OpenSSL 3.0 釋出,使用 Apache License 2.0

OpenSSL 3.0 推出了,這是轉換到 Apache License 2.0 後的第一個正式版本:「OpenSSL 3.0 Has Been Released!」。

中間跳過 2.0 的原因在維基百科上也有提到,因為之前被 OpenSSL FIPS module 用掉了:

The major version 2.0.0 was skipped due to its previous use in the OpenSSL FIPS module.

雖然 3.0.0 看起來是大版本,不過主要的功能都在 OpenSSL 1.1.1 先加進去了,沒有什麼特別的理由現在就要升級到 3.0.0...

用 Podman 替代 Docker?

也是因為最近 Docker Desktop 改變授權的關係 (參考先前寫的「Docker Desktop 要開始對商用收費了,以及 Open Source 版本的設法」這篇),有不少人在講怎麼用 Podman 替代 Docker,不過要注意這邊的替代不是 drop-in replacement,而是功能上的替代。轉移的過程還是得花一些時間處理...

在 Mac 上面的範例大多都是用 Homebrew,我在 MacPorts 上也有看到套件:「podman」,看起來好像得多裝 qemu,但即使把 qemu 裝起來,也還是不會動... 後續因為沒有需求,加上先前已經把 Docker CLI 的版本弄好了,暫時就沒再多研究要怎麼跑起來。

另外有人寫了「Migrating from Docker to Podman」這篇,在「GUI Replacement」的部份還介紹了對應的 GUI 方案,也可以參考看看。

跟以前的養套殺類似,都會推動一些 open source 替代方案的成熟度,以這次的情況看起來這些能量有很大一部份都會進到 Podman 裡面,對於個人用戶也可以再放幾個月看看是不是要跳槽過去。

Docker Desktop 要開始對商用收費了,以及 Open Source 版本的設法

Hacker News Daily 上看到的,Docker Desktop 修改了他的授權條件,對於商用版本要開始收費了:「Docker Desktop no longer free for large companies: New 'Business' subscription is here」,養套殺的過程...

目前看到的條件是 250 人以下的公司,而且年營業額在 10m 美金以下的情況免費,另外個人、教育以及非商業的 open source 專案保持免費:

It remains free for small businesses (fewer than 250 employees AND less than $10 million in annual revenue), personal use, education, and non-commercial open source projects.

如果不符合的話,第一種方法是花錢繼續用 Docker Desktop,看起來最少要買 Pro 等級的方案,費用是每個人 USD$60/year 或是 USD$7/month。

第二種方法是只安裝 command line 的部份,這個部份可以透過 MacPorts 或是 Homebrew 的方式安裝。

我自己是用 MacPorts 的方法裝,雖然有點麻煩,但因為是一次性的設定,應該還算堪用。

首先是去 VirtualBox 官網上面安裝軟體 (我是連「Oracle VM VirtualBox Extension Pack」都裝了),然後就可以用 MacPorts 裝三包:

sudo port install docker docker-compose docker-machine

接著可以建立要跑 Linux 的虛擬機,docker engine 會跑在裡面:

docker-machine create --driver virtualbox default

然後把虛擬機跑起來:

docker-machine start

可以設定讓虛擬機在整台機器重開機時自動把虛擬機跑起來,但這部份就自己在網路上找文章設定了,因為我用不到... (記憶體不夠,而且平常我也不會在本機上開發)

接著設定需要用到的環境變數:

eval "$(docker-machine env default)"

然後就可以跑 docker ps 之類的指令了,後續就如同以前常見的操作。這個設定環境變數的指令也可以考慮放到 ~/.bashrc 之類的地方讓他在開啟 terminal 時自動設定好。

Homebrew 的話應該也有類似的搞法,就請自己搜了...

OpenRsync 專案

看到「(open)rsync gains include/exclude support」這篇才注意到有 OpenRsync 專案...

在 OpenRsync 的網站上是指到 OpenBSD 的 cvsweb 上:「src/usr.bin/rsync/」,不過在 GitHub 上也有一個 repository:「kristapsdz/openrsync」,裡面有提到目前應該是以 OpenBSD 內的 source code 為主:

This system has been merged into OpenBSD base. If you'd like to contribute to openrsync, please mail your patches to tech@openbsd.org. This repository is simply the OpenBSD version plus some glue for portability.

然後有也提到 OpenRsync 主要就是 license 的關係 (rsync 目前是 GPLv3):

This is an implementation of rsync with a BSD (ISC) license. It's compatible with a modern rsync (3.1.3 is used for testing, but any supporting protocol 27 will do), but accepts only a subset of rsync's command-line arguments.

不過在一開始的報導裡面,有人反應軟體與 rsync 的相容性不太好,會搞爆 rsync:

By grey (grey) on 2021-08-31 05:17

Nice!

Albeit, the last time I was testing openrsync, I discovered I could use openrsync to reproducibly crash rsync on FreeBSD13-CURRENT on a Raspberry Pi 3 and decided rather than try to debug rsync, I would wait for openrsync to mature a bit, I'm grateful to see that it continues to progress!

就當作個記錄...

Brendan Gregg 遇到的 An Unbelievable Demo

Hacker News Daily 上看到的熱門話題,Brendan Gregg 是效能分析領域的大老,現在在 Netflix 工作,在維基百科的條目「Brendan Gregg」上也有提到他的一些知名發明,像是 Flame Graphs:

He has also created visualization types to aid performance analysis, including latency heat maps, utilization heat maps, subsecond offset heat maps, and flame graphs.

昨天他發了一篇文章在講之間他遇到的事情,原文把過程寫的很有戲劇性,值得去看一看:「An Unbelievable Demo」,而 Hacker News 上的討論也很精彩:「An Unbelievable Demo (brendangregg.com)」,還引出了 Colin Percival 也分享他的經驗。

快速講 Brendan Gregg 遇到的事情,2005 年時 Brendan Gregg 因為業務上的需要 (他當年是效能分析的顧問),幫 Sun 推出的 DTrace 寫了一包工具,叫做 DTraceToolkit,用 GPLv2 或是 CDDL 釋出。

這包工具被 Sun 的人拿去用,並且拔掉作者與授權資訊,然後還被拿去「世界巡迴」介紹這個工具,最後在雪梨的時候居然是拿來介紹給 Brendan Gregg,然後被原作者打臉。

不過他後來還是加入了 Sun... XDDD

Colin Percival 的故事則沒有牽扯到 copyright issue,不過也很有趣,這邊提到的是 bsdiff,也是個經典的工具:

Reminds me of when Apple started providing "smaller size updates" to OS X. I was curious about the details since my doctorate had touched on the topic, so I worked my contacts (I had a few in Apple engineering from the FreeBSD / OS X relationship) and after a few months I got back as answer: "We're using a tool called bsdiff, are you familiar with it?" I was indeed, since I was the author of said tool.

(Just to be clear, there was no license violation involved in this case; just a lack of awareness of the provenance of the open source software they were using.)

另外在其他的 thread 裡面,可以看到 Brendan Gregg 也有浮上來回應 (可以直接字串搜尋 brendangregg),裡面也提到了有趣的故事,像是他另外一個發明 latency heat map 在一些會場上的交流,以及自己也有遇到其他工具的作者:

Thanks. There was a time when many observability products were adding latency heat maps, and at one conference expo floor there were three companies with latency heat maps on their screen at the same time, pitching them as a flagship feature. If I walked near them they'd start trying to explain them to me, and I never figured out an appropriate response. If I said "hey, great to see you added them, I invented these back at Sun" I'd get funny looks.

I think it's a small world, and everything is software, so the chance you'll bump into someone who wrote software you are using I think is pretty high. I was once trying to get my head around Andi Kleen's pmu-tools, and I had the github repo open in my browser on my laptop I was carrying, when the guy sitting next to me on a bus says he's Andi Kleen. (Ok, it was a bus taking Linux conference attendees to an event, not a random bus, but I still found it remarkable timing -- I was studying pmu-tools at that exact time!)

拿來配啤酒的文章 XD

Grafana 家的軟體改 AGPLv3

Grafana 家的軟體宣佈從本來的 Apache License 2.0 轉換成 AGPLv3:「Grafana, Loki, and Tempo will be relicensed to AGPLv3」。

相關的討論可以在 Hacker News 上的「Grafana, Loki, and Tempo will be relicensed to AGPLv3 (grafana.com)」看到。

Going forward, we will be relicensing our core open source projects (Grafana, Grafana Loki, and Grafana Tempo) from the Apache License 2.0 to the Affero General Public License (AGPL) v3. Plugins, agents, and certain libraries will remain Apache-licensed. You can find information in GitHub about what is being relicensed for Grafana, Loki, and Tempo.

這應該是對 Amazon Managed Service for Grafana 的反擊。

看起來 Grafana 7.5.3、Grafana Loki 2.2.1 以及 Grafana Tempo 0.6.0 是最後使用 Apache License 2.0 授權的版本,不確定會不會有人 fork...

AWS 對 Elasticsearch 的戰爭:OpenSearch

AWSElasticsearch 的戰爭繼續升溫,AWS 出來喊,搞了自己的 community 要跟本家 PK:「Introducing OpenSearch」,衍生出來的兩套軟體分別是 OpenSearch (對應 Elasticsearch) 與 OpenSearch Dashboards (對應 Kibana)。

Hacker News 上的討論「OpenSearch: AWS fork of Elasticsearch and Kibana (amazon.com)」裡面有些討論還蠻精彩的,其中這段:

One thing which surprised me: Elastic has a market capitalization of ~$11B.

I think that changes some of the more floaty ethical concerns. This is not a David vs Goliath situation. This is Goliath vs Super-Goliath.

雖然就公司市值比例來看,大約是 100:1 這個數量級的公司在打架 (AWS 的母單位 Amazon 大約在 USD$1T 的等級),但這其實這不是小蝦米被大鯨魚欺負的故事,而是大公司跟暴力超大公司之間的打架。

會怎麼演變其實猜不出來,但因為在 open source search engine 技術這塊的確缺乏其他像樣的競爭者,AWS 這樣丟資源進來未必是件壞事。

另外一方面,這件事情對商業公司在在 open source 的其他領域則是比較負面,很明顯的 Amazon 這樣玩對於其他以 open source 為基礎的商業公司處境就更嚴峻了。

Mapbox GL JS 的授權改變,以及 MapLibre GL 的誕生

看到「MapLibre GL is a free and open-source fork of mapbox-gl-JS (github.com/maplibre)」這篇,翻了一下資料發現年初時 Mapbox GL JS 的軟體授權從 v2.0.0 開始變成不是 open source license (本來是 BSD license),而社群也馬上 fork 最後一個 open source 版本並且投入開發,變成 MapLibre GL

MapTiler 在年初的時候有提到這件事情:「MapLibre: Mapbox GL open-source fork」。

The community reacted swiftly: forks of the latest open-source version were made almost immediately by multiple parties. In another positive development, the community came together the next day and agreed to make this a joint effort, rather than splitting energies. A video call was organized and the MapLibre coalition was formed. It includes people working for MapTiler, Elastic, StadiaMaps, Microsoft, Ceres Imaging, WhereGroup, Jawg, Stamen Design, etc.

MapLibre GL 目前與本來 v1.13.0 相容,可以直接抽換過去 (後來在二月的時候有出一個 v1.13.1,不過那是在 v2.0.0 改 license 之後的事情了):

  "dependencies": {
-    "mapbox-gl": "^1.13.0"
+    "maplibre-gl": ">=1.14.0"
  }

記錄一下,以後要在網站上用的話,得注意到 Mapbox GL JS 在沒有註冊的情況下不能使用,而且 SDK 會強制蒐集資料:

Mapbox gl-js version 2.0 or higher (“Mapbox Web SDK”) must be used according to the Mapbox Terms of Service. This license allows developers with a current active Mapbox account to use and modify the Mapbox Web SDK. Developers may modify the Mapbox Web SDK code so long as the modifications do not change or interfere with marked portions of the code related to billing, accounting, and anonymized data collection. The Mapbox Web SDK only sends anonymized usage data, which Mapbox uses for fixing bugs and errors, accounting, and generating aggregated anonymized statistics. This license terminates automatically if a user no longer has an active Mapbox account.

不過如果是抓 OpenStreetMap 資料的話,Leaflet 應該還是目前的首選...

AWS 跳出來決定繼續搞 Elasticsearch 了

先前提到「Elasticsearch 與 Kibana 也變成非 Open Source 軟體」,後來 Elastic 的 CEO (創辦人) 發了一篇「Amazon: NOT OK - why we had to change Elastic licensing」直接批評 AWS

接下來是 AWS 跳出來放話了,基本上也是個新聞稿:「Stepping up for a truly open source Elasticsearch」,大概就是會繼續維護自己的版本,維持本來的 Apache License, Version 2.0,然後批評 Elastic 所說的話不實之類的...

現在還在雙方放話的階段,過一陣子看看有什麼更新...

Elasticsearch 與 Kibana 也變成非 Open Source 軟體

Nuzzel 上看到的消息,ElasticsearchKibana 也變成非 Open Source 軟體了:「Elasticsearch and Kibana are now business risks」,官方的公告在「Upcoming licensing changes to Elasticsearch and Kibana」這邊。

新版將會採用 SSPL (由 MongoDB 設計出來的授權) 與 Elastic License (Elastic 的商用授權) 的雙重授權,不過兩個授權都不是 Open Source 授權。

應該是跟 Amazon Elasticsearch Service 這種搞法加減有些關係?不知道 AWS 這邊後續會怎麼弄...

另外如果不選擇 Elasticsearch 的話,目前好像只有 Solr 算是堪用?不過很久沒回去看 Solr,不知道現在軟體發展到什麼程度...