Redis adopts dual source-available licensing

I think most people are aware of the occasional contributions from the behemoths. Sometimes, entire projects. But charity is not a sustainable business model. When you provide a service offering the marginal returns go to the provider. In the B2B world, that’s a golden deal for these companies. Normally, you’d have a rev share or something like it. So it’s very understandable there’s a shift in the industry. It’s probably for the better for everyone.

The work was still on the behalf of AWS and their goal to make money and out compete Redis. it seems like this thread is forgetting that?

The alternate future seems to be a headline like "Redis shuts down and stops development" anyway, so how is this different?

What do you think Redis should do? Continue to let the cloud providers run them out of business? And all because Amazon was gracious enough to fund 1 employee working on it? I think this thread is missing that response.

This is like seeing an employee of Philip Morris pointing out that they have employees volunteer to tell kids how smoking is not healthy or like when British Petroleum funds research on green energy... I'm sorry but you're a cog in a machine which is fine but we have structural problems at play here that can't be swept under the rug

one of my colleagues unknowingly was part of Amazon’s embrace and extend phases so ah… yeah it’s not all bad.

That might make sense if the tools in question were created by corporations who used OSS as a pseudo demo.

Redis the project/tool existed long before Redis the company owned it.

Vagrant existed before HashiCorp owned it.

Significantly: both companies dropped permissive licensing after the creator of their (original) products stepped away, and both are venture capital backed companies.

So we could just as easily say "I see that long term people will preemptively fork projects the moment they are owned by a VC backed company"

I doubt that. What has been proven clearly in the industry is that FOSS works excellently as a way for businesses to collaborate on common infrastructure. Linux is by far the biggest success in this area, but there are also things like Kubernetes, clang, Python and others.

What does not work, not long term, is trying to build a business around selling a FOSS solution - RedHat is probably the only notable exception here. But having multiple companies invest in a common tool that they all use as part of their infrastructure has worked wonders.

I think it comes down to is the project there to make money or not. If it's mainly for money then it would never start out open source (ie AWS) but if it's a solution to a problem that can be improved via collaboration then it'll be Open Source (ie OpenStack). This hasn't really changed over the years.

What we are seeing here, as others have pointed out, is that companies are buying Open Source solutions and then close sourcing them because they view it as a money maker which in the end leads to forks.

Looks neat, but probably only for internal MSFT usage.

For what it's worth... Microsoft was quoted in the Redis press release as a cloud provider that has partnered officially with Redis under this new licensing scheme.

There are many drop in replacements (we use keydb), but, depending on the features you use, there are a lot of api compatible (but sometimes lacking features) compatible drop ins. We migrated of a large redis cluster overnight; 0 software changes.

Do those users actually exist, thought?

Broadcom is able to screw over its customers because they have to choose between either reworking a core part of their infrastructure, running legacy code without support (provided you have a perpetual license), or paying a huge license fee. With Redis, the current version is already open-source: you can maintain it yourself, switch to a drop-in replacement community fork, or pay one of the dozens of SaaS companies to run it for you. Switching away from the official Redis flavor can be as simple as a one-line change in your infrastructure recipe. If they increase their prices, why would anyone stay?

I think MySQL is probably a better comparison. After Oracle's acquisition they have been trying quite hard to add vendor lock-in and extract money out of it, but these days MariaDB has essentially made it completely irrelevant. I wouldn't be surprised if the future of Redis looked quite similar.

The reason this inevitably faceplants is lack of access to real user feedback.

Invariably, someone looks at the numbers and realizes "We could make way more money if we only catered to the top 2% of our customers!"

Unfortunately, opinions and needs of the top 2% of customers != a generally useful product.

Thus, the reason to try and maintain user volume is better product-market feedback to guide development, instead of revenue.

What are you talking about? At some megacorp I work at, we had a similar situation where some other braindead product changed its license. Even since, there's, on average, 30% engineering position, maintaining the old deprecated version before the license change.

When it comes to large corps, the prices paid for these products is already so large, because of the scale, that it often times makes more sense to employ your own, instead. These kind of decisions are taken all too often. We'll spend a good few sprints exploring possibilities/mapping differences/POCing to more accurately estimate all these findings and their ROI before deciding. This can also include tough migrations. At a previous megacorp; ELK did a nasty? Migrated to OpenSearch.

So, hard no on your take.

Why would there be thousands of forks? We only need one good one.

I'm predicting such a fork backed by several core committers, and possible several cloud providers will emerge pretty quickly because they all need this to continue to exist as free and open source. AWS is not going to pay Redis a cent. Nor is Azure. Or Google. Or people commercializing open stack. All of those offer Redis support currently. Lots of their users use it.

MySQL is used as upsell, when it can't take the requirements any longer, there is Oracle RDMS over there with a nice upgrade deal discussed over lunch.

And Apache kvrocks

MariaDB called and said, "I'm still here" ;)

LibreOffice? MariaDB? X.Org?

FRRouting forked from Quagga. Quagga is dead now, FRRouting is on overdrive.

It’s bait and switch to community developers who contributed free labor to a for profit company for what is now either a fork or a more restrictive license

It's salami bait and switch.

It is our obligation as developers to communicate to companies if we want these license changes to happen or not. If you don't like it, don't contribute and invest your time into projects that are licensed in way that matches your needs and wants.

The best thing you can do is to fork the project at the commit prior to the license change, and maintain it from that point onwards (and/or contribute to other forks with the same goal).

The other side of the coin is that this move is totally in their rights, morally and legally.

Legally, sure. That's pretty binary.

But if you claim they have the moral right to do so you need to elaborate on that. Since they had a "social contract" with the community (people who submitted PR's, advocated for Redis, etc.) which a single side has now altered. I don't see how one can do that an claim to be in their moral rights to do so.

We've altered the deal, pray we don't alter it any further...

This is one way to see it. The other side of the coin is that this move is totally in their rights, morally and legally.

Morally I would say it depends on contributors. If there haven't been any then sure, but if I contributed a feck-load of code to some project and they slap on a commercial license, I guess I feel somewhat shafted.

For me, using OSS means that if I bump into a problem, I can fix it and use, and share the fix. Yes, I've created OSS projects and contributed to others.

It also means that if the people providing the software decide to change the deal to something that is too onerous for me to accept, I have options that don't disrupt the continuity of my business.

If I no longer have those rights, I'm no longer willing to rely on this software.

Unfortunately, it's far from trivial to rip Redis out of a running application environment and they know that.

This kind of change feels like a bait & switch to so many people, because it is a bait and switch.

Now that it has been integrated, and could cost hundreds of thousands or millions of dollars in labor to rip out, they change the deal.

We've been reassured for many years that this is OSS and it will always be OSS and many people relied on that assurance to place a hard and expensive dependency on this software.

That is a betrayal of trust and it's hard for me to understand how people aren't seeing it that way.

First stable GA release in Jan. They're talking up the pending 1.7 release... https://www.thestack.technology/opentofu-1-7-business-value/

Hey, tech lead of OpenTofu here.

It’s going excellent! I’m surprised by how well adoption is going.

Just the day before yesterday we had OpenTofu Day at KubeCon, and instead of the expected ~30 people we had 150-200 attendees and a packed room!

The next major release, 1.7, is coming out soon too.

I certainly won't sign CLAs to entities like IBM (Eclipse/RHEL) or Oracle. But I did willingly sign a CLA for the Apache Software Foundation. I didn't enjoy doing it, but at least they're a force for good.

Not all CLAs are the same... for example, the CLA from the ASF is NOT a copyright assignment. Other CLAs _are_.

Redis was popular enough long before clouds.

Also, with AGPL-style license Redis will not become less popular. Anyone still will be able to use it as a cache, but not as a free work done by others that you can resell without contributing back.

Aws not offering it does indeed make it harder to adopt, especially if you have to have additional billing contracts with an additional business party, have to validate their certifications (soc2, etc), customer data sharing agreements, etc.

There’s a difference between developer popularity, and ability to actually use it in commercial product. If AWS provides a commercial alternative out of the box available within existing contracts and certifications, adopting that is low friction.

What does code being used by AI have to do with "big bad megacorps who effectively exploit FOSS developers?" I don't see any connection there, while I do see it for something like SSPL.

It's a semantic thing and I agree with the feedback - specifically with the "F" in FOSS. That sort of license would be Open Source but not completely Free (as in freedom, not beer).

I am still not entirely convinced that "disallowing code from being used by AI" is going to hurt megacorps in the long run - or the individual.

I guess plenty of people have already made their own call on this matter but I'm still genuinely undecided. As much as the megacorps are rushing to rule the AI roost - it's possible it will turn out to be a universal solvent to some degree.

But I'm also pretty lukewarm about AGPL and SSPL. I feel there's a huge amount of fragmentation in open source land and I'm often unable to use code in situations where I feel the original creator would probably have been ok with it.

Look more closely and you'll see that they offer a competing service right next to it... it's about the most anti-competitive posture you can imagine as they slowly corrode their foundation

Wait, no. You can't run it for anything commercial unless you pay up. That's their whole spiel.

As opposed to leeching from open sourcing your software just to undercut the competitors and then bait and switch into closed source? There's absolutely no problem with wanting to sell your software and being proprietary. But the issue is really that they are a multi million or even billion (hashicorp) who built that value on top of being open source.

They are completely within their right to switch licences but it doesn't mean that we have to fall for the narrative that they are protecting themselves from the big guys. Let's be honest, no one would've used redis or terraform if it was closed source. Or if it wasn't available on the big guys platforms.

Redis started as a community project and had tons of community contributions. I'm sure that their effort to gain fairness for the smaller guys doesn't apply to anyone smaller than them. It's ironic that they did exactly what they imply the big cloud players did, scoop up open-source work to build corporate value

However if your company goal is to ensure the software exists (as a non-profit steward), this is a resounding success!

That depends on whether those big competitors are contributing code back.

If they are, then great, the code continues to exist as high quality open source, even if you're playing a smaller role.

If they aren't, then the good version isn't open source. Your goal is failing even when you ignore profit. And at that point maybe an "open source except for those guys" license gets you closer to your goal in practice.

If your goal is profit, don't open source your core product.

Or more fundamentally, don't open source your value prop. Open source your complement. So many OSS shops build a valuable core only to realise their actual business ends up being selling managed servers.

If your goal is profit, don't open source your core product.

It's not hard to create a profitable business on open source and make good money. The question is how much.

If your goal as a founder is to be a billionaire, open source products are not going to do it. You need monopoly-level rents to do that, like Oracle or Snowflake. There's plenty of opportunity to create millionaires. But you'll have to forego VC financing to do it because that math does not work for venture capital funds.

the goal of keeping your user freedoms will inevitably be put aside

That depends on who you consider the user. If it's the person buying managed redis, then this license change doesn't affect any user freedoms.

I don't know, it feels like this way of doing things doesn't work well, but pure open source also doesn't work well when you want to pay salaries to a bunch of devs.

Authors can only change the license if they are the sole authors or if they impose a CLA requiring others to grant re-licensing to the original authors.

A copyleft project with no CLA, levels the playing field so that everyone has the same rights. Eg.: Linux kernel

Thank you, and it's great that it was recognised a structural change was needed inside and that they attracted you to help implement that. I understand there's deep and long threads on the mailing list, and that there are great flaws with the SSPL.

That the communication with MongoDB crashed and left a sour after taste I can imagine. But the fact now is that there's a deeply flawed SSPL out there, OSI's only real public statement is very dismissive of it. It does not address at all the concerns of Elastic or MongoDB, painting them as some sort of bad guys, when in fact their products have always been open source, even when they were so valuable they really didn't need to be.

And the companies that drove them away from what OSI considers open source, are OSI's two biggest sponsors! Two sponsors it is worth mentioning, who built their products entirely as proprietary closed software, on top of open source software.

So now, wether they meant to or not, OSI has profiled themselves as defenders of proprietary platforms, making no effort to acknowledge the plight of open source companies, and lost credibility to such a degree that now again one the great open source companies has dismissed their approval and went for an unapproved license.

If the OSI was really serious about the "greater good", they would have worked with the FSF and helped MongoDB, Elastic and Redislabs defend against proprietary platform companies such as AWS and Google with an AGPLv4 that has the provisions the SSPL introduced without causing the concerns other people raised in this thread with regard to (possibly intentional?) vagueness around what does and does not need to be open sourced.

If that had happened, then maybe today Redislabs would have announced their switch to an OSI approved open source license, and the OSI would have retained its legitimacy and reputation. How many great budding open source/open core projects have been inspired by the success of Redis, MongoDB and Elastic, that now will consider the same path as these companies, or worse, that of Hashicorp?

To quote wikipedia on the SSPL

Certification with OSI

"In 2018, MongoDB submitted the license to the Open Source Initiative (OSI) for approval. The company withdrew its submission in 2019.[19][20] In January 2021, following the re-licensing move by Elastic, OSI released a statement declaring that the SSPL does not comply with its Open Source Definition because it discriminates against specific fields of endeavor,[which?] describing it as a "fauxpen" source license.[7]"

wikipedia links to https://opensource.org/blog/the-sspl-is-not-an-open-source-l...

So it would seem your take is not quite accurate. It's not simply that it was withdrawn, the OSI board of directors has made public statements.

I'd note that the argument made above "discriminating against specific fields of endeavor" is not fundamentally different than other viral copyleft licenses.

While it has a big poison pill, the whole point of viral copyleft statements is about having a poison pill. The GPL arguably discriminates against fields of endeavor (i.e. closed source code, actually preventing it). The SSPL discriminates against cloud service providers by having a poison pill, which in theory, actually discriminates less, as that field is allowed to use it, just the requirements to use it might be to onerous to be reasonable. But there should be no logical difference if its just about "discriminating against specific fields of endeavor".

i.e. it comes down to a value/emotional statement vs a pure logic statement. The value is that cloud providers need to be allowed to use the code without severe restriction, while its ok to prevent closed source products from using the code.

It's fine for the OSI to make decisions that are not purely logical, but are simply about trying to protect the values that they want to push, but they should also be honest about it.

How can it be used at all under SSPL then? There are no operating systems on which Redis runs that uses that license.

Isn't SSPL compatible with the GPL? If so you could "just" republish your stack under the new license. Not sure how feasible this strategy is in practice, as any company's stack is vast and no one wants to enumerate it all...

MongoDB was AGPL. They decided it was not sufficient to prevent an Amazon hosted MongoDB offering so they went down the path of SSPL.

The goal of these license changes is to prevent people from selling Redis as a service essentially, in order to prevent them competing with the redis company's offerings. If it was AGPL, you would still be allowed to do that.

Well, if you've grown tired of this debate, maybe I shouldn't reply, but maybe someone else wants to have it: Sure, it's not OSI-OSS, but what does that mean for the world, in practical terms?

OSI-defined OSS means "comes with no restrictions, except maybe redistribution", whereas this license adds another restriction (you can't run the software as a service without offering the source, as I understand it). How does this restriction affect us?

It surely can't be that OSS as defined by the OSI is the only good thing, and anything else is horrible, it has to be a continuum. Why is this license so bad, when it only affects AWS? How are my liberties being restricted?

It doesn't really answer anything to say "it's not open source", because that just implies that we already agree on why that's bad.

There is only a handful of organizations this will impact and they’re all rich corporations that don’t need my pity. The project is mature, so most remaining work is likely feature adds required by mega-scale and niche commercial uses cases, that’s just not work people usually do for fun.

There is still a long tail on this. For example, wikipedia offers a cloud like platform thar people who contribute to wikipedia can sign up for free to, get some web space where they can make small unofficial tools, provided that the tool is somehow related to wikipedia. This includes redis hosting among other things (https://wikitech.wikimedia.org/wiki/Help:Toolforge/Redis_for... ). The license change would probably effect that use case ( the RSAL would prohibit that. The situation with the SSPL is less clear (IANAL))

"open source" has always been a marketing term. It doesn't mean anything because it's never meant anything.

The GNU people fought the good fight on free/libre software, but they lost because companies are greedy and devs are lazy at their day jobs.

E.g. your linux distro might no longer package it and you might have to rely on packages maintained by redis which might not be as well integrated into your distro (although lots of users probably don't care about that)

This might be me living in a bubble, but OS packages for this kind of server software really feel like a relic the past.

Containers have been around for a decade and we now have tools like podman that run without privileges or daemons. I run my freakin' Raspberry Pi 4GB as a pure container host, just because it makes the system cleaner and more reliable at almost no cost.

Now I'm sure some people still want to `apt install redis`, for example to squeeze every last ounce of performance out of hardware, and more power to them if that's what gives them the best results.

But Debian maintainers have to do a lot of dull, unfun work to update, test, and bugfix native packages for Redis and Mongo and RabbitMQ and... is that really a good use of their precious, unpaid time? To make the UX and performance only slightly better than 'podman run redis'?

Copyleft isn't permissive. It's a viral license that sets restrictions on derivative works, forks and contribution.

I can't see how you can shoulder the blame of (possible) failure of FOSS dream on developers. Devs (usually) don't control budgets and can't really ask for money to pay for freely licensed code. If blame is to be given then I'd point to money handlers for not acknowledging this situation.

Then there's the question of what I should be paying anyway. Who among all those non-free developers are paying in turn to all the professionals whose code they build on? Are proprietary developers somehow exempt from paying themselves? If and when I choose to pay I like to think all that contributed are getting the benefit.

There's a long line of professionals behind every code that should have been paid. Certain percentage might have tried to get paid. And even some who in fact did get paid.

Developers are entirely to blame - the fraction of developers meaningfully contributing to FOSS or advocating for supporting it is tiny. Just ‘import foo’ and holy smokes - free shit, yes please!

That isn't open source.

It is open source if the source code is available under an open source licence.

For example, OpenJDK is licensed under the GPL and Oracle provides licensed builds, but that does not make OpenJDK not open source.

TimescaleDB has an open core style license that seems to prevent the cloud services from repackaging their DB.

It's not technically fully open source, but it's pretty close to it.

Actually, I just took another look and they now market their "open core" as the apache edition (or perhaps have diverged from the "community edition" now)

To a lot of people (if not the majority outside hacker-news), yes.

Nope. This is tied to the whole "Free as in speech, not beer" thing.

Open Source has core definitions around the freedoms (the "speech") allowed to people when making use of that source code.

Source available makes the source code available for free (the "beer") along with certain specific freedoms, but not all of the freedoms that would be required to be Open Source.

Whether or not you think those missing freedoms are important is a matter of personal opinion, I suppose. I think they are, which is why I try to avoid source available software if there is a reasonable open source alternative.

Yes, except some people are trying to redefine English. Open source means the source is open - you can see it.

They are. The change is that the source is no longer (as?) free.

Indeed Redis was open core before the switch, sorry that I didn't check. And being open core was not enough for them, SMH.

Maybe such is the destiny of foundational open source server software... If it's "cloudable" no profitable business will come out of it.

???

The JVM and the .NET clr are just runtime JIT engines. It’s not like they ship with a full O/S and a hypervisor.

Because C# is a nice language that can be fast and C++ is a shit language that can be fast.

You're behind the times:

Publishing your app as Native AOT produces an app that's self-contained and that has been ahead-of-time (AOT) compiled to native code. Native AOT apps have faster startup time and smaller memory footprints. These apps can run on machines that don't have the .NET runtime installed.

https://learn.microsoft.com/en-us/dotnet/core/deploying/nati...

While there are limitations, this is an active area of work for future versions of .NET.

And yet the benchmarks are better than C or C++ alternatives, somehow.

At this point C# little to nothing common with Java and builds a perfectly runnable binaries. C# is extremely capable and strong and arguably is one of the best dev platforms there is.

(On the other hand, call me an old fart, but my trust in Microsoft has been completely eroded in early millennium and did not came back.)

This dual-license model provides greater clarity and flexibility, empowering developers to make informed decisions about how they utilize Redis technologies in their projects.

Yeah sure.

That is why enterprise shops than get all the cool toys, because many devs aren't willing to pay for their tools, and then they wonder when their toys aren't available any longer as the creators got enough CV coverage to get a proper job, doing proprietary software for big corps.

Great to see we have alternatives.

I'd rather see alternatives from individuals and small business. Microsoft can subsidize whatever freebie project they want simply because of their cash reserves. Redis, on the other hand, is the lifeblood of a single company. There is a much greater incentive for them to produce a better product.

the conditions today are vastly different than they were 20 years ago when there was no AWS to resell your FOSS to the whole world

No, its not. SaaS has existed for more than 20 years and reselling FOSS has been something it has done as long as there has been FOSS to resell.

What's changed recently is people launching venture-funded startups centered on gaining popularity through the appeal of FOSS with initially no clear monetization plan or one centered on selling services that were essentially just the FOSS, hosted. That’s the new thing, and why there is so much energy going into trying to figure out how to retain the marketing appeal of FOSS with the new licenses that lack the value proposition of FOSS.

Yes you're right, this is the opinion from Fedora's legal counsel: https://lists.fedoraproject.org/archives/list/devel@lists.fe...

You can also build whatever you want with SSPL, as long as absolutely everything you use to run a service that supports it is also licensed as SSPL. It's not that different from the AGPL in spirit.

3 clause BSD gives everyone permission to use it in new works that are made available using license terms of one’s own choosing, so long as the obligations of those 3 clauses continue to be met.

But what I get from this is: The project switched away from 3 clause BSD to something that is less permissive.

When will developers learn that the BSD does not protect you or your users? I understand the philosophical reasons some folks like BSD/MIT-style licenses, but at the end of the day they are not much more than public domain: anyone can take someone’s work and contributions, make improvements and keep the entire thing — original work and contributions, as well as improvements — proprietary.

If you care about a software commons, if you care about benefiting from the improvements others make to your own software, if you care about your users benefiting from the improvements others make: use a copyleft license!

No, they won't because they already charge premium with good margin on it and competition exists.

Microsoft/Azure already agreed to enter new license agreement, others will follow if they haven't done it yet.

Nobody will notice anything, nothing will change for anybody. Some forks will popup and die off for sure though.

Every license has strings attached, including Public Domain [0] (that's why SQLite is not open-contribution).

ps. yes, I am aware of license vs copyright distinction and relation they create.

[0] https://www.sqlite.org/copyright.html

(who actually know their stuff and how licences work, rather than random engineers)

The whole licensing diatribe is more ideological than concrete, so it's actually about "random" engineers more than lawyers.

so I'm not sure what you are trying to suggest...

First, that most, if not all, of the criticism of dual licensing, in particular WRT the Redis case, is unfounded/uninformed. The SSPL is liberal when it comes to "engineering" freedoms (fork/distribute); the restriction is a business one (SSPL is very close to AGPL).

Second, most importantly, with the advent of cloud engineering, as of now, there's no licensing that makes everybody happy. And this implies that there will be plenty of complaints no matter what (just look at the dual licensing threads):

- if a company adopts standard FOSS licenses, there will be complaints about cloud companies leeching off open source projects

- if a company adopts non-standard but still liberal licenses (e.g. SSPL), there will be complaints about companies betraying the FOSS principles

Right, thanks for the correction. For reference, the v2 withdrawal thread is here: http://lists.opensource.org/pipermail/license-review_lists.o....

With the current expectations, no license will solve the problem of making software open and prevent companies from "stealing" it. The "stealing" point is not necessarily my opinion; just pointing that there's always noise about it.

But now you're open to [Redis] taking you to court saying that your service that uses [Redis] is too similar to “just [Redis]” for you to offer it to anyone else.

Field of use restrictions are a terrible idea, and totally incompatible with “open sourceness”.

Redis is using the wrong definition of permissive.

Seems like AWS did contribute to Redis and has implemented quite a few features [1] and have been partners for quite a while [2]. This could not have any effect for AWS but for other cloud providers instead.

[1] https://aws.amazon.com/blogs/opensource/how-to-become-a-redi...

[2] https://redis.com/press/strategic-collaboration-agreement-wi...

Yeah, https://redis.com/press/redis-ceo-succession/, seems to be the case here. It took them a little over a year to decide open-source isn't profitable and move away.

Mods merged comments from another thread that pointed somewhere else.

Honestly, I created it just to keep things organized. I fork a lot of projects for different reasons, but mostly just to keep a copy around for when "weird shit happens". Eventually I had some many forked projects in my "mindcrime" org that they got in the way, so creating a "mindcrime-forks" and moving all the forks there seemed like an obvious choice.

I also did a "mindcrime-templates" for template pom.xml files, and silly little "starter projects" of various sorts that I can clone down and and have something set up the way I like it, with minimal scaffolding, and then start morphing it into whatever I need.

That's not strictly accurate. SSPLv1 is only a choice for the source code. One can elect to use RSALv2 for both binaries and source code.