Updating the license from MPL to Business Source License · hashicorp/terraform@b145fbc

Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at https://hashi.co/bsl-blog, FAQ at https://hashi.co/license-faq, and...

GitHub
I have to say this is just horribly disappointing. #Hashicorp keeps becoming more and more hostile towards the people it wants as customers.

@tedivm Is it, though? I haven't dissected the new license, but it seems that the main change is the usual fight against the "you write the code, we'll make the money" deal.

I'm not *happy* about these changes, but I can see why they keep happening.

@PCOWandre @tedivm the BUSL is not open source:
https://spdx.org/licenses/BUSL-1.1.html

Edit: Sorry, it looked like your "is it though?" was referring to "open source" rather than "disappointing" on my end!

Business Source License 1.1 | Software Package Data Exchange (SPDX)

@johnny @tedivm Oh, I get the fact that a license that excludes certain use cases doesn't meet the definition of open source.

But I can understand why there's a new wave of licenses that provide source but exclude certain business models.

@tedivm

Of cource, *this* copy of the repo still is.

https://codeberg.org/suetanvil-mirrors/terraform-foss

terraform-foss

The MPL-licensed Terraform sources.

Codeberg.org

@tedivm

The change isn't retroactive, so if you want an MPL-licensed source tree, there you go.

@Fil3 I was hoping Terraform would escape it.

@Fil3 @tedivm

I hope Merriam-Webster adds Cory Doctorow's name to the upcoming 2024 new word of the year announcement.

@tedivm what a shit show of a company. Let’s see them go the way of Lightbend. Light who? Exactly
@tedivm Spiritually, that sucks. Realistically, meh.
@tedivm One more CLA and Copyright assignment trap...
@tedivm @tychotithonus ... aaaaaaand we have another case study for why CLAs are terrible. Meanwhile, gotta admire the chutzpah of a company who says the quiet part out loud and calls it the BS license.
@tedivm This is big. Large public sector agencies using TF can't magically come up with money for licensing this time of year.
@dr0037 @tedivm Is there a reason they can't just pin version?
@dalias @dr0037 @tedivm large public sector orgs can't just stop keeping up to date with security fixes: they have responsibilities to those they serve, are attractive targets for bad actors, and are under much greater scrutiny for decision making than the private sector. If there's no open source fork in short order to keep those security updates coming, this will deal a huge blow to trust in open source.

@dalias @dr0037 @tedivm Although I don't think this change will be a problem for the large majority of the public sector since the only usage it immediately restricts is provision of services that directly compete with Hashicorp.

It's not a good change for FLOSS movement, but I'm not sure this issue is a major one.

@petrichor @dalias @dr0037 @tedivm "HashiCorp will continue to backport critical security patches, as available, to existing versions under the MPL 2.0 license until December 31, 2023. Any patches after that date will be provided under the new license."
@aurorapenguin @petrichor @dalias @dr0037 @tedivm hopefully there will be at least one viable fork at that time.
@dr0037 @tedivm can't they keep using it for free unless building a competing product?
@tedivm Doesn’t Pulumi rely on Terraform in the backend? If so, then they’re in trouble

@tedivm

As a not-software metaphor: it's like the apartment complex now charging for elevator access. Sure, the stairs are still free. But you've suddenly lost the ability to access the top floors (in the clouds as it were) unless you use a lot more human effort or pony up the cash

@tedivm vault, too. Probably the whole bunch?

@tedivm

Hashicorp product management: “our open-source product is better than our enterprise product, oh no, what do we do?!”

Hashicorp legal: “hold my beer”

@tedivm surely they can't change any contributions from MPL to any other incompatible license?

@makegeneve They can because they require contributors to sign Contributor License Agreements which signs over the individual developers copyright to Hashicorp.

Most developers are okay with that because they assume companies will switch from one open source license to another (say MPL came out with an upgrade). Hashicorp took advantage of that good will to steal and relicense the work. While legal, it's certainly not ethical.

@tedivm FFS. #sleazy

Individual developers should never take the time to sign any contractual agreement unless they are being paid. I hope no-one was foolish enough to do so.

@makegeneve @tedivm if they don't receive good and valuable consideration, it's not a contract