MbedTLS licensing terms

[5U4GB]

That's also why many OSS licenses have advertising clauses as their main component

In this context of the above I wonder how often a dev of "OS" software is hoping to make money doing "consultancy".

This only works in limited circumstances.  One that I've encountered several times is where the software is so hard to use, and there are no real alternatives, that it's easier to just pay the author(s) a consulting fee and offload the problem to them him.

Another one is the dual-license model, available under some OSS license but there's an option to buy a support contract.  Many companies will actually require that a contract be in place before using something in order to ensure that a software component they're using doesn't just evaporate when the dev(s) get tired of it.

[5U4GB]

The MbedTLS guys bring out a new version every not many weeks! No idea how they find the time. Somebody was talking about a quantum crypto resistant version. They can just keep going...

Which is only a feature on the web, where you need to be new and shiny and cromulent and everything more than a week old is out of date.  With embedded having a target that shifts once a fortnight used in a product that may have a 20-year lifecycle is a major liability.

[voltsandjolts]

Nobody creates open source software with expectation of getting rich. People just want to release the software for everyone to use.

For the most part that's likely true, but it's increasingly common to see start-ups distributing open source code. They want to get traction in a market, and free-to-use gets that traction, coupled with open code giving more confidence a product won't just disappear. Then it evolves to open-core and/or paid support services. And here we are in 2025, with the Open Source Software Market valued at approximately USD 45 billion, so there is money to be made.

[peter-h]

How is that 45BN made up?

[5U4GB]

How is that 45BN made up?

It's made up by someone at Gartner saying "Hey Bill, how much do you think the open-source market is worth?" and Bill replying "I dunno, how does $45B sound?" and the first person responding "Yeah, that sounds credible.  Put it in a report and charge $1295 for people to read it".

[voltsandjolts]

Same like non-open source software market then?

[peter-h]

Well at least you agree that a valuation of the OS market is obviously BS since there is no revenue stream other than 3rd party work generation for consultants, like my Magento example above.

In my project it cost perhaps 5k to 10k of contractor time to integrate MbedTLS into LWIP.

[Nominal Animal]

there is no revenue stream other than 3rd party work

Why would you think that?

Just because you do not buy and sell free/open source software like you buy and sell proprietary closed source binaries, does not mean there is no revenue stream.  Just because you don't understand how to make money developing open source, does not mean nobody else can either.

Many senior free/open source developers contribute because they need the software tool themselves.  That is exactly how Linus Torvalds initially created git.  It is also why better software companies recognize that it is in their business interest to let their senior developers spend a part of their paid work time contributing to free/open source software projects: they tend to focus on developing the tools used by the company to get things done better.

This means that the majority of people getting paid to develop free/open source are not consultants, but working for a company or organization that uses those tools in their everyday business.  The software is not a product, but a tool.  The developers don't get paid by the product, they get paid by the results.

Using ones FOSS project contributions as a portfolio is how new but capable developers can become senior developers with the accompanying paycheck, without staying in a single company for years.  These are the people who get hurt worst when advertising/notice clauses are ignored in licenses.

When I've consulted for businesses and organizations, I've most often used open source licenses, simply because I treat the work product as a tool "owned" by them (in the FULU Foundation / Louis Rossmann sense), instead of as a COTS product I sell them.  I found the work itself fun and rewarding, but the business aspects (especially selling ones own time in the first place) are incompatible with my personality.  This is a major niche currently occupied by bullshit-talking money-grabbing huge consultant firms, which I believe from experience that many software developers and systems integrators could get into: developing bespoke tooling and customization that the client will wholly "own" (except for redistribution as governed by copyright).  There are lots of people that are opposed to this in principle, just because they believe that the work product they get is tied to the custom vendor, which is how large consultancies keep squeezing money out of their clients.  The trick, therefore, is to use an open source license on the work product, showing and proving to the client that they have the right and freedom to pick anyone to do further work on the tooling if need be, and won't be tied to you-as-the-vendor for the lifetime of the tool.

[voltsandjolts]

Well at least you agree that a valuation of the OS market is obviously BS

It's for me alone to say what I agree with. I agree only that the markets are often times based on bluster, bullshit and belief. Values after a crash are more like real-world sustainable value imo.

... no revenue stream other than 3rd party work generation for consultants

Nope. Consulting is just one part of the goods and services built around OS. Too many to list here, but one example you likely haven't thought of is how OS provides a market for traditional closed source software, "Look here, our software makes it easy to manage <open source stuff> on a wide scale for deployment throughout your organisation". Which was certainly part of the Red Hat strategy when they sold to IBM for $35B a few years back.

In my project it cost perhaps 5k to 10k of contractor time to integrate MbedTLS into LWIP.

Take consolation in that you've had way more than 10k of consulting time out of this forum's members, for free.

[peter-h]

When I get something working, I post the code. And lots of detail.

So I put plenty back into the community.

Haven't seen you do that   Just personal attacks.

[voltsandjolts]

I put plenty back into the community.
Haven't seen you do that   Just personal attacks.

Haven't seen = haven't looked.
And please quote all my personal attacks for all to see, instead of vague handwaving.

[Nominal Animal]

Just personal attacks.

Do note that while my posts are blunt, they're not intended as hostile at all.  I'm only telling you (you personally, and all readers in general) what I wish one of the business angels had told me thirty years ago, when I was starting my then IT business at an incubator.

[5U4GB]

In my project it cost perhaps 5k to 10k of contractor time to integrate MbedTLS into LWIP.

And this is why the dual-license model used by a number of OSS projects works, if it costs less to license a usable code base commercially than to fight a hard-to-use-one that's free like a puppy, you have a business model.

[peter-h]

Do you mean there are people who integrate MbedTLS into your product, for a consultancy fee?

There are other X509 implementations but then one can debate whether they are better or not. My view, FWIW, is that MbedTLS is quite well known, and while its never-ending stream of new versions make it hard to sell a product where the customer needs to be aware of the version (and in particular not TLS 1.3 unless you go for a new version) this may be OK given the obvious IoT security requirements (e.g. not a Server and not on an open port).