Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Elasticsearch is open source, again

elastic.co

Post reply on HN
Print view View original

371–380 of 473 posts

Re: Elasticsearch is open source, again

#371

Post by batch12 »

willcipriano wrote: post #337
nijave wrote: post #331

Earlier quoted context omitted.

Security is a basic non functional requirement for all software.

Then don't use it? It's non-functional right? I don't get where the complaints come in. Side note: Security in these discussions is often something more like "It works with my single sign on system" or "It lets me check this box on my audit form". Security doesn't only have to happen at the app layer and it's completely doable to isolate any software in a way that is is secure despite itself. So it's less security an…

Not only do I demand secure software by default, but I actively work to terminate relationships with companies who feel how you do. They can have whatever ideals they'd like, just none of the money I steward.

Re: Elasticsearch is open source, again

#372

Post by indymike »

willcipriano wrote: post #304
_pdp_ wrote: post #265

Earlier quoted context omitted.

Unfortunately many companies charge extra for security where security should be the default. Truth to be told there some some situations where extra security costs could be justified but there are not many if charge is necessary it should be considered as a temporary measure. My $0.02.

[flagged]

> Why is security free?

People don't want to get hurt, physically, emotionally, financially.

> Not just in software but in general?

People being harmed is very expensive.

> you need to pay tribute to those who can

This is a very primordial view of things. Security and safety are literally the underpinning of modern, western society. The cost of that security is baked into prices for services and products, taxes and law.

Re: Elasticsearch is open source, again

#373

Post by redwood »

sanderjd wrote: post #305
redwood wrote: post #295

Earlier quoted context omitted.

Out of curiosity, did you pursue a rev share model with Elastic (Co) for your Elastic managed service? I guess that's not something thay can be discussed openly but recognizing you probably had 10x their revenue in the managed service and another 10x their revenue in compute behind the OSS, I wonder if there could have been a proactive happy middle ground found years ago. I suppose that they might not have accepted s…

> But I do think it'd be a good look for AWS to proactively help these companies. But how much value does "a good look" have to AWS?

Depends on who sits in the antitrust seat. It's pretty incredible to realize the one who does today wrote this a few years ago: https://www.yalelawjournal.org/pdf/e.710.Khan.805_zuvfyyeh.p...

Re: Elasticsearch is open source, again

#374

Post by IceDane »

zymhan wrote: post #180
bytearray wrote: post #74

Earlier quoted context omitted.

What are we appreciating exactly?

Maybe a ridiculous writing style for a blog post about software licensing?

I was wondering what the fuck was going on and whether this was internal community meme or style that I just wasn't aware of. Turns out it's just cringey corporate goons being cringey corporate goons.

Re: Elasticsearch is open source, again

#375

Post by KingMob »

outop wrote: post #296
KingMob wrote: post #274

Earlier quoted context omitted.

Hyperbole aside, they certainly haven't given as much as they've gotten, though. E.g., remember when Heartbleed hit, and the world learned that OpenSSL was maintained by one person getting only $2000/year for it? Fixing Heartbleed was estimated to cost half a billion dollars world-wide.

> Hyperbole aside, they certainly haven't given as much as they've gotten, though. Agreed, but the point of sharing software is that it's not a zero sum game. The thing you create once is not diminished by me using it many times.

We still have to pay our bills under capitalism, though. Software copies might be infinite, but money isn't.

Re: Elasticsearch is open source, again

#376

Post by cduzz »

fieldcny wrote: post #362
cduzz wrote: post #351

Earlier quoted context omitted.

I'm not sure what you mean by "security" in this context. Identity management, role based access control, useful audit logs; all "enterprise" features, probably are very expensive to implement, and make for obvious "up-charge" product segmentation. I suspect there's some combination of "the community doesn't add useful implementations of these features" and "we can't possibly risk our reputation based on some communi…

Using your yardstick, we wouldn’t have any open source software, everything costs time to implement, that’s the point of open source, we donate time to the collective community. All those security features are not enterprise specific, they are rudimentary for any modern open source product

I'm saying that companies that opensource their products tend to distinguish "enterprise" and non-enterprise based on things like RBAC and audit mechanisms, neither of which is "security" as much as "compliance".

The original license owner, if a commercial enterprise trying to sell the product alongside the "open" version, has less incentive to accept those features from the community as it would reduce their sales of the enterprise version of the same thing, and may not align with their long-term product roadmap.

In open source, the team managing a codebase isn't under any obligation to accept contributions the community and you are welcome to fork the project, if you like.

Re: Elasticsearch is open source, again

#377

Post by CuriousCosmic »

wokwokwok wrote: post #267
CuriousCosmic wrote: post #210

Earlier quoted context omitted.

well importantly, Elastic was originally Apache-2.0. Then Amazon started using their stuff and they relicensed to their not-really-FOSS-license. Then Amazon forked their stuff, a bunch of legal conflicts happened. Now they are friends again. And now they relicensed to AGPL (which is FOSS). So they were originally Apache-2.0 which was permissive versus now they are AGPL which is copyleft. The important distinction her…

Realllllly? I sure hope not. There going to be some hard irony here, of making such a fuss about it before, when it was someone else doing it , and then doing it themselves. We’ll see. Maybe they’re principled enough not to rip off the open search contributions. If not, you’ve really got to believe there’s no sincerity left at elastic. I guess time will tell; I’d like to believe they’re better than that.

There's a difference though. Prior to the relicensing, Amazon had a private fork they were running and weren't contributing upstream. Only after the relicense did they open source their fork.

Now you have two open source projects and one has a copyleft license and the other has a permissive license.

Taking contributions from the permissive to the copyleft project isn't ripping off contributions. It's using open source software and collaborating in the FOSS ecosystem. And Amazon would be free to pull contributions back the other way just as well as long as they agree to the mutual terms of the AGPL (which is by all means a FOSS license).

Re: Elasticsearch is open source, again

#378

Post by rpdillon »

cortesoft wrote: post #218
ok_dad wrote: post #156

Earlier quoted context omitted.

What, when Amazon forked an open source project, as was allowed by the license, and continued to support that open source license even when the original company abandoned theirs? I’m not an Amazon fan, but they did the same thing (forking) that many others do, and they did it perfectly legally according to the license.

No one ever accused Amazon of breaking the law. The issue that Elastic had is that their entire business model was offering a managed elasticsearch solution. Amazon then created their own offering of the same thing, but of course since it is Amazon it was more tightly coupled with AWS and benefited from being a native AWS solution. There was simply no way for Elastic to compete with that. Now, there can be a lot of o…

Several years ago, I led a project at a startup to move from Postgres to Elasticsearch for geographic search. I chose Elasticsearch because it had the capability to do geohashing and so it provided a credible alternative to PostGIS for our particular use case. Geohashing-based search is particularly computationally intensive, which is somewhat different from traditional full-text search, which can be memory intensive.

I wanted to pay Elasticsearch to host our search cluster. And I did for a while. But it became clear we were paying for gobs of RAM that we weren't using and we didn't have enough CPU to really cover our search needs. I talked to the head of sales at the time and he said they were working on a plan that would allow us to choose machines that were more CPU heavy but that that was in the pipeline and there was no ETA.

So we switched to AWS and everything worked just fine.

All this is to say, Amazon was not offering the exact same service. They were offering a better service.

Re: Elasticsearch is open source, again

#379

Post by jkaplowitz »

maccard wrote: post #329
jkaplowitz wrote: post #298

Earlier quoted context omitted.

> Slightly off topic but it saddens me that so much time money and effort from incredibly smart people is spent on this bullshit. Was it bullshit when Debian wanted to make sure that Google Compute Engine images shipped as Debian didn't include proprietary software, components that would nonconsensually report telemetry to Google from within the guest operating system beyond what is inherent to the nature of any VM r…

You’ve missed my point a little - > Was it bullshit when Debian wanted to make sure that Google Compute Engine images shipped as Debian didn't include proprietary software, components Absolutely not. But, calling it Debian on Google Compute vs Google Compute for Debian has absolutely no bearing on whether they’re doing that or not. Like you, I’ve had similar discussions with lawyers on my side and “the opposition sid…

> Absolutely not. But, calling it Debian on Google Compute vs Google Compute for Debian has absolutely no bearing on whether they’re doing that or not.

It does have a bearing on whether Debian has a say in the matter, though. In fact, Google did ship customized images that didn't meet Debian's requirements to be called Debian alongside other ones which did until they were able to achieve good enough outcomes with the latter images - achieving this took a bunch of collaborative work over time.

Those other images were described in ways something like "Google Compute Engine-optimized images for Debian" (I forget the specifics), and indeed Debian completely agreed that they didn't have veto power over the contents of those images, assuming they were in fact for Debian instead of for a totally different operating system.

> Like you, I’ve had similar discussions with lawyers on my side and “the opposition side” and we’ve spent hours arguing over the semantics of these things while ignoring the root problem - in this case google bundling nonfree software with Debian and calling it Debian.

To be clear, Google did not bundle non-free software with Debian and call it Debian - they didn't even do that with their customized GCE-optimized images, though there were ways other than licensing in which those weren't up to the Debian trademark policy standards. Google did the right thing on this issue and only put free software inside all of those image images. But as you might imagine, plenty of people in Debian started out skeptical of that fact until they and Google collaborated enough for the truth to be clear.

> And yet here we are unfortunately discussing how we’ve come full circle, and I’m wondering how many thousands of people hours across google, elastic and all of their users were spent on dealing with a naming dispute.

My hours on this conversation don't count - I haven't worked for Google in almost a decade and am typing this in unpaid personal time.

And, speaking from firsthand memories of collaborating across Debian and Google on this, pretty much none of the discussion was about a naming dispute. Google agreed that Debian had the right to decide whether a modified image could be called "Debian", and Debian agreed that Google had the right use the word "Debian" in the descriptive way I've been highlighting when shipping images not approved to be called Debian.

The nature of the collaboration was much more productive than that: "Okay, Debian wants the images to meet this set of standards to be called Debian and meet Debian users' needs, Google wants the images to meet that other set of standards to be a proper Google offering and meet Google users' needs, some of the relevant standards / workflows / cultural attitudes aren't obviously compatible at first glance, but we acknowledge that we have some shared users who want Debian on GCE to work well for them. How do we achieve this?"

That's not a waste of time at all - and lawyers were not involved in the vast majority of those discussions, because it wasn't a legal dispute.

Similar good collaborations happened between Debian and the Azure and AWS teams, and some collaboration events even happened with Debian plus all three clouds. I must say, 2000s-era me would have been very surprised to see Microsoft hosting an event with Debian developers, giving them \\backslash\printer\paths in order to print something, and offering them Visual Studio subscriptions to enable working on Debian on Azure...

I should probably add a very clear disclaimer here: I am not speaking for Debian, their US fiscal sponsor and legal trademark owner Software in the Public Interest (SPI), Google, Amazon, or Microsoft in any of my comments on this Hacker News post, and while I retain very inactive affiliations with Debian and SPI, I have no current affiliation with any of the major cloud providers.

Re: Elasticsearch is open source, again

#380

Post by CuriousCosmic »

ok_dad wrote: post #222
CuriousCosmic wrote: post #208

Earlier quoted context omitted.

It's a bit more complicated than that because Elastic during all of this had some of the plugins in Amazon's OpenDistro (now OpenSearch) project recycling proprietary code from Elastic's commercial, source available codebase under OpenDistro's permissive Apache-2.0 license. https://www.elastic.co/blog/dear-search-guard-users-includin...

Your link specifically says Amazon didn’t steal the code, some German company did. I get it, Amazon is bad, I agree they are too, but not because they’re malicious, Amazon is bad because they’re too large to compete on level ground with anyone other than Google or Microsoft in the cloud. My peeve is with the companies like elastic that claim they are for open source but they try to prevent the open source from being…

> Your link specifically says Amazon didn’t steal the code, some German company did.

Yeah it's not that Amazon stole the code, it's that they were distributing stolen code. It's not as bad but it's still problematic unless Amazon immediately pulled said code when they were notified.

> My peeve is with the companies like elastic that claim they are for open source but they try to prevent the open source from being used as such. It’s a scam to attract developers who care about open source.

I think this was less about preventing open source from being used and more about picking the wrong license for their project. The way I see it they took the long way around because they were afraid of the AGPL.

They dual licensed under the SSPL (which is the AGPL with one change that makes it problematic) and the Elastic License (which they originally also provided code under a previous version of).

Then they are now finally getting around to moving from the SSPL to the AGPL (while technically still offering the SSPL).

Had they gone straight to the AGPL none of this would have been even worth discussing but a lot of people are afraid of that license in the same way people used to be scared of the GPL.

> If I made code I wanted to be open source, I’d understand that means everyone can use it, like a public road or a public park. That includes big corps.

Sure however if you chose an open source license, you probably don't want companies selling access to your software with a few extra closed source bits bolted on without contributing anything back. It's not legally wrong but it's a dick move and against the spirit of FOSS. So even then Amazon hadn't broke any laws but it'd make sense for a FOSS oriented company to pivot to a license they think would force upstream contribution. Elastic just fucked up and chose a bad license (SSPL) because they feared the AGPL. This is just them getting over that fear and picking the license they should have picked from day 1.

> At least Amazon actually supports the Apache licensed OpenSearch product!

They do now. When Elastic was Apache licensed they did not. That was the problem. It was only when they re-licensed Elastic that Amazon open sourced their fork. Had they not, OpenSearch would still be the closed source AWS ElasticSearch.

Post reply on HN