Hacker News Reader

Comment by mikepurvis | Hacker News Reader

I don't think it's the freedom to run it anywhere. It's the freedom to run it anywhere and make changes to it that you don't contribute back:

1. Amazon wants to make private changes to the management layer for their cloud offering and not share those.

2. ES doesn't want that, so the 7.11+ license restricts it.

3. Amazon doesn't want to have to explain to their customers why their ES offering is stuck on v7.10, so they're changing the name of it.

4. Elastic was really hoping this wouldn't happen, but they overestimated the value of their brand and Amazon called their bluff.

So yeah, nominally OpenSearch is unrestricted, but realistically few other entities are in a position to make or benefit from the private modifications Amazon will be making. For us normal people, ES and OS are equivalent today, so it's more about how they're going to diverge over time in terms of fixes, features, whatever.

View on HN

The SSPL directly prohibits offering the software as a service without releasing the source code of your entire operation regardless of if you change it or not:

> If you make the functionality of the Program or a modified version available to third parties as a service, you must make the Service Source Code available via network download to everyone at no charge...

> “Service Source Code” means the Corresponding Source for the Program or the modified version, and the Corresponding Source for all programs that you use to make the Program or modified version available as a service, including, without limitation, management software, user interfaces, application program interfaces, automation software, monitoring software, backup software, storage software and hosting software, all such that a user could run an instance of the service using the Service Source Code you make available.

AKA someone must be able to create aws.example.com if aws uses SSPL code. Not exactly the 'freedom to run it anywhere'.

https://www.mongodb.com/licensing/server-side-public-license....

Doesn't a lot of that hinge on what the "service" is? Like, if I run some generic knowledgebase website and use my own ES installation to provide user-facing search, does Elastic want to see my Ansible scripts? Or just the ones related to the search function?

If this interpretation holds, I feel like it could be a pretty big problem for companies like GitLab, who not only have deep integration with ElasticSearch, but offer it as a premium-tier feature:

https://docs.gitlab.com/ee/integration/elasticsearch.html

Maybe this really is just a cash grab from the Elastic side, like, "it's too easy to self-host rather than paying for our SaaS offering, so now you need to pay us for many common self-hosting use cases also."

There's several lawyers who believe the wording would imply the problematic interpretation - /dev/lawyer is one on the internet, one from my anecdotes is the lawyer who advised the company I used to work at.

SSPL doesn't come up under free or open source licenses partly for this reason, actually.

> Making the functionality of the Program or modified version available to third parties as a service includes, without limitation, enabling third parties to interact with the functionality of the Program or modified version remotely through a computer network, offering a service the value of which entirely or primarily derives from the value of the Program or modified version, or offering a service that accomplishes for users the primary purpose of the Program or modified version.

This probably qualifies it as a service, but since it looks like gitlab doesn't install it or redistribute it Elastic isn't going to come after them (if they don't use SSPL code then SSPL doesn't apply). Plus, GitLab is effectively open-source, so they might meet the qualification for using SSPL anyways. Of course, I am not your/a lawyer.

> I run some generic knowledgebase website and use my own ES installation to provide user-facing search, does Elastic want to see my Ansible scripts?

According to Elastic, "it depends" - if you can just search by entering a term in the searchbox, you're probably fine; If you allow users to use Elastic's query language, you're very likely in violation. If you let your customers define Kibana dashboards, you're definitely in violation.

It's worth noting that you can do a custom deal with Elastic, as long as you pay whatever they ask & accept their terms (or renegotiate them, which is a fairly painful process) - so maybe GitLab did just that.

Great point. SSPL is basically the open source equivalent of “we had to destroy the village in order to save it.” In order to protect their IP from being “taken away” because of their original licensing decision, they basically chose a new license that’s effectively no longer open source (although it is “source available”).

Err, SSPL which Elasticsearch is licensed under isn't AGPL - it's a viral, proprietary license - not quite the copyleft we'd want if we wanted a fair playing field between all actors working on it.

It's a viral open source license, it literally requires open sourcing code, there's nothing proprietary about it except that we allow a council of elitist snots to decide what is and isn't Open Source(TM), and they have decided Google and Amazon support is more important than viable businesses which are building open source businesses.

The SSPL literally violates Freedom 0.

> The freedom to run the program as you wish, for any purpose (freedom 0).

And though we're talking about open source instead of free software, without Freedom 0, the software still might as well be proprietary.

Edit: It also violates Rules 1, 5, 6 & 9 of the OSD. So no, let's not call it "open source"

Could you provide a link to explain how it violates "Rules 1, 5, 6 & 9 of the OSD"? Thanks

Common freaking sense reading.

https://opensource.org/osd

If you can't use the software because you're a cloud provider, that's rules 1, 5 and 6 easy.

If using it forces you to relicense all of your code under the SSPL that's rule 9.

It is well known at this point that the SSPL withdrew their request for recognition to the OSI because they do not meet the rules of the OSD.

by definition sspl only qualifies as a source available license but it restricts stuff in so many ways that it is basically propriatary, even for normal uses. btw. even open source licenses are not free or libre, they also restrict usages, just not as hard as most source available licenses. source code is not open if I'm restricted to use it in most cases without making everything open, it's available of course, but that limits my use case by a huge margin. even open source (osi) licenses do that, but in a way more fair manner, which does not discriminiate usages. heck I'm not even a fan of gpl 3 (especially agpl) , because I think they also discrimnate usages and are also poorly written (too much stuff that is hard to understand without a lawyer)

> If you can't use the software because you're a cloud provider, that's rules 1, 5 and 6 easy.

I may be mistaken but I thought cloud-providers can use it and offer it for others to use as well, they just can't charge for that. But I may be wrong.

This is incorrect, you are free to use the program if you wish, it just also, like the GPL, conveys requirements on open sourcing code you use with it. Open sourcing services without the necessary tools to run it isn't much good, so SSPL ensures the freedom to run your own better than GPL based licenses.

no. get it right. if you are not free to run the program without additional stipulations, especially stipulations that dictate how you license _your_ code, then you are not free to use the program as you wish.

Literally, "as you wish". Stipulations is "as we wish".

And you can read it from the OSI themselves: "The SSPL is Not an Open Source License" https://opensource.org/node/1099

The SSPL conveys no new stipulations not permitted by GPL-based licenses, it is just more inclusive in doing so.

If SSPL isn't open source, neither is the GPL.

GPL carries no restrictions if you don't distribute the software.

The AGPL on the other hand, was a huge mistake, IMO.

The AGPL was the first step in addressing a critical need to protect the users' right to run the software they use, the SSPL just continues that, as many services wouldn't be runnable without the support code around them.

I hear what you're saying, but those whose mission is to encourage open source software don't call the SSPL anything but a source-available, proprietary software license. Like literally the organization that defined what "open source software" is.

While you may disagree, you aren't going to convince me to take your word over theirs, especially when I have come to the same conclusions they did on my own.

On a moral principle, AGPL levels the playing field fairly much like the GPL license, just the terms of distribution are updated for an age of software as a service. No one is exempted to the rules in AGPL like SSPL - it is intentionally viral, even if you'd dislike using it in many of your projects (though I think it's fair to say lawyers don't like the ambiguity of the language).

Just like some projects are best under LGPL instead of GPL, AGPL has its place in the toolkit of free software licensing.

The principle of in the GNU manifesto would be that the software is available for anyone to use in the same way, such that Elastic isn't elevated to not disclose their closed source additions to the software.

At this point, they are directly violating that core principle as well as the uncontroversial OSI directive 6 which copyleftists like myself don't really have a problem with... So I'm not sure what the issue here would be other than you dislike the larger companies' involvement in OSS? I think myself and others would appreciate clarification.

Could Elastic's business model work if lucene were licensed SSPL?

I think it probably could not. And if lucene were licensed GPL, it would not be possible for ElasticSearch to use this new SSPL license, it would be have to be GPL too.

If you think this is about Elastic caring about openness and freedom, ask yourself why they don't drop the CLA for a DCO and let themselves be beholden to the same terms

Counterpoint: FSF and Mozilla require CLA too

Except that FSF and Mozilla are not usual for-profit companies with primary mission of making as much money as possible. Elastic on other side is and it's funded by VC money that want return on their investment.

Reply on news.ycombinator.com