HashiCorp's new license is still open source-ish, just with less free lunch
- Reference: 1691769611
- News link: https://www.theregister.co.uk/2023/08/11/hashicorp_bsl_licence/
- Source link:
The [1]announcement came out yesterday from co-founder and CTO Armon Dadgar, who [2]The Reg interviewed a year ago. Indeed, we've been [3]following the company's funding as early as 2016. HashiCorp is probably best known for its Terraform infrastructure-as-code tool, which [4]The Reg attempted to demystify in 2017. It's also behind Vagrant, which The Reg FOSS Desk has [5]described more recently.
The Business Source License – the BUSL or [6]BSL for short, and HashiCorp uses one abbreviation in the announcement and the [7]other in its source code – was the creation of MariaDB, another company [8]walking the tightrope between open source and making money. HashiCorp is at pains to point out that it's not alone in this:
With this change we are following a path similar to other companies in recent years. These companies include Couchbase, Cockroach Labs, Sentry, and MariaDB, which developed this license in 2013. Companies including Confluent, MongoDB, Elastic, Redis Labs, and others have also adopted alternative licenses that include restrictions on commercial usage.
The gist of [9]HashiCorp's BSL is that the software's source code remains freely available, and you're granted "the right to copy, modify, create derivative works, redistribute, and make non-production use." Note the restriction about use in production.
Here's where it gets a little squirrelly: you "may be" granted the right to use the code in production provided you don't compete with HashiCorp. The exact wording is:
You may make production use of the licensed work, provided such use does not include offering the licensed work to third parties on a hosted or embedded basis which is competitive with HashiCorp's products.
If these terms prevent you from using HashiCorp's source, you have to purchase a special "commercial license."
That all said, after a cut-off period called the Change Date, the source code to that specific version automatically reverts to a full FOSS license of the company's choice. If the vendor doesn't specify a Change Date, then this happens after four years, so it still becomes FOSS even if the company goes belly-up – or the [10]author gets run over by a bus or something.
[11]
The move has been controversial to say the least. The [12]bunfight on Hacker News is still growing with some harsh words. Joe Duffy, founder and CEO of rival infrastructure-as-code vendor Pulumi, said:
The blog post is disingenuous. We tried many times to contribute upstream fixes to Terraform providers, but HashiCorp would never accept them. So we've had to maintain forks. They lost their OSS DNA a long time ago, and this move just puts the final nail in the coffin.
[13]MariaDB CEO: People who want things free also want to have very nice vacations
[14]Want to know the future of FOSS? You can look it up in a database
[15]Open source biz sick of FOSS community exploitation overhauls software rights
[16]Give 'em SSPL, says Elastic. No thanks, say critics: 'Doubling down on open' not open at all
The Reg reported on HashiCorp's [17]slow response to contributions just a few months before its [18]very successful IPO raised one and a quarter billion bucks.
There have been some approving comments: Avi Press, CEO of [19]open source monitoring organization Scarf , [20]tweeted : "HashiCorp has set a good bar for how to do a BSL switch smoothly. No misnaming anything, no attacks, just a difficult business decision carefully communicated. They are a well-meaning group of people who have shown they do care about OSS, whether or not you like their decision."
[21]
While OpenUK's Amanda Brock said: "The statements about BUSL are sadly open washing.
"It would be wrong to suggest these two ever intended a 'bait and switch' but they have indeed switched away from open source. The pressure of enabling their competitors with their innovations – an inevitability of open source – did not align with the need to generate share holder value.
[22]
"There's almost a bigger question here – how much money is enough? Is a lot of money with others generating a lot of money too a reason to stop?"
HashiCorp has an [23]FAQ about its licensing policies, but we suspect it will not assuage the ire of many of its users. ®
Get our [24]Tech Resources
[1] https://www.hashicorp.com/blog/hashicorp-adopts-business-source-license
[2] https://www.theregister.com/2022/03/28/hashicorp_interview/
[3] https://www.theregister.com/2016/09/08/hashi_corp_cash_influx/
[4] https://www.theregister.com/2017/12/06/what_is_terraform/
[5] https://www.theregister.com/2022/05/31/distrobox_130_released/
[6] https://mariadb.com/bsl11/
[7] https://github.com/hashicorp/vagrant/commit/a7135c000b55fbc2a346baf1dbf8169beedccf0f
[8] https://www.theregister.com/2023/05/16/mariadb_growing_pains/
[9] https://www.hashicorp.com/bsl
[10] https://www.theregister.com/2015/06/17/now_i_can_die_happy_what_linus_didnt_iquitei_say/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZNavitYGgcmfJPiZb-ZOKQAAAww&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[12] https://news.ycombinator.com/item?id=37081306
[13] https://www.theregister.com/2023/05/16/mariadb_growing_pains/
[14] https://www.theregister.com/2022/09/12/opinion_column_foss/
[15] https://www.theregister.com/2022/09/08/open_source_biz_sick_of/
[16] https://www.theregister.com/2021/01/18/elastics_doubling_down_on_open/
[17] https://www.theregister.com/2021/09/07/hashicorp_pause/
[18] https://www.theregister.com/2021/12/10/hasicorp_ipo/
[19] https://www.theregister.com/2023/05/05/russia_open_source_growth/
[20] https://twitter.com/avi_press/status/1689797286522753024
[21] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZNavitYGgcmfJPiZb-ZOKQAAAww&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[22] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZNavitYGgcmfJPiZb-ZOKQAAAww&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[23] https://www.hashicorp.com/license-faq
[24] https://whitepapers.theregister.com/
Ah, Open Source
I still don't really understand these arguments. You started Open Source, free for all. Now that you have business people telling you that you can make mint out of that code, you're switching allegiance.
That feels more than a bit like a bait-and-switch to me. I'm pretty sure that, if their code had not garnered interest outside of the ham radio community (just an example), they wouldn't have bothered.
But no, they started Open Source so everyone could benefit and marvel at all they could do with the code, and now that they're successful, oh, hey, you should pay now.
I think there needs to be some honesty in the Open Source realm, as in new projects should clearly state if their intention is to monetize and change licenses down the line.
And, in any case, I don't think it is fair to put a blanket change on the code. You want to change license ? Fine. State that, as of YYYY/MM/DD, the last version under Open Source is the current NN.XXX.ZZZZ-WWWW (version numbers are such a hassle these days), and as of version BB.FFFF, the license changes to pay as you go (or whatever).
That would be more honest for everyone, and much less hypocritical for the company.
The other solution, of course, is to always be wary of a company offering code as Open Source. You just know that, if they become successful, they're going to change. For the worst (as far Open Source is concerned).
Re: Ah, Open Source
Can't you just get the last open source release, fork it, and carry on with its open source licence, pretty much ignoring whatever the company is trying to do next if you don't agree with it?
Re: Ah, Open Source
Yes. The thing the OP wanted - "And, in any case, I don't think it is fair to put a blanket change on the code. You want to change license ? Fine. State that, as of YYYY/MM/DD, the last version under Open Source is the current NN.XXX.ZZZZ-WWWW (version numbers are such a hassle these days), and as of version BB.FFFF, the license changes to pay as you go (or whatever)." - is already the case, it can't really be otherwise. They can't retrospectively un-release versions they've already released under an open source license.
Re: Ah, Open Source
The problem happens when one company owns the copyrights - typically this means they do all the develoment, or almost all, and outside contributors must sign contrubutions overto them, or use a license that allows closing adding restrictions.
I think the question to ask when a business says its software is open source, is whether they have a bsiness modelthat works with ooen source.
Poor business model
Unfortunately they massively over-priced Terraform Cloud and their Enterprise/licensable products.
I expect if it was 1/10th of the price, they'd get way more than 10x users, and make considerably more profit.
I don't know a single company that actually pays to use Terraform Cloud, and I've consulted for at least 20 organisations using Terraform over the past 5 years. Everyone's that's seen the demo of it seems to have the same answer:
"Sure, it looks really nice, but I can write my own pipelines and get 80% of the functionality I want for a bit of elbow grease and no subscription/licensing costs over and above what I already pay to GitLab / GitHub / BitBucket - the extra 20% isn't worth what Hashicorp wants to charge"
Now I guess the sweet spot might be if Hashicorp integrate and partner more tightly with GitHub / GitLab, improving those offerings, charge a few dollars a month per user on top of existing subscriptions and effectively get a revenue stream directly from them - I could see that being a move that works.
AGPL with a supplement would have helped
With the supplement being a dual-licence giving HashiCorp a commercial right to use the code under any licence (while everyone else is stuck with AGPL terms) would have achieved the same non-compete restrictions in practice while allowing them to legitimately claim their product is actually open-source.
They just weren’t creative enough. Sad times.
No more open source
All this means is that HashiCorp is no longer an open source company. I expect many companies to move away from HashiCorp tools in the near future.
Shareware
Have always considered HashiCorp's stuff as shareware, in that its existence as true FOSS was completely dependent on HashiCorp's share price or financial priorities.
Decent software (albeit dreadful QA) that solves unique problems. There's a path to monetisation but post-IPO that was always going to involve gradual retraction of licensing and community engagement.
Only one question matters
Is stoning, burning, or drowning the appropriate punishment for heresy in the modern age?