The beginners guide to open source licenses

If you’ve heard of open source, and you’re like me, you might have assumed that open source means, well, open source: the code you are writing is free for everyone to see and use. But like me, you’d be wrong; very wrong. Over the past decade, much of open source has shifted away from a laissez-faire, open use policy and towards a restrictive licensing structure that is more akin to music, although not exactly. This post will walk through the different types of open source licenses, who uses them, and why things have changed so much over the past few years (hint: it’s the cloud providers’ faults).

A (little) bit of open source history#

To understand why open source software needs to be licensed in the first place, a small history lesson is in order. Today, the entire internet as we know it relies on thousands of public pieces of open source infrastructure, from operating systems (Linux) to version control (Git) to web frameworks (Next.js) to frontend libraries (React). These pieces of software are usually maintained by a small group of underpaid, overworked developers, a fact that’s reflected in this popular xkcd comic:

It’s undoubtedly a very odd situation that so much of our infrastructure relies on these publicly built and maintained, not-for-profit pieces of disjointed software. How did we get here?

Early origins of open source software#

In the earliest days of software (think the 1950s), programs were so tedious and difficult to write that nobody would have dreamed of making them public and free to use. But in the 1980’s, things started to change thanks to Richard Stallman, a pioneer of OSS (and complicated figure):

In 1984, Stallman spearheaded the creation of the GNU, a free operating system that was made to counter closed systems.

In 1985, he wrote the GNU Manifesto, asking for support in the development of the GNU operating system.

He also founded the Free Software Foundation (FSF), a nonprofit that was aimed at promoting freedom in computer use.

By 1987, most of the essential components of the GNU operating system were complete. There was an assembler, editor, and various Unix utilities like grep and ls. A C compiler was almost finalized.

In the 1980s, Stallman also created the GNU General Public License (GPL). All the components of the GNU operating system were released under this license.

Today, the GPL allows for the freedom to share and change all program versions, ensuring that they remain accessible to all users.

Stallman went on to become a god-tier famous programmer, known as rms among developers, and campaigns to this day about how important open software development is. After the GPL was invented, other programmers like him created big pieces of the open source ecosystem we know today:

• Linus Torvalds worked on Linux in the 90s
• The Apache Software Foundation was created in 1999, and the Apache HTTP Server (used by tons of the Fortune 500 to this day) was released 4 years earlier in 1995
• Firefox came out in 2004, Node.js in 2009, Docker in 2013, etc.

The important thing to understand is that many of the people working on this stuff were philosophically invested in having their software be open and available. They were not trying to build commercially successful companies. It was a movement!

That’s why if people ask me, I say that the term open source means a lot more than just the logistical fact that the code is free to see and use; it’s more about a community, and a philosophy around how things should be built. The internet is a public good that impacts the lives of everyone on earth, and there’s an argument to be made that the pieces of infrastructure that hold it up should be public domain, not owned by a for-profit corporation. This idea goes well beyond low level infrastructure, and has implications for applications too. I’d highly recommend reading this interview with Jack Dorsey where he explains how these concepts apply to something like Twitter.

The stock market ruins everything (the MongoDB story)#

Okay, great, open source is cool. But the problem started when people realized that you could $$ MAKE MONEY $$ off of it by offering support, managed services, and add on products. There’s obviously nothing inherently wrong with this, but what it does do is create highly perverse incentives over time between the companies that profit off of the open source, and their obligation to maintain and improve that open source. Essentially, the better you make the open source, the less exciting your commercial cloud product is relative to that open source. This is a tale as old as time and has played out with several highly successful public companies with origins in open source like MongoDB, Elastic, Redis, Confluent, etc.

When it comes to the drastic change in licensing philosophies over the past few years though, the real culprit here is cloud providers, especially AWS. Let’s use MongoDB, who created significant controversy when they switched up their license to a much more restrictive version back in 2018.

10 years prior to this entire license fiasco, the co-founders of a company then called 10gen released the first version of MongoDB. It was permissively licensed using GNU AGPLv3, which is a lot of letters basically saying that anyone can use the software to do whatever the hell they want as long as they too share the source code. What happened was that cloud providers abused this license and proceeded to fuck MongoDB by offering competitive solutions on their own hardware, without contributing anything back to the original OSS community.

​​“The market is increasingly consuming software as a service, creating an incredible opportunity to foster a new wave of great open source server-side software. Unfortunately, once an open source project becomes interesting, it is too easy for cloud vendors who have not developed the software to capture all of the value but contribute nothing back to the community,” said Eliot Horowitz, the CTO and co-founder of MongoDB, in a statement.

This license change happened in late 2018, so it’s possible he’s referring to smaller cloud providers that I’m not familiar with. But if you wait until a few months later, and assume that Horowitz probably knew this was coming, you can see one of the great dick moves in the history of cloud infrastructure. Feast your eyes on this AWS product called, and I’m not kidding, AWS DocumentDB (with MongoDB compatibility). Here’s the link, for those curious.

This was released in January 2019, only a few months after the MongoDB license change . So AWS took the MongoDB source code, which they did nothing to build or help maintain, and built a managed service on top of it to sell to their customers. Not a shocker if you know the history of this company, but nevertheless a perfect example of how relatively permissive licenses like the AGPL leave open source creators vulnerable to commercial exploitation.

Other companies were not far behind Mongo on this one: Elastic and Redis both recently updated their licenses to the more restrictive SSPL.

So with all of that out of the way…let’s talk about the actual types of different licenses and what they mean.