_msw_

Disclosure: I work for Amazon, but I don't work directly on Redis related cloud services. I am close to the Open Source Program Office, and I care a lot about the people who do the hard work required to collaborate on open source projects.

Madelyn Olson did the hard work for years to earn the trust of other Redis core developers to become a core maintainer, all while employed by AWS to do that work. She and other AWS developers have contributed a lot to the core Redis engine. Some may say that they too worked their asses off for the Redis community.

You can read more about some of those contributions here: https://aws.amazon.com/blogs/opensource/behind-the-scenes-on...

That's not strictly accurate. SSPLv1 is only a choice for the source code. One can elect to use RSALv2 for both binaries and source code.

Personally, I don't find foundations to be a magic solution for this problem. There are many examples where a single company has decided to basically "fork" their way out of foundation housing and the community is left with the same outcome.

In my personal opinion, there's no good reason to have a license policy at the CNCF, or any Linux Foundation directed fund, that makes using copyleft licenses so burdensome, especially when they are as "weak" as MPL 2.0 is.

I know that there are Reasons. I just don't think they are good ones.

Personally speaking, I wish it had been OpenInfra.

I think they have a stronger sense of community building, and more more intentionally make space for individuals to take leadership roles that are truly independent from their employer (member company) affiliations.

> 19. How does HashiCorp now refer to the freely available versions of products that were formerly known as open source (or OSS)?

> We have referred to versions of our products as either open source (OSS), Enterprise, or Cloud. Going forward, we will refer to the open, freely available versions as “community”. The BSL license is open, free, and source-available. However, it does not meet the definition of open source as defined by OSI, and that is why we will refer to the products as the "community" edition rather than the "open source" edition as we did previously. There are many references to open source on our websites and we are actively working to clarify these language changes in the coming weeks

Source: https://www.hashicorp.com/license-faq#details-on-nomenclatur...

If there is anything specific you believe is confusing, please provide some details and I will pass the feedback on.

No, it didn't copy the software. That's like saying min.io copied S3 software, which would also be false.

It implemented a wire protocol for interoperability purposes, similar to functionality in IBM DB2, Azure CosmosDB, FerretDB, and other databases.

Disclosure: I work for Amazon.

Amazon has never offered a database service based on the MongoDB server software. Not when it was AGPLv3 nor when it was SSPLv1.

The CLA was put in place in December of 2018 [1]. Presumably contributions made before that were under inbound=outbound terms [2], meaning the contributing author licensed their exclusive rights under MPL 2.0, which is a file-based copyleft license. (see the chart at [3]).

[1] https://www.hashicorp.com/blog/introducing-a-cla

[2] https://docs.github.com/en/site-policy/github-terms/github-t...

[3] https://en.wikipedia.org/wiki/License_compatibility#Compatib...

> That's the Free Software slogan, not open source. The only relationship between the two is that open source can easily be relicensed into Free Software (or proprietary, or whatever.)

While you are correct that the Free Software Movement has slogans like "free as in freedom" and has a definition based on "the four freedoms," the Open Source Movement also recognizes and advocates for "Software Freedom" as well.

"We build a world where the freedoms and opportunities of Open Source software can be enjoyed by all." [1]

Software that is licensed under Apache 2.0, MIT, BSD, or any of the other so-called "permissive" licenses is labeled "Free Software" by the Free Software Movement as-is. It does not require a "relicense" to become Free Software.

Said another way: you don't have to use a copyleft license like the GPL to qualify for the "Free Software" label.

It is just a different name for the same thing, because there was a group that developed a vocabulary before another group existed.

[1] https://opensource.org/

This is true. The question to me is: does the party to whom you give the rights and authority subscribe to community-oriented FOSS license compliance principles? [1]

[1] https://sfconservancy.org/copyleft-compliance/principles.htm...

> But the (modified) source is available to consumers of the service either way, under the AGPL?

If Amazon made an AGPLv3 licensed program available to others over a network, it would have an obligation to provide to anyone that has access to that program the complete corresponding source.

Today, there aren't any services from Amazon that offer AGPLv3 licensed programs as a service. An example that may come to someone's mind is Grafana, but there is a partnership there, and AGPLv3 is not the binding license in that case.

In my personal opinion, AGPLv3 compliance is not difficult, so long as the licensor of the software is committed to community-oriented copyleft enforcement principles [1].

[1] https://sfconservancy.org/copyleft-compliance/principles.htm...

And this is why I think people who love Software Freedom should think twice about signing a CLA for their copyleft licensed contributions. [1]

inbound=outbound license terms is a good norm for FOSS. Why should a software vendor play by different rules than everyone else when it comes to things like copyleft compliance?

[1] https://meshedinsights.com/2021/06/14/legally-ignoring-the-l...

> Does Amazon have any policies against offering AGPv3 software as a service?

Each use of AGPLv3 licensed software has to be reviewed to ensure that the obligations of the license can be and will be met (and also screen for cases where it is known that the vendor of software does not prefer a company like Amazon import the software under a FOSS license). Today we use AGPLv3 licensed software internally, and include AGPLv3 licensed software in Amazon Linux (Ghostscript, in particular).

> Does Amazon contribute funding back to the software projects they offer as a service?

Yes, in varying ways. For example, it is not easy to provide "funding" for something like Apache Kafka. You need to have people working on the upstream.

> Does Amazon contribute code changes back to the software projects they modified when offering them as a service?

Yes, but not all changes are appropriate for upstream.

Disclosure: I work for Amazon.

AWS never offered MongoDB as a managed service, or used any of their server software when it was licensed under APLv3, or SSPLv1.

However, we have contributed patches to MongoDB even after their license change to improve its performance on Graviton processors. Because that's what's good for customers, and MongoDB is an important customer and partner.

AGPLv3 gives all the permissions needed to offer software as a manged service, just like every other FOSS license does. Unfortunately, in my personal opinion, the license has been co-opted by companies that do not care about Software Freedom, and rather hope that companies fear the license so they choose an alternative commercial agreement [1]. I don't think that's good for the community.

[1] https://sfconservancy.org/blog/2020/jan/06/copyleft-equality...

Disclosure: I work for Amazon, but I've been a copyleft advocate for a quarter century.

Indeed, copyleft can be politically scary. Especially when for-profit companies co-opt copyleft to drive licensing revenue by selling alternative license arrangements [1]. If all those who adopt copyleft licenses pledged to commitment to community-oriented GPL enforcement principles [2] I think that it would be a lot less scary. Unfortunately we've seen "copyleft trolls" that try to wield copyleft as a weapon, either for profit or to make other demands that are not helpful to the community.

Copyleft licenses are, indeed, protective licenses from my perspective. Or, they should be.

An aside, when it comes to "Amazon pulling the rug" -- what exact incident are you referring to?

[1] https://sfconservancy.org/blog/2020/jan/06/copyleft-equality...

[2] https://sfconservancy.org/copyleft-compliance/principles.htm...

Yes, it is natural for people to look at what's offered, see "it's free for me to use" and think that it's open source software like everything else that the broader community has worked hard to accomplish over the past 25 years. The hard work that created a bountiful commons of public software that anyone can use for any purpose is taken for granted these days.

One day they may understand what they didn't have to fight for. But I hope they don't.

Yes, I can see why you might make this argument. [1]

[1] https://github.com/keygen-sh/keygen-api/blob/master/LICENSE....

The mission of OSI and the mission of Creative Commons are related, but that doesn't mean that the OSI should do everything that Creative Commons has done.

The overlap in mission between the OSI and Creative Commons is the "approved for free cultural works" label [1]. This came about during collaborations between the members of the Free and Open Source Software community and Creative Commons leadership in 2006. [2]

Software licenses with restrictions are nothing new or novel. From my perspective, "accepting" them isn't staying ahead, it's stepping backwards on a mission that has been a quarter century in the making.

[1] https://creativecommons.org/2008/02/20/approved-for-free-cul...

[2] https://en.wikipedia.org/wiki/Definition_of_Free_Cultural_Wo...

While the Creative Commons has a "non-commercial use" license, a work under such a license would not qualify as a "free cultural work" [1], which is the equivalent designation as Open Source Software for non-software works. Free Cultural Works give everyone the same essential freedoms that are required by the Open Source Definition.

I think when people make material available under a CC-BY-NC and call it "open source", the community should react the same way. It's neither open source, nor a free cultural work.

[1] https://creativecommons.org/share-your-work/public-domain/fr...

Back when you were at Amazon, I was at Red Hat. (disclosure: I am at Amazon now, and have been for a bit over 13 years).

From my perspective when I was at Red Hat, Amazon was very much an IT consumer. Amazon was a _hugely_ important customer for Red Hat, even appearing on stage to give their testimony about the benefits [1]. It was a "lighthouse" customer that really opened some doors to selling Enterprise Software.

Part of what we sold to Amazon was being their connection "upstream". In 2001 it was quite unusual for an IT shop like Amazon to participate directly upstream. One benefit of being a customer of Red Hat's was: they will fix bugs and work upstream on your behalf.

It was a very reasonable approach in those days to use an existing contractual / support relationship with a vendor like Red Hat to deal with all of those details and complexities, which often required strong social connections among open source developers and maintainers working together upstream.

I think that over time as large companies shift to consume open source software directly from upstream, they have to build the capabilities and connections to participate directly rather than going through an intermediary like Red Hat. It can take a fairly long time to do that.

[1] https://www.computerworld.com/article/2577912/linuxworld--am...

Live migration can't be used to address every type of maintenance or underlying fault in a non-disruptive way.

Disclosure: I work for Amazon, and in the past I worked directly on EC2.

From the FAQ: https://aws.amazon.com/ec2/faqs/

Q: How does EC2 perform maintenance?

AWS regularly performs routine hardware, power, and network maintenance with minimal disruption across all EC2 instance types. To achieve this we employ a combination of tools and methods across the entire AWS Global infrastructure, such as redundant and concurrently maintainable systems, as well as live system updates and migration.

Here's a comment that I made in a past thread.

https://news.ycombinator.com/item?id=26650082

Indeed. I was only saying what I would _like_ to see...

Disclosure: I work for AWS, but I don't work on the Amazon Managed Service for Prometheus. I have my own very long held opinions about Free and Open Source software, and I am only speaking for myself.

To me, the AGPLv3 license isn't about forcing software users to "give changes back" to a project. It is about giving the permissions to users of software that are necessary for Software Freedom [1] when they access a program over a network. In practice, that means that changes often flow "upstream" to copyleft licensed programs one way or another. But it was never about obligating changes to be "given back" to upstream. In my personal opinion, you should be "free to fork" Free and Open Source Software (FOSS). Indeed, the Grafana folks seem to have decided to do that with Grafana Mimir.

Personally, I hope that they accept contributions under the AGPLv3 license, and hold themselves to the same obligations that others are held to with regard to providing corresponding source code of derivative works when it is made available to users over a network. In my personal opinion, too often companies use a contributor agreement that excuses them from those obligations, and also allows them to sell the software to others under licenses that do not carry copyleft obligations. See [2] for a blog post that goes into some detail about this.

If you look at the Coretex project MAINTAINERS file [3], you will see that there are two folks listed that currently work at AWS, but no other company other than Grafana Labs today. I would love to see more diversity in maintainers for a project like this, as I think too many maintainers from any one company isn't the best for long term project sustainability.

I think if you look at the Cortex Community Meeting minutes [4], you can see that AWS folks are regularly "showing up" in healthy numbers, and working collaboratively with anyone who accepts the open invitation to participate. There have been some pretty big improvements to Coretex that have merged lately, like some of the work on parallel compaction [5, 6].

TL;DR, I think it is easy to jump to some conclusions about how things are going in a FOSS project that don't hold water if you do some cursory exploration. I think best way to know what's going on in a project is to get involved!

--

[1] the rights needed to: run the program for any purpose; to study how the program works, and modify it; to redistribute copies; to distribute copies of modified versions to others

[2] https://meshedinsights.com/2021/06/14/legally-ignoring-the-l...

[3] https://github.com/cortexproject/cortex/blob/master/MAINTAIN...

[4] https://docs.google.com/document/d/1shtXSAqp3t7fiC-9uZcKkq3m...

[5] https://aws.amazon.com/blogs/opensource/scaling-cortex-with-...

[6] https://github.com/cortexproject/cortex/pull/4624

ICYMI, Amazon Linux includes versions of Ghostscript that are licensed under AGPLv3 (the license changed at version 9.07). [1]

AGPLv3 licensed software is also permitted for use within the company in some circumstances.

[1] https://alas.aws.amazon.com/AL2/ALAS-2021-1598.html

Disclosure: I work for AWS, but they don't pay me to share my personal opinions on FOSS licenses here on HN. I'm speaking for myself.

Personally, I am a fan of AGPLv3. But I am uncomfortable with advice to apply APLv3 code in an expectation that BigCorps will not touch it. There are many very large companies, including multinational companies based in China, that have no fear of AGPLv3, and are also prepared to meet the obligations of the license.

Many times I have read (including in comments down thread) that "big companies fear AGPLv3." That may be true in some cases, but not all. And the state of adoption or rejection of community licenses changes over time. 25 years ago, many companies "feared" GPLv2.

That changed, and now GPLv2 is widely accepted. The same could happen for AGPLv3, and personally I think that the movements that advocate for Software Freedom will be closer to achieving their goals if that happened.

Disclosure: I work for AWS.

There were contributions sent upstream for Elasticsearch bugfixes and enhancements. Some of those PRs are still open, for example [1].

A sampling of additional PRs can be found in this blog post [2].

Further contributions upstream to Apache Lucene have been growing over the years. The new Approximate Nearest Neighbor support in Elasticsearch 8.0 comes from work that was sponsored by Amazon in upstream Apache Lucene [3].

[1] https://github.com/elastic/elasticsearch/pull/64513

[2] https://aws.amazon.com/blogs/opensource/stepping-up-for-a-tr...

[3] https://issues.apache.org/jira/browse/LUCENE-9004