Please don't advertise BSL-licensed software as "open source"

[mswilson]

(speaking only for myself as an individual, and long time advocate for Free and Open Source Software)

https://about.codecov.io/blog/codecov-is-now-open-source/

I'm happy to see a move toward openness, but I'm sad to see the continued trend to advertise goods as "open source" when they are made available under terms don't give all the permissions that the Open Source Definition requires. Codecov will become open source in a little under 4 years. Until then, due to the restrictions of the BSL, the source code is available, but it's not open source.

[atoponce]

The Business Software License is not included in OSI's list of open source licenses. The OSI has a clear definition on what it means for a license to be "open source".

Some discussion has been made about BSL online, such as CockroachDB switching to BSL:

The BSL is not an OSI-approved open source license, though Kimball emphasized that it's still open. The BSL converts to an Apache license after three years. As such, the recent CockroachDB 19.2 update will become open source in three years under the Apache license. The big difference between Apache and the BSL comes down to one big exclusion.

"You can't offer CockroachDB as a database as a service," Kimball said. "It's really preventing Amazon from just plugging us into RDS (Amazon Relational Database Service) and I had to do that to keep our business viable in the face of predatory behavior from companies like Amazon."

Further:

Paul Dix, founder and CTO of InfluxData, said that while it's appropriate if other vendors want to use licenses such as the BSL, he emphasized they are not open source. Truly open source licenses enable users to take the code and do whatever they want with it, he said.

It seems clear that Covecov is not open source. "Source available freeware" would be more accurate.

[elliotwutingfeng]

It should be noted that it is possible for a project's latest commit to remain perpetually licensed under BUSL by regularly incrementing the BUSL change date, as exemplified by cockroachdb and sentry itself.

This strategy allows a project maintainer to ensure that at any given time, only years-old versions of the project are open-sourced, while keeping recent versions not available for commercial use.

I do not know if codecov intends to fully switch to Apache 2.0 by 2026. However, if they intend to adopt the increment strategy instead, the BUSL allows for that.

Either way, right now, codecov is not open-source, a more accurate term would be "source available".

[illiliti]

Yet another company that abuses open-source term for their marketing crap. So bad.

[eliatcodecov]

Thanks for the feedback. We're changing the post by adding the following author's note at the top:

We are using the term "open source" because we feel it best reflects our intent -- current and future -- with this product. Specifically you can: view the source code, contribute to the source code, and download and run the code for yourself. We are using the BSL because we feel it currently best aligns with our goals while supporting our ability to function as a business.

While we acknowledge that the BSL is currently not an approved OSI Open Source license, it still aligns strongly with our own open source goals and intent for Codecov at this time.

[maciek134]

It's not that it's "currently not an approved OSI license", it never will be because it's not compatible with what Open Source is.

As it stands the title of the post is incorrect and is misusing the term for marketing reasons.

Source available is what describes your intent, because you don't want to be an Open Source project.

[instancezero]

"it still aligns strongly with our own open source goals and intent for Codecov at this time." [emphasis added]

And that's the exact problem. Next week the "goals and intent" can change in ways that are incompatible with FOSS and there's no option to respond with a fork. And that, ladies and gentlemen, is closed source.

[lanodan]

Right, it won't ever be an Open-Source license, the BSL is explicitly designed to go against the "Fields of Endeavor" clause:

https://opensource.org/osd/ - The Open Source Definition, by the OSI

6. No Discrimination Against Fields of Endeavor
   The license must not restrict anyone from making use of the program in a specific field of endeavor. For example, it may not restrict the program from being used in a business, or from being used for genetic research.

It's particularly striking that Codecov expects contributions, aka gratis labour as you exclusively see fit via code reviews, with a license that doesn't allows for a balanced deal.

And given how fast software made by the industry simply bitrots, I would say that codecov won't be open-source, the expiry time is pretty much "okay, now it's abandon-ware but entirely legal". (And I'd recommend using a copyleft license like the MPL-2.0 if you're going to made modifications, so codecov would have to be at the very least open-core if they would want to use the code)

[atoponce]

The license also explicitly states it's not an Open Source license:

The Business Source License (this document, or the "License") is not an Open Source license.

Claiming anything else at best is demonstrably incorrect and at worst flat out lying.

[elliotwutingfeng]

"it still aligns strongly with our own open source goals and intent for Codecov at this time." [emphasis added]

And that's the exact problem. Next week the "goals and intent" can change in ways that are incompatible with FOSS and there's no option to respond with a fork. And that, ladies and gentlemen, is closed source.

While I am not a lawyer, I would partly disagree, changing the license at any given time (even to proprietary) should not retroactively apply to old versions/commits of the project, so forking old commits of a project (when that particular commit's BUSL license date expires) remains an option.

An example is mapbox switching from BSD-3-Clause to proprietary at version 2, and maplibre being a community fork of mapbox version 1 (BSD-3-Clause) licensed.

It is still not good to claim that a product is "now open source" when right now, it is not.

[illiliti]

Thanks for the feedback. We're changing the post by adding the following author's note at the top:

We are using the term "open source" because we feel it best reflects our intent -- current and future -- with this product. Specifically you can: view the source code, contribute to the source code, and download and run the code for yourself. We are using the BSL because we feel it currently best aligns with our goals while supporting our ability to function as a business.
While we acknowledge that the BSL is currently not an approved OSI Open Source license, it still aligns strongly with our own open source goals and intent for Codecov at this time.

This is outrageous. You have acknowledged that you are lying, but still want to continue lying, now on purpose, because you "feel" it's better this way? Seriously? Is that your marketing manager told you this bullshit?

Also your goals have nothing to do with open source. The whole post is contrary to itself.

[illiliti]

I have created a hall of shame for such putrid companies like codecov - https://codeberg.org/illiliti/openwashing. Let's raise awareness about these liars.

[lucas-zimerman]

So it's an open source project but with a license not approved by OSI.

[illiliti]

It is not an open source project. The license is not open source and hence this project is not.

[mswilson]

This is closer to what I was hoping to see. Kudos. https://blog.sentry.io/lets-talk-about-open-source/

[illiliti]

This is closer to what I was hoping to see. Kudos. https://blog.sentry.io/lets-talk-about-open-source/

TL;DR: Another acknowledgement in lying with no further action. No one is going to drop false advertising or relicense affected projects to an actual open-source license.

[illiliti]

To back up my words here are examples where false advertising is still present:

• https://about.codecov.io/ (Codecov is now open (source) should be retracted)
• https://about.codecov.io/customers/ (same as above)
• https://about.codecov.io/$any_valid_or_invalid_page/ (same as above)
• https://github.com/codecov/worker (By open sourcing Codecov should be retracted)
• https://github.com/codecov/codecov-api (same as above)
• https://github.com/codecov/gazebo (same as above)
  https://github.com/codecov/gazebo/blob/a385563ed352f5bf99ee612e9956193f6babd98a/Makefile#L6 (should be just Users)
• https://github.com/codecov/contributing (open source should be retracted)
• https://github.com/codecov/contributing/blob/main/CONTRIBUTING.md#why-pull-requests (Codecov is an open source project should be retracted)

No action is being done to retract these statements as of now.

Also I would drop that blog post(or at least title and that cynical image about being open-source) but if it won't be mentioned anywhere I think it can stay. It will serve as a reminder of these events.

[eliatcodecov]

I've opened pull requests to update every instance of "open source" in our repositories that you have taken the time to reference, @illiliti.

I have no purview over the marketing pages (i.e., https://about.codecov.io) but have directed that team to your comment.

[illiliti]

Great! That's what should have been done in the first place. Not just admit a mistake but also fix it. Alright once all those fixes + about.codecov.io fix are applied I believe this case can be considered closed unless anyone here wants to object or add something.

[chadwhitacre]

I've opened pull requests to update every instance of "open source" in our repositories
I have no purview over the marketing pages [...] but have directed that team to your comment.

Reopening to track these.

• https://about.codecov.io/ (Codecov is now open (source) should be retracted)
• https://about.codecov.io/customers/ (same as above)
• https://about.codecov.io/$any_valid_or_invalid_page/ (same as above)
• Update README.md worker#51
• Replace "open source" in README codecov-api#66
• Replace "open source" in README.md gazebo#2180
• Update Makefile gazebo#2181
• docs: Remove Open Source from Readme.md contributing#7
• docs: Remove Another Reference to Open Source contributing#8

[chadwhitacre]

Marketing pages now use "Codecov source code is now available on GitHub."

https://about.codecov.io/

https://about.codecov.io/customers/
https://about.codecov.io/$any_valid_or_invalid_page/

[illiliti]

I see all fixes are merged. The case is closed I think.

[chadwhitacre]

Let us know if you find anything else @illiliti. Thanks to you and everyone else for calling us out.

[yawaramin]

Thanks for the action. I recommend locking this issue to prevent latecomers from brigading it.

[illiliti]

Locking is unnecessary in my opinion. Let it open for now in case if someone discover remnants of open-source mention.