Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Elasticsearch is open source, again

elastic.co

Post reply on HN
Print view View original

351–360 of 473 posts

Re: Elasticsearch is open source, again

#351

Post by cduzz »

_pdp_ wrote: post #265
adrianco wrote: post #257

Here’s the initial AWS response to the license change that they made in 2018, which I helped write. At the time we didn’t think a new license made sense, as AGPL is sufficient to block AWS from using the code, but the core of the issue was that AWS wanted to contribute security features to the open source project and Elastic wanted to keep security as an enterprise feature, so rejected all the approaches AWS made at…

Unfortunately many companies charge extra for security where security should be the default. Truth to be told there some some situations where extra security costs could be justified but there are not many if charge is necessary it should be considered as a temporary measure. My $0.02.

I'm not sure what you mean by "security" in this context.

Identity management, role based access control, useful audit logs; all "enterprise" features, probably are very expensive to implement, and make for obvious "up-charge" product segmentation.

I suspect there's some combination of "the community doesn't add useful implementations of these features" and "we can't possibly risk our reputation based on some community contribution" and "we can use this to segment our product to sell to some and give it away to some."

This set of features seems to always get put in the "enterprise, only for licensed / supported customers" and it stinks.... I can understand why, though, and none of these are strictly speaking "security" as much as "compliance"

Re: Elasticsearch is open source, again

#352

Post by adolph »

willcipriano wrote: post #337
nijave wrote: post #331

Earlier quoted context omitted.

Security is a basic non functional requirement for all software.

Then don't use it? It's non-functional right? I don't get where the complaints come in. Side note: Security in these discussions is often something more like "It works with my single sign on system" or "It lets me check this box on my audit form". Security doesn't only have to happen at the app layer and it's completely doable to isolate any software in a way that is is secure despite itself. So it's less security an…

> Security doesn't only have to happen at the app layer

Agreed and once an application has differentiation between a “super user” and users of fewer privileges, it needs an application security model. Additionally once there are differences in which data a user may access, it needs a data security model.

Re: Elasticsearch is open source, again

#353

Post by jen20 »

Nathanba wrote: post #144
andrewmutz wrote: post #113

For use by businesses, the AGPL is a nightmare from my perspective. What does it actually require on behalf of a company using AGPL components? If I write my own library and link statically I need to release that? What about if I link it dynamically? What if the library is running on a separate machine and is separated by the network? I'm sure there will be people commenting in this thread that they understand exactl…

Those are the same reasons for why I avoid AGPL (and GPL frankly, because I dont want to make my frontend code fully open source either). I always thought that when a project is AGPL then I might as well consider it off limits for myself because if any of my code is touching it and then that code indirectly eventually reaches users via the network then wouldn't that also mean that I have to open source everything? I…

> In an ideal world we would have a license where you're required to open source only the changes you make to the 3rd party code, not everything that surrounds it

Good news! That license mostly exists: it’s called AGPL.

The one where you have to open source “everything” (not really everything, but close to it) is SSPL [1], but that requirement only applies in certain circumstances.

[1]: https://en.wikipedia.org/wiki/Server_Side_Public_License

Re: Elasticsearch is open source, again

#354

Post by hungie »

wavemode wrote: post #342
hungie wrote: post #336

I'm increasingly of the opinion that the definition of "open source" that narrowly defines open source is going to be the thing that contributes to the reduction of open source software. Open source communities are essentially anarchist syndicates, collectively working towards common good. Groups like Amazon coming in and taking their work and selling it, profiting to the tune of millions, and contributing nothing ba…

You can be as tired of it as you want, but tiredness doesn't change the meaning of words. What you probably want instead is "fair source": https://fair.io/ Like their names imply, open source is about source being open. Whereas fair source is about ensuring that code is used fairly. I would argue that people contributing to open source shouldn't be putting themselves in a position to be "actively exploited". If that'…

You speak as if there is a divinely written definition for the words "open source". There is not, there's a group of people who have said, "this is ok, this is not".

I'm of the opinion that those people have made a mistake that will work against them, and they should consider revising their definition.

Re: Elasticsearch is open source, again

#355

Post by donor20 »

This is their somewhat muddy response to the “trolls” who might say

“Changing the license was a mistake, and Elastic now backtracks from it”.

We removed a lot of market confusion when we changed our license 3 years ago. And because of our actions, a lot has changed. It’s an entirely different landscape now. We aren’t living in the past. We want to build a better future for our users. It’s because we took action then, that we are in a position to take action now.

Re: Elasticsearch is open source, again

#356

Post by skywhopper »

weinzierl wrote: post #292
adrianco wrote: post #257

Here’s the initial AWS response to the license change that they made in 2018, which I helped write. At the time we didn’t think a new license made sense, as AGPL is sufficient to block AWS from using the code, but the core of the issue was that AWS wanted to contribute security features to the open source project and Elastic wanted to keep security as an enterprise feature, so rejected all the approaches AWS made at…

"as AGPL is sufficient to block AWS from using the code" I have taken this position in another thread a while ago, but the responses seemed to indicate that this is not a clearly cut situation at all. If it was, what is the point of the "source-available" licenses in the first place? I mean, the idea that they were invented to cut out AWS is pretty prevalent, no?

AGPL doesn't forbid Amazon from providing a competitive service using the software. Elastic License/SSPL/BSL all do. That's the difference.

Re: Elasticsearch is open source, again

#357

Post by bad_user »

sanderjd wrote: post #322
jchw wrote: post #119

Earlier quoted context omitted.

For the most part I don't think people are against shared source or closed software existing, being sold, being marketed, etc. There's really only two things people viscerally don't like: - Marketing a project that isn't open source as open source. Debate about what the "definition" is or why it matters all you want; taking a term and using it in a way that contradicts the vast majority of domain experts is bullshit.…

I think you make good points here, but it's also annoying that the words "open source" are defined to mean something a lot more specifically detailed than what the words themselves intuitively mean. For instance, your post calls things "shared source", which, to me, is a lot less clear of a description for the projects you're describing that way. ("Shared" how? Shared ownership? Or what?) I think "source available" i…

"Shared source" comes from Microsoft's initiative, back in Ballmer's days when they were attacking Linux with FUD campaigns and patent threats (which continued well after their "Microsoft changed" marketing campaign).

https://en.wikipedia.org/wiki/Shared_Source_Initiative

The software industry called their initiative for what it is. Whether it's "shared source" or "source available", it's a poisoned gift. In the case of Microsoft's shared sources, this was because it was opening up readers of that source to the possibility of patents lawsuits. I remember for instance that Microsoft was making more money from Android, by threatening phone makers with patents, than they did from Windows Mobile.

Re: Elasticsearch is open source, again

#359

Post by skywhopper »

perryizgr8 wrote: post #279
adrianco wrote: post #257

Here’s the initial AWS response to the license change that they made in 2018, which I helped write. At the time we didn’t think a new license made sense, as AGPL is sufficient to block AWS from using the code, but the core of the issue was that AWS wanted to contribute security features to the open source project and Elastic wanted to keep security as an enterprise feature, so rejected all the approaches AWS made at…

I don't know if this was part of the issues but adding authentication to Elastic APIs and Kibana is so confusing and complicated that it is almost impossible to do unless you go for a managed solution. I'm sure that one factor alone motivates a lot of users to buy the service instead of hosting their own using the available source.

Yeah, this is an underrated aspect of all the managed hosting options out there. If vendors made it easy to deploy their code, folks would be far more willing to run it themselves. But just rolling out a simple production-ready cluster of most software is a nightmare of complexity. (Note that while open-source software is often not great at this, proprietary software is often just as bad or worse. This is not a side-effect of open-source. It's a failure of prioritization of the operator experience.)

Re: Elasticsearch is open source, again

#360

Post by skywhopper »

donor20 wrote: post #355

This is their somewhat muddy response to the “trolls” who might say “Changing the license was a mistake, and Elastic now backtracks from it”. We removed a lot of market confusion when we changed our license 3 years ago. And because of our actions, a lot has changed. It’s an entirely different landscape now. We aren’t living in the past. We want to build a better future for our users. It’s because we took action then,…

This statement is confusing to me. I never found the old situation confusing, until Elastic started adding invented licenses and trying to claim openness while monopolizing the right to host their software. That was confusing.
Post reply on HN