Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Terraform Registry Terms of Service have been updated

github.com

Post reply on HN
Print view View original

31–40 of 136 posts

Re: The Terraform Registry Terms of Service have been updated

#31

Post by armchairhacker »

jeremyjh wrote: post #28
jacquesm wrote: post #4

Companies want the benefits of open source (massive community contributions, lower development costs, better security, community exposure, marketshare) but don't like the downsides (from their perspective: forks, lack of control, freeloaders etc). TOS changes like this are fine, it's their garden, but ultimately all they'll do is put even more power behind forks and alternatives. Because the people that were motivate…

I think this damages all commercial OSS projects. Because after Docker and Terraform, any effort to bring in some OSS project as a dependency will be met with "Sure, it's open source now, but what about when...".

IMO it shouldn't be much different than "sure, it's open source now, but what if it stops being maintained?"

Because open-source code never stops being open-source, it just stops getting open-source updates. Closed-source in some situations can prevent you from using existing software; you also have other closed-source issues like bugs being unfixable.

Would you rather use a service that worst-case, you have to patch and maintain yourselves? Or a service that worst-case you have to switch to an entirely different service?

Re: The Terraform Registry Terms of Service have been updated

#32

Post by jacquesm »

armchairhacker wrote: post #31
jeremyjh wrote: post #28

Earlier quoted context omitted.

I think this damages all commercial OSS projects. Because after Docker and Terraform, any effort to bring in some OSS project as a dependency will be met with "Sure, it's open source now, but what about when...".

IMO it shouldn't be much different than "sure, it's open source now, but what if it stops being maintained?" Because open-source code never stops being open-source, it just stops getting open-source updates. Closed-source in some situations can prevent you from using existing software; you also have other closed-source issues like bugs being unfixable. Would you rather use a service that worst-case, you have to patch…

That's true, but for a lot of companies having an entity behind a piece of software will definitely be a major factor in their decision making process so these kind of tricks ultimately benefit closed source offerings. And that's quite annoying. The idea behind open source is very solid, but the assumption that any user of a large package is ultimately able to continue to maintain it is faulty and that means that for a lot of parties the benefits of open source only materialize if someone else is willing to take up the mantle, they are simply not able/staffed/wealthy enough to do this.

So every time someone does a rug-pull all FOSS projects suffer.

Re: The Terraform Registry Terms of Service have been updated

#33

Post by ashald »

tyingq wrote: post #6
milliams wrote: post #3

Even though this will likely prevent OpenTF from connecting to registry.terraform.io to get plugins, the source code for most (all?) plugins is still open source and actually stored on GitHub (e.g. https://github.com/terraform-provider-openstack/terraform-pr... ). More work for OpenTF to get up and running, but also feels reasonable that HashiCorp wouldn't allow connecting to their service.

>still open source and actually stored on GitHub I think that's true, but it's probably hard to recreate large parts of the index. I don't think there's any mandatory manifest or something like that where you can reliably identify a repo as something that appears in their registry. Probably some missing metadata too.

It's... effort consuming, but is doable and more like a 1-time effort.

A while ago I built an alternative plugin manager for Terraform (https://github.com/paraterraform/para) and explored the idea of distributed indices (where you just host a file in the repo as seen in https://github.com/ashald/terraform-provider-stateful/blob/m...).

So at the end of the day, it's either about the effort to inventory the current registry and find sources that are available, or do this on an ongoing as-needed basis (eg something like para would allow an index to be hosted in a github repo managed with PRs).

Re: The Terraform Registry Terms of Service have been updated

#34

Post by sigwinch28 »

chippiewill wrote: post #12
jrudolph wrote: post #8

Getting a lot of docker hub vibes from this one. HashiCorp is course within their rights. Can't be cheap to run the registry given the obscene size of some terraform providers. $ ls -lah terraform/providers/registry.terraform.io/hashicorp/aws/5.14.0/darwin_amd64/ total 368M Anyone have an idea of the reasons terraform needs a 370 MiB binary just to call REST APIs?

I think the providers might actually come from GitHub because the registry insists you have them as release assets

That indeed seems to be the case. Seems that for community providers, HashiCorp is serving up JSON which refers to GitHub download links.

Here’s a sample size of 1: https://registry.terraform.io/v1/providers/spacelift-io/spac...

According to the provider registry protocol, which I have previously implemented for internal hosting (in an afternoon of writing a single file of Python): https://developer.hashicorp.com/terraform/internals/provider...

Re: The Terraform Registry Terms of Service have been updated

#35

Post by tyingq »

rwmj wrote: post #22

What's the legal theory that allows HashiCorp to control the use of data after downloading it? Is it like if I offered MP4 files on my website that can be downloaded by anyone but added the condition you must view them in VLC only? (which I'm fairly sure would be unenforcible even if the MP4 files were proprietary content)

There's all sorts of them. Here's one example, in the EU:

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A...

The bigger thing, though, is that they don't necessarily need to be on completely solid legal ground. Just enough semi-plausible legal ground to out-spend you on the matter.

Re: The Terraform Registry Terms of Service have been updated

#36

Post by scarface_74 »

armchairhacker wrote: post #31
jeremyjh wrote: post #28

Earlier quoted context omitted.

I think this damages all commercial OSS projects. Because after Docker and Terraform, any effort to bring in some OSS project as a dependency will be met with "Sure, it's open source now, but what about when...".

IMO it shouldn't be much different than "sure, it's open source now, but what if it stops being maintained?" Because open-source code never stops being open-source, it just stops getting open-source updates. Closed-source in some situations can prevent you from using existing software; you also have other closed-source issues like bugs being unfixable. Would you rather use a service that worst-case, you have to patch…

> Would you rather use a service that worst-case, you have to patch and maintain yourselves?

Having to patch and maintain a complex piece of open source code yourself for most smaller non tech companies for all practical purposes means that it might as well be abandoned closed source code.

Re: The Terraform Registry Terms of Service have been updated

#37

Post by candiddevmike »

yuppie_scum wrote: post #19
cube2222 wrote: post #15

Hey! Just wanted to say that this doesn't impact OpenTF too much. It's an extra step we need to take before a stable release, but long-term it'll make us more decoupled, which is great. As someone else commented, all providers and modules other than Hashicorp's are hosted on GitHub and the registry is just a "redirector". We'll do something similar, other than some special handling for Hashicorp's providers. Also, I…

I sure hope that opentf doesn’t just cause a fragmentation in the ecosystem that ruins the user experience, especially for the many people who are happily using unpaid TF and self hosted state stores.

Why aren't you interested in switching to OpenTF?

Re: The Terraform Registry Terms of Service have been updated

#38

Post by bloopernova »

The leadership at Hashicorp doesn't seem to "get" open source development, or at least doesn't seem to value the community of their customers.

The change of license could have been attributed to them trying to protect their SaaS business if you squinted. But now they're saying "this is ours and you can't play", even though that hurts tf in the long run due to alienation of the community. I get that they need to generate revenue, but I don't understand how alienating their customers makes money even in the long term?

Did leadership or ownership change recently?

Re: The Terraform Registry Terms of Service have been updated

#39

Post by candiddevmike »

cube2222 wrote: post #15

Hey! Just wanted to say that this doesn't impact OpenTF too much. It's an extra step we need to take before a stable release, but long-term it'll make us more decoupled, which is great. As someone else commented, all providers and modules other than Hashicorp's are hosted on GitHub and the registry is just a "redirector". We'll do something similar, other than some special handling for Hashicorp's providers. Also, I…

Happy to help provide mirrors for an OpenTF registry if necessary

Re: The Terraform Registry Terms of Service have been updated

#40

Post by m-p-3 »

I mean it's reasonable for HashiCorp to limit who uses their infrastructure since they foot the bill for it. Google did a similar thing for the Chrome Web Store to download extensions when Microsoft released Edge, pushing Microsoft to host its own distribution channel.
Post reply on HN