traversaro
18 hours ago
Related gitlab comment: https://gitlab.gnome.org/GNOME/libxml2/-/issues/976#note_253... .
codethief
15 hours ago
This should be higher up and seems very relevant to understanding what's going on. Looks like the (former) maintainer does not actually want to abandon libxml2.
bayindirh
11 hours ago
He just wants his sanity and dignity back while continuing his passion project. Respectable and commendable, if you ask me.
morkalork
9 hours ago
The bit about google employees willing to step up and work on the project is kind of disgusting: The company is too cheap to fund the project with money, but don't worry, they've got an endless supply of eager developers looking to 'pad their résumé' and deny you all the reward and satisfaction of what you built. It almost reads like a threat "work for free or we'll fork it and take it away from you". Wow
bayindirh
9 hours ago
Wow, indeed. To add insult to the injury, the whole message reads like this:
> Good news is several Google and Apple engineers have volunteered to help with libxml2 and libxslt security issues, despite your effort to sabotage libxml2 users...
I mean, c'mon. He's carrying the world on his shoulders and people are just pointing fingers?
Also, this shows how evil corporations are. I can understand Apple, it's their culture to avoid GPL code and and committing code to any public project needs permission from everyone plus the campus cat, but Google, the apparently bastion of open source software is doing the same thing without any shame...
They have morphed into the next Microsoft AFAICS.
Despicable.
tristan957
8 hours ago
mcatanzaro frequently makes these over the top comments, and when called out, refuses to backtrack on them.
matheusmoreira
6 hours ago
The accusation of sabotage was pretty disgusting but there's something that's arguably even worse deeper in the thread:
> maybe if you stop fixing things for free, perhaps somebody will suddenly be willing to pay you to do so
We should all remember that line every time we think about being generous or altruistic. He essentially called the maintainer a fool.
overfeed
4 hours ago
I think mixing altruism with work is a mistake, which is the sentiment I read into the (sarcastic) comment. The maintainer has very little leverage for payment if they continue working on the project for free.
The maintainer has to pick a side and commit to it, and deal with the downsides. Alternatively, they may choose not to play.
matheusmoreira
4 hours ago
I don't think he should be forced to pick sides. He made the thing, he knows the code base inside out. It would have been trivial for companies to hire him as a consultant or something since they're all depending on him. Why didn't they? It really makes no sense.
aseipp
3 hours ago
Nick Wellnhofer did not create libxml2 or libxslt, David Veillard did. Nick has been the primary contributor since about 2015, though.
matheusmoreira
2 hours ago
My mistake, I apologize.
Still, it looks like he maintained the library for a long time. He no doubt has more knowledge about the code base than outsiders. That ought to be valuable to corporations relying on the library and contributing security patches.
lovich
an hour ago
> Why didn't they?
Because he continues to work for free? Companies are amoral actors. They aren’t going to donate out of charity and if someone wants to give them free work they won’t say no
matheusmoreira
7 hours ago
The maintainer's leverage is severely diminished due to the fact MIT licensed versions of the software exist. Only new code will be copylefted so it will be easier to cut him out of the picture.
This is why developers should AGPLv3 their personal projects from day one. Then others can't fork it under another license.
Even if they choose AGPLv3, the creator still maintains full freedom since they own the copyrights. They can make a commercial version if they want to. They can even relicense it under favorable terms to companies for a licensing fee. Everyone else must abide by the copyleft rules.
If they don't like it, let them pay hundreds of thousands of dollars a year for their own developers to make their own in house proprietary version.
overfeed
4 hours ago
> This is why developers should AGPLv3 their personal projects from day one.
That would be detrimental to "growth hacking" GitHub stars and gaining traction. One can't be paid without baiting users first.
morkalork
2 hours ago
Is there a free-for-corporate use under XX revenue or limited time license one can pack with an AGPLv3 project? Something that doesn't block people, even businesses, from using the project during the growth stage but also doesn't give away all your rights or ability to get paid later?
matheusmoreira
2 hours ago
There's gotta be a way to do this ethically, naturally and organically. I want people to engage with my projects too but I don't really want to sell my soul for it.
I hate advertising so I don't even post about my projects anywhere unless some very specific conditions are met. People found and shared my projects anyway. They've made it to the front page of HN. I even gained a GitHub sponsor because of that. Not enough to turn my hobby into full time work but still awesome.
kelvinjps
an hour ago
I don't like the comments from Michael candaroza they feel entitled
JonChesterfield
9 hours ago
I really hope the AGPL fork is called libxml3
matheusmoreira
11 hours ago
> The basic idea is to offer a paid commercial license for people who don't want to use GPLed code.
This business model is known as selling exceptions to the GPL.
https://www.gnu.org/philosophy/selling-exceptions.html
Use the most radically copyleft and freedom preserving license you can. If the corporations want your software, you present a business solution: pay for special licensing conditions.
It's even blessed by Stallman. I emailed him to confirm. Unlike permissive licenses, only the original copyright holders get to benefit in this way. Others don't have this relicensing permission. The damage is contained.
I hope it works out for him. Watching beggar barons make billions off of free software that's being maintained for free is really hard to watch.
bayindirh
11 hours ago
Personally what he's doing is very sensible, and how I personally advocate. Hope it works out for him.
I personally like the slow and steady tide of understanding the value of GPL family of licenses.
zamalek
7 hours ago
My friend sent me that article a few months ago. It _completely_ changed my approach to OSS contribution: from a 25yr MIT/BSD adherent to AGPL adherent in 30min.
matheusmoreira
7 hours ago
It was very influential for me too. Here's another one, also from Zed Shaw:
https://web.archive.org/web/20120620103603/http://zedshaw.co...
> Why I (A/L)GPL
> Open source to open source, corporation to corporation.
> If you do open source, you’re my hero and I support you.
> If you’re a corporation, let’s talk business.
> I want people to appreciate the work I’ve done and the value of what I’ve made.
> Not pass on by waving “sucker” as they drive their fancy cars.
ducktective
9 hours ago
So if one wants to open-source his project and sell it :
- Licence as AGPL
- Mention that commercial use (without having to open source the derivative work) is available
Did I get it right?
1- Is this solution useful for subscription-based contract too?
2- Does it make a difference if the product is a app, library or hardware device?
tobias3
4 hours ago
The main problem is that you need to have contributors sign a copyright assignment/CLA, otherwise their code is going to be AGPL only and you cannot license it commercially.
Or you don't have any contributors, which is the base case, I guess.
matheusmoreira
6 hours ago
> Did I get it right?
I think so.
> 1- Is this solution useful for subscription-based contract too?
If you mean SaaS, then maybe. I emailed Stallman about the ethics of the SaaS case and he said it's a net good.
You might want to think about whether the license actually gives you leverage in that case though. You might find that the corporations are perfectly willing to host a service using your AGPLv3 software. That's within their rights.
You only gain leverage if they want to create a proprietary version of your software.
> 2- Does it make a difference if the product is a app, library or hardware device?
Absolutely. The GPL has very specific wording with regards to linking and distribution which trigger license conditions. You should read the full license for a better understanding.
Hardware is a completely different matter, I won't even pretend to know anything about how licensing works in that case.
Remember, I'm not a lawyer. I'm just a hobbyist free software developer who's also trying his best to understand all this and make the best possible decision.
bgwalter
10 hours ago
The RedHat apparatchik at the top of the link is amazing. Attacking others from his secure position and celebrating more corporate influence:
"Good news is several Google and Apple engineers have volunteered to help with libxml2 and libxslt security issues, despite your effort to sabotage libxml2 users -- especially web browser users -- by disclosing all vulnerabilities immediately rather than allowing them the industry-standard 90 day disclosure deadline used by all other GNOME projects (#913 (closed)). They've posted a couple patches in the libxslt issue tracker already. I assume you're not satisfied with this, and are now trying to push them away. If that's your goal, you'll no doubt succeed pretty quickly."
RedHat often has a detrimental effect on open source, it is filled with bureaucrats and careerists.
Thanks Nick Wellnhofer for going AGPL. You are setting a great example!
preisschild
11 hours ago
> You are no doubt well aware that nobody will ever use a GPLv3 libxml2
Why wouldn't other FOSS projects like Gnome Web for example not use GPLv3 licensed software?
imtringued
10 hours ago
Because according to the Gitlab comment you've taken that excerpt from, companies are so allergic to the GPL that they will not only avoid using the GPL version of libxml2, no. They will maintain a MIT fork of libxml2 out of spite, even though they've been actively running away from their responsibility to do so.
matheusmoreira
3 hours ago
Let them maintain it. We can take their permissive code and add it to our AGPLv3 projects literally no questions asked, we just have to replicate the copyright notice and license file. Meanwhile they can't take our copyleft code without also copylefting any improvements they distribute. And with AGPLv3, network use is distribution.