Hacker News Reader

Comment by bee_rider | Hacker News Reader

I somehow still don’t get what single vendor open source code is, even after reading the article.

Is it code that is open source but the license says “no forking.” And maybe the license says they are allowed to fork it and chance the license to proprietary?

Or is it code that is open source, but nobody has ever bothered to fork it. With the potential spin that sometimes code is just so specific that nobody would bother forking it because it is super tied to some platform or hardware.

The former, that just seems like looming proprietary code. The latter, I dunno, can’t blame people for implementing niche projects I guess.

View on HN

Take Hashicorp's Terraform as an example. Until recently, the code was completely open source with a permissive license. You could do exactly as you like with it. The 'single vendor' decided that was no longer in their best interests.

What's the problem? Now you have 1000's of companies that rely on this software, and if they want to continue to receive security updates, they need to comply with the new license. Of course, people are free to fork projects, and that has been done in the case with terraform, but it's something that a foundation-led project most likely wouldn't do (change the license).

There's another flavor of single vendor open source IMO. I call it 'look but don't touch open source.' Modern software projects have become some complex, and the build and dependency systems so customized, you could have the source code available, and be free to modify it, but wholly unable to do so because of the build-time complexity. A foundation-led project would, ostensibly, ensure that the entire lifecycle of the software is approachable by end users (docs, tooling, etc).

And then you have the look and "you can touch if you give away all rights for what you contribute". Contributor License Agreements where basically you contribute to a "GPL" project, but you sign away the rights to your contribution to the company, so they can still close source it any time they please while including your code.

I think they are basically saying an OS project with a single commercial entity as the maintainer.

If that’s the case, it seems like a very bigcorp-centered perspective. Indie devs and people who aren’t already well-connected don’t have the ability or resources to get consortiums of companies behind their projects or create open source foundations.

So I don’t know—maybe it wasn’t intended this way, but it comes across as very gatekeep-y to me. Like telling people that unless they are already established and famous enough to start a project that has tons of backing from the start, that they can’t “really” be opensource (despite a very real opensource license), meaning you as the little guy should either build your project for free with no hope of ever making a living from it, or else be excluded from the broader opensource community.

I like to think of Open Governance vs Open Source on topics like, if someone adds SSO to the OSS repo, will the main vendor behind it reject the PR because it breaks their OSS core business model

Reply on news.ycombinator.com