Opensource Licensing Danger Zone?

Machine-generated from the episode audio and not hand-corrected, so names and technical terms may be imperfect. The audio is authoritative.

All right, you're listening to yet another episode of the CTO Advisor podcast, some fresh content over the next few weeks. We're going to actually get in a two-for-one in this conversation. You will see it in two separate weeks, but I get the pleasure of having it in all one podcast. This week, Ned Bellavance rejoins the podcast, Ned in the Cloud. Ned is a content creator extraordinaire. If you haven't checked out his Terraform Tuesdays on YouTube or any of his content on classes on doing automation and infrastructures code with Terraform, you're missing out on some great learning.

Ned, welcome back to the podcast. Thanks, Keith. Thanks for having me again. I appreciate it. And yeah, I mean, it's a lot of Terraform content, but I get into some other stuff too. I'm talking about policy as code, and I guess as code is probably the thing that I'm most focused on now is just all the different ways we can express infrastructure and traditional operations things as code. Yeah, you're reminding me to publish or republish a podcast we did.

It's going a couple of years ago with an executive. I think it was might have been an executive from HashiCorp that wrote a policy as code book. It was a really fascinating conversation, just the frameworks around doing policy as code and where the gaps in the technology are at today and where or yesterday and where the industry needs to go and the advantages of policy as code, really great concepts. Yeah. So I have you on for this first episode and we'll tease the next episode.

io. io is using, whether they're using it against the spirit of open source or the legal ease of the license. We'll get into that a little bit, but I think it raises some higher issues. The second episode we're going to record is we're going to talk to Ned about his AI workflow. Basically Ned does as code things and are the chat GPTs of the world about to replace developers and network engineers and content creators? io story. Ned, do you want to give an overview of what the two companies do or what's that issue here?

Sure. Just as a very general what the two companies are all about, they're both all about software defined storage. I know Steven Foskett doesn't like calling it software defined storage, but that's what the industry has agreed on. Sorry, Steven. io is focused on a very broad deployment model and they're very focused on object-based storage. So that's their bread and butter. io distributes their software on an open source basis. They do have licenses available. io's code in an open source fashion to develop their own products.

io has taken exception to the way in which Wicca has used it and previously how Nutanix also used their same software. And so they wrote a very pointed blog post that came out on Friday, basically calling out Wicca for their use of the software. And more importantly, they wanted to revoke their license. io as my object storage. It's a feature within the Wicca product, just like Nutanix tried to use it as a feature within their object store product or product. And open source, they call this copy left.

Basically the ability to take a open source project, if you use anything like Prometheus, SDO, Kubernetes, and a package solution from a paid vendor, this is kind of the same concept. 0 or whatever the specific license is, I think from an enterprise user perspective, from a CTO, someone's implementing Wicca IO, we kind of take for granted that all the open source components of the underlying system are covered in my licensing agreement. And I think this raises the concern back, you know, a la Microsoft shaking down Red Hat users and Skoll going after Linux in general.

Should organizations and engineers be worried about this open source software that's making up the bomb of the solutions that they consume? Well, I think we do have to focus a little bit on the different licensing types, and I'm not an open source licensing expert by any means, but I know that there are certain licenses that say, hey, you can take this software, you can use it as you see fit. You can copyleft it into your proprietary software, and that's okay. Like that is fully fine.

You know, it would be great from a community standpoint if you make improvements to the software to upstream it back to where you got it from. That would be very much appreciated, and that's in the, it's not a requirement. It's not a legal requirement, but it's part of being a good open source netizen, right, is giving back. And that's like the MIT license and such. It's the idea is software is free. These ideas are free. Give back to the community.

If you do that, you're overall, you're not, you know, in, you're not breaking the idea of the license. Right. So if you do, if you're leveraging that type of license, those well-known licenses, the MIT license, the Apache 2 for the most part, you can, you don't have to give back, but it'd be nice if you did. And people have called out companies like Amazon that appear to be taking open source software, adding some of their own secret sauce, not necessarily giving back to the community and then charging people a lot of money for it.

Now that's a debate for another day, but that's like what's been lobbed at them, right? And then there's the newer licensing that was introduced to, I don't want to say poison pill, but it kind of does. It's sort of poison pills, the creation of your own proprietary software, software using their open source. And this would be this AGPL license that basically says, if you use our open source software to develop your own software by including our software, your software now also has to be open source and be available.

The source code has to be available for anyone who requests it. That's a pretty big deal. If you're trying to develop something that is either proprietary and closed source or is like open core, where some aspects are open source, but some of the paid portions are not. And that's a very common business model. So by introducing this new license type, it's almost a poison pill for anybody who wants to develop under it. Because it's like, oh no, what impact does that have to me as the vendor who's trying to develop my software?

But does that have secondary impacts on the client who implements my software that may now also carry this license? So this also has a secondary effect, even if you're not building software to be packaged. io from a company culture perspective. io, CTO, CEO, he's the founder. io object storage is the most pervasive object storage software in the world. io behind the covers. And I've talked to AB on a podcast on Great Beards of Storage, and I'll see if I can find it and link it in the show notes.

io software they use in the enterprise. io gets the idea of how much of the open source free version is being used specifically in a customer's environment. io running in your environment, because the open source license says that if you're using it, you need to contribute back the projects in which you're using it for. And that becomes not just an interesting problem for vendors creating software, but for end users creating software too. And the alternative is, so they have the AGPL license that is meant for developers, but then they have their official licensing, which is like a company like Weka could pay for.

io. io software sitting right there. We know you're using our software and based off of this AGPL license, you have to either open source your content or you're in violation. And because we're angry or whatever, we are revoking your AGPL license. Of course, Weka came back and said, we're not using the version of your software that has that license associated with it because before you switched over to this new licensing regime, you hadn't been using the Apache 2 license. When we forked your software and are using the version that had the older license on it, you can't retroactively revoke our license based off a license change you made later in later versions of your code.

io, I think. io. I don't think I'm thinking, oh, you know, as a way to protect myself, let me engage these folks. No, no, they seem, I would either make one of two decisions. You know, if Weka is something that is integral to my business today, and I'm realizing true value from it, I'm going to stick it out and assume that the two of them are going to be grownups, put on their big boy pants and work it out. And I, as the customer, am going to be fine.

Or if it's not integral to my business, then I'm going to dump Weka because I don't want to deal with this headache of these two companies fighting. io loses. So I don't see how this is advantageous for them, unless this is just a shot across the bow because they see, like you said, we're gathering telemetry data from all these other projects that are also using our software. And we want to let all those other projects know unequivocally that we will be coming for you for our licensing dues, or you have to adhere to the AGPL license.

So maybe that's the grander scheme or strategy behind the post. And I think for, I agree with you in the short term, as a customer, I'm really not worried about this. This is, you know, noise and they need to go work this up behind. I don't think either company is large enough to sue one another or go after individual companies at this point. And this is, I think, where I want to wrap up the conversation, kind of as advice, because we're not just a news piece.

This is not legal advice. We're not lawyers. We're not open source licensing experts, as we mentioned. But we do know enough about enterprise software procurement to make some recommendations from a just hygiene perspective. Make sure you have a indemnification clause in your software agreements and your software licensing. io excludes open source software indemnification. io, or even customers, and they just have deep pockets, and part of the strategy is to extract Skoll-like type licensing fees, that's a risk. I don't know how realistic that risk is, but it's a risk you should consider.

And I think it's a rather simple modification in an agreement. Wicca is not that big of a company. They're not going to give up a huge sale off of, from indemnification. So make that simple hygiene step. Any recommendations you want to make, Nat? I just want to echo what you're saying. Neither of these companies are particularly huge. I looked it up. io is in Series B funding with about $126 million in funding. It's not a lot.

And Wicca is actually bigger in terms of funding. They're in Series D with about double the funding amount, more than double the funding amount. So we're not talking about real big fishes in the pond here. io has the legal pockets or depth of pockets to wage any kind of legal war. I think this is more noise than it is actual threat. More bark than bite. All right, Nat. So for those that want to follow your, I'm going to say pervasive content, because you create a lot of content and we didn't even talk about your work over at our friends, the Packet Pushers, your podcast with the Packet Pushers Network.

Let's pull up some stuff. Sure. I mean, the best place to find everything is just go to my website. com. Pretty easy to remember. And if you want to reach out directly to me, I'm still using Twitter. So you can find me. It's ned1313. I'm right there on Twitter. So you can ping me there and my DMs are open. I'd love to hear from you. All right, Nat. Stay tuned. Let's record a second podcast.

If you're listening to this, the week of March 26, which is a couple of days after we recorded the episode, a couple of weeks after that, we'll publish yet another episode talking about AI on AI workflows. com. I'm also still using the BERT site and I'm at ctoadvisor, DMs are open.