Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Elasticsearch is open source, again

elastic.co

Post reply on HN
Print view View original

381–390 of 473 posts

Re: Elasticsearch is open source, again

#381

Post by wavemode »

hungie wrote: post #354
wavemode wrote: post #342

Earlier quoted context omitted.

You can be as tired of it as you want, but tiredness doesn't change the meaning of words. What you probably want instead is "fair source": https://fair.io/ Like their names imply, open source is about source being open. Whereas fair source is about ensuring that code is used fairly. I would argue that people contributing to open source shouldn't be putting themselves in a position to be "actively exploited". If that'…

You speak as if there is a divinely written definition for the words "open source". There is not, there's a group of people who have said, "this is ok, this is not". I'm of the opinion that those people have made a mistake that will work against them, and they should consider revising their definition.

But... there is a definitively written definition for those words. The phrase was invented to refer to a very specific thing. Changing the meaning of the word would accomplish nothing except force existing usages of the word to change.

Like, if fair source licenses began to be referred to as "open source", then "open source" will have lost its original meaning. So now when stating that something is "open source", you will have to clarify whether you mean "original open source" or "expanded open source" (or something like that). This distinction will be very important to potential users, since it may or may not restrict their intended use case.

It's no different from if we were to start referring to reptiles as mammals. Now when a biologist wants to refer to only organisms with mammary glands, they will need to use some other term, like "milk-making mammals". It does nothing but cause confusion.

Not sure how else to explain this concept... like, I'm really just talking about semantics and pragmatism here. I don't disagree with you on ideological grounds, if that's what you're assuming.

Re: Elasticsearch is open source, again

#382

Post by rbanffy »

skywhopper wrote: post #356
weinzierl wrote: post #292

Earlier quoted context omitted.

"as AGPL is sufficient to block AWS from using the code" I have taken this position in another thread a while ago, but the responses seemed to indicate that this is not a clearly cut situation at all. If it was, what is the point of the "source-available" licenses in the first place? I mean, the idea that they were invented to cut out AWS is pretty prevalent, no?

AGPL doesn't forbid Amazon from providing a competitive service using the software. Elastic License/SSPL/BSL all do. That's the difference.

It also ensures Amazon can’t add any secret sauce to the code they offer - everything must remain open.

Re: Elasticsearch is open source, again

#383

Post by kikoreis »

weinzierl wrote: post #292
adrianco wrote: post #257

Here’s the initial AWS response to the license change that they made in 2018, which I helped write. At the time we didn’t think a new license made sense, as AGPL is sufficient to block AWS from using the code, but the core of the issue was that AWS wanted to contribute security features to the open source project and Elastic wanted to keep security as an enterprise feature, so rejected all the approaches AWS made at…

"as AGPL is sufficient to block AWS from using the code" I have taken this position in another thread a while ago, but the responses seemed to indicate that this is not a clearly cut situation at all. If it was, what is the point of the "source-available" licenses in the first place? I mean, the idea that they were invented to cut out AWS is pretty prevalent, no?

Well, the comment from OP isn't necessarily complete. The AGPL is not about preventing someone from using source code (indeed that would be contrary to the spirit of all liberal and copyleft licenses), but rather the condition under which source code modifications need to be made available.

Specifically, if you offer the software for "Remote Network Interaction" (AGPLv3 section 13), well, "if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version".

I think the original challenge with AGPLv3 vs (to grossly generalize) the VC-backed open source corporate ecosystem was not around source code, but around monetization as SaaS by the hyperscalers. The problem there is even if the hyperscalers publish source code modifications (which they probably have no problem with) they have such sales efficiency and gravitational pull that they will end up eating your business.

Re: Elasticsearch is open source, again

#384

Post by tensor »

lolinder wrote: post #95
chadash wrote: post #69

I'm pretty happy with this, since they are keeping the option to use the Elastic License. Now everyone can be happy. To me, it's weird that the AGPL is any more "open source" than the Elastic License. The AGPL requires you to publish all of your source code if you make any changes to the product; the Elastic License just says, "don't use our code to make a direct competitor to Elasticsearch". I find the former to be…

> to publish all of your source code if you make any changes to the product Specifically, this is the text [0]: > if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version There are a few companies who try to make it sound like i…

If the client talks to service A, which talks to AGPL service B, I assume that would count as having to "prominently offer the source code for service B". No? If that's true, then it becomes a real pain to track all the places where an end user could indirectly come in contact with service B.

If that's not how to interpret the license then wouldn't a simple API gateway or proxy circumvent it?

Re: Elasticsearch is open source, again

#386

Post by ang_cire »

cduzz wrote: post #376
fieldcny wrote: post #362

Earlier quoted context omitted.

Using your yardstick, we wouldn’t have any open source software, everything costs time to implement, that’s the point of open source, we donate time to the collective community. All those security features are not enterprise specific, they are rudimentary for any modern open source product

I'm saying that companies that opensource their products tend to distinguish "enterprise" and non-enterprise based on things like RBAC and audit mechanisms, neither of which is "security" as much as "compliance". The original license owner, if a commercial enterprise trying to sell the product alongside the "open" version, has less incentive to accept those features from the community as it would reduce their sales o…

RBAC is absolutely a practical security control, even for non-commercial users. Least necessary privilege is not a checkbox, it will 100% save your butt in a breach by limiting blast radius.

Re: Elasticsearch is open source, again

#387

Post by wmf »

KingMob wrote: post #271
wmf wrote: post #141

Earlier quoted context omitted.

Grafana https://grafana.com/blog/2021/04/20/qa-with-our-ceo-on-relic... RethinkDB http://web.archive.org/web/20161003231505/https://rethinkdb.... BerkeleyDB http://web.archive.org/web/20170211004058/http://www.infowor... MongoDB tried the shakedown but I guess it didn't work http://web.archive.org/web/20240202161503/https://www.mongod...

Those links are all generic pages related to their licenses. I'm not seeing how they support the idea of a "shakedown", which is criminal extortion.

They all say if you sell the database as a service you can't use AGPL; you have to pay for a commercial license.

Re: Elasticsearch is open source, again

#388

Post by FireBeyond »

thelittleone wrote: post #272
_pdp_ wrote: post #265

Earlier quoted context omitted.

Unfortunately many companies charge extra for security where security should be the default. Truth to be told there some some situations where extra security costs could be justified but there are not many if charge is necessary it should be considered as a temporary measure. My $0.02.

Including the recent trend of access to SOC2 reports requiring an "Enterprise" tier subscription.

Or worse, "SSO" as an Enterprise feature. You're a 2-3 person startup, you set up GSuite, you want to set things up right, oh, "$Call us" for a tier with SSO. Nope, I guess disparate users for now. Not the worst in the world to be clear, but an entirely arbitrary gate, in my experience.

Re: Elasticsearch is open source, again

#389

Post by wg0 »

sschueller wrote: post #268
metadat wrote: post #198

Hasn't everyone already moved on to Open search? At this point it's more stable, which is preferable. Too little too late. Cannot trust.

I am in the middle of the migration from Elastic Search to Open Search... Not sure what to do right now.

Go for OpenSearch. Elastic might flip the license once more depending upon how and what stock market wants.

Re: Elasticsearch is open source, again

#390

Post by skrtskrt »

mirashii wrote: post #25

> For example, MongoDB used to be AGPL and Grafana is AGPL. It shows that AGPL doesn’t affect usage or popularity. I take some issue with this characterization. Let's look at Grafana in particular. Grafana was not always AGPL, and much of its popularity came before the license change. I've been in multiple organizations who only purchased a license for Grafana to avoid the AGPL terms because it had gained traction al…

> AGPL software is still outright banned

This is just an unforced error to enforce this for a product that is literally an internal analytics tool. You can even host it and sell it as a service under AGPL! you just have to open source your changes/contributions.

The Grafana AGPL-licensed stuff has massive adoption, the few places where corporate lawyers can't get their heads out of their butts can just keep suffering.

Post reply on HN