Open-Source Rug Pulls

by allsparkinfinite on 2024-05-25

I'm a huge advocate of open-source software. It's built for and by community. The open-source utopia is a world where everyone writes software with source code freely available for review. Interested and able members of the community will try, test, review, and submit improvements to projects that they wish to use and/or improve. Some may "fork" a project to take in a somewhat different direction to the original project, reusing most of the code but making significant modifications of their own. Collaboration at its finest. Communism in software, if you will.

We live under capitalism, though. Many companies zealously protect the source code for their software when it's their money maker. They expended significant effort in writing this code, dammit, and they'll be damned if they let anyone else have it before they've squeezed every last penny they can make out of it. It's the only course of action their shareholders will accept.

And yet, there are some for-profit organizations that make open-source software. Angels who share the fruits of their labour with the public, often to the detriment of their bottom line. Corporate open-source seemed to be a safe haven for open-source idealists in the warzone of capitalism.

Seemed to be.

Of late, there have been many examples of companies taking away the open-source licences of some of their products. HashiCorp of Terraform fame, Redis as in RedisDB, Red Hat known for RHEL, MongoDB, CockroachDB, Confluent, ElasticSearch, Sentry.
"Wait, who are those last few guys?", I hear you ask.
Well, those are small companies that got away with this first, emboldening the bigger players to do it as well.

Detriment Of Their Bottom Line?

Whenever you see a company with an open-source product, two things are true.
One, there is a community of volunteers around this project which is happy to provide their effort to keep the project moving.
Two, the community is good enough at creating bug reports and pushing patches to the code that it makes financial sense for the company to rely on the volunteers instead of hiring a few more developers and testers.

In other words, the decision to keep a project open-source can also be driven by capitalistic sentiments.

Why Do Commies Go For Corporations?

The open-source utopia makes no claims about who is the ultimate decision maker of a project. It could be a single dedicated person, it could be a committee, and it could be a corporation. All we need is the freedom to view and modify the source code of the project. This is the implicit contract between open-source project maintainers and volunteers. This trust can be broken in a couple of scenarios.

The project may reach a stage of maturity where the company is ready to take all development in-house. Or maybe the value provided to the company by the volunteers reduces, and it no longer makes sense to trade-off ownership for volunteer labour.

How Is This Breaking Trust, Exactly?

A part of the open-source ideal is that everyone is free to use the software without contributing anything in return. Users don't have to volunteer for every project they use. When a company decides to move an open-source project to a proprietary licence, this part of the ideal is violated.
Additionally, the company then assumes ownership of the project, including the parts contributed by volunteers.

How Is This Legal?

Loopholes.

Open Source Licenses are written to avoid these kinds of rug pulls, but they don't cover all the cases.

RHEL in particular is built on the Linux kernel, which is published under a license (GPL) that requires everything built upon it to make its source available as well. RHEL is now making source code available only to paying customers, which technically satisfies the requirements of GPL.

In addition, taking these violators to court is also not a feasible option for non-profits like the Linux Foundation.

What Can We Do?

Fork them. The community is often quick to create a new branch of the project from the last version that was published under an open-source licence.