Live data from Hacker News

HashiCorp adopts Business Source License

hashicorp.com

381–390 of 760 posts

Re: HashiCorp adopts Business Source License

#381

That's pretty disappointing. I personally haven't used much beyond vault (I've used but not enjoyed or built anything on terraform), but this is pretty diametrically opposed to what I appreciated most about hashicorp products. Heck, I've even contributed a chunk of the code I use the most from vault (Cert management) and now I'm going to have to reevaluate whether I can attempt to use that service for customers going…

I read the rest of your comments on this topic and I’m sorry this happened to you. I have extensive experience with enterprise vault, implementing and managing it across a company infrastructure to manage application secrets, and during the few years we implemented vault and was in negotiations about our contract, I noticed the sales engineers would 1) be dishonest or misleading about features “needed” for our user c…

Definitely appreciate your comment, so thank you. It means a lot.

I think fortunately, I'm not doing all that much with vault aside from initializing it, configuring k8s auth, writing some small policies depending on some inputs for the specific user, and then setting cert-manager up to use it. It's definitely one of the more simple projects to rip and replace.

But it's frustrating, for sure. I got some of my coolest code set up to unseal and initialize vault programmatically, and was hoping to eventually get it to a point where I'd be able to orchestrate that on a user's behalf without having control myself, via e2e crypto. Maybe with another CA project I could achieve the same thing. But yeah, looking at the new license file in the vault project, I'm not sure how well any of this would work out if my code was orchestrating it. And certs are pretty fundamental to the project.

Re: HashiCorp adopts Business Source License

#382
post #25

Earlier quoted context omitted.

Abusing the spirit of open source, what? If somebody doesn't want any competitors they should have read the licenses and understood them, and not simply used open source as a buzzword for marketing purposes.

> If somebody doesn't want any competitors they should have read the licenses and understood them, and not simply used open source as a buzzword for marketing purposes. One should always read software licenses before installing a dependency, regardless of how a particular project is marketed. This would still be necessary even if companies weren’t using the term “open source” to refer to this type of license. People…

> People make it sound like companies are out to confuse you by calling it “open source”

That is exactly what people who call non-OSI-approved licenses “Open Source” are doing.

However, I agree, one should also read the license and those of the entire dependency tree.

Re: HashiCorp adopts Business Source License

#383
post #327

Earlier quoted context omitted.

Pulumi Founder/CEO here. The blog post is disingenuous. We tried many times to contribute upstream fixes to Terraform providers, but HashiCorp would never accept them. So we've had to maintain forks. They lost their OSS DNA a long time ago, and this move just puts the final nail in the coffin. Thankfully over time, they already pushed responsibility for most Terraform providers back onto their partners, so I'm hopefu…

>We tried many times to contribute upstream fixes to Terraform providers, but HashiCorp would never accept them. So we've had to maintain forks. They lost their OSS DNA a long time ago, and this move just puts the final nail in the coffin. OSS doesn't mean that you have to accept any PRs that showed up in your repo, nor does it mean that you have to let a competitor steer your project simply because you're building i…

I don't know if it is the case for the fixes pulumi sent, but for PRs I've made to terraform providers it can take a very long time for them to be looked at, and even longer to get merged. And I think it is mostly from nor having enough resources to approve and merge PRs. Although that could possibly be fixed by inviting developers outside the company to help with approval and merging, especially for providers.

Re: HashiCorp adopts Business Source License

#384
post #195

Earlier quoted context omitted.

I am a paying Pulumi user. Their tool integrates with a cloud platform and we pay per resource managed by Pulumi. Pulumi is one of several products where I like that it’s open source in case I need to move off their cloud, but hope that I don’t have to (Plausible is another).

[Joe, Pulumi Founder here.] Said well (and thank you for being a customer and valuable member of our community!) The analogy I draw sometimes is that our open source infrastructure as code SDK ("Pulumi") is like Git, and our commercial offering ("Pulumi Cloud") is like GitHub. Like GitHub, the Pulumi Cloud offers valuable features that go beyond the open source project for teams looking to manage lots of projects sec…

Is the Pulumi Individual Edition open for use by solo founders operating as a sole proprietership? I can't find anything clarifying whether it's individual (as in hobbyist, nonprofessional) or individual, as in, one person not collaborating with anyone else.

Re: HashiCorp adopts Business Source License

#385
post #111

Earlier quoted context omitted.

Looking at the public data [1], Hashicorp looses money every quarter. At some point they need to stop burning cash because they have yet to figure out how to run a sustainable business. I don't know enough about their operations to have good suggestions on how to become sustainable. But, I don't like this move. There are many sustainable open source companies. Moving to source available from open source will likely n…

> There are many sustainable open source companies. What are some examples?

SUSE, Canonical, Prisma (though their dashboard is closed source), Gitlab, pretty much every crypto company in the blockchain/web3 space.

And Hashicorp + Red Hat managed to make it work as open source companies for >10 years also

There are many more "open core" companies, like TimescaleDB, Docker, etc, who then sell proprietary services on top of the open source software

Re: HashiCorp adopts Business Source License

#386
post #350
post #298

Earlier quoted context omitted.

The huge difference is where the copyright of the code lays. OSS projects that require contributors to assign their copyright away, should not be trusted, and should not receive goodwill contributions to begin with. Otherwise, what today is Apache 2.0, tomorrow can become Commercial, while asking nobody for permission, because the maintainers have ownership of 100% of the code. Not that OSS projects backed by commerc…

This is incorrect, this can happen with any permissive license (BSD, Apache 2...) regardless of copyright assignments.

No, it’s correct. BSD at least allows anyone to create a restrictive fork of the code.

With a CLA, it grants Hashicorp rights to your contribution no other corporation has.

Re: HashiCorp adopts Business Source License

#387

Earlier quoted context omitted.

If so, you can check out Infisical ( https://github.com/Infisical/infisical ) as an open source alternative to Vault. The absolute majority of our codebase is licensed under MIT and we have no intentions to change that. Disclaimer: I'm one of the founders.

I'll definitely check it out. That said, I'm starting to feel a lot more skeptical of the ability for even founders to manage stuff like this. I would say the same of my own OSS as a "founder," but if my company controls it in some way then I'm not sure there's a reasonable way for me to ensure that continues in perpetuity. At least not via a split model like a lot of these recent news stories have revolved around. F…

I think the easiest way to manage it is essentially to do nothing. Accept open source contributions without a contributor license agreement and their copyright locks in future maintainers, yourself included. Extricating those contributions eventually becomes impossible without a cleanroom rewrite that is usually economically impractical and way too risky to a business with revenue.

Re: HashiCorp adopts Business Source License

#388
post #298

Earlier quoted context omitted.

The huge difference is where the copyright of the code lays. OSS projects that require contributors to assign their copyright away, should not be trusted, and should not receive goodwill contributions to begin with. Otherwise, what today is Apache 2.0, tomorrow can become Commercial, while asking nobody for permission, because the maintainers have ownership of 100% of the code. Not that OSS projects backed by commerc…

Does assigning copyright with a CLA mean that I would not be free to, say, submit the same PR to more permissive fork as well as Hashicorp's vault?

Yes, they would be allowed.

Re: HashiCorp adopts Business Source License

#389
post #260

Earlier quoted context omitted.

Are you pretending they aren't a competitor profiting off that work though? Pulumi is free, except you pay for the features that aren't free: https://www.pulumi.com/pricing/ . So, Pulumi has grown their directly competing product partially on top of the Terraform ecosystem - and I'd argue they'd be half as successful without reusing Terraform providers - and make money off of that product. It's at least understandabl…

Is there anything stopping Hashicorp from implementing their own pulumi backend and profiting off the pulumi client? I kind of feel that this is the point of open source. That the work one group of people does can be leveraged by all of humanity.

I think that would be an acknowledgment too painful for the brand.

Re: HashiCorp adopts Business Source License

#390

Earlier quoted context omitted.

I argue the window is moving as to what “open source” means out of survival. Source available is the new open source, and what young technologists will grow up grinding on. You’ll have folks complain about it during the transition (as happens with any Overton window sort of event), but they’ll move on eventually and a new crop of tech industry will grow up with this as the new normal. Change is inevitable, broadly sp…

> I argue the window is moving as to what “open source” means out of survival. I don't think this is happening at all. Open source means the same thing it's always meant. Some people are just retreating from open source. Which is fine, they should be writing Free Software anyway if they want the world to have it, or use proprietary licenses if they don't. Otherwise very wealthy people will live on your back.

“Free software” and “open source” mean the same thing.
Post reply on HN