Live data from Hacker News

MongoDB's Server Side Public License Is Likely Unenforceable

processmechanics.com

191–200 of 245 posts

Re: MongoDB's Server Side Public License Is Likely Unenforceable

#191

Yeah, I'm not necessarily opposed to the general spirit of what they're trying to do here, but this license just doesn't make sense in practice. Now that I've had more time to look at it, I'd really recommend that everybody stay the f%!# away from MongoDB. This bit in particular really hits the nail on the head: Let's assume that it is ok somehow to pass forward other open source software, solving that problem. What…

After spending some time reviewing this licencse the only conclusion I come to is that this license is malicious...let me explain Let say you are a young startup building a cool SaaS solution. E.g. A data analytics solution. If you make heavy use of MongoDB it is very possible that down the line the good folks at MongoDB come calling since "the value of your SaaS derives primarily from MongoDB..." So at that point yo…

I think we're all on the same page about the shoddiness of being in the open source insurance business, but that is not what the SSPL is for, nor could it be used for that. We simply can't make the claim that any SaaS other than specifically MongoDB as a service derives primarily from MongoDB -- or rather, it it's possible to make the claim, but it's easier to defeat it.

Re: MongoDB's Server Side Public License Is Likely Unenforceable

#192
post #20
post #8

Earlier quoted context omitted.

No. If you take MongoDB and offer it as SaaS, the additional software that's part of your offering, such as monitoring, backup solutions, etc, have to be open-sourced, or you have to make their code available (since the chair of OSI defines what's open source).

I just had a call with MongoDB sales yesterday, and specifically asked if the licence changes impacts us, where we use Mongo as a datastore for our application, but we're not offering Mongo itself as a service. They were very quick and clear to say that the change is about those providers offering Mongo itself as a service. Using mongo in your stack to provide your service is not implicated at all. The only grey area…

Statemens made by sales, are they legally binding?

Re: MongoDB's Server Side Public License Is Likely Unenforceable

#193
post #186

Earlier quoted context omitted.

No apologies required! If we see this question come up a lot we can add it to the FAQ. MongoDB does not release the stack for Atlas, our SaaS. That's possible because we own the copyright to the source code -- we don't have to issue the software to ourselves. The blog post we published announcing the change covers this, as well as our motivations and expectations in a lot of detail: https://www.mongodb.com/blog/post/…

that's sketchy and means you are violating your own license. and since there is no dual licensing or anything that says that the mongodb inc does not do what the license says...

They aren't violating anything. They own the copyright. The license exists for everyone else that isn't MongoDB Inc. They can do as they please and this isn't sketchy or in violation of everything. Open source software still has copyright and the owner of the copyright has no limitations to what they can do with the software they own. Open source software comes with a license which limits what everyone else can do with the software.

Re: MongoDB's Server Side Public License Is Likely Unenforceable

#194

Earlier quoted context omitted.

After spending some time reviewing this licencse the only conclusion I come to is that this license is malicious...let me explain Let say you are a young startup building a cool SaaS solution. E.g. A data analytics solution. If you make heavy use of MongoDB it is very possible that down the line the good folks at MongoDB come calling since "the value of your SaaS derives primarily from MongoDB..." So at that point yo…

I think we're all on the same page about the shoddiness of being in the open source insurance business, but that is not what the SSPL is for, nor could it be used for that. We simply can't make the claim that any SaaS other than specifically MongoDB as a service derives primarily from MongoDB -- or rather, it it's possible to make the claim, but it's easier to defeat it.

The whole point of this discussion is that MongoDB, Inc could make that claim (as you agree)...and we as users of MongoDB will have to spend money fighting off that claim. You'd have to pretty naive to use software that has these terms.

Re: MongoDB's Server Side Public License Is Likely Unenforceable

#195
post #34

Earlier quoted context omitted.

I'm sure that there are tasks for which non-relational stores might be better suited, but pretty much anything MongoDB does, Postgres does it better and in a more performant way (esp after the optimizations to the JSONB data type in the last few major releases).

So, I've been trying to figure this out a bit lately. How would you go about writing a customer facing query builder that is analogous to the MongoDB aggregation pipeline with SQL? With MongoDB I could conceivably generate/store a JSON object for such a query. In SQL it seems a lot more obtuse to do.

Keep it simple: stick with MongoDB-like JSON objects for queries but write some code to map those queries to SQL immediately before execution.

Re: MongoDB's Server Side Public License Is Likely Unenforceable

#196

Earlier quoted context omitted.

No apologies required! If we see this question come up a lot we can add it to the FAQ. MongoDB does not release the stack for Atlas, our SaaS. That's possible because we own the copyright to the source code -- we don't have to issue the software to ourselves. The blog post we published announcing the change covers this, as well as our motivations and expectations in a lot of detail: https://www.mongodb.com/blog/post/…

That takes some level of hypocrisy - you are not making your Atlas as opensource, but you require others to do so. This clearly indicates that you are using an opensource license as an extortion schema against competitors.

It absolutely does not make them hypocritical. They own the copyright and can do as they choose. They simply don't want other companies getting rich on their back by simply offering a MongoDB SaaS. Why is it OK for AWS to just take a project and start making millions off of it while the people who invested in the project get nothing? AWS and similar cloud companies are simply trying to strip mine all the value from some popular open source projects and contribute nothing back. Most of these cloud companies show zero interest in partnering with the copyright owners so now we're seeing copyright owners take a stand against this exploitation.

There's a big difference between a piece of free software being vital to your codebase and you simply selling that free software as-a-service.

Re: MongoDB's Server Side Public License Is Likely Unenforceable

#197

Earlier quoted context omitted.

weary (tired) -> wary (concerned) not nit-picking, just attempting to help other readers who aren't native English speakers

For those that don’t know, they are sometimes pronounced the exact same, which is why they are often mixed up (see also affect and effect). Where I’m from weary is pronounced WEER-y though.

They're also sometimes spelled the same. Doesn't make it correct.

Re: MongoDB's Server Side Public License Is Likely Unenforceable

#198
Huh. So, the rush to release and announce the license before OSI vetted it, was in fact VERY VERY intentional. Not some poorly planned "rush the news out" mismanagement.

And the recent stink on HN where OSI claimed MongoDB was not Open Source because the license had not yet been reviewed, with many claiming (correctly) that OSI is not the determiner of what is open source, appears to have been out of order.

I think there was a base assumption that the license would in fact be fine, and OSI claiming it wasn't because they hadn't stamped it ... yet ... was overreaching.

Anyway my understanding is that the single largest user (and commercial licensee) of MongoDB hates it and can't wait to get away from it. With that in mind, this licensing nonsense smells like a desperate grab. Maybe it's time to short $MDB?

Re: MongoDB's Server Side Public License Is Likely Unenforceable

#199

Disclosure: I work for MongoDB. If you look at these two threads you'll find my comments in them, addressing similar concerns to those raised in this one. https://news.ycombinator.com/item?id=18229452 https://news.ycombinator.com/item?id=18229013 To reiterate those comments, the SSPL only affects people who are offering the licensed software to the public as a service. This does not include any software that uses Mon…

> The FAQ we put out here makes that clear ...while the license itself absolutely does not. I can read the GPL and tell what's expected of me, but I have no idea how to interpret clauses like: > Making the functionality of the Program or modified version available to third parties as a service includes, without limitation, enabling third parties to interact with the functionality of the Program or modified version re…

Absolutely I understand. And you taking the time to articulate the issues is generous, and I appreciate that as well.

I make no claim that the SSPL is as easy to understand as the GPL. It's not. IMO the GPL's domain is such that it's easier for it to capture its intention succinctly. Do you link your software to this library? No? You're in the clear. You do? Then your software has to be released under the GPL.

The SSPL wants one thing: for people who make software available as a service to release their service stack under the SSPL. The problem is that defining "as a service" too narrowly makes it easy to circumvent. Imagine you used a really narrow definition, something along the lines of "running and managing an unmodified version of the software on behalf of someone.” It would be easy to add a single junk feature and get out of that obligation.

Every ambiguity you cite in the license is precisely crafted to thread that needle. Lawyers can certainly debate whether it was done so effectively, but the way I see it, we are looking at competing design goals: 1) embody the above licensing requirements, and 2) be easily comprehensible to laypeople. In a perfect world, these goals would not be in competition, but as we designed the SSPL, it was clear that they are.

The language you cite in your concern here is a good example of that:

>> or offering a service that accomplishes for users the primary purpose of the Software or modified version.

>Does not explicitly mention MongoDB, except by contrast implying that if we offer a service - even one not MongoDB-based - that accomplishes the primary purpose of MongoDB or a fork of it, then we're subject to the new terms.

At first glance, that last phrase "or offering a service that accomplishes for users the primary purpose of the Program or modified version" is an astounding overreach; it seemingly attempts to obligate you to release completely unrelated software under the SSPL just because it provides the licensed software's behavior. But the mere fact of a license's existence cannot obligate you to its terms; you have to use the licensed software. So it follows that the clause only affects you if your "unrelated" software is used to provide the same functionality as the licensed software that you are using in the service. I.e. you wrap the software in a clean-room implementation of a connecting driver and then build an external proxy that offers an identical API to the wrapped software but uses none of its code.

I hope that example at least makes clear that the language used in the SSPL doesn't introduce ambiguity for its own sake, or as a means to drive users to commercial licenses, it is a byproduct of the need to counter real-world means of circumventing its requirements.

>> offering a service the value of which entirely or primarily derives from the value of the Program or modified version,

>Explicitly calls out interacting with MongoDB. My company's website is basically a wrapper around accepting a query from a user, converting that into the appropriate NoSQL query, reformatting the result, and presenting it to the users. Since our web server is more or less an abstraction layer from the underlying database, it sounds like our whole website would be subject to the new terms.

Looking at the example of your company's website, I would say with complete certainty that it is not affected. You are not making that database's functionality available to anyone, and no matter how thin the functional layers are that you put on top of it, the value you provide doesn't derive primarily from the value the database provides.

Now, without implying that the SSPL is so perfectly crafted that it needs no refinement, I'd like to present this thought experiment:

If the area that the SSPL seeks to cover inherently means that its language has to be less straightforward, but if also it is shown to be legally sound and confined to the territory we claim it to be, then is it a worthy endeavor to pursue? If so, what constitutes "shown to be legally sound" etc.?

Re: MongoDB's Server Side Public License Is Likely Unenforceable

#200
Cloud computing is becoming the dominant model, and the current combination of OSS licenses and public cloud players/incentives make it nearly impossible for OSS companies to monetize in the cloud. While there are no perfect answers, we either need to come up with new licenses (difficult) or pursue a new approach to cloud (decentralization) that supports OSS monetization.
Post reply on HN