[HN Gopher] WEKA Responds to Allegations Made by MinIO Regarding...
___________________________________________________________________
WEKA Responds to Allegations Made by MinIO Regarding OSS Licensing
Author : dagmx
Score : 86 points
Date : 2023-03-27 15:57 UTC (7 hours ago)
(HTM) web link (www.weka.io)
(TXT) w3m dump (www.weka.io)
| Takennickname wrote:
| I just want to know if MinIO contact Weka before this fall out or
| not. If not, then MinIO comes off as a bunch of psychos. If so,
| then grab your popcorn.
| chatmasta wrote:
| According to the article, they did not:
|
| > At the end of the business day on Friday, March 24th -
| without warning, provocation, or even providing WEKA with an
| opportunity to review and respond to their claims - MinIO
| issued a public statement that made several false and baseless
| accusations against WEKA. It was the first time MinIO had made
| us aware of their concerns.
| remram wrote:
| It seems they might be psychos, they are misrepresenting what
| AGPL allows all over their issue tracker, for example this:
| https://github.com/minio/minio/issues/12829#issuecomment-889...
|
| > Also NOTE: I need to remind you are under AGPLv3 violation
| here if you are using MinIO with proprietary purposes. Please
| consult a software lawyer for more information.
|
| Or this:
| https://github.com/minio/minio/issues/13308#issuecomment-929...
|
| > Also, just want to mention that the AGPL license requires
| that all software connecting with MinIO be 100% open source for
| you/your users not to be in violation of the license.
|
| All that AGPL actually requires is that you share the source of
| your server, if you modify it.
| favsq wrote:
| [flagged]
| donmcronald wrote:
| > Also, just want to mention that the AGPL license requires
| that all software connecting with MinIO be 100% open source
| for you/your users not to be in violation of the license.
|
| So they would consider my Arq backups to MinIO a license
| violation? What if I access the GUI from a Windows PC? What
| about a Linux PC with a proprietary GPU driver?
| meepmorp wrote:
| Interesting - is this a name collision with Weka
| (https://www.cs.waikato.ac.nz/ml/weka/) or a commercialization of
| the project? I assume the former.
| sudosysgen wrote:
| It is a name collision.
| lapinot wrote:
| So they are using an outdated version because they wanted to stay
| with permissive licensing.. Kinda fun to see the reverse of what
| usually happens to a community when a company-led project goes
| closed source. Definitely got no empathy for weka in this case
| tho. Also kinda fun that minio noticed they used an old version
| but forgot that they used permissive licensing at that time.
| sokoloff wrote:
| My experience is that it's often hard for companies (and
| people) to remember facts that are inconvenient for them.
|
| If WEKA is using Apache-licensed software in compliance with
| the Apache license (as they claim) and is being accused of
| doing something else by a company with, let's just say, non-
| mainstream interpretations of license terms, I do have empathy
| and sympathy for them. (They claim that's what's happening.
| MinIO claims something else. Several of these claims are pretty
| much testable facts and I'm sure someone with time and
| motivation will test them.)
| tobias3 wrote:
| MinIO had a large investment round at unicorn valuation at the
| end of last year. Watch them desparately move up market (or more
| like flailing around) to recoup that investment.
|
| Meanwhile they cannot get their software to work on ext4 and it
| is apparently ext4s fault[0].
|
| [0]
| https://github.com/minio/minio/issues/16602#issuecomment-142...
| kapitanjakc wrote:
| From my perspective, only lawyers will get the benefits.
|
| Neither Weka nor MinIO and definitely not the community.
|
| The way MinIO accusation was worded, felt like this a reaction to
| someone saying "Boss, they've ripped us off and are earning from
| it and not attributing us, here's the proof, revoke their
| licence."
|
| And the way this response is worded, feels like, "Check
| everything if we're using their stuff, get a lawyer to draft a
| response, and tell them, this is not the way to handle it."
|
| I hope both parties resolves it soon.
| [deleted]
| candiddevmike wrote:
| There needs to be a phrase like "play open source games, win open
| source prizes" for companies that get all upset when someone else
| monetizes their product.
| jzb wrote:
| I think it depends a lot on whether they're upset because they
| failed to license the software in a way that would prevent
| behavior they don't like, or because someone doesn't seem to be
| complying with the license in the first place.
|
| If you chose a permissive license and then are shocked when
| people actually take advantage of that, you kind of deserve
| what you get. If you chose a reciprocal license and someone
| just ignores it, then I think you still have a license to
| complain. Pun kind of intended.
| candiddevmike wrote:
| I personally don't care for any open source sob stories by
| companies that use open source as a growth strategy. When you
| open source something, you will need pay the legal costs to
| enforce your license, the license doesn't enforce itself. It
| will most likely be a long drawn out process and will be a
| drain on your resources, especially technical ones. Don't
| complain when this happens, nobody forced you to open source
| your stuff to begin with.
| kadoban wrote:
| Is anyone complaining? Seems like they're just doing what
| you suggest, enforcing the license.
|
| (ignoring that they may be wrong about the breaches of the
| license, I'm sure the lawyers will work that out)
| jzb wrote:
| This is a curious attitude. No, the license doesn't enforce
| itself. But usually when someone violates copyright
| companies tend to complain about it. Often that complaint
| is accompanied by a lawsuit, but I've heard a lot of
| complaints out of the entertainment industry the past 20
| some years about copyright infringement, and I haven't
| heard anybody talking about not complaining because they
| released things and should just assume somebody is going to
| infringe.
|
| Nobody forces me to choose an open source license. Nobody
| forces me to use code that is open sourced either. So it's
| a curious attitude to take issue with a company that
| providing software under an open source license as a bad
| guy for complaining when people don't follow their license
| but not the entity that is violating the license that gives
| them the right to use software in the first place.
| endigma wrote:
| I recall minio previously playing fast and loose with the terms
| of their prized infectious foss license, a github issue perhaps?
| I recall they believed that interfacing with their AGPL minio
| through a standard s3 interface with no source changes mandated
| open sourcing of the client application.
| xet7 wrote:
| Maybe these?
|
| https://github.com/minio/minio/discussions/12895
|
| https://min.io/compliance
|
| Trying to read and understand.
| dilyevsky wrote:
| Basically they claim that even calling it from proprietary
| stack over s3 api triggers apgl obligations which most
| lawyers don't believe is true but never been tested in court
| afaik. I wouldn't recommend touching it for anything unless
| you want to play those games (or unless you want to pay for
| enterprise ofc =)) It's fake open source.
| lyu07282 wrote:
| They have a unique interpretation of AGPL, they also seem to
| think they can retroactively change the license from Apache 2
| to AGPL on their old code. So even if WEKA forked the older
| version of MinIO when it still was Apache they would still
| violate the license. Which means anyone using MinIO without a
| commercial license needs to open source their entire
| application _regardless if MinIO itself was modified or not_.
| Well according to MinIO anyway.
|
| This eventually surely lead to a lawsuit where this is tested,
| but in the meantime I would avoid MinIO at all cost. The
| commercial license to self host it is minimum $1000 per month
| for 100TB.
|
| > If you distribute, host or create derivative works of the
| MinIO software over the network, the GNU AGPL v3 license
| requires that you also distribute the complete, corresponding
| source code of the combined work under the same GNU AGPL v3
| license. This requirement applies whether or not you modified
| MinIO.
|
| https://min.io/pricing
| asveikau wrote:
| That sounds dangerous to free software/open source as a
| whole. Firstly, it's obviously not the status quo of how most
| people operate. Secondly, if they manage to win that claim in
| court it could encourage others to do the same.
| dilyevsky wrote:
| Yup
|
| https://github.com/minio/minio/discussions/13571#discussionc...
|
| https://github.com/minio/minio/issues/13308#issuecomment-929...
| nikeee wrote:
| Didn't know that MinIO used to be Apache licensed. This [0] is
| the commit that changed it.
|
| Since the S3 API largely remained the same over the last two
| years, it might be an option to use the Apache version, if AGPL
| is not possible. Of course, that would lack security fixes that
| were done in the meantime.
|
| There is also a discussion [1] about that license change.
|
| [0]:
| https://github.com/minio/minio/commit/069432566fcfac1f105367...
|
| [1]: https://github.com/minio/minio/issues/12143
| phoronixrly wrote:
| I hope more people start using AGPL from the get-go for their
| projects.
| wmf wrote:
| Companies are using AGPL not to benefit users or the
| community but to extort users and competitors into paying
| them. It's becoming fake open source.
| phoronixrly wrote:
| Links please, also it's literally FSF and OSI approved, how
| come you call it fake open source?
| dilyevsky wrote:
| https://github.com/minio/minio/discussions/13571#discussi
| onc...
|
| https://github.com/minio/minio/issues/13308#issuecomment-
| 929...
|
| Lets just say they have a weird take on what constitutes
| agpl-compliant
| jenadine wrote:
| > the AGPL license requires that all software connecting
| with MinIO be 100% open source for you/your users
|
| Indeed, I don't think that's correct. That depends on the
| definition of "connecting" but I was under the impression
| that if you use MinIO on a server, the services that
| connects to MinIO don't need to be open-source. Only the
| server component that include MinIO need to be, and only
| if end users are connecting to that component. But
| correct me if I'm wrong.
| dilyevsky wrote:
| According to commonly understood agpl interpretation
| you're correct but not as minio understands it:
|
| > Combining MinIO software as part of a larger software
| stack triggers your GNU AGPL v3 obligations.
|
| > The method of combining does not matter. When MinIO is
| linked to a larger software stack in any form, including
| statically, dynamically, pipes, or containerized and
| invoked remotely, the AGPL v3 applies to your use. What
| triggers the AGPL v3 obligations is the exchanging data
| between the larger stack and MinIO.
|
| https://min.io/compliance
| phoronixrly wrote:
| Seems like people misunderstanding the AGPL. (btw, I
| don't think this makes it fake open-source!)
| jenadine wrote:
| They're not extorting anyone. Or is anyone having paid
| product "extorting" their customer?
|
| AGPL is true open source.
| tensor wrote:
| If you are in the business of making money like minio, you
| may as well just use a commercial license. No business will
| touch AGPL, they will just opt to pay for a commercial
| license.
| [deleted]
| phoronixrly wrote:
| In fact, I am starting to ask myself the opposite... 'Since
| project X is MIT-licensed, do they need my contribution at
| all? Probably not, their license probably brings them many
| high-quality corporate contributions.'
| akvadrako wrote:
| That's kinda why the AGPL is good; it lets non-businesses
| and open-source companies use it and encourages closed
| companies to purchase a license.
| jenadine wrote:
| > No business will touch AGPL
|
| That's not true, I am in contact with many business using
| AGPL software. (Not Minio specifically)
|
| Some businesses choose not to touch it, but that's their
| losses.
| sokoloff wrote:
| Having read the minIO allegations last week, I was fully
| expecting to read some weasel-y/half refutation here.
|
| Instead, this is a strong refutation and, if everything WEKA says
| here is true, it is much less certain that they've done anything
| wrong and it seems like it's on minIO to prove that they've used
| minIO software subject to AGPL rather than only to Apache.
|
| Previous HN discussion:
| https://news.ycombinator.com/item?id=35299665
| jzb wrote:
| If you read the minio blog, they give very detailed
| instructions on how to check that they are using the software.
| It shouldn't be super difficult to figure out if any of the
| software being distributed today is post license switch.
|
| So what we have here is a very detailed description of what
| they are claiming is a violation, then a refutation that is
| very strong, but also doesn't actually address some of the
| claims in the other blog, as far as I can tell.
|
| There is a blog from minio that says they switched to AGPLv3 in
| 2021. It's unclear to me from the screenshots whether the
| software is later than that or not.
|
| I hope someone takes the time to do an independent analysis,
| and a more neutral take.
|
| Note that Weka redacted the language from the Apache license
| that says "subject to the terms and conditions," which (not a
| lawyer) seems to allow a copyright holder to deny permission if
| they're not meeting the conditions of the license. Whether they
| are or not is another question.
| arp242 wrote:
| > they give very detailed instructions on how to check that
| they are using the software
|
| It's not that detailed; it just says "there is a minio
| binary, and that's our minio". Okay, but what version is
| that? This is the crucial part, because Apache vs AGPL
| license makes a world of difference.
|
| The Apache attribution requirement seems satisfied; perhaps
| not as prominently as minio would like, but there is no
| "prominence requirement". It fails to demonstrate any AGPL
| code is used, although according to some other comments the
| monio people have a unique and interesting interpretation of
| relicensing where they think they can retroactively relicense
| Apache code to AGPL. The claim that backporting _any_
| security fixes would trigger the AGPL is also suspect;
| typically many security fixes are simple in terms of code
| changed, and tend to be fairly easy to re-implement
| independently once you know the description of the problem.
| Either way, "it's likely that [..]" doesn't really
| demonstrate much of anything and is certainly not "very
| detailed".
|
| In short, the minio post is vague and full of assumptions;
| even without this rebuttal I wouldn't put too much stock in
| it as it seems borderline FUD.
| xoa wrote:
| Not a lawyer and this is an area where I genuinely just don't
| know, so I'd love to find a place that's explored this and
| could read more. But WEKA's statement #2 about the
| irrevocability struck me as odd in its expansiveness. My
| understand was that "irrevocable" essentially is about
| arbitrariness and time, that so long as the licensee follows
| the governing license as written then it continues indefinitely
| and the licensor may not ever simply decide to revoke it. But
| if the license terms were broken, then could the copyright
| holder then say the contract was broken? I didn't think
| "irrevocable" meant "every other aspect of this contract
| doesn't matter beyond damages because even if you blow off them
| all it can't be revoked anyway". Like if I signed a copyright
| license saying "in exchange for $50/year paid on Jan 1 each
| year for a period of 10 years I grant a perpetual, worldwide,
| non-exclusive, irrevocable copyright license to said work" and
| then they just stop paying after the first year does that mean
| the license is still irrevocable, but I can sue them for
| damages? Or is the contract done due to non-performance? Or
| would that depend on other clauses? What if the value exchange
| is more of a quid pro quo thing, does that became a rare
| instance where suit for specific performance would be an
| option, or would the court translate it to money?
|
| Just really curious, I've seen that term language lots and
| never really gave it much thought until now. Surely this must
| have been fought over before. But I'd have expected a lawyer
| drafted response by WEKA to cite case law and any governing
| state/national law. Just saying "see the contract says
| irrevocable so that's that duh!" feels kinda odd.
|
| --
|
| _Edit_ : Also to be clear, this is all purely dependent on any
| license terms actually having been broken. If none were then
| yes that'd be that. It just seemed like WEKA was making an
| argument that MinIO couldn't revoke no matter what.
| roundandround wrote:
| I would interpret the Apache Licenses terms on breaking the
| license to apply to patents and there it is pretty clear that
| the party who starts litigation loses their own license. I
| don't think any open source license writer would
| intentionally want the situation where a middle-man causes a
| license to never be valid, and in this case it makes no sense
| as attribution is meant to be optional information.
| hiddendoom45 wrote:
| It does appear that their minio instance is the apache version.
| From the minio allegations the ui in the screenshots matches the
| pre-AGPL instance that I've kept around which was really just a
| simple bucket/files manager. I think all post-AGPL versions
| should be using the new ui announced here[1] in April 2021. The
| AGPL change was announced 12 May 2021[2]. The newer date in the
| out of date message could be due to them re-compiling the Apache
| version themselves.
|
| However looking at the warp version in the screenshot, version
| 3.40 is licensed under AGPL.
|
| [1] https://blog.min.io/new-minio-console/
|
| [2] https://blog.min.io/from-open-source-to-free-and-open-
| source...
| 1980phipsi wrote:
| Yeah, I noticed that about warp too.
| lyu07282 wrote:
| Relevant:
|
| https://news.ycombinator.com/item?id=35329882
| [deleted]
___________________________________________________________________
(page generated 2023-03-27 23:02 UTC)