I can’t believe how many people fundamentally misunderstand the spirit behind the GPL.
It helps to consider “the software” as a single snapshot in time, with the GPL’s intention that the consumer may make their own fixes, rebuild, and redistribute. Check.
Remember: “Free as in freedom, not free as in beer.” Selling open source software has always been explicitly allowed, as long as you make the source available to those who receive it. Check.
What the GPL does NOT provide is guaranteed access to maintenance and future versions of said software. Again, it applies to a snapshot, as delivered.
In a nutshell, the customer receives open source everything they FOR A PARTICULAR VERSION.
I see no problem — either in spirit or letter — in Redhat’s approach here.
I see no problem — either in spirit or letter — in Redhat’s approach here.
The problem lies in Red Hat's retalliation if a customer exercises their legal rights to redistribute the software. That is distinctly against the spirit of the GPL, if not against the letter.
With their user agreement they are effectively trying to enforce additional restrictions on what the GPL permits, you could see it as additional license terms, and that is forbidden by the GPL.
From the GPLv2 (the kernel's license):
if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have
The GPL requires that you do not put additional limits on a user’s rights to redistribute.
Saying “you have the right, but we’ll cut ties” isn’t really in keeping with the spirit of that.
I suspect, if it ever ended up in court, they’d agree yhat there’s no guarantee of access to future versions, but that doesn’t mean that it isn’t a shitty and cynical take that flies against what FOSS has traditionally stood for.
We can agree to disagree. “The Software” was delivered, source included. And you as end consumer are free to redistribute and maintain as you wish.
However, I cannot see any contract law judgement that would force continuation of a subscription model on the vendor (in perpetuity!) if they do not wish to remain under contract.
This is debatable. The GPL allow redistribution of a given version of the software without additional restriction. If the user receives that copy knowing in advance that redistribution will lead to retaliatory actions this can be treated as an additional restriction.
Honestly, I think they're worse. Oracle have actually done less evil in the past few years compared to before, whilst IBM/Redhat seem to be revelling in causing disharmony and aggressive business tactics.
I get where Jeff Geerling is coming from, but I think RedHat has a point as well.
I think a lot of people are coming at this from the perspective that RedHat themselves are just repackaging open source code and putting it behind a paywall, instead of also being one of the top contributors of software and bug fixes into the Linux ecosystem. Jeff mentions that Redhat is based on other open source software like the Linux kernel, but at the same time doesn’t mention that they’re also one of the leading contributors to it. I mean seriously, good luck using Linux without a single piece of RedHat code and see how far that gets you. If you’re entering the discussion from that perspective of “Redhat is simply just taking other people’s work as well”, it’s easy to have a biased view and start painting RedHat as a pure villain.
I also think that people are downplaying exactly how much effort it takes to build an enterprise Linux system, support customers at an engineering level, and backport patches, etc. Having downstream distributions straight up sell support contracts on an exact copy of your work won’t fly or be considered fair in any other business situation and I get why RedHat as a business doesn’t want to go out of their way to make that easy.
And it’s not like Redhat isn’t contributing the developments that happen in RHEL back into the FOSS community. That’s literally what CentOS Stream is and will continue to be, alongside their other upstream contributions.
Does it suck that we won’t have binary compatibility between Alma / Rocky and RHEL, yes it is frustrating as a user! Does it suck that we once got RHEL source for free and now we have to resort to Centos Stream? Yes! But the reality too is that open source STILL needs sources of income to pay developers to work on the Linux ecosystem, which is getting bigger and more complicated every day. That money has to come from somewhere, just sayin.
This argument that open source somehow needs to exploit users and blatantly skirt the intent of the GPL because profit must be taken from it is absurd.
Why is it assumed that they weren’t perfectly sustainable before and why is it the end users responsibility to bear the burden of making their business model viable if they weren’t? Being unprofitable doesn’t excuse you from following the terms of your software license.
Except they’re aren’t violating the GPL at all. Their source code is still available to subscribers (and it isn’t behind a paywall because you can get a free license) and available to the public via CentOS Stream. Their code also goes into upstream projects as well.
The GPL exists so that companies can’t just take the code and contribute nothing back. But that isn’t what Redhat is doing here so I find your accusations that Redhat is exploiting users to be very hyperbolic.
Except that Redhat is trying to literally stop one of the four essential freedoms - the freedom to redistribute. Arguably they might actually be breaking the terms of the GPL.
I don’t think they are. You can distribute the corresponding source for your binaries. You just won’t get updates to the binaries (and their corresponding source) afterwards.
No, RHEL “exploits” large companies and the public sector that require a lot of compliance certificates and long term service guarantees for the software they procure. If Red Hat doesn’t collect this money, it goes into the pockets of people with much lower upstream contributions than Red Hat.
The regular user doesn’t need RHEL. Fedora or any other non-enterprise Linux distribution is perfectily fine and they will directly benefit from the contribution that Red Hat finances through their enterprise sales.
Red Hat weren’t ever unprofitable under the old model. This is just the classic killing of the goose that lays the golden eggs. They’ll get a short term boost in profit until customers start moving to competitors.
I dont understand how redhat is going to police this policy of “we’ll keep source code open to paying customers, but reserve the right to cancel a customer that shares said source”.
Toss in GUID’s or randomly place identity files to anyone that downloads the RHEL source hoping they get accidentally published as an identifying attribute if someone does decide to publish it elsewhere.
They could try that but I suspect it would be rather easy to find anomalies like that. These are ultimately patches to an upstream and already open-source project, so one can just diff the RHEL version with the release it’s based on and quickly notice that random GUID in the sources or random spaces/indentation. Or have multiple sources leak the code independently, and then you can diff them all between eachother to verify if you got exactly the same code or if they injected something sneaky to track it, and remove it.
Lots of companies in enterprise also want to host their own mirror because the servers are airgapped, so they can’t even track who downloaded all the sources because many companies will in fact do that. And serving slightly modified but still signed packages sounds like it would be rather computationally expensive to do on the fly, so they can’t exactly add tracking built into the packages of the repos either. And again easy to detect with basic checksumming of the files.
I don’t think that many companies have their shit together well enough to mirror the source code, besides the RHEL repos aren’t small, so that’ll cost.
The companies I’ve helped either had a minimalist mirror to reduce the surface area of what was installable or to save on cost.
It’s possible that a few enterprises do a full mirror of all RHEL sources, but i doubt it’s many
I don’t know, I’ve worked in Debian/Ubuntu companies mostly. Last two had thousands of servers and both had an apt-mirror custom repo including the deb-src ones. Otherwise we just get ourselves banned from the official mirrors when thousands of VMs pull updates from the same NAT IP.
Not sure how that works exactly on the RHEL side, maybe it’s not nearly as easy or common to do that.
Add comment