message correctly, it seems that Debian decided to remove MongoDB from its main repository as well: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=915537#15

It's really not clear to me as he kind of backtracked in the next message by saying that he was writing under the role in the FTP team, rather than as Project Leader of Debian. My interpretation of that is that it is his opinion, but not a statement of policy. I'd be pretty surprised if they allow SSPL in Debian, but I don't think this is the statement that disallows it.

The FTP team is the body that ordinarily makes binding policy decisions about licenses in Debian. It's not typically the project leader's job, so I read this statement as saying "despite the .signature, I'm speaking in my role as a member of the FTP team, not the project leader overruling the FTP team."

Re: MongoDB removed from RHEL 8 beta due to license

#34

Post by chrisseaton »

pilif wrote: post #26
iqy wrote: post #23

Earlier quoted context omitted.

>Going with the maintainer's repo means that you trust the maintainer with providing security updates for the version you have installed or you trust them with providing a useable upgrade path. Why should that be a problem if you use the official repo, handled by MongoDB themselves?

Because as I said later in my post, sometimes a vendor's response to a security issue is "please update to the latest major release". Let's say you're using version 1.1 of some software and you're hit by a remotely exploitable unauthenticated RCE. You want to patch it, but the vendor says that the only fix is to update to 2.0. How quickly can you adjust your software to work with that major release that might contain…

How does this work? How are RedHat able to reach into any of the thousands of projects in their repository and fix bugs and vulnerabilities? How do they have people on staff who understand all those codebases and algorithms?

Do RedHat support engineers get tickets like 'bug in the energy minimisation algorithm of GraphViz - go in, learn that field of computer science, and fix it'?

Re: MongoDB removed from RHEL 8 beta due to license

#35

Post by vbezhenar »

iqy wrote: post #29
giancarlostoro wrote: post #22

It seems[0] the new MongoDB license is basically non-free and it would make no sense to include it in RHEL8. I hope Debian and other distros follow suit as a result if they come in agreement. It's sad that the license change all resorts to greed basically, as if Oracle took over MongoDB. If I were to ever use a NoSQL database for a new project I'd aim for MIT / 2-clause BSD based projects instead. PostgreSQL has no i…

If the new MongoDB licence is non-free, the chances that Debian will include that software in their repos are nil.

AFAIK there's non-free repo in Debian. Not sure how they compared to main repo in terms of maintaining.

Re: MongoDB removed from RHEL 8 beta due to license

#36

Post by quantummkv »

chrisseaton wrote: post #34
pilif wrote: post #26

Earlier quoted context omitted.

Because as I said later in my post, sometimes a vendor's response to a security issue is "please update to the latest major release". Let's say you're using version 1.1 of some software and you're hit by a remotely exploitable unauthenticated RCE. You want to patch it, but the vendor says that the only fix is to update to 2.0. How quickly can you adjust your software to work with that major release that might contain…

How does this work? How are RedHat able to reach into any of the thousands of projects in their repository and fix bugs and vulnerabilities? How do they have people on staff who understand all those codebases and algorithms? Do RedHat support engineers get tickets like 'bug in the energy minimisation algorithm of GraphViz - go in, learn that field of computer science, and fix it'?

It is the upstream vendor that issues fixes. What RedHat does is that it takes the commits that fix the bug and merge them into their forks and release.

Re: MongoDB removed from RHEL 8 beta due to license

#37

Post by bdavis__ »

chrisseaton wrote: post #34
pilif wrote: post #26

Earlier quoted context omitted.

Because as I said later in my post, sometimes a vendor's response to a security issue is "please update to the latest major release". Let's say you're using version 1.1 of some software and you're hit by a remotely exploitable unauthenticated RCE. You want to patch it, but the vendor says that the only fix is to update to 2.0. How quickly can you adjust your software to work with that major release that might contain…

How does this work? How are RedHat able to reach into any of the thousands of projects in their repository and fix bugs and vulnerabilities? How do they have people on staff who understand all those codebases and algorithms? Do RedHat support engineers get tickets like 'bug in the energy minimisation algorithm of GraphViz - go in, learn that field of computer science, and fix it'?

Yes, that is exactly how it works. Provided the bug reporter has a support contract and enough clout.

Re: MongoDB removed from RHEL 8 beta due to license

#38

Post by bubblethink »

chrisseaton wrote: post #34
pilif wrote: post #26

Earlier quoted context omitted.

Because as I said later in my post, sometimes a vendor's response to a security issue is "please update to the latest major release". Let's say you're using version 1.1 of some software and you're hit by a remotely exploitable unauthenticated RCE. You want to patch it, but the vendor says that the only fix is to update to 2.0. How quickly can you adjust your software to work with that major release that might contain…

How does this work? How are RedHat able to reach into any of the thousands of projects in their repository and fix bugs and vulnerabilities? How do they have people on staff who understand all those codebases and algorithms? Do RedHat support engineers get tickets like 'bug in the energy minimisation algorithm of GraphViz - go in, learn that field of computer science, and fix it'?

They have the core repo and other less/un-supported repos/channels. They'll support everything in the main repo.

Re: MongoDB removed from RHEL 8 beta due to license

#39

Post by paulryanrogers »

chrisseaton wrote: post #34
pilif wrote: post #26

Earlier quoted context omitted.

Because as I said later in my post, sometimes a vendor's response to a security issue is "please update to the latest major release". Let's say you're using version 1.1 of some software and you're hit by a remotely exploitable unauthenticated RCE. You want to patch it, but the vendor says that the only fix is to update to 2.0. How quickly can you adjust your software to work with that major release that might contain…

How does this work? How are RedHat able to reach into any of the thousands of projects in their repository and fix bugs and vulnerabilities? How do they have people on staff who understand all those codebases and algorithms? Do RedHat support engineers get tickets like 'bug in the energy minimisation algorithm of GraphViz - go in, learn that field of computer science, and fix it'?

IIRC Redhat is a downstream consumer of many projects. And they have their own repositories and format (RPM). So yes, they do fix bugs in their copies and employee people who know, or can learn, the critical packages.

Hopefully they still send patches upstream to the original projects.

Re: MongoDB removed from RHEL 8 beta due to license

#40

Post by timdierks »

bubblethink wrote: post #28
ergo14 wrote: post #15

Earlier quoted context omitted.

Really? It's so non-free that you have CentOS.

Yes, but as a customer of RH, you are not allowed to distribute RH's binaries, or they will terminate your contract. That is also against the spirit of the GPL, although not necessarily the letter. You can take the source, remove the branding, recompile, and redistribute, which is similar to what CentOS does/used to. However, the GPL allows the former too. i.e., You can straight up distribute the binaries under GPL.

This is simply not true: it's explicitly not the intent of the GPL, and furthermore the GPL is clearly a contract which explicitly spells out its intent, not a vague document whose spirit needs to be interpreted.
Post reply on HN