MongoDB Switches Up Its Open-Source License (techcrunch.com) 141
MongoDB is taking action against cloud giants who are taking its open-source code and offering a hosted commercial version of its database to their users without playing by the open-source rules. The company announced today that it has issued a new software license, the Server Side Public License (SSPL), "that will apply to all new releases of its MongoDB Community Server, as well as all patch fixes for prior versions," reports TechCrunch. From the report: For virtually all regular users who are currently using the community server, nothing changes because the changes to the license don't apply to them. Instead, this is about what MongoDB sees as the misuse of the AGPLv3 license. "MongoDB was previously licensed under the GNU AGPLv3, which meant companies who wanted to run MongoDB as a publicly available service had to open source their software or obtain a commercial license from MongoDB," the company explains. "However, MongoDB's popularity has led some organizations to test the boundaries of the GNU AGPLv3."
So while the SSPL isn't all that different from the GNU GPLv3, with all the usual freedoms to use, modify and redistribute the code (and virtually the same language), the SSPL explicitly states that anybody who wants to offer MongoDB as a service -- or really any other software that uses this license -- needs to either get a commercial license or open source the service to give back the community. "The market is increasingly consuming software as a service, creating an incredible opportunity to foster a new wave of great open source server-side software. Unfortunately, once an open source project becomes interesting, it is too easy for cloud vendors who have not developed the software to capture all of the value but contribute nothing back to the community," said Eliot Horowitz, the CTO and co-founder of MongoDB, in a statement. "We have greatly contributed to -- and benefited from -- open source and we are in a unique position to lead on an issue impacting many organizations. We hope this will help inspire more projects and protect open source innovation."
So while the SSPL isn't all that different from the GNU GPLv3, with all the usual freedoms to use, modify and redistribute the code (and virtually the same language), the SSPL explicitly states that anybody who wants to offer MongoDB as a service -- or really any other software that uses this license -- needs to either get a commercial license or open source the service to give back the community. "The market is increasingly consuming software as a service, creating an incredible opportunity to foster a new wave of great open source server-side software. Unfortunately, once an open source project becomes interesting, it is too easy for cloud vendors who have not developed the software to capture all of the value but contribute nothing back to the community," said Eliot Horowitz, the CTO and co-founder of MongoDB, in a statement. "We have greatly contributed to -- and benefited from -- open source and we are in a unique position to lead on an issue impacting many organizations. We hope this will help inspire more projects and protect open source innovation."
Differences vs. AGPLv3? (Score:1)
The summary almost goes into the differences between AGPLv3 and SSPL, but then decides to fill space with a meaningless quote instead.
What are the practical differences?
Re:Differences vs. AGPLv3? (Score:5, Informative)
The summary almost goes into the differences between AGPLv3 and SSPL, but then decides to fill space with a meaningless quote instead.
What are the practical differences?
IANAL, but the basic issue seems to be that a modified version of the OSS under AGPL would have to be provided, but nothing else needed to make your SaaS version of the original OSS product work would be.
AIUI, under SSPL if you now sell "MongoDB Instances" for people to connect to, and that you'll cover replication and backups for those MongoDB Instances them using some nifty new proprietary add-on you built, then you're going to need to open source that replication and backup code too.
I don't think this would cover some large SaaS provide that simply *uses* MongoDB on the backend, only one that's *selling* MongoDB instances as a service in and of itself.
Re:Differences vs. AGPLv3? (Score:5, Interesting)
AIUI, under SSPL if you now sell "MongoDB Instances" for people to connect to, and that you'll cover replication and backups for those MongoDB Instances them using some nifty new proprietary add-on you built, then you're going to need to open source that replication and backup code too.
I don't think this would cover some large SaaS provide that simply *uses* MongoDB on the backend, only one that's *selling* MongoDB instances as a service in and of itself.
unfortunately this subtle distinction makes SSPL a non-free license. debian for example will be forced to move mongodb and anything under this SSPL license into the "nonfree" distribution section, thus ensuring that it is excluded from use in all and any debian critical core-level services.
it's a particularly sad state of affairs - a reaction to unethical corporate spongeing - that a major prominent software team has to consider changing the license to a non-free one just to be able to pay their developers to keep working, whilst corporations all around them make hundreds of millions of dollars in profits, using their work??
it's a repeat of the exact same pattern of corporate exploitation that caused me to stop working on samba-tng and exchange 5.5 reverse-engineering, 18+ years ago.
haven't these pathological spongeing corporations learned yet from heartbleed, shellshock and the lessons of the gentoo developer that was $45k in debt and had to go work for microsoft, and the GPG developer that was $10k in debt??
Re: (Score:1)
unfortunately this subtle distinction makes SSPL a non-free license. debian for example will be forced to move mongodb and anything under this SSPL license into the "nonfree" distribution section, thus ensuring that it is excluded from use in all and any debian critical core-level services.
it's a particularly sad state of affairs - a reaction to unethical corporate spongeing - that a major prominent software team has to consider changing the license to a non-free one just to be able to pay their developers to keep working, whilst corporations all around them make hundreds of millions of dollars in profits, using their work??
If true (I'm not convinced it is), maybe Debian (and perhaps the Open Source community generally) should rethink their position on this a little in light of how the world actually works. Learning from reality has its good points.
Re: (Score:2)
it's a particularly sad state of affairs - a reaction to unethical corporate spongeing - that a major prominent software team has to consider changing the license to a non-free one just to be able to pay their developers to keep working, whilst corporations all around them make hundreds of millions of dollars in profits, using their work??
The AGPLv3 lets you use software for any purpose. Are you saying everyone should pay for Apache or Linux?
The new license forces IaaS providers to open source everything--Amazon would have to make AWS open source.
Basically, it's a matter of wanting to release it as free software but also have it be proprietary software and so not really free. This is like when Oracle released Java under GPL and then sued Google for not paying for Java.
Re: (Score:2)
it's a particularly sad state of affairs - a reaction to unethical corporate spongeing - that a major prominent software team has to consider changing the license to a non-free one just to be able to pay their developers to keep working, whilst corporations all around them make hundreds of millions of dollars in profits, using their work??
The AGPLv3 lets you use software for any purpose. Are you saying everyone should pay for Apache or Linux?
The new license forces IaaS providers to open source everything--Amazon would have to make AWS open source.
Basically, it's a matter of wanting to release it as free software but also have it be proprietary software and so not really free. This is like when Oracle released Java under GPL and then sued Google for not paying for Java.
Er, this is nothing like what Oracle has/is done. This is purely a strike against AWS and others who snatch open source systems, apply a veneer of closed source stuff and try and sell it as a service, usually while attempting to dissuade anyone from running it themselves and just "move to the cloud".
If one is an AWS, then one would be prohibited from snatching Mongo (or other covered things), renaming it and selling it as a service. If one is just using Mongo for whatever and not selling it as a direct serv
Re: (Score:2)
AWS supplies MySQL and something called "MongoDB". They didn't rename it "AWNoSQL" or something.
Google, meanwhile, built Android on Java, and converts Java bytecode to a different thing for their own VM. Java is an open-source, GPL product--Oracle actually brands OpenJDK as Oracle Java, compiles it, packages it, and ships it.
Amazon is providing the service of configuring and maintaining a MongoDB installation. Perhaps you should pay a license fee if a company hires you to install MongoDB on one of t
Here's who it applies to: cloud databases (Score:3)
Just prior to the part you quoted, it tells WHO it applies to.
It applies to people who use it to offer a cloud database service. It doesn't apply to those who offer a different service, which happens to use the database.
The new Section 13 of the SSPL reads as follows:
âoeIf you make the functionality of the Program or a modified version available to third parties as a service, you must make the Service Source Code available via network download to everyone at no charge, under the terms of this License.
Re: (Score:2)
I'm pretty sure that's unenforceable. You'd have to make the entire OS and all of its shit AGPLv3.
I guess it's time somebody fork MongoDB from its current AGPLv3 source.
That IS a problem - which leaves you with no licen (Score:3)
I see what you mean. That wording sucks.
Unfortunately, the full license says "you may use, modify, and distribute MongoDB without buying a license if you comply with the terms ..."
If you can't comply with the terms, you have no license to the software.
Imagine I say to you "you can have all the money in my bank account if you take me to the moon". That's a condition you can't meet. You can't to take me to the moon, so therefore you can't have all my money. Your inability to take me to the moon does NOT mean
Re: (Score:2)
There have been times when parts of licenses and other contracts have been invalidated.
Re: (Score:2)
it means it's webScale.
http://lmgtfy.com/?q=mongodb+i... [lmgtfy.com]
Re: (Score:2)
It means it doesn't use joins.
It can also use /dev/null for storage, which is extremely fast plus you never run out of space.
Re: (Score:3, Interesting)
Re: (Score:1)
MongoDB is web scale!
Re: (Score:2)
Postgres + the key/value extension (or even just a simple key/value table) suffices for most MongoDB use-cases. In a lot of use-cases you already have a Postgres kicking about anyway, so throwing some key/values on it makes far more sense than using a separate DB for it. In really small setups (like UniFi), Redis would probably suffice, although that's less of a like-for-like sort of swap.
I'd imagine if you're looking at TB of key/value data then MongoDB might have an advantage. Otherwise, you (probably) do
I read section 13 (Score:4, Insightful)
That is a broad category that includes a *shitload* of software that has nothing to do with the source code of Mongo DB.
The lawyer who devised that nonsense clearly has some pals in the field who are looking forward to big lengthy but more importantly expensive legal discussions on the subject.
If I write some robotics software to rotate backup tapes for my MongoDB centric service, that'd be part of the 'backup software' and 'storage software' according to that definition, but it's hardly a very clear direct derived work, so how can the license I receive to use MongoDB apply to it?
Re:I read section 13 (Score:5, Insightful)
Very much so, this could easily be read as 'anything that provides a service to a user, and accesses mongodb as a backend'
ie: 'software that uses mongodb'
Which pretty much means 'run far far away unless you want your WHOLE system to be OSS'
Perhaps thats their intention, however I doubt they have thought it through much..
Re:I read section 13 (Score:5, Interesting)
I think it actually is the intention. They think they're at a point where they're embedded in enough places that they can change the license to make it impractical to use their product without paying for a proprietary license. Of course they still want to pay lip service to being open source, and get the benefits of the community fixing their bugs. We'll now get to see whether MongoDB the company is truly providing value. If they aren't, a community fork under the old license (can't retroactively cancel AGPL on existing versions) will eat their lunch.
Re: (Score:2)
We can do better than a fork.
We can turn the MongoDB query language into a spec, and then release mongolite as MIT-licensed.
Re: (Score:2)
You could run far away, open source your system or buy a commercial licence. I think they are hoping you do the latter.
Re: (Score:2)
Only for those selling MongoDB services, not those just using it. Not sure if you were clear on that or not.
Re: (Score:2)
Very much so, this could easily be read as 'anything that provides a service to a user, and accesses mongodb as a backend'
ie: 'software that uses mongodb'
Which pretty much means 'run far far away unless you want your WHOLE system to be OSS'
Perhaps thats their intention, however I doubt they have thought it through much..
I think you guys are grossly misreading this. While the wording of that section may need some work, none of it is triggered unless you're offering Mongo as a direct service. None of it is triggered if Mongo is used as a backend. None of it is triggered if you're just using Mongo to provide some other service, but not Mongo itself. Even if it is triggered, it's pretty clear their intention is to by pass someone saying "Well, I'm selling MongoDB as "SuperMega Cloud WebScale Service. But, this pesky license re
Re: (Score:2)
unfortunately that may be what you THINK they mean by it, however it is not reflected in how they word the terms.
And that is really what matters.
these terms will have been written by lawyers, and any wiggle room (for them_) left in there will be intentional.
Lawyers work pretty damn hard to be specific where they want to be, and if they leave things vague, it is almost certainly because they want room there.
I suspect the most likely outcome of this would just be for AWS or similar to fork the whole project,
Re: (Score:2)
Fork of MongoDB that retains the AGPL v3 license coming in 3... 2... 1...
Threatening letter from someone who's contribution to MongoDB under the AGPLv3 is being impermissibly relicensed in clear violation of AGPL v3 section 10 ("You may not impose any further restrictions on the exercise of the rights granted or affirmed under this Lic
Re: (Score:2)
But if MongoDB is forked, those new commits to the forked version are under AGPLv3 and there wont be any copyright assignment.
Re:I read section 13 (Score:4, Insightful)
If I write some robotics software to rotate backup tapes for my MongoDB centric service, that'd be part of the 'backup software' and 'storage software' according to that definition, but it's hardly a very clear direct derived work, so how can the license I receive to use MongoDB apply to it?
It's an EULA like the AGPL, it does not depend on the definition of derived work like the GPL/LGPL does:
This License explicitly affirms your unlimited permission to run the unmodified Program, subject to section 13.
I can make a license that says you can only use my software wearing a pink bunny suit. It doesn't mean the code has anything to do with the suit, it's just the terms of the license. In any case, the license seems mostly intended to ban SaaS without a commercial license without actually banning it. Because I would think 99.9% of all services have some form of closed source component in their stack at some level, not even RMS has gone this far.
Thanks (Score:1)
This sounds like massive overreach. As in, you run an as-a-service shop, and suddenly you have to either open source every bit of code in the entire building, or pay mongodb for a commercial licence. That means any shop offering hosting-anything with mongodb anywhere in the picture will have to pay up, driving up costs.
Oh and it might cause interesting conflicts with other licences. Open source things you don't even have the source for? IOW, run any non-open s/w in the building anywhere at all and you no lo
Re: (Score:2)
You don't have to do anything, unless you update your MongoDB, the old AGPL license is still valid, you just need to write your own security fixes etc.
Is your service something more than MongoDB? (Score:2)
If your service is nothing more than just MongoDB, with backups provided, than yes you have to either comply by releasing your backup script, or buy a MongoDB license.
If your service is something other than just a cloud database, and specifically if it doesn't allow users direct access to the database, it's not intended to apply to you.
The wording could certainly be better.
It's not intended to be clear... (Score:2)
This is nothing to do with open source values or promotion of open source software. This is about monetizing software. They want to have all the benefits of open source software, including a community of free contributors, and to monetize their work. This is very similar to MySQL when they changed the license of the client libraries
Not trolling: who uses hosted MongoDB? (Score:1)
I'm scared to use MongoDB because people I trust have told me it's just incompetent at being a database. "It's total clown town" was what one person told me. Then there's this:
http://cryto.net/~joepie91/blog/2015/07/19/why-you-should-never-ever-ever-use-mongodb/ [cryto.net]
So I could maybe see using it as a very fast NoSQL database hosted locally for free, for something like an internal discussion board or something where some data loss is survivable. But this article is about people who are paying money to use host
Re: (Score:1)
This is what I have used MongoDB for in a past project (not my choice). A relatively fast local document cache with disk storage. In case of problems (which happened frequently) the data was regenerated.
Re: (Score:2)
Either MongoDB is better than I have heard, or else these people are stupid or at least deceived.
Which happens a lot, because 99% of the people buying and using software have no idea how it works, and are often deceived into thinking the software they're using isn't as shit as it really is. Microsoft are the perfect example of this.
Surprised they didn't do the usual (Score:2)
Just make the software impossible to use without hiring their consultants.
NPC Triggered ? (Score:2)
printf(" %s, %s", name, screed);
Re: Crashmarik needs to STOP IMPERSONATING ME... a (Score:1)
Something something host file
Violation of AGPL copyright? (Score:3, Interesting)
The SSPL to AGPL comparison [mongodb.com] makes it crystal clear that this new SSPL is a slightly modified AGPL, with the FSF copyright notice and preamble removed and a MongoDB copyright notice added in its place, with not much more than one section rewritten. Did the FSF give permission for this, and if not, by what logic would this be allowed?
Re: Violation of AGPL copyright? (Score:1)
Its a different document because they changed the name.
Re: (Score:3)
Because what they're distributing isn't the AGPL. That clause is there to prevent someone from modifying the terms of the AGPL but still presenting it as the AGPL, deceiving recipients about the terms they can expect.
Re: (Score:2)
Re: (Score:2)
There is nothing in 17 USC 102(b) that denies copyrights to "legal language" versus comparable "literary language."
Also, one of the more noted treatises and authorities on copyright law disagrees with you.
1-2 Nimmer on Copyright  2.18[E]: âoeThere appear to be no valid grounds why legal forms such as contracts, insurance policies, pleadings and other legal documents should not be protected under the law of copyright.â
Re: (Score:2)
Re: (Score:2)
Moving the goalposts, are we?
Code Revision Commission v. Public.Resource.Org ought to do it. If you can copyright the official law of a state, you can surely copyright a bespoke contract or license.
Re: (Score:2)
Depends on whether a court considers the AGPL text to be creative or purely utilitarian. Only creative works qualify for copyright protection.
Re:Violation of AGPL copyright? (Score:4, Interesting)
Re: (Score:2)
Ah yes, I had not seen that. From the faq, where is says "you can legally use..." it's not clear whether this is because the FSF don't mind, or because there is no legal ways of preventing it. Still, it seems strange to put a sign on the top of the GPL saying "modifications are not allowed" and then let it be allowed.
Prohibition conflicts with section 9 (Score:2)
The prohibition on providing the software as a service appears to conflict with, or at least be trivially bypassed by, section 9 which states that to run the software you don't have to accept the terms of the license. Section 9 conforms with the law as written: running the software, and making the copies needed to run it, are explicitly not an infringement of copyright (USC Title 17 section 117(a)(1) [cornell.edu]). If I don't have to accept the license to do something, I'm not bound by it's terms merely because I do tha
Re: (Score:2)
Re: (Score:2)
If you're providing a hosted instance of the software then you only need to use an unmodified version...
Re: (Score:3)
Re: (Score:2)
If I don't distribute the modified version, do I need to accept a license to get the right to use it? My understanding is that the FSF's position is that, for all the *GPL family of licenses, you don't need to accept the license just to run the software because you aren't distributing copies to anyone else and all the internal copies needed to run it are covered by the permissions copyright law gives you. I recall this same issue of trying to prohibit certain uses of *GPL'd software by it's recipient coming
Re: (Score:2)
How are they not breaching the FSF Copyright. (Score:2)
I am deeply confused. The first line of their comparision with AGPL shows that they have just taken the FSFs copyright of the license and claimed it as their own.
After that the license says "Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed", followed by a pile of text showing all the changes that Mongo have made.
Surely, Mongo is in violation of the the FSF copyright? You can't take someone else's work and use it as you want without their a
Re: (Score:1)
Can they even legally relicense the project like this under the terms set forth in the AGPL?
If you own the copyright, you can license it as many times as you want, as many ways as you want.
Re: (Score:1)
Sure, if they own the copyright. It's my understanding that the copyright for a contribution belongs to a contributor, however, and surely many, many people have contributed to the project.
Re: (Score:2)
I don't doubt that, as Bruce Perens here suggests, there are some problems with the new license language (hey, corporate lawyers wrote it), but I think you take is pretty close to the money.
Freedom argument (Score:2)
This is in response to an AC comment with an obnoxious thread title, so I am starting a new one. But it made the claim that these sort of moves are "bastardizing the word freedom". Here's my response
Freedom means different things to different people, that's why there are different licenses. From the earliest days of the open source movement there have been arguments as to what "free" should mean. The BSD/GNU approaches are an example of that early division. Licenses are designed to reflect the intentions of
open-source rules (Score:2)
What about dependencies? (Score:1)
There is a lot of talk about the meaning of a switch from AGPL to SSPL from the consumer side.
Or: How does it affect me if I use the new version?
My question is: What about dependencies?
It's perfectly legal to re-license source that you own the copyright; that's literally the exclusive right you have as the copyright holder.
However, it DOES NOT mean that you can keep using dependencies (written and owned by others) that might be GPLv2, GPLv3, or AGPLv3 licensed.
The GPL licenses are pretty clear: If you incor
"SAAS" Hype (Score:3)
Is it just me, or is SAAS hype? It appears that the big vendors want SAAS to succeed because they want to nickel and dime you for everything you do.
It would be like "Fee-Based Legos": you can snap together components easily to get an application/system up and going relatively quick, but you pay rent for each Lego block you use. The big IT co's would love this because you'd get hooked on most of the components such that you have to pay if you want to keep your software up without reworking much of it. And they'll probably jack up prices for older versions, meaning you gradually either pay more, or spend time constantly reworking your software for the newer versions.
The big IT co's appear to have found this more profitable than the pay-once approach because they push it with existing products. For example, Adobe stopped selling one-time-pay versions of their graphics suite (except maybe for students). If you want their graphics suite, you have to pay for a subscription.
Another annoyance of SAAS is that you have to often convert back and forth between JSON or XML and your shop's language. It's a lot of interface busy-work. If you make a programming-language-neutral service, then you are pretty much stuck building and managing such conversions. In some cases it can be made somewhat automated using reflection and other tricks, but such often has annoyances and glitches.
Re: (Score:1)
I'm mostly talking about dividing custom software into rented components by domain functionality, not just databases, file server, email, OS, etc. For example, renting a Bootstrap-like rendering engine or a parsing API.
However, I will agree that "SAAS" is rather vague in that just about any I/O could be called "SAAS".
Adobe example [Re:"SAAS" Hype] (Score:1)
Few purchased a new version every year. The usual pattern was buying the desktop version for X dollars, and then upgrading every 2 or 3 years via the upgrade price, which was typically about 1/2 to 1/3 of X.
But anyhow, the choice of single-purchase is now gone.
So far Adobe has no significant graphic design suite competitors. If
Re: (Score:1)
As mentioned elsewhere SAAS is perhaps too open-ended a concept/definition to make generalizations. As far as "web based" applications instead of desktop or client-stored applications, we do seem to be trending that way, although a hybrid "cached application" approach may be the future.
But with customized systems, shops often find that if the parts of the system's stack
Might not qualify as an Open Source license (Score:2)
The issue of the license text being infringing of FSF's copyright needs to be addressed. I doubt FSF is going to give permission for this use of their text. There is a possible 17 USC 102(b) argument, but most sources (Nimmer, Adams) disagree, and I don't know of any case law. This might require a full rewrite, and IMO OSI would face a risk of being a contributory infringer simply by hosting a copy of the current text on their site. The legal ambiguity of that might be sufficient reason for rejection.
I am m
Re: (Score:2)
If lawyers were never wrong, we'd have no need for courts. Which means they're wrong half the time, or at least the adopt unsupportable arguments half of the time.
Case law has overridden him on the GPL question, thanks in part to my pro-bono testimony. But courts and lawyers still take him seriously. And me, sometimes.
Re: (Score:2)
Oh Thank God (Score:2)
GPL is free software, not open source (Score:2)
There are critical legal differences between "free software" in the sense of the GPL, "free as in speech" licenses, and "open source". It's unfortunate that whoever the original article cited failed to make the distinction, because it's a powerful one.
Re: (Score:2)
A profitable move. (Score:1)
They just bought MLab. This may be aimed at competition to force them to buy licenses.
A couple of things (Score:2)
1. Doesn't the GPL have a stipulation, that if the text of the licenses is amended or modified, that you need to refer back to the original license?
2. I see why they're getting picky about it, but do these guys really have anything to offer? Okay, you get the source code for a service. What's useful there? Are these guys actually doing anything to change or improve the product? Something more than a graphics treatment? Do we know that? I'm skeptical.
Re: (Score:2)
Why do I have a feeling that contributors would be holding their breath for a long time over that one?