hertgDec 1, 2023

When I heard that Teleport is gonna change their license, I almost had a "aight, here we go again" moment after being fucked with by #Lightbend and #HashiCorp recently. Thankfully they switched to AGPL and not BSL (which I think stands for bullshit license).

The common tactics of companies "promoting #opensource" to gobble up a larger audience and then pull a bait and switch with the licensing seems to have caused me some serious PTSD.

https://goteleport.com/blog/teleport-oss-switches-to-agpl-v3/

#teleport #licensing

Teleport OSS will relicense to AGPLv3

A detailed explanation, schedule, and FAQ on why we have switched Teleport OSS to AGPLv3 software license.

Show threadDiego Elio PettenòDec 1, 2023
@hertg it doesn't have a significantly different effect though, given how AGPL is basically a toxic license for most professionals.
Show threadIvan Vučica 🕳️Dec 1, 2023
@flameeyes @hertg I learned of it recently, I wanted to look at it for purely personal use, and -- yeah, I'm already back at the "I'd rather roll my own" stage.

I understand why, I know it would not really affect me for personal deployment, but it fits into the category of things I'd rather not have under AGPL or BSL.

I also don't understand what is the meaning of "we ship binaries as Apache2" if the source is AGPLv3. There's no practical difference to shipping AGPLv3 binaries.
Show threadDiego Elio PettenòDec 1, 2023

@ivan @hertg if the binaries were licensed as AGPLv3, the corresponding source code would have to be provided when running it over the network.

They could have said that the binaries are provided under a Freeware License and it would basically mean the same at that point — it's the not-unusual implication of "the copyleft implications are for Others, not for Us."

(It also probably means that they'll only accept patches that are CLA'd or Apache-2.0 licensed for that.)

Show threadDiego Elio PettenòDec 1, 2023

@ivan @hertg

> A Contributor License Agreement (CLA) gives Teleport the right to dual license external contributions and makes sure contributors don’t submit code that has any restrictions to it.

Yep.

Show threadhertg

@flameeyes @ivan There's been another update, in case you missed it:

https://infosec.exchange/@hertg/112072368307528980

Michael :donor: (@[email protected])

Teleport is changing their license further. https://goteleport.com/blog/teleport-community-license/ #teleport #goteleport #licensing #opensource

Infosec Exchange
Mar 10, 2024 at 4:47pmWeb
Show threadIvan Vučica 🕳️Mar 14, 2024
@hertg @flameeyes
Show threadDiego Elio PettenòMar 16, 2024

@ivan @hertg listen, I'm not saying that I have a blog post about everything, but I'm fairly sure I could pull an Onion and make this a madlib template and it'll work just as well…

https://flameeyes.blog/2017/07/21/fake-free-software-hurts-us-all/?mtm_campaign=social&mtm_kwd=mastodon

Fake “Free” Software hurts us all

Brian Krebs, the famous information security reporter, posted today (well, at the time of writing) an article on…

Flameeyes's Weblog
Show threadIvan Vučica 🕳️Mar 21, 2024
@flameeyes …well, that post is SOMEWHAT topical.

I’m thinking that the particular example of gSOAP in the post, as described, is still free software, just it’s a cathedral and not a bazaar. It’s not a great situation, but precisely forkability is what makes it free. No need to move the goalpost there, imho: you don’t need to take in contributions.

But, if as a dev (company or otherwise) someone at some point changes the social (and licensing) contact, well,

1. I reserve the right not to trust them again
2. Even cost-free it becomes untrustable

I’d rather run freeware software than free software where the core contributors use their legal rights to pull the rug under me. Especially if I have alternatives. Why depend on something it will take ages to rip out if suddenly someone pulls an oracle on me?

I am also ok with GPL and LGPL, and depending on what the thing is, very unlikely to be comfortable with AGPL. I don’t see Apache or MIT or BSD as a replacement: if someone wants to use the fruits of my (hobby) labor, the minimum is that they contribute back. AGPL pains me because it’s unclear to me where the “network access” stuff kicks in. I can understand GPL and LGPL; for AGPL less so.

I really dislike unpredictability, so rug pulls and AGPL make me less happy than just running something proprietary but perma-free. With freeware, at least I know where I stand..

@hertg