Live data from Hacker News

Nutanix Objects violates MinIO’s open source license

blog.min.io

31–40 of 149 posts

Re: Nutanix Objects violates MinIO’s open source license

#31
post #29
post #9

Any recommendations on MinIO forks or open-source alternatives with more welcoming licenses? They changed their license from Apache recently. https://en.wikipedia.org/wiki/MinIO#Re-licensing

How is the AGPL not welcoming?[1] [1] https://drewdevault.com/2020/07/27/Anti-AGPL-propaganda.html

It's only not welcoming to those who wish to close the source.

It's the paradox of tolerance: you must not tolerate those who find others intolerable.

Re: Nutanix Objects violates MinIO’s open source license

#32

Earlier quoted context omitted.

You are being downvoted but I actually think there are some fair points that you are making. We use a lot of FOSS in our company. We pay licenses and contribute very little (our job isn't to improve gitlab or docker, we are shipping a software product on top of that), but I wouldn't know where exactly we are in the legal-illegal spectrum to save my life. I consider myself an employee, not an entrepreneur. If I was an…

For the record, opensource licenses are generally fairly understandable.

And if you're lazy, there are websites which gives you a summary of it: https://tldrlegal.com/licenses/tags/OSI-Approved

I'm really starting to think that companies violating OSS licenses is often times malice, not ignorance.

Re: Nutanix Objects violates MinIO’s open source license

#33

Sometimes it's pretty cut and dry, just people using open source without attribution and hoping that nobody will find out. But why? MinIO is licensed under AGPL (the current versions, at least): https://github.com/minio/minio/blob/master/LICENSE It effectively mandates that the modified version needs to be made available: https://en.wikipedia.org/wiki/GNU_Affero_General_Public_Lice... The GNU Affero General Public Li…

No idea about the relationship between MongoDB and DigitalOcean, but note that you've linked to the "community" edition; their site also shows an "enterprise" edition, which is more likely for a large entity like DigitalOcean to be using.

Why is it more likely?

Re: Nutanix Objects violates MinIO’s open source license

#34

Sometimes it's pretty cut and dry, just people using open source without attribution and hoping that nobody will find out. But why? MinIO is licensed under AGPL (the current versions, at least): https://github.com/minio/minio/blob/master/LICENSE It effectively mandates that the modified version needs to be made available: https://en.wikipedia.org/wiki/GNU_Affero_General_Public_Lice... The GNU Affero General Public Li…

> DigitalOcean, for example, proudly advertises managed MongoDB as a service: https://www.digitalocean.com/products/managed-databases-mong ... > And yet, to the best of my understanding, the entirety of the DigitalOcean platform isn't open source (even though many projects are): https://github.com/orgs/digitalocean/repositories I don't think it's required to open source everything, only the bits that provide the Mong…

> I don't think it's required to open source everything, only the bits that provide the MongoDB service. I don't know if they've done that.

Yes, that's my exact point - these things are sometimes full of finer points. I don't doubt that DigitalOcean have talked with MongoDB and have probably figured out some sort of a deal, or another way to offer it as a service (someone mentioned them using the enterprise version, where the terms are probably different).

Though offering MongoDB as a service for a small no-name company all of the sudden seems impossible, unless they actually want to open soruce lots of their own code.

> Also, the SSPL seems to be a little controversial [1] as it appears to want to relicence all software it's running near under itself.

Of course, there was backlash to it even existing, much like larger companies didn't really like AGPL being a thing either.

Then again, I guess one could argue that MongoDB definitely can create such a license, as a reaction against cloud platforms utilizing their solution: https://www.mongodb.com/blog/post/mongodb-now-released-under...

  This should be a time of incredible opportunity for open source. The revenue generated by a service can be a great source of funding for open source projects, far greater than what has historically been available. The reality, however, is that once an open source project becomes interesting, it is too easy for large cloud vendors to capture most of the value while contributing little or nothing back to the community. As a result, smaller companies are understandably unwilling to wager their existence against the strategic interests of the large cloud vendors, and most new software is being written as closed source.
I don't really have a horse in that race, though in theory such a license would be good for the open source community, whilst its effects on larger cloud vendors are also pretty much clear. Of course, there is a lot of controversy around it and it's not considered "open source" at all by many.

Re: Nutanix Objects violates MinIO’s open source license

#35

Sometimes it's pretty cut and dry, just people using open source without attribution and hoping that nobody will find out. But why? MinIO is licensed under AGPL (the current versions, at least): https://github.com/minio/minio/blob/master/LICENSE It effectively mandates that the modified version needs to be made available: https://en.wikipedia.org/wiki/GNU_Affero_General_Public_Lice... The GNU Affero General Public Li…

No idea about the relationship between MongoDB and DigitalOcean, but note that you've linked to the "community" edition; their site also shows an "enterprise" edition, which is more likely for a large entity like DigitalOcean to be using.

That's a great point, thanks for bringing it up! I've updated my original post with this detail as a possible explanation, since it's the one that makes the most sense.

I guess that MinIO or any other company could also do something similar, have dual licenses, where interested parties can pay for commercial usage and whatnot.

Re: Nutanix Objects violates MinIO’s open source license

#36
post #23
post #3

They use a load of other FOSS software under the hood too, not least of which libvirt/KVM. I wonder how many other licences they're violating this way.

libvirt uses LGPL and the KVM/linux kernel uses GPL. Both are fine to keep to yourself if you run it on your own machine and only expose it over the network. MinIO uses AGPL which explicitly includes network usage so Nutanix is forced to provide all patches and associated code.

Recent versions of MinIO use AGPL. Much of what they talk about here are issues with Apache licensed code. (The switch happened in April 2021).

https://github.com/minio/minio/commits/master/LICENSE

This really seems like Nutanix just didn’t include the MinIO NOTICES file in their OSS disclosures for some reason. Something so minor should have been an easy oversight to fix. Without actually testing out Nutanix, it’s hard to know if they are actually violating this part of the Apache license. MinIO isn’t included in their “open source packages we use” webpage, but that’s not where the NOTICES message would need to be included. Either way, it’s odd that things escalated like this.

The newer AGPL versions of MinIO would offer its own licensing challenge for Nutanix (which is part of the reason for the switch to AGPL). But that’s not even what MinIO is focusing on in their post. MinIO also don’t show the version of their software that they claim Nutanix is using. And it’s very possible that Nutanix froze the minio version in April 2021 (quite likely the case).

Re: Nutanix Objects violates MinIO’s open source license

#37

Sometimes it's pretty cut and dry, just people using open source without attribution and hoping that nobody will find out. But why? MinIO is licensed under AGPL (the current versions, at least): https://github.com/minio/minio/blob/master/LICENSE It effectively mandates that the modified version needs to be made available: https://en.wikipedia.org/wiki/GNU_Affero_General_Public_Lice... The GNU Affero General Public Li…

nutanix uses the apache licensed version probably, which changed in 2021. so it's even more buzzling since they would've just needed a NOTICES file.

Re: Nutanix Objects violates MinIO’s open source license

#38

Around 2019, a lot of kubernetes distributions started popping up. They often bundle various open source solutions into one platform/PaaS and sell it to the end users. I wonder, - What are the consequences for these companies? - Do they share revenue with the open source projects? - Can they simply distribute these services without any consequences? - If not, When and How does a small open source project org enforce…

Note that projects in the cloud native space are mostly Apache-licensed. (For example, the CNCF only approves other licenses on an exception basis I believe.) In that case, so long as attributions/trademarks are honored (which oddly seems to not have been the case here), projects licensed in that way can be freely used with Kubernetes without other restrictions.

Re: Nutanix Objects violates MinIO’s open source license

#39
post #12

Earlier quoted context omitted.

Please don't blame engineers on every single issue. The engineer may not even know there's an issue here. They may be assured by their boss or legal department that they are in the clear. They may not even think about such mundane things like licensing and stuff, that's what they have higher ups for. If someone is to blame, then it's the company leadership and legal department. As much as we want to make us engineers…

> They may not even think about such mundane things like licensing and stuff Imagine a medical doctor or civil engineer claiming that knowing the laws of their professions is "mudane". That's why no one takes programers seriously. > we are not decision makers. You totally can decide to not work on stuff you are not comfortable with. It's not like there's a shortage of software engineering jobs.

> You totally can decide to not work on stuff you are not comfortable with.

I seriously don't get why engineers think they share no responsibility whatsoever for the company they work for. Somehow, they seem to think their situation is comparable to someone picking orders at an Amazon fulfillment center. Thinking they "have no choice" when making 6 figures and having to fight off the recruiters. That's just an easy excuse they tell themselves to help them sleep at night. It's an insult to workers who actually have little choice to do shitty jobs for shitty companies to put food on the table and can barely make ends meet.

Re: Nutanix Objects violates MinIO’s open source license

#40
post #2

Open and shut case. Disappointing that the Nutanix engineers care so little about their peers.

Please don't blame engineers on every single issue. The engineer may not even know there's an issue here. They may be assured by their boss or legal department that they are in the clear. They may not even think about such mundane things like licensing and stuff, that's what they have higher ups for. If someone is to blame, then it's the company leadership and legal department. As much as we want to make us engineers…

The engineer who includes the binary is responsible for understanding the ramifications
Post reply on HN