Mapbox GL JS 的授權改變,以及 MapLibre GL 的誕生

看到「MapLibre GL is a free and open-source fork of mapbox-gl-JS (github.com/maplibre)」這篇,翻了一下資料發現年初時 Mapbox GL JS 的軟體授權從 v2.0.0 開始變成不是 open source license (本來是 BSD license),而社群也馬上 fork 最後一個 open source 版本並且投入開發,變成 MapLibre GL

MapTiler 在年初的時候有提到這件事情:「MapLibre: Mapbox GL open-source fork」。

The community reacted swiftly: forks of the latest open-source version were made almost immediately by multiple parties. In another positive development, the community came together the next day and agreed to make this a joint effort, rather than splitting energies. A video call was organized and the MapLibre coalition was formed. It includes people working for MapTiler, Elastic, StadiaMaps, Microsoft, Ceres Imaging, WhereGroup, Jawg, Stamen Design, etc.

MapLibre GL 目前與本來 v1.13.0 相容,可以直接抽換過去 (後來在二月的時候有出一個 v1.13.1,不過那是在 v2.0.0 改 license 之後的事情了):

  "dependencies": {
-    "mapbox-gl": "^1.13.0"
+    "maplibre-gl": ">=1.14.0"
  }

記錄一下,以後要在網站上用的話,得注意到 Mapbox GL JS 在沒有註冊的情況下不能使用,而且 SDK 會強制蒐集資料:

Mapbox gl-js version 2.0 or higher (“Mapbox Web SDK”) must be used according to the Mapbox Terms of Service. This license allows developers with a current active Mapbox account to use and modify the Mapbox Web SDK. Developers may modify the Mapbox Web SDK code so long as the modifications do not change or interfere with marked portions of the code related to billing, accounting, and anonymized data collection. The Mapbox Web SDK only sends anonymized usage data, which Mapbox uses for fixing bugs and errors, accounting, and generating aggregated anonymized statistics. This license terminates automatically if a user no longer has an active Mapbox account.

不過如果是抓 OpenStreetMap 資料的話,Leaflet 應該還是目前的首選...

PHP 的 Git Server 被打穿,決定把整個 Git 系統搬到 GitHub 上

就如同標題說的:「Changes to Git commit workflow」,Hacker News 上的討論也可以看一下:「PHP's Git server compromised, moving to GitHub (php.net)」。

Yesterday (2021-03-28) two malicious commits were pushed to the php-src repo [1] from the names of Rasmus Lerdorf and myself. We don't yet know how exactly this happened, but everything points towards a compromise of the git.php.net server (rather than a compromise of an individual git account).

While investigation is still underway, we have decided that maintaining our
own git infrastructure is an unnecessary security risk, and that we will
discontinue the git.php.net server. Instead, the repositories on GitHub,
which were previously only mirrors, will become canonical. This means that
changes should be pushed directly to GitHub rather than to git.php.net.

不知道發生什麼事情,要等事後的報告出來...

Airtable 的 Open Source 替代方案 Baserow

Hacker News Daily 上看到的產品 Baserow,另外在 Hacker News 的討論也有蠻多有趣的東西:「Baserow.io – Self-hosted Airtable alternative (baserow.io)」。

Baserow 的後端是用 Django 寫的,前端則主要是用 Vue.js

可以看到討論裡 Airtable 的問題,先不講定價問題,只講其他的部份... (因為就如同討論裡面有提到的,有可能是公司故意把定價策略訂成讓不願意花大錢的人使用)

首先是每個月都有「穩定的 downtime」,不過這邊的描述到的數字明顯有問題,一個月當了七個小時也有 99% uptime (兩個九)。

不過先撇開這點,付費服務一般都可以看到 99.9% 的 Monthly SLA (三個九,一個月只允許 43.2 分鐘),這個情況的確是不太符合業界的標準:

Reliable 1-5 hours a month of downtime. There are months where it's literally 1 nine of uptime. Their status page was actually down for a while (I think they forgot to renew it?)

另外一個有很趣的是很奇耙的設計:

Booleans in the API are `true` or `undefined`. Seriously.

看起來要有蠻多背景知識才有可能知道為什麼這樣搞 XDDD

先丟給 data team 看看,如果他們有興趣的話再找機會架起來...

Open Source 專案的 Office Hour

Simon Willison 提出了一個想法,認為 Open Source 專案可以透過 Office Hour 的方式幫助社群:「Open source projects: consider running office hours」,順帶一提的是,本來的標題是「Open source projects should run office hours」,在 Hacker News 上有些人看不爽,所以就改掉了,討論串在「Open source projects should run office hours (simonwillison.net)」這邊可以看到。

Office Hour 這個詞不知道出自哪裡,不過在大學的時候常常用到,主要是教授或是助教會安排一個固定的時間與地點,讓學生可以過去發問。

社群也有類似的作法,像是 WikimediaIRC office hours,是線上的形式,透過 IRC 溝通。

如果是商業公司主導的 open source 專案應該是可以考慮的方法,有地方可以問的確會方便不少。

AWS 跳出來決定繼續搞 Elasticsearch 了

先前提到「Elasticsearch 與 Kibana 也變成非 Open Source 軟體」,後來 Elastic 的 CEO (創辦人) 發了一篇「Amazon: NOT OK - why we had to change Elastic licensing」直接批評 AWS

接下來是 AWS 跳出來放話了,基本上也是個新聞稿:「Stepping up for a truly open source Elasticsearch」,大概就是會繼續維護自己的版本,維持本來的 Apache License, Version 2.0,然後批評 Elastic 所說的話不實之類的...

現在還在雙方放話的階段,過一陣子看看有什麼更新...

Elasticsearch 與 Kibana 也變成非 Open Source 軟體

Nuzzel 上看到的消息,ElasticsearchKibana 也變成非 Open Source 軟體了:「Elasticsearch and Kibana are now business risks」,官方的公告在「Upcoming licensing changes to Elasticsearch and Kibana」這邊。

新版將會採用 SSPL (由 MongoDB 設計出來的授權) 與 Elastic License (Elastic 的商用授權) 的雙重授權,不過兩個授權都不是 Open Source 授權。

應該是跟 Amazon Elasticsearch Service 這種搞法加減有些關係?不知道 AWS 這邊後續會怎麼弄...

另外如果不選擇 Elasticsearch 的話,目前好像只有 Solr 算是堪用?不過很久沒回去看 Solr,不知道現在軟體發展到什麼程度...

Nmap 變成非 Open Source Software

在 RSS reader 上看到「A license change for Nmap」這篇,雖然看不到內容,但標題已經先把重點講出來了 (雖然在 Hacker News 上找一下就有連結了),看起來 Nmap 的軟體授權有改過,查了一下是在去年十月出版的 7.90 發生的,不過最近突然被炒熱了起來:「Nmap 7.90 Released! First release since August 2019.」。

We also did some long-needed license cleanup and gave the license a name (Nmap Public Source License) to avoid the previous confusion of Nmap being under "GPLv2 with various clarifications and exceptions". The NPSL is still based on the GPLv2, but brings in terms from some other popular open source licenses. See https://nmap.org/npsl

看到這種自我宣稱的就超可疑,而翻了一下 NPSL 裡面的限制,看起來就不怎麼符合 open source license 的定義,在「Is nmap's custom NPSL license free?」這邊的說明算是很客氣了,都是掛上「probably」,不過大家自己讀過以後應該就會知道問題了...

目前開槍的應該就是 Fedora 了,Fedora 在 Nmap Public Source License (NPSL) Version 0.92 - devel-announce - Fedora Mailing-Lists 這邊決定把 NPSL 列為 bad license,並且在 Fedora 裡面禁用。

Debian 目前則是在「#972216 - nmap: New NPSL 0.92 license likely non-free - Debian Bug report logs」這邊也有類似的討論,不過目前看起來就還在討論,沒有動手。

Gentoo 跟情況跟 Debian 也類似,在「Add NPSL (nmap license) to MISC_FREE」這邊討論中。

看起來這幾天應該會有進展,沒意外的話應該是會被封殺,裡面的條款把 installer 之類的程式也都限制進去了,直接影響到 Linux 平台的各種工具 (像是 apt/dnf/yum)。

該拉個折凳,買個爆米花來等著看了...

Travis CI 停止提供服務給 Open Source 專案

Hacker News Daily 上看到這個,在講 Travis CI 終止對 open source 專案的服務:「Travis CI is no longer providing CI minutes for open source projects」。

有不少專案已經改用其他 CI 服務的 free tier 做,像是 GitHub ActionsCircleCI 都有提供。

看了一下 Hacker News 上的討論,不少人是可以理解不會有永遠免費的午餐,只是這次 Travis CI 的處理讓大家覺得比較討厭的是,一方面官方一直跟 open source community 說我們很願意支援 open source community (前幾個禮拜官方 blog 還有發文重申這件事情),另外一方面是一直在朝著關閉服務走:從限制 10K credits 開始,到現在不會再提供 credit 給 open source 專案。

有人整理了對應的時間軸:

? 2018: Travis CI announces they are starting the process of merging travis-ci.org, which provided free builds for OSS projects, into travis-ci.com, which until then was only for paying customers. They promise OSS builds will continue to be free.

? 2020: Travis CI announces they are shutting down travis-ci.org at the end of the year and all projects have to move to travis-ci.com. They promise OSS builds will continue to be free.

Early November 2020: travis-ci.com switches from providing unlimited builds for OSS to only providing 10k one-time credits by default. Projects that meet certain guidelines (e.g. no one paid to work on them) can apply for recurring credits.

Later in November 2020: CI for many OSS projects that had migrated to travis-ci.com starts to fail, as they've exhausted their 10K credits.

Dec 2020: If what is reported here is accurate, Travis CI stop providing any recurring OSS credits. CI breaks for the remaining OSS projects on travis-ci.com.

Jan 2021: travis-ci.org shuts down. CI will be broken for all projects using it. They'll have the option of migrating to travis-ci.com, but will soon break again as they exhaust their 10k credits.

這種服務非常吃 CPU resource,大型專案如果每個 push 或是每個 pull request 都跑一輪完整的測試,成本應該不低,大概可以理解為什麼 Travis CI 會這樣決定,不過態度就...

其他家有提供 free tier 的 CI 最近應該會湧入不少人,這幾個月可以看看其他家會不會也跟進,另外一方面應該也會有人開始自架?

IFTTT 與 n8n

看到「Goodbye IFTTT」這篇在講 IFTTT 收費後的替代方案。

我自己還是繼續用 IFTTT,主要是 Line 的 bot 申請起來太麻煩了,就花錢丟著,其他的大多都有方案可以處理。

但不管怎麼樣,open source 的方案還是可以玩看看... 文章裡其中一個提到的是 n8n,用 Node.js 寫的,裝起來也蠻簡單的 (我是用 nvm + npm 裝起來),而目前支援的項目在「Integrations (Nodes)」這邊可以看到。

跑起來後連上去,這界面看起來更像當年 Yahoo! 家的 Yahoo! Pipes,而不是 IFTTT... 有點唏噓的感覺。

晚點再多花點時間玩玩 n8n...

另外一個是用 Rails 寫的 Huginn,純粹個人偏好,應該暫時不會碰...

Debian 資助 PeerTube 發展

看到「Debian donation for Peertube development」這則消息,Debian 決定資助 10K 歐元提供給 PeerTube 發展。

不過更大的幫助應該是 PR 上的部份,這帶出來的曝光度以及「認可」的部份比 10K 歐元重要的多。

回到 Debian 決定資助的原因,是因為 DebConf20 需要一個非封閉式平台的直播架構,而 PeerTube 看起來很適合這個情境:

This year's iteration of the Debian annual conference, DebConf20, had to be held online, and while being a resounding success, it made clear to the project our need to have a permanent live streaming infrastructure for small events held by local Debian groups. As such, Peertube, a FLOSS video hosting platform, seems to be the perfect solution for us.

前幾天在「有風聲說司法部會把 Chrome 拆出 Google」這邊有提到 YouTube 很難取代的問題,這個算是其中的一個方向,試著在解決平台壟斷的問題...