Allan Jude: ZFS and OpenZFS are licensed under the CDDL, which is a slightly modified version of the Mozilla Public License. And so the CDDL says - I’m not a lawyer; don’t take my legal advice. But in general, the license says that you can make a binary out of CDDL license code, and you can license that binary however you want, so that you can make a product out of it, or whatever. And so you can make a ZFS binary, a kernel module, or whatever, and license that even under the GPL, so it’d be compatible to integrate it into the Linux Kernel. But the GPL itself requires that any code you link into it has to be licensed under the GPL and the CDDL. It doesn’t let you just change the license on that code to be under the GPL. And so that’s where that kind of incompatibility comes in. But it’s not a very strong one, and Ubuntu is pretty sure that their legal way around it is working.

But because the FreeBSD license is literally two sentences, “Don’t take off the copyright” and “Reproduce the copyright”, it means that we could pull in all of ZFS, the codebase directly into FreeBSD. So if you go to the FreeBSD GitHub and the repo, under syscontrib there’s a directory called OpenZFS that has a whole copy of the ZFS source code. So this means ZFS is completely just built into FreeBSD. So the FreeBSD bootloader has full support for reading from a ZFS pool, and so you can boot directly off ZFS, even if you’re using all the advanced features of ZFS. So this allows a feature called boot environments, where your root filesystem, if it’s ZFS, it’s actually a virtual file system, and you can have multiple different ones, or you can clone it and take snapshots. So when I’m preparing to go to a conference or something, I have my laptop that runs FreeBSD, that I give my presentations off of, and I use a desktop most of the time when I’m at home… So I haven’t used my laptop much in the months between conferences. So I’m going to update the OS, because it’s been a while, but that’s when everything has the greatest chance to break, when you’re installing all these package updates, and so on.

So with ZFS I can take a snapshot of my root filesystem, and save that as “Before I broke everything.” And then update stuff. And it all seems to work. And I check at home, and I can play stuff on the TV, so my HDMI is working, everything’s fine. But say I fly to the conference, I get there, and something isn’t working right. I can just reboot in the bootloader, say “Hey, I want to use the image of before I broke everything, instead of the latest version of FreeBSD.” And it will roll back my root filesystem. But, importantly, it doesn’t roll back my home directory. So I still have the latest version of my slides, but I have an older version of my OS that still works, because whatever latent problem I found, that ex Windows didn’t want to support a certain resolution, or whatever broke. And so that can be really powerful.

Or if you’ve ever tried to update the firmware or the OS on like a little router or something, they often have two images; they always have like the one-year update, and then there’s like a spare one [unintelligible 00:31:15.20] switches to this, so that if you somehow botch the firmware update, they have a second firmware they can boot from in the meantime. So FreeBSD had a feature like that before it had ZFS called NanoBSD, that let you do that. You’d partition up your disk into two big partitions and one little one. And the little one would hold the configuration, and the two big ones would be like version A and version B of whatever you’re trying to install, whether it was a firewall, or a router, or whatever. And you’d be running off A, so you’d update B, and the next time you’d boot you’d switch to B, and then you can ping pong between these two images. But ZFS allows you to do that with an unlimited number of images. Because each is just this virtual file system in the pool, you can have as many of these as you want, and you can access them directly from the bootloader and decide which one you want to use.

[00:32:01.16] And when you’re switching to one, it doesn’t make the other ones go away. All the data is still there, because ZFS is copy on write, so only the bits you actually changed are taking space. So having seven copies of your operating system doesn’t take that much space, because you only have to store the differences, not all of the data seven times. And so that allows much deeper integration.

But also, if we go back – when we talked about the fact that the base system utilities, like top, for example, are not a separate package that came from a different maintainer somewhere. That is part of the FreeBSD operating system. So when you start top on FreeBSD, under the line where it tells you about how much free memory you have, it has two lines about ZFS, telling you “This is how much of your memory is being used by the [unintelligible 00:32:43.04] this much is for frequently used files, this much is for recently used files, and this much is data that’s pending being written. Here’s what your compression ratios are, and memory”, and all this other information that would only be there if you had ZFS. And because FreeBSD is integrated with ZFS, top can just be compiled against the version of ZFS [unintelligible 00:33:02.19] and be able to get that information all integrated.

Cory Doctorow: Sure. As I mentioned, I’ve got an eight-year-old and she was born in London in our flat in a pool in the living room. She likes to hear the story of her birth, right? So we would tell her the story of her birth… My wife told her she came and yanked on my arm and shouted, “Story arm”, that I would tell her a story. So she runs up whenever she is bored and she yanks at my arm and yells “Story arm!” And being a writer, I like to iterate when I tell stories, so I’d tell them a little differently every time. I’d start a little further back or go a little bit further forward.

What I realized was that the interesting part of her birth story was the stuff that led up to her birth, and not like the stork stuff, but the stuff about how my wife and I met and became best friends and lovers and a couple, and got married and decided to have a baby. You know, all of that stuff is unique; the stork stuff is the same for everybody. What your parents did to make you is almost certainly something I can guess at with a pretty high degree of accuracy, right? But how your parents came to make the decision to do that and make you - everyone has a different version of that.

[20:08] The open source version of how we got here, we talk about the licenses and we talk about the packages and milestones, but there’s like this really strong social component to how we got here, because around the same time that the open source movement was starting, it was also around the same time that the open web movement was starting, that we were sun setting these proprietary network architectures - whether those were the ones the phone companies ran… You know, AT&T circuit-switched services-centric network or the big commercial services like Compuserve in AOL… They both kick-off around the same time, and yet the open web has collapsed, the open web is almost dead.

We are in a desperate and dire moment for the open web, and the free and open source software movement has soared; everything, including the things that are closing down the open web is built on free and open source software. So that is an amazing thing, and the speech kind of interrogates what the difference is, and how one soared and the other sank, and what we can learn from the free and open source movement to keep the web open as we try to open it up again.

I think the thing that the free and open source software movement had going for it is this thing called the Ulysses Pact. The story of Ulysses goes that Ulysses was gonna sail into siren-infested waters and anyone who heard the song of the sirens would be tempted irresistibly to jump into the sea and the sirens would drown them. So normally, when sailors sailed into the siren sea, they would fill their ears with wax. But Ulysses was a hacker and he wanted to hear what the sirens’ song sounded like, so he had his men lash him to the mast so that he could hear it, but he couldn’t get loose. So what he used was his strong self, the moment at which he was strong, to predict that in a future moment he would be weak and to take countermeasures to prevent himself from giving into that weakness. We use Ulysses pacts all the time - if you go on a diet, you should throw away your Oreos away on night one; not because you’re like incapable of resisting temptation, but because everyone sometimes has moments of weakness, and the strongest thing you can do is to recognize that you will have a moment of weakness in the future and take a countermeasure against it.

In the free and open source world, our Ulysses pact is the irrevocable license, because the failure mode of free and open source software, having founded a free and open source software company, I can tell you is that there are moments in which it feels like your survival turns on being able to close the code that you had opened when you were idealistic. There are moments of desperation when that happens.

Of course, it’s ridiculous, because if you’re making anything substantial under free and open source software, you’re building it on other things that other people have opened and can’t close, and if they were to close off their code your project will collapse. So every one of us wants to be the only one who can revoke a free and open source software license, while all the plumbing that we built on top of stays open. Because the licenses are irrevocable, because you can’t close it once you opened it, you generally don’t even get the pressure from your investors or from potential acquisition suitors or from other parties who can otherwise lean on you and put a gun to your head - they don’t even bother, because there’s no point in shouting at you to close the code, if they know that it’s not course of action that’s even open to you.

[23:44] So even though the same desperation that led us to close the web is present for everyone who’s ever made an open source project that succeeded, that desperation can’t express itself in the same failure mode that the web has had. So my talk is about how we can build a Ulysses pact for a newly opened web around two principles that will keep the web open even in the desperation of its founders, even when the pirates who founded it become admirals.

The first principle is that any time a technology or computer gets an order from its owner that conflicts an order that’s been given to it by a remote party, the owner should 100% of the time without exception win. The owner always gets to overwrite remote policy.

The second one is that any true fact about the security of a system that you rely on should always be legal to disclose, under every circumstance. My pitch is that these two principles should the principles that we become zealots for; that if they’re not calling you an unrealistic idealist about your adherence to these principles, then you’re probably not trying hard enough. So my pitch is that the people who care about building an open web to be the nervous system of the 21st century, to have an Internet of Things that’s not an Internet of things on fire that spy on you and ruin your life, is that we need to like take these principles and cherish them as much as we cherish the core principles of free and open source software, and weave them into our licenses, into our professional codes of conduct, into our membership agreements, into every single piece of what we do, so that there’s never any question that this will come about.

There have been lots of times when the governments have tried to pass laws that say “In order to make software, it has to be closed” and the fact that there’s all of this critical, open software has meant that those laws died every time. Because you’re going back to them and saying, “Well okay, but what you’re talking about is throwing away all the infrastructure on which the digital world is built. What are you planning to replace it with when you pass your dumb law?” You know, reality asserts itself, and so if we can create a reality on the ground to assert itself when governments contemplate stupid laws that say that remote parties can override local parties, whether those are crypto backdoors, or DRM, or lawful interception overrides, or any of the other things that have been the parade of horribles of the 21st-century, then we can make a difference.

Heather Meeker: Yes, I helped MongoDB draft the license, with of course the help of Mongo legal counsel and their business team. I think it’s fair to say that I led the drafting of it.

Stefano Maffulli: Oh, yeah. In a nutshell, we are the maintainers of the Open Source definition. And the Open Source definition is a 10 point checklist that has been used for 26 years. We have celebrated 25 years last year. It’s the checklist that has been used to evaluate licenses, that is legal documents that come together with software packages, to make sure that the packages, the software, comes with the freedoms that are written down; they can be summarized as four freedoms, that come from the free software destination… That is the freedom to use the software without having to ask for permissions, the freedom to study and to make sure that you know and to understand what it does, and what it’s supposed to be doing, and nothing else. And for that, you need access to the source code. And then the freedom to modify it, so to fix it and increase its capacity, or help yourself… And the freedom to make copies, that is for yourself or to help others. And those freedoms were written down in the ’80s by the Free Software Foundation, and the Open Source Initiative started a couple of decades after that, picking up the principles and spreading them out in a more practical way… At a time when a lot of software was being deployed, and powering the internet, basically. This definition [unintelligible 00:10:19.28] licenses gives users and developers clarity about the things that they can do. It provides that agency and independence and control, and all of that clarity is what has propelled and generated that huge ecosystem that is worth 8.8 trillions.

Johnny Boursiquot: [08:08] I’ve been fortunate enough to not have worked directly for those companies, but I have worked on projects for other third-party companies through my employer, that basically did not wanna use any open source at all. And usually, the problem came with sort of legal and licensing, especially with projects that did not have any sort of specific, explicit licensing in the repositories themselves, where you couldn’t tell whether you were allowed to use a software for profit or not… So the waters were kind of murky; legal was always basically saying “Nope, you can’t have that in there.”

David Kanter: Yeah… So the other thing I was actually going to mention is one of the things that our organization is very dedicated to is the maintenance and upkeep of these. So if you think of ImageNet, that really started this round of innovation in machine learning. And it was ImageNet, and then the realization that, “Hey, AlexNet plus GPUs plus ImageNet beats humans at image recognition. Oh, my gosh”, right? Now, ImageNet is fantastic, it’s amazing, but now it’s old, it hasn’t been updated, there’s some legal issues associated with the licensing… So imagine we’re doing speech-to-text, and we did that in 2019. That model, that dataset would not have anything about COVID or coronavirus or any of these other things. So you want to keep these things up to date, and that does cost some amount of money. And so by offloading that to the community, or MLCommons, we’re curating our stuff - it’s part of where our budget goes - that can be very helpful in terms of combining community resources. And so that’s another aspect to the business case.

But to answer your question, I think it is very easy to slide into these binaries, right? It’s a very natural way of thinking. And where we’ve had a lot of success, I think, is usually where there is some sort of research folks involved or some sort of specialists who can think about this and reason about it - these kind of endeavors inevitably involve your legal department.

Karen Sandler: Yeah, so the way that conservancy works… There are a bunch of different fiscal sponsors in our space, and they all have different niches. The way that we work is that the projects are a part of us. Once they join us, it’s as if we are their foundation. Some fiscal sponsors are organizations like Software In The Public Interest (SPI). Their projects have a loose affiliation with them; it’s kind of like a grant making style relationship, where for us our projects are part of us. There are some advantages to it.

We signed legal agreements on behalf of our projects, so when our projects have conferences, we’re the ones organizing the conferences; when they get donations, the donations come through us. We help developers travel to conferences by reimbursing their travel, we help with their trademarks… The Kernel developers aren’t the only ones who want their license enforced, so we do that for our member projects who want it, as well. We help with licensing generally, any kind of legal questions that our projects might have, because they’re us. Our projects are us, so our lawyers are their lawyers.

Adam Stacoviak: That show was titled “We ask a lawyer about GitHub Copilot.” Now, this actually – if I’m splitting hairs here, this was better-suited to be an episode of the Changelog. However, I will say that Nick Nisi and b0neskull did a phenomenal job hosting this, and I would dare even say better than maybe you and I might have. And I’m actually thankful they did it instead of us… Because again, back to that shared perspective, shared voices - I was so happy to listen to this show, and hear the perspective Luis brought.

[01:20:20.26] From my understanding, Luis is a lawyer by trade, but he’s in software, and I’m sure he does programming, I’m just not sure what his full background is… But he works at Tidelift, and as you know, Tidelift is very much fighting to pay the maintainers; they’re finding ways to create a sustainable ecosystem of enterprise-ready open source that’s secure, that’s maintained by the maintainers, and that the maintainers aren’t starving, they’re actually getting money for their hard work, and the enterprises that are using it are finding ways to support it. That’s very much Tidelift’s mission. So Luis is coming from that perspective of like “What is fair use? What does the law say about how this works in terms of copyright and legal licenses?”

As you know, whether it’s proprietary software or open source software, there is a legal license in place that says what you can and can’t do with it. So when it comes to the court of law, he really brought a great perspective on how we should detach emotionally from this and look at it from the law… And if we don’t like how it’s working, that doesn’t mean that “Okay, deal with it.” It’s more like “This is how the law works”, and so I think as people who live in the U.S. legal system, or legal systems anywhere throughout the world, if you wanna change how this works when it comes to fair use or copyright, then the way to change is through legal processes, and stuff like that. But I just really appreciate the lawyer perspective of this conversation. Let’s hear the clip.

Mike Pennisi: So he also made JSLint… So yeah, he has this license that he applies to a lot of his projects, that is - as we were saying, the MIT license, with this clause. And in an immediate sense, what that does is it essentially makes what is otherwise a really clear and succinct legal contract, which is kind of a thing to be treasured, I’d say, in this world…

David Cramer: Yeah, and I actually would go farther than that, take away the contributors… We are protecting the ability for somebody to have great software for free, in our case. We say “Sentry is free. It’s a version of open source; describe that how you will, but Sentry is available to everybody at a price point that is reasonable for everybody…” And by us being able to continue to fund that, we ensure that future. If somebody else comes along, uses our code - well, one, they’re never using it in an open source way, and they’re certainly not contributing back, so it doesn’t actually ensure that future. And I think that’s the most important thing you can take - if you want things to be sustainable, if you want something to be long-lasting, then it has to have financial backing of some sorts. And that’s the guarantee we created out of this. But that’s a business protection at the end of the day, right?

So going back to the BSL… What we said is we want those things - we want those protections, we want a license that can be universalized, and the biggest thing was we didn’t want GPL, we didn’t wanna have two versions of Sentry where we create an open core model… We didn’t like those models of open source, ignoring the headaches that go behind it. And it’s also important to know that not all of Sentry is open source. We don’t open source any of our infrastructure. It’s all closed source. It’s how we run our servers, how we run on top of the cloud… That’s all proprietary, and we won’t ever open source that. It just doesn’t make sense, in all honesty. But the service is the exact same service that powers our entire business, it was free open source, and now it will eventually be free open source. So that’s where the BSL comes in.

What I really liked about the BSL was it allowed us to check all the boxes, first off. It said “We could protect our business, we could still let basically anybody use it for free, and it opens up a lot of flexible possibilities around that.” And the one caveat was it meant you couldn’t take Sentry code and use it in a different way, for good and bad. So if we came up with a really clever way to solve a problem, I would like to be able to share that with the world, because there’s no reason for us to reinvent the wheel all the time.

Now, legally speaking, you can take that chunk of Sentry and use it somewhere else. That’s what the BSL prevents, which we don’t love. Now, our compromise was twofold; one, the BSL is a time-based license, with a maximum time period of four years. That means that when the license is stamped - which it has to be stamped… So say it’s stamped January 1st (we’ll say) 2020, a maximum of four years from that date it must convert to a more open source license. Those are the requirements of it. But that four years is flexible, so we chose three years. And we chose three years – to some degree it’s a little arbitrary. We chose it in the same way that I think - and I won’t speak for them - Cockroach chose it. I talked with them and I like their reasoning. Three years is enough time that it protects us, because we think in three years that version of Sentry will be so outdated that it doesn’t matter from a business risk point of view, and it’s not too long where we feel like it’s just completely useless.

Now, maybe two years would be better… I also don’t know if there’s a minimum time. I don’t know if you could say every month, or every day even… But our thinking was like two or three years felt good, and we might change this in the future. We might go to two years. That’s a nice flexibility. But after that basically for us – and this is something you can choose, again… We said “After that time period it converts to Apache 2.” And that’s pretty nice… And that’s nice because it allows us to solve that eventually you can use this code in any way you want, which means you can learn from it, you can reuse modules, components etc. But unrelated to legal side, we made the commitment internally - and we’ve even committed this externally - if there’s something that makes sense for the wider community, petition us and we’ll open source it in a free license. We can do that. And we can also grant one-off licenses for things.

[20:22] So to me it was the right set of compromises that still allowed us to eventually achieve those goals… But it’s not technically open source anymore, even though a lot of the components resemble open source.

Brett Cannon: Yeah, and it’s been one of the most frustrating bits about the conclusions I reached. When I’ve given this talk, I’ve had people come back and say “Well, can you give us a call-to-action?” And it’s like, “No… People are just flat out hard. It doesn’t work that way.” I can’t just give you a technical solution of “You know, if you just follow these five rules, suddenly the whole world would be better.” If we knew what those five rules were, we would be following them already. It just doesn’t exist.

[01:03:44.01] The way I try to view it is – you’re right that the general thing is we just literally need to be kind to each other. It literally comes down to just kindness. There is no need, ever, to be rude. Why are people rude? Usually, people are rude either because they’re frustrated, or because honestly they’re trying to bully someone down to win the argument. It’s a power play… So it’s really not necessary.

In these technical communities you often hear, “Oh, everything should be based on the technical aspects of the discussion, and nothing else”, but these people who come in and are rude are trying to game the system by forcibly trying to talk down other people by being rude enough that they wanna walk away or not participate, or blow their stack or what have you, and just have them lose that argument.

For me, it’s trying to be kind while realizing the root cause of why we need to be kind. As I said earlier, open source is all about trying to help keep the project running, bringing new people in, keeping/sustaining them, keeping everyone happy. But the other thing to realize is open source owes no one anything.

Let’s say you use Python. I don’t owe you anything. I gave you a gift of software that I put my limited time on this planet into to try to make it useful for you; you took it, you used it - fantastic. That is the end of it. I have a legal obligation to let you use that software based on the open source, and that’s where it stops. I think people forget that fact. They come and they think I owe them bug fixes, or I owe them new features, or I owe them another release. I owe, I owe, I owe. There’s somehow a feeling – people come to open source as somehow there’s an obligation on my part beyond the code that I put out there, with the licensing, that you’re allowed to copy and use this, it allows you to keep this license with the software… And there isn’t. There is no obligation.

I think if more people will come to open source realizing that there is no obligation, the interactions would be better, because then suddenly you don’t come from a position of demand, you come from a position of request. You’re not gonna come to me and demand I fix a bug if you realize I have no obligation to help you with that bug. But if you realize I could help you if you requested nicely, because I choose to put my time and effort into helping you, your interaction suddenly shifts, your expectations shift, how you choose to work with someone shifts… And I think that’s the key here; the conclusion is be kind to one another, which I know is, as you said, borderline a cliché, but I think the key is understanding how do we try to refrain the position of open source such that we all kind of naturally reach for the kindness result. I think the key there is setting the proper expectation for open source and its participation by remembering no one owes anyone anything. And I know that really ruffles some feathers with some people, because they suddenly think “Well, where’s the motivation? How are people gonna help?” People who think in terms of numbers are like “Oh, there’s gotta be some ulterior motive or some driver for people to participate in open source”, and it’s like “You know what? No.” Open source is kind of a hippy-dippy thing when you really think about. It’s literally people just doing it for the fun of it, and just to be kind to other people, to give out software that they think others might like. They don’t need any other motivation.

This is something I think people forget - as long as you don’t destroy that motivation, people will just keep doing it regardless. So making sure that we remember that there is no obligation and we just need to be kind to these open source contributors to have them keep doing what they do and giving us this software that we benefit from, we’d go a long way towards helping us with the sustainability problem… Because if we are just nice to each other, this burnout problem goes away. If you just understand that “You know what, the two of you don’t owe me another podcast. If you do another episode - awesome. I will happily listen and I will appreciate it… But there’s no obligation on your part, just like I have no obligation to fix any more bugs in Python ever in my life. I really don’t.”

Salvatore Sanfilippo: Exactly. I believe so as well. There was, I believe, some – I was not part of the company when this happened, but I believe that this was a consideration. But then, you know, sometimes also the legal advice that you get… I will say something a bit maybe unpopular, but I think that the legal offices in companies sometimes create the worst possible setups for companies. Because the legal offices don’t really try to usually balance the risk, the legal risk with the company potential, but they are mostly going always to err on the safe part, in order to be right later. If you are super-conservative, you never do anything wrong from your point of view. However, you are paralyzing the company.

Many times when I had to do contracts, I skipped the lawyers that were in between and we could not understand each other, and said “Okay, I will write the contract. This is the contract. If you want, you can fix the form”, and immediately, the thing started to immediately to work, the conversation. And I believe that sometimes it can happen that choices are – but if you read the AGPL license very, very well, you actually discover that also the form is not extremely clear. It’s not very well written. So I believe that it’s very hard that somebody will authorize to use it in a software as a service setup without any kind of a signed paper by the folks that have the copyright. And this could be a good – I think that they did a good thing switching back. Basically, in this kind of changing setup, you try, and you believe “This is very similar to AGPL. People will accept it.” Instead, you find the cultural resistance, and then you step back, “It makes sense. I can understand that.”

Break: [00:40:09.20]

Stephen O’Grady: So Copilot is – frankly, it’s like it is for some…. You know, Google does this with Duet, right? Duet is their brand for their generative AI – or I should say, their conversational interface, right? It’s in all kinds of – like, Workspace, and GCP, and all these other pieces. So yeah… Because in other words Microsoft, if they want to leverage that technology, they have to make a decision “Is this legal or is it not?” And clearly, they’ve come to the – I mean, they have come to the conclusion it was, because otherwise you don’t release that project, and invest in it what they have. But like I said, there’s a difference between “Hey, we’re going to do this and hope it’s legal”, versus “Hey, we’re going to indemnify people.” And you’ve seen this historically in open source… I’m trying to think of an example where customers have said “Okay–” You know, this is like going way back, with the scale license issue with respect to Linux Kernel; one of the questions was like “Hey, will you indemnify us?” And it was really difficult, even for companies that were like “No. Hey, legally we’re on solid footing.” If you were a smaller company at that time, which most of the open source companies were, indemnifications, like - how would you do that, practically speaking? You just don’t have the resources. So the point is is that from a Microsoft standpoint - yeah, when I saw that, that was a pretty big deal.

Break: [01:03:34.15]

Josh Padnick: Yeah, that’s a great point. So one of the – there are a few kind of core tenants of our vision, and one of them is, of course, a clear, unambiguous open source license. Another one is backward compatibility. And what that specifically means for us is that any bug fixes that are reported, either to us, or that we see to TerraForm, we would like to implement fixes for. I should also say, it’s extremely important to the group to remain compliant with HashiCorp’s license. So we cannot just go to their repo and copy code improvements, just because they’re available. We are still working with our lawyers to figure out what information can we legally glean from what happens there, and where do we need to just not even look. So legal compliance is something that’s really important to us.

Anyway, to your point about compatibility… So that’s bug fixes. Then for new features that Hashi TerraForm releases, like I just said, we cannot just copy their implementation. But our understanding is that we can copy the interface, and we can do our own implementation, and make it interface-compatible. So to the greatest extent possible, we want to make OpenTF a drop-in replacement for Hashi TerraForm. And then once we feel like we’ve really achieved that expectation, where people feel like “Hey, this project is pretty stable. I can use this, I’m happy with it”, the other kind of big thread that we have is a community-driven RFC process for whatever improvements people want to see in OpenTF that could never make their way into HashiCorp. One example would be those encrypted state files, like I mentioned before. HashiCorp never wanted to merge that PR, and now this is an opportunity for OpenTF to figure out the right way to do encryption on state files, what all the potential pitfalls could be, go through a proper RFC process, get that merged, and now it’s a superset of what HashiTF would be.

Another example would be better importing from the Go codebase. So HashiCorp also made this sort of pivotal decision a while ago to lock down a lot of the internal libraries of TerraForm under a specific package in Go, so that they were difficult to access… And that meant that you couldn’t really use TerraForm as a library, you could really only use it as a CLI tool. And for those of us who are building things like pipeline solutions that operate TerraForm, or TerraGrunt, or whatever, we have to go through this awkwardness of using the CLI tool, when what we’d really like to do is just access the Go library directly.

[38:20] Another example would be downloading providers from any registry. So right now, HashiCorp forces you to download providers from their registry. And if you’ve written a custom provider, like maybe you’ve got some custom API, and you want people to be able to write TerraForm code for your custom thing - this understanding I need to check, but my understanding is that you can’t host that provider except with HashiCorp’s paid services. I might be wrong on that, so I definitely need to check on that. But in either case, with a community-driven process, we can now allow users to download their providers from any registry. In fact, someone from our consortium released a proof of concept video just a couple days ago showing how they were able to download TerraForm providers from Docker Hub, or ECR, or GitHub Container Registry.

So our first priority is compatibility, so that you can just do a drop-in replacement for Hashi TerraForm. But once we feel like we’ve really met that expectation, then we want to start focusing on our own set of innovations around this community-driven RFC process.

Daniel Whitenack: Yeah, one follow-up too on the LLaMA 2 front, which is connected to the legal topic that we talked about before with Damien Riehl, which people really loved that episode. I loved that episode, too. We’ll link it in the show notes… About the legal consequences of generated content. But I was chatting back and forth, and actually Damien got in a Twitter chat, which is - there’s this interesting thing, which we didn’t really talk about on the show, but a lot of people are doing… I think it’s worth just mentioning it on the show, because it’s kind of a conundrum to me, to be honest, without actually talking it through with a lawyer… Which is technically I think you’re not supposed to use GPT output to train or fine-tune another non-GPT model.

So what comes out of - let’s say you have an OpenAI account, and you generate a whole bunch of output from GPT 4, which is going to be really good, and then you fine-tune an open, smaller model on that GPT output, and you make the open model good, like GPT 4. So that’s what a lot of people are doing. It’s not really like a hidden thing. People are posting these models on Hugging Face… And the question on Twitter, which I thought was really interesting, and maybe listeners can consider, is - well, first off, it seems to break the license agreement with OpenAI… But also, machine-generated content isn’t copyrightable. But also, if they do that, and then they post the model, can I use the model that they posted on Hugging Face? …if it’s sort of from the – what is the thing? Poison Well, or whatever… And yeah, what all of that would actually hold up in court? It’s a whole mix of things. So I just – I’ve been thinking about it a lot, and I think it’s an interesting thing that we’ll see play out.

José Valim: And again, if it’s an npm package, or a Hex package, or Ruby Gems, nobody’s going to run compiled code, or obfuscated code… Because again, the person could be doing anything with that. So I think the nature of this module - it needs to be based on… I think it’s honor system or something like that and if you say “Hey, you need to buy per user…” – but not everything’s per user; some people just say “Hey, it’s a team license.” Let’s say “Oh, if you’re using one person, it’s a single license. Otherwise it’s a team license.” And then there’s basically a kind of trust situation that you are doing those things, and you are going to follow those rules.

And the other thing is most companies - they will do that, because nobody wants to have legal trouble because they are not following a certain license. And the people that are not going to follow the license - they are probably the people that would not be interested in paying for our software in the first place… So there are those things to balance.

So with the license - we are going to do a lot to make sure that if it’s through license, we are going to have the UI to manage that. And you know, for the organization it’s also great, because if you’re a big organization and somebody is removed from the organization, you need to make sure they did not have access for those packages and this kind of stuff, because it can be a liability. So if somebody gets some paid software out of a company, it’s actually the responsibility of that company to make sure it doesn’t happen… So the corporations are also interested in making sure that all of this works together, but a lot of it will be yeah you know that’s what we have and again, it goes back to the idea of supporting the team, supporting the open source project, and everybody understanding those goals and making the correct decisions, and the legal decisions as well.

Steve Francia: So the license question - I give that answer mostly tongue-in-cheek, because I think everything you said, Jon, is right. But we’ve heard from a lot of – while maybe not every individual is doing this, companies are very concerned with this. License compliance is a huge deal, because it can really get you into a lot of hot water. Every company and individual should be concerned with it, but the larger the company is, the bigger the defensive legal staff needs to be, and the more concerned they are with this. All of the Go tooling certainly doesn’t do this today, but we did build in more license awareness into Go.dev.

Manish R Jain: I think it’s a very delicate trade-off between trying to choose a permissive license, which allows most users to just use the software, while also dissuading a big company from coming in and stealing your financial longevity in some sense, right? And if you put Commons Clause in place, it’s true, the project is no longer open source, because the Commons Clause is not OSI-approved.

Now, Redis did a smart thing there - they kept most of their codebase under the BSD license, which is still open source, but chose some of the modules that they had built and put them under Commons Clause. So you can think of, again, as this open core model in some sense, where most of your code is open source, but then some of your code is not. When we applied Commons Clause for Dgraph, we applied it fully, which means all of the codebase was under Commons Clause. And we were just not convinced that that was the right move, and this became very apparent when, again, Google went in and banned the Commons Clause as well. Now, I don’t agree with their reasoning for Google to ban the Commons Clause, which was that they feel that the Commons Clause prohibits all commercial usages, which is completely wrong, really… The Commons Clause has this term called “if the code is substantially the same as the original code, then they can’t sell it.” “Substantially” is a term used very commonly in legal documents to basically indicate that if you tweak things a bit, it doesn’t make it different. That is just a way of saying that if largely you’re selling the same thing, which is selling, let’s say Redis modules in this case, or selling Dgraph, then you would not be allowed to do that. But you can build something on top of it, for example you could build a question asking website, you could build some other proprietary service on top of Dgraph, and you can sell that; nobody stops you from doing that, because it is not substantially the same thing.

That was the idea behind the Commons Clause. I feel like the intentions were correct, but it was very hard to convey to people in the community, and even cooling this case, what “substantially” meant. I think we went through many debates around explaining to people “substantially doesn’t mean this, substantially doesn’t mean that”, but I don’t think it’s a fight that is easy to win.

[01:00:12.23] After we realized that the Commons Clause was banned by Google - it brings us back to the same place where AGPL is banned by Google, and again, it affects that option, so we decided that we will switch back to the Apache license. Now, there’s an interesting backdrop here. This is back in 2017, I think - CockroachDB, a database company in New York, had come up with a license which was essentially Apache plus enterprise license (what they called the Cockroach license), and what they did was instead of trying to closed source their enterprise modules, they made it source visible, and they collocated it right next to their open source codebase. Now what they have is they have the main source tree, which is Apache-licensed, and then certain modules which are under the enterprise license, are still with the code visible.

That was a very attractive system, and it was very well-received by their community, and it’s something that I had in the back of my mind for a while, and I felt that Dgraph was still young enough, and we had started to build our enterprise features, but I felt that we can easily switch over to that license and make it work… So what we have done now is that we have brought Dgraph back to Apache without any clause, and we’re gonna build the enterprise modules, which will be source visible. This system is also adopted, I’m not wrong, by ElasticSearch, and is just in general a very big win for liberal open source licenses, in some sense.

One more thing on top of this is that – so this is our journey; that’s where our journey sort of concludes… But after we switched over to Apache license and enterprise license, MongoDB, which was previously AGPL, has gone even stricter and created a license called SSPL (Server Side Public License). Now, as AGPL was sort of stricter that GPL, SSPL is even stricter than AGPL. It tries to do the same thing as the Commons Clause in some sense, but it does it a bit differently. It says that if you run MongoDB as a service, then you must open source the codebase which helps you run MongoDB as a service. Again, it’s a jab at the big service providers, like Amazon, but it’s just done in a different way, where they probably have a better chance of getting it approved by OSI… But in my mind, it’s trying to achieve the same thing as what Redis was doing with the Commons Clause.

Philipp Krenn: It’s definitely not very common. I think one or two other companies have looked into similar things. I think CockroachDB is one of them, though they are much smaller and much younger as a company. I’m not aware of any other more established or larger company doing that.

[44:02] Also, from the legal perspective, it is very interesting, and on the one hand side, we really want to kind of like keep the legal text there to a minimum and not scare anybody away. On the other side, it needs to be water-proof so that nobody can find a loophole to legally use our commercial intellectual property to make money themselves, or just use it for free and work around that.

Some people have had the concern that while you can just take the code, modify it and kind of like comment out all the licensing restrictions, but we don’t assume that this is kind of an issue for any established company. Anybody who is capable of paying, or at least in the Western world… I’m not sure how it’s like in the rest of the world, especially with the legal system there, but we don’t see that as a major risk, that somebody could just easily modify the source code now and run everything because it’s open.

We have thought about that, we are not afraid of that; we’re still in the process of drafting that legal document or that license that we will add, and we’re also kind of right now cleaning up the code for the opening, because you need to make sure what was closed source code there are absolutely no credentials, there cannot be any references to customers, you don’t want to have anything else that might be embarrassing… So there is kind of a cleanup process right now that the colleagues are going through.

Heather Meeker: [07:49] Open source licenses have gotten a lot more standardized over time, or at least people have fully embraced the benefits of having them be standardized. Today, there are still people writing open source licenses, but this notion of license proliferation is considered a definite negative in the community. If you roll back the time 20 years ago, you had the GPL and you had a few others, but people still thought it was a good idea to write new ones. Now, there’s a real notion that it’s not really a good idea to write new ones. That is, I think,q mostly sensible because they tend to be kind of difficult documents to interpret, and you have to, for instance, import a lot of knowledge about how they are used, and so forth.

Most of them are shorter documents that don’t have a lot of detail, so every time you write a new one, when you start on day one you don’t have any history with the license to use to interpret it, and that’s difficult.

I should step back… For instance, GPL version two became widely accepted by industry, but a big part of that was that industry got comfortable with the community norms for how to comply with it. That is sort of outside the four corners of the license. Normally, when you’re interpreting legal documents, you basically just look at the four corners of the document. You look a little bit outside, but one of the primary roles of interpreting licenses is you have to look at what the objective meaning of the license is. With GPL version two you had this long history of use that was very helpful and made people much more comfortable about what it meant, understanding that it’s a very complex document.

That’s the long way of saying that today everybody understands the value of standardization in open source licensing, meaning standardization of the license terms in a way that was kind of a side benefit of open source. So if somebody comes to you and says, “I’m using this software in a tender Apache2 or a tender GPL2”, I know immediately what that means, whereas in proprietary licensing, you have to actually read every single license.

Over time, a lot of what has changed is that people have converged on a half a dozen licenses or so, almost to the exclusion of all else. There are still new licenses being written, but they tend to be at the margins.

Richard Hipp: Yes. So when I ditched the dependency on the GPL to GDBM library and wrote my own, it was all my code at that point, and I could put whatever license I wanted in it. And I thought I wanted a much more liberal license so people could just toss this into their application and not have to worry about it. And I looked at the BSD license and I looked at the MIT license and I thought, “You know, really, what’s the point?” Why not just say, “Hey, it’s public domain” and put it out there? And that what I did.

That was a little bit of a tough decision. That’s kind of letting your baby go because you’re casting it into the wind and hope that it does well.

Also at the time I did not realize, having lived my whole life in the United States, which is, you know, under British common law, where the public domain is something that’s recognized. I did not realize that there were a lot of jurisdictions in the world where it’s difficult or impossible for someone to place their works in the public domain. I didn’t know. So that’s a complication. And for that reason some companies started to say, “Hey, we need to buy a license anyway”, so we made this product available. “We’ll sell you a license for SQLite.”

We do our best to talk them out of it and explain they don’t need this, but for a lot of people it’s cheaper to pay the fee and get the license than it is to convince their lawyers that they don’t need one.

So that’s one way that we have, you know, making a little bit of money to fund continuing development. It’s more than just a license, though, it’s also a warranty of title. The document we send them represents and warrants that all, every byte of source code is an original work that we control, it came from us. In other words, they are not bits and pieces that we just pulled off of the Internet, that might be contaminated with licenses that you don’t know about. And if you are doing a large project with potential legal exposure, you wanna make sure that you really can use this without incurring possible are lawsuits down the road.

Maybe Google wishes that they had thought more about Java before they put it in the Android. They don’t want… Ten years down the road, if their product’s a big hit they don’t want somebody coming back and say, “Oh, that SQLite actually had stolen some code from us and so now you have to pay a license to us.”

Derek Collison: Yeah, so what the audience might not know is that the CNCF was kicked off at a large meeting at the Switch Data Center in Las Vegas, of which I attended. And I was actually part of the founding governing board. So a lot of people might think “Oh, Derek’s role with the NATS project and NATS being a project in the CNCF - that’s kind of the totality of it.” But that’s not the case. And even early on, we were looking at what value CNCF could bring to the ecosystem from a consumption perspective, the users, to the people or the companies that want to utilize that, and then of course, the projects themselves… And then for me, it was like the companies that are driving said projects. In the case of something like Kubernetes, where it’s all of the big boys, so to speak, there’s not a lot that the CNCF needs to do there. It’s kind of taken on a life of its own and it’s marching down a path.

What we started to realize is that as time goes by - because this was, I think, over a decade ago - that both the CNCF and projects can evolve. And where we were at was looking at the question “Are we the best fit for CNCF?” And no fault of CNCF’s per se, but it just felt pretty clear to us that certain projects were at this tier, and other projects were way down here, and we kind of were in the latter category.

In no way were we attempting to relicense the whole codebase. I mean, one, you can’t do it, because once it’s released, it’s AP2, it’s there. That will never change. But the CNCF in early discussions – because we said “Hey, would you be open to letting the project leave if the landing spot made sense?” Meaning we could do a joint statement where it’s like “No, it’s landing in this new foundation, made up of lots of big users and customers or production uses of the NATS ecosystem. Commitment to AP2, X, Y, Z.” And during those early conversations, which started in February, we were asked “Hey, are you considering a license change?” And we’re very well aware that we can fork and do a Synadia version enterprise server, and X, Y, Z, and so we said “We’re considering, just for the server, that we might do like a BSL.” And at the time, the BSL - for us, it wasn’t translated well out into the media… But the reason that we were considering it was we felt that it was the best show of commitment to both OSS and to our customers. And I’ll explain what I mean by that. The BSL has usage clauses that you have to define when you release the software. And one of them is there’s a period of time after which it converts back to whatever language you pick, which - we would pick AP2. And it doesn’t matter what Synadia does, the Linux Foundation does, CNCF does, that is a legal contract that once we release, let’s say, a server with the BSL license, after two years it’s converted to AP2. Even if we don’t actually update the copyrights, or update the license, or whatever. And so we felt that from an OSS ecosystem.

And again, we’ve gotten lots of additional information, lots of additional feedback. Most of it constructive, some of it not. And we’ve been listening. But our initial thought process as we were going down this path was “Hey, this signals really strongly that we’re not going to hold anything back. It will always kind of revert back to generic drug prices.” Some of the good parts of what the patent system originally was trying to do early on. I’m not claiming that the patent system is necessarily good these days. It’s a necessary evil, right?

[36:16] In addition, if you would imagine a two-year BSL window, and let’s say Jerod wanted to be a customer of Synadia - and customers are worried about vendor lock-in, price gouging, all those normal things - you could say, “I want to do a two-year contract, so I have predictable pricing”, and at the end of that, that all stuff that I’m paying for converts to AP2, and I can now use it for free. Or I could say “Oh, I like the next version, too. I want to use that and [unintelligible 00:36:39.10] and do that.

So I’m not saying that it transpired the way we wanted it to, but I think people’s thought process that we’re just evil and we’re just trying to price gouge and be greedy and stuff like that - I don’t feel that that necessarily is correct, at least as we were discussing internally. We care deeply about our commitment to open source. But we are starting to see a very disturbing trend where customers that everyone would recognize - they’re in the Fortune 50 - that are using NATS to power production-level services or functions or products, not only had never reached out for any type of commercial agreement with us, but actually have policies that say “If you’re in the CNCF and you’re incubating and graduating, we’re not paying for it, period.”

Donald Fischer: Yeah, this is the best part of Tidelift for me, it’s my co-founders, and then the team that we’ve built to go on this mission together with us, and it is an interesting story. I have three co-founders - Havoc Pennington, Jeremy Katz and Luis Villa. We’ve all known each other pair-wise for at least 15 years, and a couple of us go back longer than that. As I mentioned before, we all intersected at Red Hat in the early 2000’s, and then we’ve collaborated on different projects since then… And each of us sort of has a different ingredient that we contribute to the mix.

I talked about my background a little bit; a lot of it is sort of the business side of open source. Havoc, our co-founder, currently is leading Product for us. He is a long-time veteran of the open source world. He was originally one of the founding voices in the GNOME Freedesktop community, the Linux desktop, and co-led the creation of the GNOME Foundation, which continues productively to this day, and implemented a lot of the software himself that powers the GNOME desktop. I got the chance to work with him first when he was leading the desktop development team at Red Hat. Then Havoc has interestingly gone on to do tours in a couple of other interesting and different open source communities. He was working for a stretch in the Scala community, in sort of the greater Java world, and then most recently was back in the Python data science community before we got together to start Tidelift.

Then the third co-founder is Jeremy Katz. Jeremy is an amazing technologist. I got to know him when he was one of the core developers at Red Hat, then he went on to sort of grow his professional portfolio beyond just open source - he was an early employee at HubSpot, the marketing SaaS company. He led the implementation of this product called Stackdriver, which was a startup that was sold to Google and now serves as essentially the management console for the Google Cloud platform, so really a seminal piece of software in the cloud generation.

And our fourth co-founder, Luis, has (I think) the most unusual story, which is Luis started with the rest of us as a programmer, open source developer, but Luis ended up going to Law School, and then closing that loop by becoming an open source legal expert, really, one of the widely respected voices around legal issues associated with open source. He did a really interesting stretch working with Mozilla, where he actually led the drafting of the Mozilla Public License 2.0, and then he had a really interesting time at Wikimedia Foundation, the organization behind Wikipedia, dealing with a whole bunch of open content issues there, and sort of leading the community effort there as well.

So it’s a really interesting set of disparate backgrounds and professional experiences, grounded in having all been open developers, software developers, and open source participants in the early years. I guess what we’re trying to do is bring those different experiences back together and apply them back where we all started, trying to make open source work better for everyone, the creators and the users.

Donald Fischer: Yeah, this is the best part of Tidelift for me, it’s my co-founders, and then the team that we’ve built to go on this mission together with us, and it is an interesting story. I have three co-founders - Havoc Pennington, Jeremy Katz and Luis Villa. We’ve all known each other pair-wise for at least 15 years, and a couple of us go back longer than that. As I mentioned before, we all intersected at Red Hat in the early 2000’s, and then we’ve collaborated on different projects since then… And each of us sort of has a different ingredient that we contribute to the mix.

[48:19] I talked about my background a little bit; a lot of it is sort of the business side of open source. Havoc, our co-founder, currently is leading Product for us. He is a long-time veteran of the open source world. He was originally one of the founding voices in the GNOME Freedesktop community, the Linux desktop, and co-led the creation of the GNOME Foundation, which continues productively to this day, and implemented a lot of the software himself that powers the GNOME desktop. I got the chance to work with him first when he was leading the desktop development team at Red Hat. Then Havoc has interestingly gone on to do tours in a couple of other interesting and different open source communities. He was working for a stretch in the Scala community, in sort of the greater Java world, and then most recently was back in the Python data science community before we got together to start Tidelift.

Then the third co-founder is Jeremy Katz. Jeremy is an amazing technologist. I got to know him when he was one of the core developers at Red Hat, then he went on to sort of grow his professional portfolio beyond just open source - he was an early employee at HubSpot, the marketing SaaS company. He led the implementation of this product called Stackdriver, which was a startup that was sold to Google and now serves as essentially the management console for the Google Cloud platform, so really a seminal piece of software in the cloud generation.

And our fourth co-founder, Luis, has (I think) the most unusual story, which is Luis started with the rest of us as a programmer, open source developer, but Luis ended up going to Law School, and then closing that loop by becoming an open source legal expert, really, one of the widely respected voices around legal issues associated with open source. He did a really interesting stretch working with Mozilla, where he actually led the drafting of the Mozilla Public License 2.0, and then he had a really interesting time at Wikimedia Foundation, the organization behind Wikipedia, dealing with a whole bunch of open content issues there, and sort of leading the community effort there as well.

So it’s a really interesting set of disparate backgrounds and professional experiences, grounded in having all been open developers, software developers, and open source participants in the early years. I guess what we’re trying to do is bring those different experiences back together and apply them back where we all started, trying to make open source work better for everyone, the creators and the users.

Jerod Santo: Redis is forked

Vicki Boykis:

I, as a cynical Eastern European, hate almost everything in software. But I love Redis with a loyalty that I reserve for close friends and family and the first true day of spring, because Redis is software made for me, the developer.

That’s high praise, which makes what she says next land with even more gravitas than it would in isolation:

The old Redis was for developers. The new Redis is for enterprise sales, and for generative AI. It’s true that it’s not yet entirely clear what all of this means for the future of Redis the software. Some say the licensing changes won’t impact much if you’re not a large-scale Redis reseller. Because it’s true that the license changes were all legal and all parties acted in accordance with both what’s acceptable and what the market dictates to sustain the software. And yet at the same time, projects that depend on Redis are withholding updates or migrating.

But the problem is not only that the license changed suddenly, without warning, it’s the messaging behind the change, and the message is, even though there is extremely active community development, Redis is no longer in and of the community. We are no longer being consulted.

If you heard Adam and I on Changelog & Friends over the weekend, you already know how I feel about this. But if you didn’t: I’m with Vicky. Redis is no longer for us, and I’m no longer for Redis. May a thousand ideas/forks rise out of its ashes.

Simon Willison: Now, with GitHub Copilot… What’s interesting there is in that case it was trained on code that had been released and made available, but was under – the big argument people have is about licensing. It was GPT licensed. That is not supposed to be used in this way. I did not give permission for people to do this. Another thing - with Stable Diffusion there was no license involved at all; it was just scraping artworks off of the internet. We should talk about where those artworks came from as well. I’ve done a bunch of work around that. With Copilot - it’s trained on effectively code from GitHub, which was publicly visible, but people are still very upset about the lack of respect for the intent of the license, if not for the sort of legal words of the license.

And yeah, I’m seeing people saying “I will not use Copilot because it’s unethical”, people saying “I would not allow Copilot-written code into my product.” It’s a whole fascinating set of things in itself. I personally have been using Copilot for some of my projects, mainly to write tests, to be honest, because it’s incredibly effective at writing unit tests. You put in a comment saying “Check this” and it literally completes the code for you right in front of your very eyes. And tests are kind of tedious code, that I don’t want to be spending as much time on.

But I’m also an expert programmer. I’ve been programming for 20 years; when it inevitably puts weird little bugs and uses MD5 hashes where it shouldn’t and so forth, I spot it and I laugh about it and I correct it. If I was a brand new junior programmer, I’d be much more inclined to accept it in the same way that I might copy and paste code from Stack Overflow without understanding what it does. And that can lead to all kinds of security holes and design flaws in the code that you’re writing.

[44:19] But yeah, so again, I feel like a lot of the ethical conversations around this are playing out quite similarly. I have no fear at all of being replaced by an AI, because as you get more senior as a programmer, you realize that the code writing is the easy bit. The bit that actually requires skill is figuring out the requirements, figuring out what people actually need, figuring out the best sort of way to structure it, and so on. If an AI writes the code for me, that’s great. That’ll save me an hour a day, but I’ve still got seven hours’ worth of the other work that I was doing to get onwards.

But if you want to talk 200 years in the future - hey, notoriously, human beings can’t predict 10 years in the future, so who even knows…?

Eric Holscher: How do we navigate that kind of… Like, we’re all looking at this term, and we want it to mean what we want it to mean. And with Read the Docs we actually have a page in our documentation that’s like “Yes, we are open source. Yes, our license gives you these legal freedoms…”, but just because – the big one for us is “Yes, you can install this at your company, but our priority is to support our hosted open source version for the community, and the core developers of Read the Docs generally are gonna work on that first. And if we have time, we might help you with your local install.

You’re completely legally able to install it, we’re not saying you can’t do that… But we are saying we have a set of priorities as an organization, as a human, and that’s how we’re gonna direct our time. So don’t feel bad… Before you install this, you should probably know that we’re not gonna support you doing that, because we have other stuff to do.”

Steve Francia: Our logo is more flexible that’s used than most logos, but there’s guidelines within the brand book on what acceptable use is. We talked about what to license it under and spent some time with our open source legal team, and their advice was copyright the logo is the appropriate thing to do. It lets people use it under fair use rights and under the guidelines that we’ve set forth, but they can’t make modifications, they can’t sell it, they can’t do different things to it because it’s copyrighted.

Dan Kohn: Oh, definitely. We’ve needed to hire more people, and then we’ve just needed to standardize a lot of processes. CNCF started with just Kubernetes, and then it took six months or something for us to get Prometheus. Then I think Fluentd was number three after like eight months. So during those phases, if you needed something, you would just send an email to me or our Chief Operating Officer, Chris Aniszczyk, and say “Hey, can you help us with this event?” “Oh, I need to set up an account for so and so.” “Oh, I’m having this issue.”

That worked fine at first, but I think almost like any organization or software company, you just have to put processes in place going forward. So we have something we call the Service Desk, and it’s just a ticket tracking system… But any of the maintainers of any of those 26 projects can in principle ask for anything – I mean, conveniently, we’ve had the budget so far that we haven’t needed to turn them down for a lot or for much at all.

[39:58] But the specific requests tend to be – I mean, a lot of them are just like super-minor things, like “Oh, can we have an official Kubernetes slide deck that people can do community presentations without having to use their company’s slide decks?” Or for Prometheus, it was “Hey, we wanna run a community event for about 250 people. Can you help us organize that, handle all the money for us for the sponsors that wanna come in, help us sell it, and such?”, and so we’re very happy to do it.

And then, you know, presenting to our end-user community, engagement there… All of our projects are very eager to be involved in KubeCon + CloudNativeCon, so although we do have this competitive track system, we also have slots, internal deep-dive slots for each of the projects… So they definitely appreciate that opportunity to get in front of the audiences.

We do a lot of work with them on social media, on press relations and analyst relations, on giving them some kind of tracking on how things are going…

I mean, one way of thinking about it is that if you’re a big company, like a Red Hat or a Google and you have an open source project that you’re trying to promote, for commercial reasons, your company can provide you with a set of services. But what we’re suggesting is that for a lot of core cloud native projects, it’s much better for it to be hosted by a neutral foundation… But you’re still gonna want those services, so we try and provide a lot of those same things.

I mentioned the certification process, and we also offer training courses with it. And then thankfully, it hasn’t been that involved yet, but also offer a variety of legal services around trademarks, contributor license agreement if they want that… We generally recommend that projects instead go with a DCO (developer certificate of origin), which as you may know, originated with Linux. So we just work with the projects here…

But the sort of bigger picture is that what a foundation needs to provide has certainly changed significantly in the last 20 years. When Apache started up, it was a huge deal to have a source code repository, to have a web page, to have some basic kind of continuous integration infrastructure… And today, basically any open source project can get that for free from GitHub, from Travis, CircleCI and similar kinds of services… And we actually encourage them to do that. We don’t try and move them over to our infrastructure, but we do try and provide a set of services that remain useful.

Luis Villa: Oh, yeah. Absolutely. And by the way, you specifically called out New York, and Natalie said in the pre-chat that she wanted to ask about the EU… We as open source programmers, and open source developers of various sorts, tend to make an assumption that we can write a license that applies across the entire world. And in most law, that’s like a completely laughable idea. It’s somewhere between laughable and actively considered harmful. And so we’re sort of lucky, in some ways, that the core concept of copyright, which is what applies to that actual written thing, distinct from the ideas, is actually a global standard. A treaty called the Berne Convention; that’s 1908, maybe, or 1903.

So copyright has been standardized across the entire world for 100 years, which makes it a good platform for lawyers to build a global system on. If you’re talking about databases, no global platform, no global legal platform… So writing a database license is responsible for a lot of these gray hairs; again, sorry, podcast listeners. You should watch it live next time. And similarly, with AI, we don’t know how some of this is going to play out. We can offer guesses, and frankly, very interesting guesses. This is a very fun theoretical game, but we don’t know how it’s gonna play out in court.

And by the way, Kris, I think the other meta thing that’s really interesting for programmers… I often like to remind developers that writing a contract is like writing code and then not executing it, at all. And you’re just sort of reading it, and like, we all agree more or less on what the output should be, but until it’s actually been executed, which happens through a court… Right? A court says, “This is what the thing is”, then we don’t actually know what the outcome is.

So everything that I say here is going to be based on like a handful of things. Part of the challenge in Oracle v. Google is that we’d all been operating under these assumptions about what copyright law was, but there had been no litigation over whether or not an API could be copyrightable since the ‘80s. So the closest analogy we had was Lotus 123 dropdown menus. And it turns out things have changed a lot since then. But because it hadn’t been executed by a court, we really didn’t know how this was going to turn out. And so that makes predictions – this is why lawyers’ favorite phrase is “It depends.”