Terraform-AWS-modules/Terraform-AWS-eks transitions to non-free license

https://github.com/terraform-aws-modules/terraform-aws-eks/pull/1937

by pricechild • 4 years ago

80 121 4 years ago

tyropita• 4 years ago

Have you found more open-source projects that follow a similar approach to spreading information about the Ukraine-Russia conflict?

Would be nice to compile a list of them!

toyg• 4 years ago

Lists tend to attract the "proscription" prefix, when in a political context.

Also, if you support the stance, you arguably don't want to make it easy for Russian/Belarusian users to avoid software, you want to maximize their inconvenience - which you do when they invest time into learning something and then find out they are technically not allowed to use it in production.

This said, it's all theatre anyway - I would bet good money that most Russian businesses already didn't care about respecting FOSS licenses, considering the infamously lax attitude about copyright enforcement in that country (and in China and Iran). So adding that sort of clause will stop absolutely no one, in practice, and I bet the authors will never even try to sue anyone in Russia (or anywhere else with some sort of jurisdiction over Russia, like the WTO) for infringing it.

marcinzm2• 4 years ago

edited: I see the addition now.

detaro3• 4 years ago

How is adding "Additional terms of use" not a license change? That's not just a "statement of support".

c0l0• 4 years ago

IANAL, but afaik, copyright licenses can only ever affect (re)distribution - not use.

malka2• 4 years ago

since it only affects use, not redistribution, am I allowed to redistribute this, without the additions to the apache licence ?

antonbabenko15• 4 years ago

I have updated the wording in README - https://github.com/terraform-aws-modules/terraform-aws-eks#a... . The project was and will be under the same Apache 2 license. You can continue using it as nothing is happening in Ukraine. I will never stop you or anyone else.

josephcsible2• 4 years ago

The "Additional terms of use" section makes it non-free. Compare it to the Commons Clause.

antonbabenko15• 4 years ago

I have updated the wording in README - https://github.com/terraform-aws-modules/terraform-aws-eks#a... . The project was and will be under the same Apache 2 license.

reacharavindh2• 4 years ago

As much as I hate what Russia is doing, I’d hate even more for software to come under political purviews.

If an author of a library chooses to apply political condition(however justified they may be), then the software is simply not free by definition.

I’m neither Russian nor Ukrainian. I cannot turn a blind eye simply because it doesn’t apply to me. What if another library that I use apply a license that says “those that look like this cannot use my software from now on”?

black_puppydog2• 4 years ago

I’d hate even more for software to come under political purviews.

Really? Making software free is just about as political as it gets. Restricting that freedom, as happens here, is equally political. I guess you just don't this special kind of politics in your software.

joshmanders3• 4 years ago

Right? Like the whole open source movement was a massive political thing... Open source by definition is political.

throw_m239339• 4 years ago

The reasonable answer is also a political fork.

The author is entitled to use whatever license they want, and the community is entitled to a fork if it doesn't violate the previous license. That's all there is to it. the author doesn't owe the community anything, and the community, as long as they respect the terms of the previous license, is free to fork the project and get rid of the new license.

In general, these political stunts eventually reflect badly on their author. Open source is a double edged sword.

jacobr14• 4 years ago

Although one thing the author does owe the community is clarity in the license. The PR in question changed the named of the license from "Apache 2.0" to "Modified Apache." If you change the terms of a well known license, like Apache or MIT or whatever, for whatever reason, you should not mislead others into thinking it is an unmodified licensed.

jen204• 4 years ago

I’d hate even more for software to come under political purviews.

You would hate a statement being added to README file EVEN MORE than civilians being shelled indiscriminately, entire families shot while waiting in bread lines, and the targeting of war correspondents by a foreign army?

Got it.

reacharavindh2• 4 years ago

That’s a twisted interpretation of what I wrote. One can be disgusted to a high extent, and then from that baseline even more disgusted by some _added_ on top of it. Just because a despicable thing is happening, one must not justify viewing the whole world through that lens _alone_ and refuse to reason things in other contexts.

clearcoat• 4 years ago

I’d hate even more for software to come under political purviews.

Yes, but has not that ship sailed already?

I go to great efforts to keep my "feed" purely technically focused, but in the past ~2 years this has become basically impossible.

crmd3• 4 years ago

I’m ethically torn here.

On one hand, I ask myself what I would have done if I worked at IBM in the 1930s[0]

On the other hand, as an LGBT person, I firmly believe that maximal freedom of speech protects vulnerable people from erasure.

What this means for free software is a tough question.

[0]https://en.wikipedia.org/wiki/IBM_and_World_War_II

sonjaqql• 4 years ago

As an LGBT person, I fear that efforts like these are noble but empty. Assholes gonna still be assholes, Russia is gonna pirate software [0], and global Terraform users won't notice.

Could this act actually awaken an IT team to the atrocities, in a way that makes a difference?

[0] https://writing.kemitchell.com/2022/03/05/Russia-to-Legalize...

gzer0• 4 years ago

"maximal freedom of speech protects vulnerable people from erasure"

It's very easy to say things like this without fully comprehending all of the implications. Here's an example: Google restricted the usage of its own product, Google Maps, in an effort to halt the killing of Ukrainians by Russian armed forces, who were using Google Maps to launch their operations. This directly contradicts your claim.

GreenWatermelon• 4 years ago

Here, google didn't approache freedom of speech. They merely restricted the services of their product in a particular area

jacobr14• 4 years ago

I don't think there is a tradeoff. Not all actions constitute speech. Supporters of Russian actions should be able to spout off their horrible thoughts, but that doesn't mean companies the need to sell their goods or services to Russia. The two categories of acts aren't the same.

crmd3• 4 years ago

Agree no one should be compelled to sell software to Russia, but the topic at hand is the dangers of normalizing national restrictions in open source licensing. Would you be comfortable with an open source license that bans Jewish users because of the Palestinian conflict?

igetspam2• 4 years ago

It sucks to have to agree with someone that you don't fundamentally agree with but I think the author of the PR is correct. This is a modification of the Apache license and while I appreciate and support their stance, it does seem to mean that the license is non compliant. I support anyone's desire to protest things (no matter which side I'm on) but you can't just make up your own rules.

the-lazy-guy2• 4 years ago

How exactly do you fundamentally disagree with the author of the PR? He literally did no statements beyond saying that this is not an Apache License anymore.

dtech2• 4 years ago

The author of the module disagrees with the author of the PR that adding this additional restriction does not make the project Apache License anymore.

igetspam2• 4 years ago

You're right. I disagree with those who would not accept the license modifications as truth because I support them but the author of the PR did not state their political stance.

Proven• 4 years ago

You fundamentally agree with the person who opened the issue on the issue of license, that's the only thing that matters here.

He is right, the changed license is discriminatory.

Older commits can be used freely, so not a big deal for a while at least and by then someone can fork the code.

oauea• 4 years ago

but you can't just make up your own rules

Sure you can. Your project, your rules.

nigma13377• 4 years ago

Well its not his license.

allknowingfrog• 4 years ago

Sure, but you can't make up your own definition of the Apache 2.0 license, which was the point of the original comment (and the PR in question).

seneca3• 4 years ago

Sure, but that doesn't mean he can redefine terms. He can't both change the license and claim it's compliant with that license. That contradiction exists regardless of his ownership of the project.

black_puppydog2• 4 years ago

I'm not sure what the title here should be, but this one seems incomplete

Edit: maybe this?

Terraform-AWS-modules/Terraform-AWS-eks restricts license for Russian/Belarussian users

glogla2• 4 years ago

The title is technically true, but it makes a strong effort to paint it as a bad thing.

krageon• 4 years ago

Nothing is being painted, the title is factually correct

nigma13377• 4 years ago

I hate this presidence things like these set. I would hate code being split into left/right, and that's kinda the presidence set here

As much as I think the war is wrong, having it seep into other things which are "non-political", is incredibly annoying.

toxik4• 4 years ago

Nothing is non-political. You do not exist in a vacuum.

glogla2• 4 years ago

Yes. "I don't want politics in X" (software, video games, etc) mean "I support the status quo" which is by itself a political position - and often a privileged one.

nigma13377• 4 years ago

I just wanna code without thinking about the stuff happening in the world. Political stuff has its spaces, why does it have to infest everything else

seneca3• 4 years ago

Funny how the people who say this always seem to have the same political ideology, which they want to loudly push.

jen204• 4 years ago

Anton’s project, Anton’s rules. Simple. You don’t get to choose what license gets applied to his thousands of hours of work just because you want to live in a vacuum, when the reality has his own family under siege by a foreign army.

Furthermore, if you’re going to make grandiose statements about what may or may not become precedent, it would behoove you to learn the word you’re trying to use first.

nigma13377• 4 years ago

Well i mean, he doesn't get to claim its apache when its litterally not.

Furthermore, its an internet comment, i'm not gonna double check my spelling

0xbadcafebee• 4 years ago

I'm in favor of a license hack for humanity.

The International Science Council [1] has a Committee for Freedom and Responsibility in Science that "promotes freedom for scientists to pursue knowledge and to freely exchange ideas, at the same time as advocating the responsibility of scientists to maintain scientifically defensible conclusions, and of scientific institutions to apply high standards." [2] They have published a list of Freedoms and Responsibilities of Scientists[3], the main principle of which is "the free and responsible practice of science is fundamental to scientific advancement and human and environmental well-being."

Reading the list in full, it seems evident that there is intellectual dissonance between the aims of scientific freedom and the aims of the Universal Declaration of Human Rights[4] (which it references). It opposes blocking access to science based on discrimination, which is laudable. However, it also doesn't explicitly oppose science done that supports discrimination, or science done by organizations that support discrimination.

This makes sense when you consider that advances in science like GPS can be used to help you drive to a birthday party, or to guide a missile towards one. Clearly you can't condemn scientific research by itself, as it has too many potential applications for both good and harm, often unknown at the time the research is done.

Similarly, discriminating against research on the basis of "ethnic origin, religion, citizenship, language, political or other opinion, sex, gender identity, sexual orientation, disability, or age" also prevents the free and responsible practice of science, so the list of Freedoms and Responsibilities of course opposes this discrimination. But what if the end result of that science research is used to discriminate against those same people for the same reasons? What does a responsible, ethical scientist do then?

What we can do is oppose the use of science by people with those discriminatory goals, or goals that violate universal human rights. If you know someone is researching genetics in order to popularize Eugenics, there should be no responsibility to continue supporting that research. Similarly, if you believe that not supporting scientific research may help put pressure on a nation that is waging an unjust and unprovoked war which is killing thousands of innocent civilians [in violation of universal human rights], you should have no responsibility to continue supporting said nation's scientific research. In other words, it should be okay to discriminate if you are discriminating against violations of universal human rights.

Considering this, I would propose that one major tenant of any new Open Source license is to discriminate against organizations or nations that want to research, use, or produce science or technology, if that organization or nation is widely considered to be violating universal human rights. This goal has the effect of communicating an ethical red line you must not cross if you want to participate in a global human community, and will be a discouraging factor when nations again consider the potential ramifications of their actions.

Basically, we should use access to collaboration in science and technology as a lever to improve human rights.

edit Ethical minds think alike! Somebody already created a version of the MIT license with this exact restriction! The Hippocratic License[5]: "an Ethical Source license that specifically prohibits the use of software to violate universal standards of human rights, and embodying the Ethical Source Principles." It appears there are many[6] other such licenses.

[1] https://council.science [2] https://council.science/about-us/governance/committees/commi... [3] https://council.science/what-we-do/freedoms-and-responsibili... [4] https://en.wikipedia.org/wiki/Universal_Declaration_of_Human... [5] https://firstdonoharm.dev/ [6] https://ethicalsource.dev/licenses/

cies2• 4 years ago

if that organization or nation is widely considered to be violating universal human rights

I can list recent violations from both US, Russia and China. So now what? The US has already said they'd prefer to invade The Hague than have a USer trialed there. You need a court to establish what's a violation and what's not. And who should provide the judges?

raffraffraff2• 4 years ago

Ugh. Lookit: it sucks to be forced to say anything at all, whether you agree with it or not. One thing I can say for certain is that my employer (and probably yours) is only into virtue signalling when it's 100% safe, everyone else is doing it and it has zero negative repercussions. I don't get to decide what my employer's stance is on licenses. I guarantee you that many people will end up moving away from these modules, not because they agree with Putin, but because they have to. Nobody wants the hassle or risk of auditing a million different licenses.

I'm an environmentalist. Should I update all my licenses to ban meat eaters, frequent flyers and drivers? Where does this shit end?

sofixa• 4 years ago

FYI this is not an employer doing the "virtue signaling", it's the individual contributor to the project.

raffraffraff2• 4 years ago

I know that. What I'm saying is that most employers are interested in virtue signalling, as long as it's a nice visible logo at a rainbow parade. That's cheap PR. But give them a legal headache and see how long they're willing to keep it up. My point is that many employers (certainly mine) would tell me to find another module or write my own, if they see this.

antonbabenko15• 4 years ago

ryandvm• 4 years ago

Ugh. As much as I am against the invasion, I absolutely do not want to have to start examining software licenses for obscure political litmus tests. Especially pointless ones like "I believe Putin is a bad dude".

I mean, if we're going to go down this road, then let's actually effect real change and slip some clauses in there with teeth like "no click-through license agreements" or "no pop-up cookie prompts" or "no ad trackers"...

nrmitchi3• 4 years ago

Okay, so while this title is technically true, it is phrased in a way to incite panic.

Just to be clear, AWS/Hashicorp is NOT beginning to charge people for the use of Terraform modules.

jhugo6• 4 years ago

terraform-aws-modules is a community thing, that consists of modules that are thin wrappers around the official AWS provider, that serve very little purpose other than to add a dependency and create problems like this.

antonbabenko15• 4 years ago

lol

jen204• 4 years ago

This is neither an AWS project nor a HashiCorp project. Why would that even be in question?

res0nat0r• 4 years ago

I'm sure just due to the repository naming many people think it is official. I did before I started using them and looking deeper.

nrmitchi3• 4 years ago

Because regardless of that, the naming of the organization and repositories strongly implies that it is managed be a combination of AWS and Hashicorp.

At a first glance, "transitions to non-free license" implies that you now have to pay for it. The default isn't "Well I guess non-free means it's still free but not the OSI definition".

People very often do not read beyond the title.

"Community maintained terraform-aws-modules transition to non-OSI-approved license" would probably be more accurate, but not nearly as click-bait.

lars_francke• 4 years ago

It is fine for people to reuse/derive from the Apache license but it is _not_ fine to continue to use the name "Apache" in the license name as "Apache" is trademarked. I believe this is a changed license as it does not matter whether the change is in another file or not.

Edit: https://www.apache.org/foundation/license-faq.html#mod-licen...

antonbabenko15• 4 years ago

Hi. I am Anton Babenko, maintainer (ukrainian by heart) here. I have updated the wording in README to state the facts about Russia (facts with links to wikipedia) - https://github.com/terraform-aws-modules/terraform-aws-eks#a...

It was never my intention to make changes in a license in any way. It would be just wrong to drop 5+ years of my life working on all terraform-aws-modules and betray everyone who have been participating as contributors and users.

If there are questions, please ask here or twitter (@antonbabenko).

seneca3• 4 years ago

I hope you and your loved ones are safe and weathering this this war of aggression as best as possible. I hope your homeland remains free and is able to oust the dictator attacking it.

I commend you for reverting the terms of use change. I also believe that this sort of remaining political statement in a project sets a poor precedent, and diminishes the work. Free software is meant to be open to all. Throwing ideological barbs in the project, however correct and riteous, undermines the project's freedom. I would urge you to reconsider.

antonbabenko15• 4 years ago

As I said earlier, I have updated the wording in README - https://github.com/terraform-aws-modules/terraform-aws-eks#a... . The project was and will be under the same Apache 2 license. You can continue using it as nothing is happening in Ukraine. I will never stop you or anyone else.

PS: It is not just Putin who attacks Ukraine but I don't want to go into this discussion here.

DandyDev• 4 years ago

Question: what is "ideological" about the facts stated in the README? Putin invaded Ukraine. Lives are at stake. Being against that is no more ideological than the need for you and me to eat and sleep.

sciurus2• 4 years ago

Hi Anton,

I see at https://github.com/terraform-aws-modules/terraform-aws-eks/c... that you have dropped the additional terms of use. I think that should alleviate the concerns people had about a license change. I appreciate you listening to your contributors and users feedback on this emotional topic.

Putin khuylo!

antonbabenko15• 4 years ago

Thank you! It was never my intention to do anything wrong with the licensing.

tonfreed• 4 years ago

Thank you for wading into the lion's den. You're a braver soul than most

antonbabenko15• 4 years ago

I wish I can do more to "explain" to users from Russia/Belarus what we experience in Ukraine... maybe not in the most efficient way sometimes but that's how it works

bombcar• 4 years ago

Stallman has discussed this years ago: https://www.gnu.org/philosophy/programs-must-not-limit-freed...

The most pertinent part is:

A condition against torture would not work, because enforcement of any free software license is done through the state. A state that wants to carry out torture will ignore the license. When victims of US torture try suing the US government, courts dismiss the cases on the grounds that their treatment is a national security secret. If a software developer tried to sue the US government for using a program for torture against the conditions of its license, that suit would be dismissed too. In general, states are clever at making legal excuses for whatever terrible things they want to do. Businesses with powerful lobbies can do it too.

sciurus2• 4 years ago

This license change appears to affect not just the EKS module, but all the modules in the terraform-aws-modules organization.

For example, here is the same change in their VPC module: https://github.com/terraform-aws-modules/terraform-aws-vpc/c...

antonbabenko15• 4 years ago

I have updated the wording in README - https://github.com/terraform-aws-modules/terraform-aws-vpc#a... . The project was and will be under the same Apache 2 license.

jhugo6• 4 years ago

By definition, it's not under the Apache 2 license if you add extra terms, even if those terms only apply to some people.

aaomidi4• 4 years ago

FWIW anyone I don't think apache 2's definition is set in stone. Think of this as derivative of apache 2, without the author saying it's apache 2.

skyzyx3• 4 years ago

It’s literally a pre-defined legal document. It’s definitely set in stone enough to warrant filing lawsuits and taking people to court over.

beny23• 4 years ago

While I completely abhor the invasion, I can't help but feeling that the licence (and equally important) accompanying code change - https://github.com/terraform-aws-modules/terraform-aws-eks/b... - feels like a weaponisation of open source, and I think this is a dangerous thing to do. I do think that with change of "additional terms & conditions" to "additional information", it still feels an ethically dangerous place to be.

I would not be happy if a library codifies political statements. What could be next? Conditions that state you agree to vote for/against Trump, that you disagree with homosexuality or are against transphobia. Note, I'm not accusing anyone of having those views neither am I commenting on them, they merely serve as an example of the dangers of discriminating.

Dependencies and supply chain attacks are the big thing - and while dependency scanning and pinning are an important component, but I don't think it is possible to use open source libs at scale without a certain amount of trust. I work on a platform where there are hundreds of teams and thousands of microservices. I'm now trying to think how we can assess the risk of thousands of dependencies and millions of lines of code. Without trust, the only way that's possible is to fork all libs, prevent open source and generally kill off any agility and velocity. My problem is that this weaponisation is killing off trust. It's not about sitting on the fence or taking sides in a war. It's about what open source has achieved over the last 30 years and I think that's now more at risk than before…

AitchEmArsey• 4 years ago

The only appropriate response here is for a corporate owner (Hashicorp preferably) to fork the repo just before the license change and to assert that their version is the default, and drive future development there.

The original author is entitled to their opinion and can restrict their own development to a repo with license conditions they define, but it is not reasonable to expect companies to accept non-standard and politically charged license terms. Getting shit done is hard enough and this change will not move the needle on Ukraine/Russia sentiment one iota.

antonbabenko15• 4 years ago

You are asking a corporation to clone "a community-driven project" and maintain it. Ok. There are 2.7K of forks of just this module already if you want to use them.

skyzyx3• 4 years ago

It is astonishing to me how poor our literacy of software licenses is as a community. Also, reading the comments here, there are two wholly independent things happening that most people are conflating as the same thing.

Software licenses are LEGAL DOCUMENTS. If you are not a lawyer, who has a specialty in this specific area of law, don’t go fucking with them.

1. Fuck Russia. This is the only right answer to the question.

Entirely separately is #2.

2. If you change the terms of a license, it’s a different license. The changed license was not the Apache 2.0 license, and was additionally a breaking change in every sense of the phrase.

I appreciate that @antonbabenko recognized this and fixed it, but these two issues are entirely separate. What Russia is doing is terrible. That is an absolute fact. But the new Terraform variables that were added in that commit have absolutely nothing to do with making the software work in the way that it was intended to, therefore, they do not belong.

This has nothing to do with being anti-politics. I’m very heavily political, and I fully support Ukraine in this case. I also have strong opinions on both “free software“ and also “open source software“, and I apply them at the license level by selecting a pre-existing license without making custom modifications to it.

But things like `var.putin_khuylo` simply don’t belong in the software itself. Nor does it belong in an OSI-approved software license.

skyzyx3• 4 years ago

Terraform-AWS-modules/Terraform-AWS-eks transitions to non-free license

Related Stories