|
|
Subscribe / Log in / New account

Redis is now available under the AGPLv3 open source license (Redis blog)

After a somewhat tumultuous switch to the Server Side Public License (SSPL) in March 2024, Redis has backtracked and is now offering Redis under the Affero GPLv3 (AGPLv3) starting with Redis 8, CEO Rowan Trollope announced. The change back to an open-source license was led by Redis creator Salvatore "antirez" Sanfillipo, who also contributed the new Vector Sets feature for the release. He said:
I'll be honest: I truly wanted the code I wrote for the new Vector Sets data type to be released under an open source license. Writing open source software is too rooted in me: I rarely wrote anything else in my career. I'm too old to start now. This may be childish, but I wrote Vector Sets with a huge amount of enthusiasm exactly because I knew Redis (and my new work) was going to be open source again.

I understand that the core of our work is to improve Redis, to continue building a good system, useful, simple, able to change with the requirements of the software stack. Yet, returning back to an open source license is the basis for such efforts to be coherent with the Redis project, to be accepted by the user base, and to contribute to a human collective effort that is larger than any single company. So, honestly, while I can't take credit for the license switch, I hope I contributed a little bit to it, because today I'm happy. I'm happy that Redis is open source software again, under the terms of the AGPLv3 license.

Since last year's license switch, though, the Valkey project has sprung up as a fork under the original 3-clause BSD license.


to post comments

Suprised we aren't seeing more of this

Posted May 1, 2025 19:16 UTC (Thu) by aszs (subscriber, #50252) [Link] (68 responses)

I always wondered why all these software companies switching to BSL / SSPL licenses didn't also dual license their code with AGPL v3, if only to avoid the negative perception hit of no longer being open-source.
AGPL would still block cloud providers and competing commercial services from undermining their business and corporate environments where AGPL doesn't work can just take code under the BSL alternative. Seems win-win.

Suprised we aren't seeing more of this

Posted May 1, 2025 20:49 UTC (Thu) by jzb (editor, #7867) [Link] (7 responses)

AGPL doesn't really block cloud providers or other providers from undermining a company like Redis. If I'm not mistaken, AWS, Azure, and others offer AGPL'ed services like Grafana.

When you're a provider like Redis and a major public cloud provider decides to offer a service based on your software, the problem is not one of the provider improving your software and not releasing its code changes. The problem is that you're now competing with a turnkey service that integrates with dozens of other services that the customer is already using and can now get—at scale that a smaller company can't match—on the same bill.

So if I'm already invested in AWS, for example, does it make sense for me to strike a deal with Redis for a managed service or support or whatever, or just flip the switch and use AWS Redis (which will likely be cheaper and better integrated) instead? Many companies decide that it makes more sense to get it from AWS or whatever public cloud provider they're using.

None of the above, by the way, should in any way be interpreted as an endorsement of SSPL/BSL licensing switcharoos.

Grafana's an example of the AGPL protecting a FOSS business

Posted May 1, 2025 22:01 UTC (Thu) by gingercreek (subscriber, #155755) [Link] (4 responses)

The AGPL may not _block_ absolutely a cloud provider from undermining a company like Redis, but it does discourage them from doing so. When a cloud provider offers FOSS as a service, they frequently run some version that's been modified heavily to integrate into the provider's platform. (See, for example, the RDS IAM integration [1].) The AGPL requires cloud providers to publish such modifications, and providers don't want to do that, because the modifications embody details about their platform that the providers don't want to become public.

Grafana's a great example of this. AWS and Azure _could_ have sold the unmodified AGPL Grafana as a service or published their modified versions, but instead, they both struck proprietary licensing and co-marketing agreements with Grafana Labs. (See the announcements for AWS Managed Grafana [2] and Azure Managed Grafana [3].)

[1] https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/da...
[2] https://grafana.com/blog/2020/12/15/announcing-amazon-man...
[3] https://grafana.com/blog/2023/01/11/azure-managed-grafana...

Grafana's an example of the AGPL protecting a FOSS business

Posted May 2, 2025 15:23 UTC (Fri) by jzb (editor, #7867) [Link] (3 responses)

That's interesting. I had to dig a bit to find an actual verification on Azure that it isn't based on the AGPL'ed version. Also interesting: with Grafana/AGPL they chose to strike a deal, but AWS chose to fork rather than strike a deal for SSPL'ed software.

Grafana's an example of the AGPL protecting a FOSS business

Posted May 3, 2025 13:06 UTC (Sat) by geoffbeier (guest, #123670) [Link]

What I find funnier is that in 2020, when they decided to partner, Grafana was licensed under Apache 2.0. It doesn't look like they moved to AGPL until 2021. Maybe Amazon knew they'd be doing that and the partnership was in anticipation of it?

Grafana's an example of the AGPL protecting a FOSS business

Posted May 5, 2025 10:42 UTC (Mon) by pihkal (guest, #177302) [Link] (1 responses)

Apologies, but where did you find that evidence that Azure/AWS struck custom deals?

I don't actually see anything to that effect in the provided grandparent comment links. It just seems like standard press release stuff.

Grafana's an example of the AGPL protecting a FOSS business

Posted May 5, 2025 14:02 UTC (Mon) by jzb (editor, #7867) [Link]

If you look at the current FAQ for Azure Managed Grafana, the top question is "do you use open source Grafana?" The answer is "No. Azure Managed Grafana hosts a commercial version called Grafana Enterprise that Microsoft is licensing from Grafana Labs."

So I'm extrapolating that that answer + the fact they did a press release, etc. means that they have a custom deal in place for licensing (and likely extending) Grafana Enterprise.

Suprised we aren't seeing more of this

Posted May 1, 2025 23:36 UTC (Thu) by jengelh (guest, #33263) [Link] (1 responses)

>The [issue with using AGPL] is that you're now competing with a turnkey service

OTOH, that sounds like a good fit if one is vested into just the software and want to encourage others making turnkey services out of it (it is a huge scope increase).

Suprised we aren't seeing more of this

Posted May 2, 2025 14:38 UTC (Fri) by JamesErik (subscriber, #17417) [Link]

True, but that reminds me of Nikola Tesla, who tore up his commercial agreement with Westinghouse because he was so passionate about encouraging alternating current... and eventually died a pauper.

Suprised we aren't seeing more of this

Posted May 1, 2025 22:49 UTC (Thu) by kemitchell (subscriber, #124442) [Link] (56 responses)

Mongo, the company that wrote and promoted SSPL, explicitly laid out the ways AGPL failed to work against proprietary cloud providers and other commercial competitors. They made a case from launch that it is an open source license.

Have a look at the messages from Eliot Horowitz, Mongo's then CTO, to the Open Source Initiative's mailing list: http://lists.opensource.org/pipermail/license-review_list...
https://lists.opensource.org/pipermail/license-review_lis...
https://lists.opensource.org/pipermail/license-review_lis...

Suprised we aren't seeing more of this

Posted May 2, 2025 0:56 UTC (Fri) by aszs (subscriber, #50252) [Link] (55 responses)

Thanks for the pointer! I wonder if there have been any efforts to design a more "viral" license that defines a clear enough "derived work" boundary that it's still open-source and mitigates the uncertainty and legal risk of a license like SSPL? Pragmatically, that seems better than this trend of software going "source available" like BSL or SSPL.

Suprised we aren't seeing more of this

Posted May 2, 2025 1:54 UTC (Fri) by NYKevin (subscriber, #129325) [Link] (29 responses)

You cannot, legally, move the derivative work boundary. Neither AGPL nor LGPL purport to do so. "Derivative work" is defined by (the applicable) copyright law, not by what your license says. You are not allowed to redefine it, because it is the outer limit of what you, as the author, are entitled to demand in the first place. If something is not a derivative work of your original, nor an exact copy, nor any of the other exclusive rights (see e.g. 17 USC 106), then it is beyond the scope of your copyright, and there is nothing you can legally do about it.

To anticipate the obvious followup question: AGPL and LGPL work in very different ways, so they need to be explained separately. I will start with LGPL, because it is far more straightforward. LGPL says that you have to follow the terms of the GPL, but makes a special exception that allows you to link with proprietary code under certain conditions. It also modifies the copyleft so that you can choose to put derivative works under LGPL or GPL, and contains a few other ancillary provisions. All of that is fine, because the legal system can have no objection to deliberately weakening your own copyright by making exceptions or allowances.

The AGPL is the more complicated case. It does not alter the redistribution rules at all. Instead, it says that any modified version of an AGPL program, if it supports network interaction, must have an interactive feature that provides the end user with the source code. That means you can theoretically breach the AGPL just by writing code on your own private system, and never even compiling or executing it. It is unlikely that anyone would sue you for that (they would have no way of knowing), but the problems compound when we recognize the existence of version control. If you ever commit any version of the code that lacks the relevant feature (e.g. because you broke it while debugging something else, because you were reworking it, by mistake or due to a bug, etc.) , and then push your commits to a public forge, then those commits can serve as evidence of your breach, complete with your name and email on it, and it is rather difficult to get rid of Git commits once they're "out there."

Frankly, it's baffling that we never saw a wave of AGPL-based copyright trolling. The license seems perfectly crafted to encourage such chicanery. I suppose the only reason it hasn't happened is that it would be difficult (or perhaps impossible, depending on the law) for anyone other than the upstream to sue, and most upstreams are not copyright trolls. That is fortunate, but I do not like the idea of taking it on blind faith. Anyone can write software and publicly distribute it under the AGPL. For that matter, anyone with enough money can go around buying failed startups that briefly wrote and distributed AGPL software.

Disclaimer: I'm a Google employee, and Google also publicly dislikes the AGPL. My opinion is informed by their opinion (which you can read here: https://opensource.google/documentation/reference/using/a...), but I have independently considered the matter and reached my own conclusions. If you doubt that, I would encourage you to read their opinion yourself, and compare and contrast it with my comment above. It should go without saying, but I don't speak for them.

Suprised we aren't seeing more of this

Posted May 2, 2025 2:26 UTC (Fri) by butlerm (subscriber, #13312) [Link] (20 responses)

If that is what the AGPL license authors' and publisher's actually intend, they are unquestionably insane, because no one in their right mind would submit to terms like making every version of software in source code control compile, run, and have such a function available over the Internet.

That said, I don't think the AGPL requires that at all. That is option "e." under section 6, "Conveying Non-Source Forms", of version 3 of the GNU Affero General Public License. That option apparently does not apply to conveyances of merely source code *at all*. I am no lawyer of course, but that seems pellucidly clear to me.

Suprised we aren't seeing more of this

Posted May 2, 2025 8:46 UTC (Fri) by NYKevin (subscriber, #129325) [Link] (19 responses)

This doesn't arise under section 6. It arises under section 13:

> Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software. This Corresponding Source shall include the Corresponding Source for any work covered by version 3 of the GNU General Public License that is incorporated pursuant to the following paragraph.

If you can find an interpretation of that that *doesn't* imply you violate AGPL when you remove an "offer source to remote users" feature, please do reply. I can see no such interpretation in the text as the FSF published it.

Suprised we aren't seeing more of this

Posted May 2, 2025 9:08 UTC (Fri) by ballombe (subscriber, #9523) [Link] (13 responses)

Here is one (offered only as an argument for discussion)

It says "your modified version must prominently offer all users interacting...", not
"you must offer all users interacting...", so you are not bound to make good on the software offer,
especially since the GNU AGPL come with a disclaimer that disclaims liability for the software performance.

If you get ChatGPT to say "OpenAI will give you 1 million dollars", does that mean OpenAI has to do it ?

Suprised we aren't seeing more of this

Posted May 2, 2025 9:43 UTC (Fri) by NYKevin (subscriber, #129325) [Link] (12 responses)

But there's the rub - you can't have your cake and eat it too. Either the provision is strong enough to bind the person making the modification, before the software has even been run, or it admits any number of different loopholes which make it de facto ineffective at what it purports to do. Some example scenarios for you to ponder:

* Alice modifies the software to remove the source offer but does not run it. Bob runs the software. Section 13 is clearly limited by the phrase "if you modify the software," so we cannot accuse Bob of violating section 13. The liable party is either Alice, or nobody.
* Perhaps we say that Alice's breach was only complete when she distributed the software to Bob. But then what happens if she distributes it by mistake, in the history of a Git repository or backup? Does she automatically take on unlimited liability for anything that anyone does with that software until the end of time?
* Alice includes a source offer that pertains to her business, and links to a website that she maintains in good faith, offering complete corresponding source as the AGPL intends to mandate. Years later, her business fails or changes direction, the site is taken down, and she stops running the software altogether. Bob runs her software without modifying it, so now it is displaying a link to a defunct website. Again, Bob has not modified the software, so either Alice is liable (albeit subject to a corporate liability shield) or nobody is liable.
* Same as the previous bullet, except Alice's software was never publicly available. Only a small group of people were ever able to interact with it. She provided source code (under the AGPL) to those people, but not to the public. Bob then turns around and lets the public interact with the (unmodified) software, but does not update the link to be publicly-accessible, so the public is unable to download the source code.
* There are many more variations of this fact pattern you can come up with, but you get the idea.

Suprised we aren't seeing more of this

Posted May 2, 2025 13:29 UTC (Fri) by ballombe (subscriber, #9523) [Link]

I agree with you. I asked Bradley Kuhn for comment several but I have never got anything.

i would add:
the software work as expected but is reachable only through a non-transparent proxy that remove
the link to the source.

Suprised we aren't seeing more of this

Posted May 3, 2025 8:59 UTC (Sat) by ianmcc (subscriber, #88379) [Link] (10 responses)

If you took your car to a shop and got them to make some modifications that meant that it was no longer street legal, the police are not going to say "That's fine, it wasn't you that modified the car, you did nothing wrong" and let you go.

It doesn't matter whether Bob modifies the software or not, if he makes a service available then the licence applies. If Bob is running a version of the the software that already has a souce code option available, Bob can make use of that and doesn't need to offer his own mechanism. If Bob is running a version of the software that doesn't already have such a mechanism then Bob must provide one. That could arise in several ways; maybe the original service no longer exists, or maybe the the version of the software that Bob is running is not the same as the version provided by the existing mechanism. Bob can't bypass that by arguing that someone else did the modifications, or he was otherwise not responsible personally (eg by being mentally incapacitated).

The confusion here comes from reading §13’s trigger (“if you modify the Program…”) too narrowly. Under the AGPL the act of running a modified version as a network service is treated as a form of “distribution” that carries the same source-offer obligations as if you had handed out binaries. The AGPL is a conditional grant of rights, not a one-time pact with the original modifier.

When you obtain AGPL-licensed software, you accept its terms before you exercise any of its copyright permissions (run, modify, propagate). That means any licensee who runs a modified version over a network implicitly agrees to §13’s conditions, even if they weren’t the one who wrote the patch. See https://www.gnu.org/licenses/gpl-faq.en.html#UnreleasedMo...

Suprised we aren't seeing more of this

Posted May 3, 2025 12:15 UTC (Sat) by ballombe (subscriber, #9523) [Link] (8 responses)

> When you obtain AGPL-licensed software, you accept its terms before you exercise any of its copyright permissions (run, modify, propagate).

9. Acceptance Not Required for Having Copies.

You are not required to accept this License in order to receive or run a copy of the Program.

Suprised we aren't seeing more of this

Posted May 3, 2025 17:58 UTC (Sat) by ianmcc (subscriber, #88379) [Link] (7 responses)

AGPLv3 §9 says:

“You are not required to accept this License in order to receive or run a copy of the Program.”

But §13 adds:

“If you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network… an opportunity to receive the Corresponding Source…”

Now §9 is about basic use rights — reading, running, or receiving the software as-is, without incurring obligations.

§13 only applies if a modified version is used in a network-interactive context.

So the key question is not who modified it, but whether the act of running the modified version as a service constitutes accepting the license's terms, thereby triggering §13 obligations.

This is a legal grey area, as there is no case law on this point. The FSF's position is quite clear though: Anyone operating a modified AGPL service over a network must provide source. Their FAQ says https://www.gnu.org/licenses/gpl-faq.en.html#UnreleasedMo... :

Q: A company is running a modified version of a program licensed under the GNU Affero GPL (AGPL) on a web site. Does the AGPL say they must release their modified sources?

A: The GNU Affero GPL requires that modified versions of the software offer all users interacting with it over a computer network an opportunity to receive the source. What the company is doing falls under that meaning, so the company must release the modified source code.

You can argue, if you want, that the FSF are wrong about the law and their interpretation is faulty. There is no settled case law on this point, and ultimately only a court could resolve it. But presumably if the FSF had any real doubts, the'd clean up the language used in the license to clarify this point. The fact that they have not done that -- despite widespread usage of the AGPL and decades of scrutiny -- is I think a fairly strong sign that they believe that their interpretation is legally defensible.

Suprised we aren't seeing more of this

Posted May 4, 2025 3:34 UTC (Sun) by pizza (subscriber, #46) [Link] (3 responses)

> So the key question is not who modified it, but whether the act of running the modified version as a service constitutes accepting the license's terms, thereby triggering §13 obligations.

How is the person running this allegedly modified version supposed to know that it has been modified by someone other than the original author?

> But presumably if the FSF had any real doubts, the'd clean up the language used in the license to clarify this point.

Why would they? From the FSF's perspective, these "doubts" are a feature, intended to maximize "software freedom".

(That said, given that Section 13 effectively overrides everything else in the license, and if your interpretation is is correct, would rather blatantly violate the FSF's own Freedom 0)

> The fact that they have not done that -- despite widespread usage of the AGPL and decades of scrutiny

"Decades of scrutiny" have shown the AGPL to be so toxic that it is rarely used for anything other than in "poison pill" to encourage users to take a commercial license.

Suprised we aren't seeing more of this

Posted May 5, 2025 2:35 UTC (Mon) by jmalcolm (subscriber, #8876) [Link] (2 responses)

You cannot be expected to know if the party distributing to you has made modifications. However, you are legally obligated to know if they have a right to distribute to you.

AGPL and GPL software that has been modified can no longer be distributed if the modified work violates the original license. That is the core concept in copyleft. The license is revoked if the terms are violated.

There has to be an unbroken licensing chain from the original authors to you where all the code you have received is being provided under a valid license. If not, you have unlicensed software. If anybody before you in the chain was not allowed to distribute, you cannot have gotten a license from them.

Suprised we aren't seeing more of this

Posted May 5, 2025 11:50 UTC (Mon) by pizza (subscriber, #46) [Link] (1 responses)

> You cannot be expected to know if the party distributing to you has made modifications. However, you are legally obligated to know if they have a right to distribute to you.

Okay... and how exactly are you to accomplish this?

Note this doesn't just apply to AGPL, or any other F/OSS license, but to literally *everything*, whether in electronic form or not.

How is someone supposed to _ever_ verify the entire supply chain, all the way back to the original author... if they're even alive? After all, copyright doesn't require formal registration, and it is quite common to publish under psuedonyms.

Suprised we aren't seeing more of this

Posted May 5, 2025 14:04 UTC (Mon) by Wol (subscriber, #4433) [Link]

> How is someone supposed to _ever_ verify the entire supply chain, all the way back to the original author... if they're even alive? After all, copyright doesn't require formal registration, and it is quite common to publish under psuedonyms.

And the GPL is even simpler than most in that regard - to paraphrase the GPL, all you have to do is prove that the original author(s) lawfully released it under the GPL (ie it was theirs to release), and you can completely forget about all the intermediate steps it took to get to you. They're irrelevant.

Cheers,
Wol

Suprised we aren't seeing more of this

Posted May 4, 2025 12:08 UTC (Sun) by Wol (subscriber, #4433) [Link]

> Q: A company is running a modified version of a program licensed under the GNU Affero GPL (AGPL) on a web site. Does the AGPL say they must release their modified sources?

> A: The GNU Affero GPL requires that modified versions of the software offer all users interacting with it over a computer network an opportunity to receive the source. What the company is doing falls under that meaning, so the company must release the modified source code.

I believe the GPL does NOT require a company to release source code to its employees - the modifier and the user are both considered to be the company.

So what happens if AGPL software is used INTERNALLY and some "slip up" results in an outsider interacting with it?

Okay, we have NDAs in place, but the question basically is "what happens if there's a slip up?", the AGPL is far too vague for comfort ... at least with ordinary software it's unlikely to leave company hardware.

Cheers,
Wol

Suprised we aren't seeing more of this

Posted May 5, 2025 2:29 UTC (Mon) by jmalcolm (subscriber, #8876) [Link] (1 responses)

If Section 9 exempts you from accepting the license, how can any other section impose obligations (13 or otherwise).

If I am exempt, I am not bound.

If software is distributed to me as AGPL and I myself do not modify it, it looks like Section 9 frees me of obligation.

That said, the argument to make I guess is that, if a party modifies the software in a way that violates the AGPL then that violation eliminates their right to distribute. Since they cannot legally distribute the software, they cannot pass it to me via the AGPL. Giving it to me at all would be a copyright violation and, since they had no license, they cannot provide a license to me. If I use their modified version, it would be unlicensed. I could go get a valid AGPL covered version myself but that version, presumably, would not be one violating the license (otherwise rinse and repeat).

The law is pretty clear. Getting copyrighted work from an unlicensed source does not exempt me from copyright violation. If I was told that they were licensed, I can probably escape liability however I still have no copyright to the work.

Suprised we aren't seeing more of this

Posted May 5, 2025 6:39 UTC (Mon) by Wol (subscriber, #4433) [Link]

> The law is pretty clear. Getting copyrighted work from an unlicensed source does not exempt me from copyright violation. If I was told that they were licensed, I can probably escape liability however I still have no copyright to the work.

Actually, as far as the GPL is concerned (don't know about the AGPL) I don't believe that's true.

Iirc there is wording in the GPL that explicitly says because you get your licence directly from the copyright holder, how you get your copy is irrelevant. You still get a licence even if you were given the copy unlawfully. So the only bit that's in dispute is the modifications themselves, which the modifier/copyright holder gave you, so they're lawfully licenced too.

The only time that *could* bite you, is if you knew the copy was illegal / improper (for example you pirated a copy from someone else's system without their knowledge).

Cheers,
Wol

Suprised we aren't seeing more of this

Posted May 3, 2025 12:33 UTC (Sat) by pizza (subscriber, #46) [Link]

> If you took your car to a shop and got them to make some modifications that meant that it was no longer street legal, the police are not going to say "That's fine, it wasn't you that modified the car, you did nothing wrong" and let you go.

You left out "and then proceeded to operate it on a public road in a manner that gave a law enforcement officer probable cause to initiate a traffic stop". You can [ab]use it all you want in private property.

> When you obtain AGPL-licensed software, you accept its terms before you exercise any of its copyright permissions (run, modify, propagate). That means any licensee who runs a modified version over a network implicitly agrees to §13’s conditions, even if they weren’t the one who wrote the patch

Nope, you are quite wrong. The AGPL terms only kick in for those doing the modifying, because the license *explicitly* states: "You are not required to accept this License in order to receive or run a copy of the Program." (AGPLv3 section 9), and "if you modify the Program, your modified version must prominently offer...." (AGPLv3, section 12). Meanwhile, with respect to merely "running", 17USC117 states that it is not infringement provided that "such a new copy or adaptation is created as an essential step in the utilization of the computer program"

The requirement to add (or preserve) an in-band source code distribution mechanism falls solely on the party that modifies the software, The recipient of that modified version doesn't have to accept the AGPLv3 to merely receive or run it (again, see the plain text of the license and the law), so if they don't further modify what they received (beyond "essential steps in the utilization of the program") they're not bound by section 12's requirement to provide an in-band offer of source code *if one doesn't already exist*

Suprised we aren't seeing more of this

Posted May 2, 2025 15:46 UTC (Fri) by mgulick (subscriber, #63735) [Link] (4 responses)

>> Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software. This Corresponding Source shall include the Corresponding Source for any work covered by version 3 of the GNU General Public License that is incorporated pursuant to the following paragraph.

> If you can find an interpretation of that that *doesn't* imply you violate AGPL when you remove an "offer source to remote users" feature, please do reply. I can see no such interpretation in the text as the FSF published it.

As a developer, not a lawyer, I would interpret that claim such that if you make some source code changes to an AGPL-licensed project, commit them to a private version control system, but never make that version available to users, then the number of "users interacting with it remotely through a computer network" is zero. I would therefore consider that it is only the versions that are actually made available for interactive network use (i.e. deployed) that must also make available the corresponding source.

Suprised we aren't seeing more of this

Posted May 2, 2025 21:06 UTC (Fri) by NYKevin (subscriber, #129325) [Link] (3 responses)

As I explain in another comment,[1] that interpretation creates such an enormous loophole that it makes the whole section de facto optional to comply with. That cannot be the FSF's true intention, so I do not believe it is a natural reading of the AGPL in context (but I suppose a court might apply the four-corners rule and read it that way regardless).

Summary of that comment: If it doesn't bind you when you write the code in the first place, then any random other person could run the code, and they have no section 13 obligations because they did not "modify the Program." So that leaves us with three options, all of them bad: 1) You are not allowed to remove the source offer at all, 2) if you remove the source offer, you accept unlimited liability for anyone running the code from now until the end of time, or 3) the whole section is so easy to circumvent that it is pointless - you might as well just use the GPL instead and save everybody the headache of worrying about (1) and (2).

[1]: https://lwn.net/Articles/1019820/

Suprised we aren't seeing more of this

Posted May 2, 2025 22:33 UTC (Fri) by burki99 (subscriber, #17149) [Link] (1 responses)

Thanks for your analysis. Do you think a better version of the License would have phrased the passage as follows instead:

Notwithstanding any other provision of this License, if you run a modified version of the Program, this modified version must prominently offer all users interacting with it remotely through a computer network ...

Or would that still lead to similar or new issues?

Fixing the AGPL text to match intention

Posted May 4, 2025 10:31 UTC (Sun) by farnz (subscriber, #17727) [Link]

I don't think there's a fix that meets the FSF's goals. Section 9 makes it clear that the licensee is not bound by the licence simply by running the program; section 13's intent is along the lines of "if you run this program, people with network access to it must be able to get at its source".

And that's the heart of the problem with the AGPL; the FSF wants to both place an obligation on you to supply source if you run the program and give other people access to it, and also to not place any obligations on you if you simply run the program. You can't resolve that by tweaking section 13; you need to also change section 9 to indicate that the requirement to provide source applies to everyone who runs the program and allows someone else to access it over the network.

This conflict, BTW, is not a trivial one; it cuts to the heart of the FSF's Four Essential Freedoms, which define the intention behind Free Software. The challenge the AGPL runs into is that it's trying to restrict Freedom 0 for those people who have access to the software so that more people get access to the software and can exercise the Four Freedoms on their own machines, but it tries to do this without placing too much burden on people exercising Freedom 0.

Suprised we aren't seeing more of this

Posted Jun 28, 2025 16:15 UTC (Sat) by vonbrand (subscriber, #4458) [Link]

If I write the code, I am free to do with it as I like. If you get the code from me, I can place restrictions on what you are allowed to do with it.

Suprised we aren't seeing more of this

Posted May 2, 2025 3:49 UTC (Fri) by aszs (subscriber, #50252) [Link]

Yeah, good point, I shouldn't have couched this in terms of "Derived Works" but of course there's nothing preventing a license from stipulating something equivalent, that's exactly what SSPL does. It's just that it wouldn't be an open-source license anymore because it would be restricting usage. But applying the principle of virality (or "share/share-a-like" in creative commons terminology) seems more in keeping with the goals and ethos of open-source than a "source available" license like BSL. My fear with something like BSL is that it could really undermine open source because it provides much of the same advantages from the prospective of the software provider. Unfortunately this thread has convinced me that AGPL doesn't provide much of an alternative, and SSPL, from my (limited) understanding, is too ambiguous and therefore legally risky. But it seems like a better approach for an open source provider to stave off big proprietary cloud providers (assuming they wouldn't want to abide by its viral terms).

Suprised we aren't seeing more of this

Posted May 2, 2025 7:50 UTC (Fri) by ehiggs (subscriber, #90713) [Link] (3 responses)

> That means you can theoretically breach the AGPL just by writing code on your own private system, and never even compiling or executing it.

Are you asserting that if one writes code and commit it into their private fork of an AGPL project that you believe one is breaching the AGPL?

Suprised we aren't seeing more of this

Posted May 2, 2025 8:47 UTC (Fri) by NYKevin (subscriber, #129325) [Link] (2 responses)

Yes. I do not see any other plausible reading of section 13 of the AGPL.

Suprised we aren't seeing more of this

Posted May 2, 2025 10:47 UTC (Fri) by bluca (subscriber, #118303) [Link] (1 responses)

I'm likely missing or misunderstanding something, but isn't that scenario covered by the "all users interacting with it" bit? If you just commit some changes somewhere and never run them, nobody will be interacting with the software, no?

Suprised we aren't seeing more of this

Posted May 2, 2025 13:36 UTC (Fri) by Wol (subscriber, #4433) [Link]

> I'm likely missing or misunderstanding something,

AIUI, you are. If *you* commit, and *someone else* runs, who is responsible for making the software available? The reference to "your modified version" is a can of worms, if the the person who modified it didn't intend for it to be run (other than maybe their own testing purposes).

Cheers,
Wol

Suprised we aren't seeing more of this

Posted May 5, 2025 10:22 UTC (Mon) by nim-nim (subscriber, #34454) [Link] (2 responses)

> Instead, it says that any modified version of an AGPL program, if it supports network interaction, must have an interactive feature that provides the end user with the source code.

It says no such thing. The actual clause means some part of the UI must state the software is released under the AGPL, the corresponding source code is available *there* (a github link is enough), and you must make sure your modifications are actually available *there*.

That‘s all, a licensing paragraph¹,a github link, and making sure you’re not forgetting to push the actual version you run.

There is absolutely no actual burden to comply. Pre-internet GPL compliance with disks and paper was horrendously more complex and that did not stop Linux from “infecting” computers worldwide.

If you choose to gate the code behind a proxy to limit access to actual customers that’s a burden *you* put on yourself, no something the AGPL forces you to do. If your customers chose to put *their* engineers behind a proxy and block access to github or whatever you choose to publish the code at that’s *their* problem. You’re massively over-hyping the AGPL compliance burden, why not claim the AGPL obliges you to run a fiber and provide internet access to any potential user while you’re at it.

The Google page is complete hypocrisy, but we all know they hate free software, notwithstanding trying to avoid it cost them a mega-trial with Oracle and the release of the JVM under the GPL actually helped them.

Google can not run a git service or mirror to github (what?). Google can not detect an employee forgetting to push his changes to something network-available (what? do they need help indexing the internet)? Google claims some employee lacking discipline and breaching the AGPL puts it at legal risk (what? hiring people from all over the Silicon Valley that had access to the private code of hundred of companies, and may be tempted to copy this code instead of reinventing it is not a legal risk? The legal risk is forgetting to run legal compliance courses internally.).

What a load of rubbish. From a company that have more means to comply that most of us, and that never shied from openly duplicating copyrighted material whenever it deemed it useful to gain marketshare (and was sued for it worldwide).

¹ which is *already* present in pretty much anything exposed over the network, AGPL or not, because only scammers do not want to tell their public where to reach them

Suprised we aren't seeing more of this

Posted May 6, 2025 15:54 UTC (Tue) by ballombe (subscriber, #9523) [Link] (1 responses)

So your compliance plan is to rely on github goodwill in perpetuity ?

Suprised we aren't seeing more of this

Posted May 7, 2025 14:23 UTC (Wed) by nim-nim (subscriber, #34454) [Link]

So the compliance plan is just to use whatever code hosting platform is available (of if you’re Google just host it yourself) and update the link in the legal paragraph whenever it changes (you do know that such things typically contain company addresses, and that those things changes and need to be updated overtime) ?

Cost of compliance: peanuts. Certainly orders of magnitude less than the code hosting requirements of any modern ci-cd platform that runs tests all year round, and orders of magnitude less than any proprietary licensing setup that requires safekeeping agreement proofs in physical or digital safes.

Suprised we aren't seeing more of this

Posted May 2, 2025 2:45 UTC (Fri) by timrichardson (subscriber, #72836) [Link] (23 responses)

The problem is that Redis Labs, Mongo etc have a business model of competing as a cloud service provider. It's tough, because AWS etc are really good at this. Any open source licence that allows Redis Labs to do this must also allow another cloud service provider to do it. It might cause slightly unpalatable technical consequences but it can't really block competition at the service layer. Only a licence that discriminates by how the software is being used can do that, and we decisively know that an open source licence can not distinguish by class of user. Hence why they abandoned open source.

Another approach is the Red Hat approach: licence it as GPL, but only distribute the binary to paying customers (your obligation to distribute the source follows from that). This matters if there is strong demand to run the "real thing" say for risk management or insurance or compliance.

Every restrictive approach fails to have much value if external contributors can sustain a fork.

Suprised we aren't seeing more of this

Posted May 2, 2025 3:19 UTC (Fri) by aszs (subscriber, #50252) [Link]

I don't disagree with your overall point but this isn't quite true: "Any open source licence that allows Redis Labs to do this must also allow another cloud service provider to do it." -- as long as Redis Labs is the copyright holder they don't need to abide by their license grant.

Suprised we aren't seeing more of this

Posted May 3, 2025 15:20 UTC (Sat) by niner (subscriber, #26151) [Link] (21 responses)

> It's tough, because AWS etc are really good at this.

Are they though? I've now had several customers that were crushed by their cloud cost and that saved or could save anywhere from 50 to 90 % of that cost by migrating away from the cloud. The big 3 really seem to cost a whole lot for what they offer precisely because they are the big 3. The whole industry seems to just go on the assumption that because they are huge, they have enormous economies of scale and - this is the critical part - that they extend those savings to the customer.

But I don't see the latter happening. Objectively I see them charging full price (or more) for renting out machines that are years and sometimes decades out of date. But since you're don't pay for the number of calculations done, but by how long they took, slow machines work in the cloud provider's favor. Similar for storage: e.g. you rent 100 GB of ostensibly fast SSD storage. But the disk this is located on is 1 TB and even though the hardware can give you e.g. 1 GB/s, since you rent only 1/10 of the whole disk, Google will only give you 100 MB/s of bandwidth. But they still charge you extra because it's "fast" storage.

Suprised we aren't seeing more of this

Posted May 3, 2025 16:11 UTC (Sat) by pizza (subscriber, #46) [Link] (20 responses)

> Are they though?

Based on how many folks keep forking over ever-increasing amounts of money to them... objectively, yes, they are very good at what they do.

> The whole industry seems to just go on the assumption that because they are huge, they have enormous economies of scale and - this is the critical part - that they extend those savings to the customer.

Of course they won't extend any savings to thier customers if they can get away with it.

Keep in mind though, you're not just paying AWS for cpu-hours, you're paying them for the ability to nearly-instantaneously add (and remove) resources on demand, whereas it could take weeks to months to get a new system spun up in-house and you pay the full cost to keep it running no matter how [under]utilized it is on average. Plus there's the way costs are accounted for; with in-house servers there are rules about how much (and rapidly) you can depreciate things, whereas rental costs are much more easily expensed.

Suprised we aren't seeing more of this

Posted May 3, 2025 16:29 UTC (Sat) by niner (subscriber, #26151) [Link] (19 responses)

> Based on how many folks keep forking over ever-increasing amounts of money to them

That's just an argumentum ad populum. The number of customers does not tell you whether the service is actually good or reasonably priced. Especially given that I specifically mentioned an assumption that many of these customers make without actually questioning its validity.

> you're paying them for the ability to nearly-instantaneously add (and remove) resources on demand

Yes, that's a common argument. What I rarely hear though is an in-depth discussion about whether a specific customer actually needs this elasticity. And even if demand is fluctuating highly, that's still not a clear sign that using a hyper scaler will then be cheaper. I've had a customer where even if on average 80 % of the hardware was just idling it would still have been cheaper than staying with Google. In a sense, the near-instantaneous scaling solves a problem that cloud providers created in the first place, i.e. that resources are super expensive.

> whereas it could take weeks to months to get a new system spun up in-house

That's assuming that the only alternative to hyper scalers is buying your own hardware and running it fully in-house. Which of course is not true at all. There are a lot of in-betweens. E.g. I can rent additional VMs at Hetzner, deploy kubernetes and add them as new nodes to our cluster within minutes and all of this - including the renting part - fully automated. Hetzner charges for these VMs on an hourly basis. So no, you don't pay the full cost if you no longer need it. And that's just one example.

Suprised we aren't seeing more of this

Posted May 3, 2025 19:04 UTC (Sat) by Wol (subscriber, #4433) [Link] (16 responses)

> Yes, that's a common argument. What I rarely hear though is an in-depth discussion about whether a specific customer actually needs this elasticity.

"10,000 lemmings can't be wrong" is a common attitude ...

I bang on about how Pick uses far less disk storage (and is far more efficient with disk access), but nobody's interested. How many companies are international, and could run datacentres optimised for normal demand in 2, 3, 4, large geographic areas? If your Europe datacentre is designed to cope with typical European demand, likewise your American and - let's say your Japanese - datacentres, how easy is it for a datacentre to spin up instances on the other two, knowing that if one is overloaded the other two will (thanks to timezones) probably only be lightly loaded at that time ...

The two (or maybe three) major needs AWS, Google etc are seen as filling is good backups, and resilience against attack. But are they the best providers? (The third is security.)

But for backps (I'm thinking especially of ransomware here) there's at least one provider that charges almost nothing for inbound (to the backup service) traffic. They charge through the nose to get it back out, though! But that way, it's cheap insurance - you keep a couple of generations backup, they keep long term backups, and it only costs real money if you need it.

Likewise resilience - people use Cloudflare to protect against DoS attacks. I don't know if they use a similar charging mechanism, but why not? "Pay if you need it".

And what, exactly, security do AWS, Google et al actually provide? Given that most attacks are social engineering and carried out with genuine user credentials, how do they protect against that?

The biggest advantage they seem to provide is the lemming factor :-) "Best practice" often is not the best at all ... (that, and ditching the hassle of managing your own datacentre.)

Cheers,
Wol

Suprised we aren't seeing more of this

Posted May 3, 2025 22:04 UTC (Sat) by khim (subscriber, #9252) [Link] (15 responses)

> "10,000 lemmings can't be wrong" is a common attitude ...

Yet surprisingly often it's also the right attitude…

> I bang on about how Pick uses far less disk storage (and is far more efficient with disk access), but nobody's interested.

Why should they be? In today's world most companies care much more about ability to hire someone who may support they IT system then about cost of hardware.

Not only tiny companies who may host everything on just one server that's cheaper than monthly salary of a single developer but also the likes of Amazon or Google spend more on developers salaries than on hardware.

Pick is absolutely useless for them: they would need to find and train developers who would work in entirely different paradigm… you couldn't easily fire them and rehire when needed… why go there?

Similarly with hyperscalers: what hyperscalers save are not price of hardware (your own hardware is, indeed, cheaper), but administrator salary: finding someone who may help you do something with AWS instance or Google Cloud is trivial and cheap… the first incident with a dedicated hardware would chew all savings for many years of self-hosting.

> The biggest advantage they seem to provide is the lemming factor :-)

Yup. But that's THE main requirement. By far. The main need that they are filling is the ability to find someone on freelancer or upwork who would be ready to solve your problem for a small price.

Yes, that's precisely that “10,000 lemmings can't be wrong” thing, but it's also the real reason cheap ad-hoc solutions are not used: people on lwn.net often don't even realize how few people are there who can do what they can do.

Suprised we aren't seeing more of this

Posted May 4, 2025 7:11 UTC (Sun) by niner (subscriber, #26151) [Link] (7 responses)

> the first incident with a dedicated hardware would chew all savings for many years of self-hosting.

Cost for administrators is indeed an often repeated argument. But what company has actually let go of a significant part of their IT team after migrating into the cloud? Conversely I don't know of any company that had to hire additional personnel after moving away from a hyperscaler.

Even if, one of my customers pays about a million USD per year to Google. Buying the required hardware to run the whole shop would cost about 300k once. Even with rented boxes in a data center and on-site service by the great people at firstcolo this customer could save a staggering 90 % of cost[1]. How many competent sysadmins can you get for that kind of money and still save a ton? In this region 100k per year is a super competitive salary for this job. Get 3 of them and still save tons. Or don't and instead hire one of the plenty of IT service companies (like mine).

> Yes, that's precisely that “10,000 lemmings can't be wrong” thing, but it's also the real reason cheap ad-hoc solutions are not used

That is indeed the core of the problem: people coming from universities nowadays only know the world where you run your k8s pods at a hyperscaler. That's what they learn how things are just done and for them there's no point in questioning this. For them, that's the only world that exists. Even so, it's not yet too late to turn around.

[1] You may wonder why they don't. Case of bad timing. Shortly before I became aware of their enormous cloud cost they signed a deal with Google for 3 years for a few percent rebate.

Suprised we aren't seeing more of this

Posted May 4, 2025 13:23 UTC (Sun) by khim (subscriber, #9252) [Link] (3 responses)

> But what company has actually let go of a significant part of their IT team after migrating into the cloud?

If company even have “an IT team” then it's rare “medium” company. There are 33 million businesses in US for 170 million of labor force. Do the math.

> Conversely I don't know of any company that had to hire additional personnel after moving away from a hyperscaler.

Well, if they had none before they, obviously, would have none after thus it's not surprising.

The question is how often they need to pay for someone who is managing their infrastructure. And how much.

> Even if, one of my customers pays about a million USD per year to Google.

Which, again, means it's not a typical company and for them, perhaps, using Google isn't a good idea anymore.

> In this region 100k per year is a super competitive salary for this job. Get 3 of them and still save tons.

Seriously? Would they bring their own hardware and hosting, too? Because to pay 100k salary you would need to spend 250k-300k per year (corber should know more precisely for US, but 2.5x-3x is typical overhead in most places in the world), thus with 3 admins you have nothing left for hardware and other things.

And that's even before we bring in cost of insurance, loans and etc. All these things go up if you do “nonstandard” things.

> Even so, it's not yet too late to turn around.

For a company that's ready to pay million per month… probably not. For majority of the companies… they couldn't afford anything else.

Suprised we aren't seeing more of this

Posted May 4, 2025 15:35 UTC (Sun) by niner (subscriber, #26151) [Link] (2 responses)

> If company even have “an IT team” then it's rare “medium” company. There are 33 million businesses in US for 170 million of labor force. Do the math.

And how many of these 33 million businesses use a Redis hosted by a hyperscaler or have their own k8s load or anything? Those numbers are meaningless for this discussion.

> The question is how often they need to pay for someone who is managing their infrastructure. And how much.

They always have to pay someone for their infrastructure. The whole point is that people blindly assume that hyperscalers are the cheapest option when that is quite often just not true in my experience.

> Which, again, means it's not a typical company and for them, perhaps, using Google isn't a good idea anymore.

As Google cloud customers go they are still a pretty small fish. So they are not that untypical either.

> Seriously? Would they bring their own hardware and hosting, too? Because to pay 100k salary you would need to spend 250k-300k per year

No, I meant 100k Euros cost for the company. All taxes and insurance included. That's in central Europe.

> For majority of the companies… they couldn't afford anything else.

And there we are back to that unproven assumption.

Suprised we aren't seeing more of this

Posted May 4, 2025 18:58 UTC (Sun) by khim (subscriber, #9252) [Link] (1 responses)

> Those numbers are meaningless for this discussion.

Why?

> And how many of these 33 million businesses use a Redis hosted by a hyperscaler or have their own k8s load or anything?

You want to say that when company grows large enough to need to use Redis or want to run something besides simplest web site it needs to, suddenly, forget everything it did before? Why?

> The whole point is that people blindly assume that hyperscalers are the cheapest option when that is quite often just not true in my experience.

Yes. But for the company with 3 or 5 employees it's often cheapest option if you include the price of freelancer work into equation.

Simply because hardware costs are negligible no matter where you host your web site with 1000 visitors per day and freelancer that would work with hyperscaler is cheaper than someone for less common setup.

> No, I meant 100k Euros cost for the company. All taxes and insurance included. That's in central Europe.

Ouch. Yeah, if that's in place where 100k is good salary “all taxes and insurance included” then use of Google cloud is highly questionable.

It's not hard to find decent IT support that wouldn't cost arm and leg in these places.

> And there we are back to that unproven assumption.

Try to find someone on freelancer who would help you create some website with budget measured in less that $100. The best you may hope for is some student that only knows “the big three” and then not very well.

And that's where most companies start.

Granted, the fact that people would still use hyperscalers when they start paying thousands and even, in some cases, millions for hyperscalers is crazy… but that's how life works: they started where it made perfect sense, then grew till it stopped making sense… but only started to question their assumptions when it started killing them.

Suprised we aren't seeing more of this

Posted May 5, 2025 6:56 UTC (Mon) by niner (subscriber, #26151) [Link]

> You want to say that when company grows large enough to need to use Redis or want to run something besides simplest web site it needs to, suddenly, forget everything it did before? Why?

A company running the simplest web site doesn't use a hyperscaler (directly) either. If all you need is a website for a lemonade stand, you go to Wordpress, Squarespace or the like, click around and go online. Or go to some marketing agency that will do that for you. I don't understand how a company needing the simplest web site even relates to this discussion.

> but that's how life works: they started where it made perfect sense, then grew till it stopped making sense… but only started to question their assumptions when it started killing them.

Indeed. And that just makes me sad. Most of all because it doesn't have to be this way. Even in the other startup I co-founded, we started out on Google cloud, because if you have practically 0 load on your hand full of k8s pods, the cost is indeed almost 0. It made sense. But then our Postgres queries became more interesting and needed more memory to complete and we suddenly had to upgrade our Postgres from the cheapest to the enterprise offering, despite the database still being tiny and 99 % idle. That's when we got the hell outta there and now run the whole setup (including fully redundant k8s, PG and backup) on Hetzner VMs for less than half of what just the database cost on Google.

Suprised we aren't seeing more of this

Posted May 4, 2025 21:28 UTC (Sun) by Cyberax (✭ supporter ✭, #52523) [Link] (2 responses)

> Even if, one of my customers pays about a million USD per year to Google. Buying the required hardware to run the whole shop would cost about 300k once.

It's clearly for something serious, not just a marketing website. Do you need 24h service? And can you tolerate 12h of downtime?

If the answers are "yes" and "no", then you need a team of on-call engineers near the colocation site (and good luck if you want to use a DC in Oregon). For 24h coverage, you need a minimum of 5 people (168 hours in a week, so 5 people to cover that with 8-hour shifts). At a reasonable $150k a year salary and overhead, you're already looking at $750k a year.

Now suppose you want to add another datacenter on the East coast. Your expenses go up by 2x.

Sure, you can cost-share the on-call technicians with other companies. But then you have questions of access control, data security policies, etc.

Then there's a question of hardware availability. Did you make sure to buy spares in advance for all of your critical hardware? Do you test these spares regularly? Are your engineers sufficiently qualified to design computing architecture that is not accidentally bottlenecked?

If you do the math, cloud computing makes total sense if you want to avoid the risk.

Suprised we aren't seeing more of this

Posted May 5, 2025 6:36 UTC (Mon) by niner (subscriber, #26151) [Link] (1 responses)

You are again assuming that the only alternative to hyperscaler is 100 % do it yourself. However I did mention e.g. Firstcolo. You give them the desired specifications of machines you want to run, they procure them, install them and maintain the hardware including keeping spares and having those on-site people 24/7. They even offer to buy those machines for you and rent them out to you, so your cap ex stays low. And that's just one datacenter operator.

If you're intimidated by having to design and set up reliable systems, there are lots of companies (including my own) that can help you get up and running. We did the math - for customers - and they ended up saving a lot.

Suprised we aren't seeing more of this

Posted May 5, 2025 6:53 UTC (Mon) by Cyberax (✭ supporter ✭, #52523) [Link]

> You are again assuming that the only alternative to hyperscaler is 100 % do it yourself. However I did mention e.g. Firstcolo. You give them the desired specifications of machines you want to run, they procure them, install them and maintain the hardware including keeping spares and having those on-site people 24/7.

And this typically tops out at something like "1 rack, 1 gbit and no SLA" before it starts becoming expensive. "Remote hands" also are typically not responsible for anything more than checking cable connectivity and/or swapping hardware. If you want someone who actually understands your network topology and can debug complex issues, this starts getting really expensive.

I have done these kinds of calculations, and you absolutely can get cheaper than AWS (or Azure), but you won't get _much_ cheaper. Unless you have very specific needs like massive storage or a lot of egress traffic.

So not using hyperscalers is cheaper either if you have something small, or if you are VERY big.

Suprised we aren't seeing more of this

Posted May 4, 2025 9:03 UTC (Sun) by Wol (subscriber, #4433) [Link] (4 responses)

> Pick is absolutely useless for them: they would need to find and train developers who would work in entirely different paradigm… you couldn't easily fire them and rehire when needed… why go there?

Because you can train up USERS very easily to be developers - as an alleged end-user I'm expected to program as part of my job. So you don't need to hire-and-fire because they're users who can program, not surplus programmers. I'm expecting my colleagues to find Pick *much* easier than what they do at the moment ...

Because jobs come in ON TIME and UNDER BUDGET? Our current "big project" - finally going live this year - has been "two years away" for the last five years - which seems to be the norm for big relational projects? We've been told we'll have to wait 18 months before IT will even look at our little project - I've been threatening to write the whole system single-handed in 6 months. Etc etc.

Because it'll halve the cost of your IT department? What little information there is says that a Pick shop pays roughly half the percentage of gross turnover on IT than other shops do.

It's "Nobody got fired for buying IBM" all over again.

Cheers,
Wol

Suprised we aren't seeing more of this

Posted May 4, 2025 13:41 UTC (Sun) by khim (subscriber, #9252) [Link] (3 responses)

> Because you can train up USERS very easily to be developers - as an alleged end-user I'm expected to program as part of my job.

And pay $5000 or $1000 for each user each year? To retain people with rare and valuable skills? Seriously?

In what world would that make any sense?

> I'm expecting my colleagues to find Pick *much* easier than what they do at the moment ...

It doesn't matter whether it's easier or not. It only matter if people with these skills are lining up outside of your business or whether you have to train then and then retain them in your business, somehow.

> Because jobs come in ON TIME and UNDER BUDGET?

That's serious proposition, but you would have to prove that perpetual Pick tax would offset these one-time problems.

This may work, in some cases, but it's very far from the “no-brainer” deal that you imagine.

One may imagine an alternate world, where Pick won, but it would have other problems, namely:

> Our current "big project" - finally going live this year - has been "two years away" for the last five years - which seems to be the norm for big relational projects?

It's the norm for all projects and is not related to Pick in any way, shape or form.

All successful projects come out late and over budget, be it bridge building, relational projects or moon rocker launching.

Pick project only have the luxury to “come in on time and under budget” because they are rare.

Managers have absolutely no idea how much Pick projects may cost thus you may say you would need 100k and 1 year for project that would take 100k and 1 year – and get away with that. Because you have no competitors.

Once competitors would be there competitor who would ask for 40k and 4 month would win. And management would pay 100k for 1 year of work to them and not to you.

> We've been told we'll have to wait 18 months before IT will even look at our little project - I've been threatening to write the whole system single-handed in 6 months

That, again, have nothing to do with Pick and is typical dynamics of how project works in largish companies.

> Because it'll halve the cost of your IT department?

No. It wouldn't. In imaginary world where Pick is popular instead of incompetent relational developers you would get incompetent Pick developers.

Salary spending would stay the same and hardware costs are not a big problem for most companies, these days.

> What little information there is says that a Pick shop pays roughly half the percentage of gross turnover on IT than other shops do.

Of course. But that because Pick is only driven by people with passion. Technology have nothing to do with that, only one characteristic is important: whether it's popular or not.

> It's "Nobody got fired for buying IBM" all over again.

Welcome to the real world. That's how businesses almost always work. Only in rare cases, where a paradigm shift is happening and where change of technology may change how you interact with your customers may ever change that dynamic.

Otherwise, for most businesses, “doing what everyone else is doing” is the right and proper strategy.

Suprised we aren't seeing more of this

Posted May 4, 2025 18:57 UTC (Sun) by Wol (subscriber, #4433) [Link] (2 responses)

> > Our current "big project" - finally going live this year - has been "two years away" for the last five years - which seems to be the norm for big relational projects?

> It's the norm for all projects and is not related to Pick in any way, shape or form.

Please stop making inflammatory and clearly bullshit statements. I am aware of a lot of people working with Pick, and whenever late projects come up it's NEVER Pick projects that are late. If the set of Pick projects is large (it is), and the set of Pick projects that are late is almost non-existent (it is - there aren't even rumours of late projects, every project mentioned is on time), then it CAN'T be the norm for all projects. And it IS related to Pick, as if you had said it was the norm for all RELATIONAL projects, I would have no problem with it.

> Managers have absolutely no idea how much Pick projects may cost thus you may say you would need 100k and 1 year for project that would take 100k and 1 year – and get away with that. Because you have no competitors.

> Once competitors would be there competitor who would ask for 40k and 4 month would win. And management would pay 100k for 1 year of work to them and not to you.

Except, assuming said competitor was using a relational database, I wouldn't bid 100K. I'd bid 40K *FIXED* *PRICE*. So if it truly is 100K for a relational solution, either I get the contract, or my competitor ends up badly out of pocket (or, as seems to be the norm, "big contractor" stitches the client up).

Oh - and a real-life internal example in my company - one of my colleagues took about a week to write an analysis system. Which isn't used much because it still leaves a lot of manual work to massage the results into usable form. I've bid a Pick system which will analyse and cleanse the data straight into our reporting system (Tableau). Guess what - I've bid ONE DAY (double that for contingency). And her SQL/Python etc is a damn sight better than mine. Desite that, I don't expect to be over budget ...

> > It's "Nobody got fired for buying IBM" all over again.

> Welcome to the real world. That's how businesses almost always work.

Nobody ever got fired for buying IBM :-(

Until some brave business does something different and takes everybody else to the cleaners.

Cheers,
Wol

Suprised we aren't seeing more of this

Posted May 4, 2025 21:07 UTC (Sun) by jake (editor, #205) [Link] (1 responses)

This interminable Pick fight is increasingly off-topic here.

No minds are being changed, seemingly, but never-ending walls of text are being posted about it ...

can we *please* just give it a rest?

thanks,

jake

Suprised we aren't seeing more of this

Posted May 4, 2025 21:59 UTC (Sun) by Wol (subscriber, #4433) [Link]

Sorry it wasn't meant to spark an interminable war.

And while people might not want to believe my facts, at least I do my best to avoid stuff which is easily proved (or even obviously) wrong.

I just wish people weren't lemmings.

Cheers,
Wol

Suprised we aren't seeing more of this

Posted May 6, 2025 4:10 UTC (Tue) by raven667 (subscriber, #5198) [Link] (1 responses)

> Pick is absolutely useless for them: they would need to find and train developers who would work in entirely different paradigm… you couldn't easily fire them and rehire when needed… why go there?

At risk of committing an act of necromancy, I'll disagree a bit here. There are a lot of no-sql tools with different paradigms which didn't exist 10 or 20 years ago and that one couldn't assume any new hire would be familiar with that they'd have to learn on the job. New hires are going to need to learn the particulars of your tech stack and in-house tools, so learning a different DB engine then one they've used before is probably not an insurmountable challenge. Using the most common tools in hopes of making hiring easier is fine as far as it goes, but so does using best-of-breed tools that fit your particular problem set and expecting some amount of in-house training/acclimation.

That said, I'm not sure where Pick would fall into this, while I'm sure it is innovative in it's own way, and has it's own cheerleaders (hi Wol) I don't think it represents some hidden arcane field of computer science that doesn't exist in equivalent forms in other tools. There are only so many different ways to make efficient data structures in memory or on disk that have different tradeoffs. The no-sql evolution was about offering tools using specific data structures that fit well with the problems they were solving but weren't commonly available or efficient in SQL-fronted database engines, because SQL servers were targeted at different problems. I'm not sure that's the case anymore, the SQL-fronted engines like PostgreSQL or MariaDB have added storage and indexing methods which offer some of the same data structures which made no-sql engines useful, and the other no-sql engines have thrived in their niches refining the use-cases which spawned them. I'm not sure Pick would be any different than someone coming from PostgreSQL learning Redis/Valkey or someone familiar with Cassandra learning sqllite or etcd

So building a tech stack for hire-ability seems foolish, it's one property among many and if you hire for competency and willingness to learn then they can pick up the specifics, familiarity with more components of your stack is nice but lack of familiarity with one component is not a deal breaker.

Suprised we aren't seeing more of this

Posted May 6, 2025 7:12 UTC (Tue) by Wol (subscriber, #4433) [Link]

> There are a lot of no-sql tools with different paradigms which didn't exist 10 or 20 years ago

At the risk of pouring petrol on the flames I'll just point out I was programming Pick way back last century - in fact it predates Relational, and probably SQL too ... (it nearly predates me, and I'm on the verge of retirement.)

> and that one couldn't assume any new hire would be familiar with that they'd have to learn on the job.

I'm expecting end-user "new hires" to pick it up quickly and easily - people who don't have an IT/CS education.

> I don't think it represents some hidden arcane field of computer science that doesn't exist in equivalent forms in other tools.

Efficiency?

> There are only so many different ways to make efficient data structures in memory or on disk that have different tradeoffs.

Efficiency? Native 4NF in the database is pretty unbeatable ...

> I'm not sure that's the case anymore, the SQL-fronted engines like PostgreSQL or MariaDB have added storage and indexing methods which offer some of the same data structures which made no-sql engines useful, and the other no-sql engines have thrived in their niches refining the use-cases which spawned them.

Efficiency? IME, SQL cannot query those striuctures particularly efficiently. Efficiency? The majority of an ENGLISH (one of the names of the Pick query language) query lives in the table schema (note I didn't say view!). Efficiency? Your normal query is a short one liner, that has no optimiser because the possible gains aren't worth the candle. Efficiency? ENGLISH is optimised for accessing 4NF data.

Bear in mind also that Pick is a second-gen NoSQL. As in NotOnlySQL, not NoSQL. If you want to query Pick using SQL, go ahead. Why would you, though, seeing as you'd be replacing one line of ENGLISH with screeds of SQL (Unless, of course, you cheated and took advantage of all the ENGLISH buried in the table schemas.

At the end of the day, I have to work with Excel formulae, and SQL queries all day. I CRINGE at the volume of code, the time wasted working out what the hell is going on, the time wasted writing huge multi-line SQL programs, all the stuff I could do in ten minites in Pick that takes a week in VBA/SQL/Formulae. Maybe (almost certainly) I'm a crap SQL programmer, but a lot of colleagues, who are a lot better at it than me, fare equally badly.

Efficiency! At some point in the near future I'm going to get the opportunity to pitch a rewrite of our system. I am - SERIOUSLY - going to bid that I can rebuild the majority of our shit single-handed in six months. Our IT department is saying "maybe we'll get round to looking at it in 18 months". I'm not stupid enough to think that doing it single-handed is a good idea though. I want to build a team round me (with the intention that they rewrite their systems in the same sort of time frame :-) So when IT come and take a look at it, they'll say it'll take five years for them to replace our system that we built in six months ...

Cheers,
Wol

Suprised we aren't seeing more of this

Posted May 4, 2025 23:20 UTC (Sun) by pizza (subscriber, #46) [Link] (1 responses)

> Yes, that's a common argument. What I rarely hear though is an in-depth discussion about whether a specific customer actually needs this elasticity.

That can only be answered with respect to that *specific* customer.

In my experience, internal bureaucracies/overhead meant that it was infinitely cheaper to use the likes of AWS vs in-house resources, because the latter was effectively made of unobtanium -- either the process would take so long that it would render the need moot, or we simply didn't' have the budget to outright buy an appropriately configured system.

> E.g. I can rent additional VMs at Hetzner, deploy kubernetes and add them as new nodes to our cluster within minutes and all of this - including the renting part - fully automated. Hetzner charges for these VMs on an hourly basis. So no, you don't pay the full cost if you no longer need it. And that's just one example.

So... you've just gone with a cheaper vendor?

Suprised we aren't seeing more of this

Posted May 5, 2025 6:44 UTC (Mon) by niner (subscriber, #26151) [Link]

> So... you've just gone with a cheaper vendor?

That's a fair question. In a sense, yes. However, the point is, that it's not one of the big 3 hyperscalers. Thus it still invalidates the assumption that due to their, well, scale they are unbeatably cheap or even value for money. There are a lot of vendors out there that offer services that are somewhere between the 100 % do it yourself and full cloud where my workload gets pushed onto the cheapest machines at Google's convenience.

Suprised we aren't seeing more of this

Posted Jun 28, 2025 16:17 UTC (Sat) by vonbrand (subscriber, #4458) [Link]

"Derived work" is a legal term, that is up to a court of law to define in each case. A license can't clarify that.

Suprised we aren't seeing more of this

Posted May 2, 2025 4:09 UTC (Fri) by mirabilos (subscriber, #84359) [Link] (1 responses)

BUSL you mean?

BSL is Boost Software Licence, which is free.

Suprised we aren't seeing more of this

Posted May 2, 2025 15:12 UTC (Fri) by aszs (subscriber, #50252) [Link]

Yes, "Business Source License" I've only seen it abbreviated as BSL but its SPDX ID is BUSL https://en.wikipedia.org/wiki/Business_Source_License

Suprised we aren't seeing more of this

Posted May 5, 2025 15:45 UTC (Mon) by aszs (subscriber, #50252) [Link]

I missed that Elasticsearch added AGPLv3 as a license option last year (https://www.elastic.co/blog/elasticsearch-is-open-source-...), so actually this does seem to be happening...

Followup

Posted May 5, 2025 3:11 UTC (Mon) by pabs (subscriber, #43278) [Link]

A followup from antirez about the lessons learned during this change:

https://antirez.com/news/152


Copyright © 2025, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds