Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Redis changes license from BSD-3 to dual RSALv2+SSPLv1

github.com

Post reply on HN
Print view View original

11–20 of 25 posts

Re: Redis changes license from BSD-3 to dual RSALv2+SSPLv1

#11

Post by mhitza »

martinky24 wrote: post #9
blagie wrote: post #8

I am building a major open-source package around redis. This kills it. AGPL, I could go with. AGPL/proprietary dual licensing works well. There's an open ecosystem and a closed one. Non-free is a non-starter. It's no longer GPL-compatible. EVERY project under the GPL using redis now has a potential legal liability from (what's looking like) a sleazeball company. Now I need to figure out if I should move to a fork or…

> I expect distributions like Debian, and Ubuntu by proxy, will move away from having a redis .deb as well. What about this change indicates that? This sounds like fearmongering, the new licenses really shouldn't affect this use case?

It's reality not fear mongering. Most distros (maybe all?) don't include non open source projects in their repos/distribution channels. You'll likely have a separate install step to include RedisLabs repositories before installing redis.

Re: Redis changes license from BSD-3 to dual RSALv2+SSPLv1

#12

Post by Pet_Ant »

blagie wrote: post #10
martinky24 wrote: post #9

Earlier quoted context omitted.

> I expect distributions like Debian, and Ubuntu by proxy, will move away from having a redis .deb as well. What about this change indicates that? This sounds like fearmongering, the new licenses really shouldn't affect this use case?

The new license is incompatible with Debian policy: https://www.debian.org/doc/debian-policy/ch-archive.html#the... The new licensing scheme effectively excludes redis from most of the open ecosystem, by cascading network effects from things like this. In this case, if you're building a package, if you pick redis, you've excluded yourself from distribution in many major distros. Ditto for many other similar effects.…

That only prevents them from adding newer versions of Redis. The current version is still fine and I'm sure that the community will patch any security holes that are discovered.

Re: Redis changes license from BSD-3 to dual RSALv2+SSPLv1

#14

Post by remram »

Pet_Ant wrote: post #7

I haven't read this license but I wished they had at least gone with the BASL. https://en.wikipedia.org/wiki/Business_Source_License IANAL, but AFAICT the BASL is not open-source, but it is _eventually_-open-source is in the source will automatically transition to being open source (GPL v2 or compatible... not sure if either BSD or AGPL work). But if you are going to go source available, license proliferation is stil…

The SPDX identifier for Business Source License is BUSL: https://spdx.org/licenses/BUSL-1.1.html

I have never seen anyone refer to it as "BASL".

Re: Redis changes license from BSD-3 to dual RSALv2+SSPLv1

#15

Post by k_roy »

Pet_Ant wrote: post #12
blagie wrote: post #10

Earlier quoted context omitted.

The new license is incompatible with Debian policy: https://www.debian.org/doc/debian-policy/ch-archive.html#the... The new licensing scheme effectively excludes redis from most of the open ecosystem, by cascading network effects from things like this. In this case, if you're building a package, if you pick redis, you've excluded yourself from distribution in many major distros. Ditto for many other similar effects.…

That only prevents them from adding newer versions of Redis. The current version is still fine and I'm sure that the community will patch any security holes that are discovered.

And this will work out for what, 6 months?

Re: Redis changes license from BSD-3 to dual RSALv2+SSPLv1

#16

Post by lathiat »

Pet_Ant wrote: post #12
blagie wrote: post #10

Earlier quoted context omitted.

The new license is incompatible with Debian policy: https://www.debian.org/doc/debian-policy/ch-archive.html#the... The new licensing scheme effectively excludes redis from most of the open ecosystem, by cascading network effects from things like this. In this case, if you're building a package, if you pick redis, you've excluded yourself from distribution in many major distros. Ditto for many other similar effects.…

That only prevents them from adding newer versions of Redis. The current version is still fine and I'm sure that the community will patch any security holes that are discovered.

It works for a year or two, then enough of a delta builds up that people get confused at why the version is so old. New docs don’t apply, etc. Similar issue has played out with MongoDB and Docker.

Plus it’s basically unmaintained so the bugs will build up and the security burden is higher since upstream will stop making their security patches under the old license (which they especially state they will do in the FAQ).

Best either retired or migrated to a fork (for Debian)

Re: Redis changes license from BSD-3 to dual RSALv2+SSPLv1

#17

Post by bananapub »

martinky24 wrote: post #9
blagie wrote: post #8

I am building a major open-source package around redis. This kills it. AGPL, I could go with. AGPL/proprietary dual licensing works well. There's an open ecosystem and a closed one. Non-free is a non-starter. It's no longer GPL-compatible. EVERY project under the GPL using redis now has a potential legal liability from (what's looking like) a sleazeball company. Now I need to figure out if I should move to a fork or…

> I expect distributions like Debian, and Ubuntu by proxy, will move away from having a redis .deb as well. What about this change indicates that? This sounds like fearmongering, the new licenses really shouldn't affect this use case?

this is a very weird claim.

most Linux distributions take free software/open source pretty seriously, and will not ship random proprietary things (at least) as part of the main distribution.

the new redis license is clearly not open source/free software, and so new versions won't be in Debian or Fedora etc. since it's a network daemon, no one is going to want to keep an ancient unsupported version and I doubt any distribution packager will want to maintain a fork, and so redis will be removed and at best a maintained fork will replace it.

Re: Redis changes license from BSD-3 to dual RSALv2+SSPLv1

#18

Post by bananapub »

truly a bizarre way of doing a dumb thing - they do not own the copyright of all the Redis code, so they cannot "change the license" of the existing code at all.

instead, they need to license their new contributions under the new license, which will effectively make the combined blob of code only available under the new license.

doesn't change what they're doing, but it's just disrespectful, incorrect and a breach of everyone else's copyright to remove the existing license and headers.

Re: Redis changes license from BSD-3 to dual RSALv2+SSPLv1

#19

Post by evanmoran »

ChrisArchitect wrote: post #13

[dupe] ( https://news.ycombinator.com/item?id=39772562 ) A more recent development of interest: Redict is an independent, copyleft fork of Redis https://news.ycombinator.com/item?id=39789986

This fork is LGPL. Does anyone know of a fork that remains BSD? I’m sure this is fine for many people, but it isn’t ok for what I’m working on.

Update: it looks like KeyDB is a good one.

https://github.com/Snapchat/KeyDB

Re: Redis changes license from BSD-3 to dual RSALv2+SSPLv1

#20

Post by Pet_Ant »

remram wrote: post #14
Pet_Ant wrote: post #7

I haven't read this license but I wished they had at least gone with the BASL. https://en.wikipedia.org/wiki/Business_Source_License IANAL, but AFAICT the BASL is not open-source, but it is _eventually_-open-source is in the source will automatically transition to being open source (GPL v2 or compatible... not sure if either BSD or AGPL work). But if you are going to go source available, license proliferation is stil…

The SPDX identifier for Business Source License is BUSL: https://spdx.org/licenses/BUSL-1.1.html I have never seen anyone refer to it as "BASL".

Too late to edit it now, thanks for the correction. I knew there was a vowel in there and it was just "BSL" as the Wikipedia page has it. My bad.
Post reply on HN