HashiCorp adopts Business Source License

> Inevitable end for every open source company since the free money ended.

Yeah. It seems like the Apache/MIT route has been working “well” to support a suite of libraries. But for bigger “business-critical” full-on products, like databases etc, you see much more weird contortions, including making self-hosting difficult and feature-gating essentials. Better than closed source, but not ideal. I’ve been thinking for a while that licensing is likely the pragmatic way out. But it’s important that it’s broadly understood, fair and clear.

> […] a product or service provided to users or customers outside of your organization that has significant overlap

Ouch, judging by the language it seems like it’s (1) unclear and (2) the authority on that ambiguity leans in favor of the company, which paves the way for selective enforcement. “Don’t worry, we aren’t going to come after anyone” is not convincing when legal documents are being signed. Hoarding soft- or future powers is a huge red flag in contracts, imo.

What do others think about this license in particular?

GPLs are a bit complicated for companies because (personal opinion alert) I THINK it is ok if you’re a company, member of a particular community, to be able to embed that on some product and not be mandated to open-source the whole thing.

IMHO not everything needs to be open-source, but in many case it just makes so much sense that is a dumb idea to reinvent the wheel.

Many projects are succesfull this way. One I can think of is LLVM.

It's just a matter of time. They're Apache 2.0 for now. But they can pull out at any moment just like Hashicorp, Grafana, Mongo any many others..

This one is interesting to me. I've been a big fan of Hashicorp ever since the only thing they had was Vagrant over a decade ago. The core of my usage has remained all of the CLI tooling, i.e. Packer, Terraform. It's more or less impossible to create any kind of competitors by trying to steal from these as they're free to begin with, plus they provide virtually no value on their own and rely on a universe of a providers and plugins to actually do anything, some of which are created by Hashicorp, but many of which are not. One of the more extensive foolaround tools I ever made was vaguely inspired by Packer, years ago when there wasn't a plugin to support Hyper-V and I wanted automate creating machine images for my Windows laptop to run various flavors of Linux so I could work on Linux from Scratch over and over without having to copy/paste everything at the command line. It was only "architecturally" inspired, though. I didn't even look at their source code and wrote everything from scratch entirely in Powershell since it was only for personal use and only intended to run on Windows.

I guess the signal here is they care more about and have pivoted business-wise to their own hosted offerings. I admit I'm not entirely sure what those are. I don't anyone that uses Terraform Cloud, but I guess someone must. So I guess Consul, Nomad, and Vault, but again, does anyone use the hosted versions of these? The big sell to me has always been all of their products can be self-hosted. Professionally, my use has mostly been with defense and intelligence customers offering behind an air gap who couldn't use the cloud offerings if they wanted to.

By far the biggest value add has always seemed to be Vault. Consul and Nomad have very clear competitors that still command more mindspace, but Vault seems to reign supreme if you want to self-host a secrets manager. On this front, though, as great of a product as it is, how much of that is even due to Hashicorp itself? The security is provided by implementations of open encryption algorithms, Shamir secret sharing, fips modules in the OS, and HSM support, but they don't make the HSMs. HA is provided by the Raft implementation of the Paxos family of consensus voting, but again, they didn't invent that. The fact this product exists at all is because they stood on the shoulders of giants who did all the heavy lifting in creating these secure and robust algorithms in the first place, and then shared them and allowed others to build commercial offerings on top of them. Your entire company exists because of other people's open source efforts, and then you close off and say no one else can build on top of your work, when if the OGs had done that, your product would never have been a viable business.

Which terraform then copied with the AWS Native provider...