The one positive of this is it seems to have livened up the open source project (Vinyl Cache). Features that haven't been added for years are now being worked on, whether they step on the toes of the commercial offering or not.
This was published in April, and we are far from consensus on what is “varnish”. Lots of distributions are now packaging vinyl and calling it varnish, some are pointing to the varnish repo instead (Fedora, Homebrew).
Well I guess the enterprise side of varnish was quite beneficial to him (and the core devs) over that time. If something gives you financial freedom over 10+ years to work on a thing you love, you can't be mad at all of it.
But if FOSS is deeply encoded into your DNA, you become pretty protective once you realize your project may become extinct sometimes in the future.
It sounds like Varnish Cache is kind of a distribution of Vinyl Cache. It's based on the FOSS project with its own downstream patches.
On another topic:
> The Varnish Cache FOSS software was initiated and sponsored by the Norvegian newspaper Verdens Gang. They hired a company called “Linpro” to handle the logistics and me to write the code.
> From Linpro grew the company Varnish Software
> IP-Lawyers still insist that Varnish Software owns the Varnish Cache name
Consultants came in a just assumed the IP? It sounds like a pretty complicated cross-border ordeal, but that is still quite a leap.
> Varnish Cache is a distribution of the open-source Vinyl Cache project, made for the modern cloud: ready for Kubernetes, with built-in TLS support, and a long-term-support release cadence with extra modules and tooling layered on top.
The comparison with MySQL/MariaDB is unfortunate, given that since the "split" MariaDB has shown itself to be every bit the corporate owned "FOSS" project while its supporters still harp on about how terrible oracle is for OSS, without actually acknowledging the real history of each respective project and accompanying company.
Given that MariaDB the company is now owned by a private equity firm, I doubt it's going to get better.
To me the biggest "unknown" with Percona is that MariaDB (the company) bought out Codership (the creators of Galera Cluster, which XtraDB Cluster is based on) and it doesn't seem to be OSS any more.
I'm sure for some shops this will drive them to pay for the same feature in MariaDB cluster, but I'm more likely to just transition to MySQL Group Replication.
This is my whole point about MariaDB - they are steadily making their OSS software completely dependent on the company (paid) versions for anything beyond toy scale.
I don't think your last sentence is fair. Many workloads don't need something like Galera, as standard async replication scales to extreme levels, and you can achieve excellent HA with external orchestration and/or proxies. FOSS MariaDB is definitely not toy-scale only.
Oracle has also been guilty of locking modern table stakes behind the MySQL Enterprise / Heatwave pay gate, such as vector indexes and JS stored procedures. And while they've recently announced more of this stuff will move to FOSS soon, at the same time their response rate to new bug reports has become worse than ever before, which is deeply worrying.
And a couple days ago Oracle announced that they're nonsensically changing their MySQL versioning/LTS naming yet again. So now the way you identify an LTS is "major version is an even-numbered last two digits of a year, while minor version is exactly 4 to represent LTS releases always being in April." So for example MySQL 28.4 will be LTS, but 28.7 and 28.10 are not. But prior to this, 9.7 and 8.4 are LTS, and 8.0 was de facto LTS but now EOL. It's bizarre. I wish I was joking!
> And while they've recently announced more of this stuff will move to FOSS soon, at the same time their response rate to new bug reports has become worse than ever before, which is deeply worrying.
A huge chunk[1] of the MySQL developers were laid off (and also large amounts of QA etc.), so it's not surpising at all that they are struggling to keep the lights on. There are talks about an external group trying to form to take more ownership, but so far, your best bets are MariaDB or Postgres, depending on whether you think MySQL 5.1 was the epitome of relational databases or not.
[1] From what I gather, about 75%. In the first wave.
> Many workloads don't need something like Galera [etc...]
This continues the faulty line of thinking that open source is just for hobby-level projects or early startup throwaway infrastructure. So many open-core models rely on this falsehood to rationalize their decisions. It should be possible to run large-scale important Internet things on Open Source code, too, for a variety of reasons.
> This continues the faulty line of thinking that open source is just for hobby-level projects or early startup throwaway infrastructure.
How so? I don't understand your comment at all. A huge chunk of the world's economy runs on async replication in FOSS MySQL/MariaDB, my whole point was that you literally don't need Galera to do that.
If you've ever had to work with nontrivial procs in MySQL/MariaDB, it's immediately clear how the status quo is deficient there, and why e.g. Postgres's multi-language support is so much better in comparison.
And how is it "minutiae" to be able to figure out "is my database version actually supported"? This is the fourth versioning scheme they've used in less than a decade, that's a bit nuts I think.
I would happily write stored procs using the current language support for a decade without pay, before I'd subject myself to putting javascript in a fucking database engine.
> And how is it "minutiae" to be able to figure out "is my database version actually supported"?
Remembering "8.4", "9.7" and ".4" just doesn't seem like a particularly big deal to me. The number* has only changed 3 times in the last 10 years.
I don't like JS either, but lots of people do. And if you're expanding a DB beyond SQL-only, JS is an obvious first choice before adding further languages from there. (The MySQL feature is called "Multilingual Engine Component" and not "JavaScript Engine Component".)
As for the versioning, it's a nightmare for third party vendors like me, because it will absolutely increase the number of companies who are unintentionally running unsupported non-LTS "innovation" releases because they can't keep all these versioning changes straight. The major-version only changed 3 times in the past decade because 8.0 was "evergreen" for most of that time, which was also not a good strategy, yet the most obvious solution (SemVer) is always ignored by Oracle in favor of more confusing alternatives.
does the mysql/mariadb comparison actually make sense? mysql is not really a downstream distro of mariadb (maaybe even the opposite?) so i thought i understood the situation as presented until that paragraph
The way I remember it, was that MySQL was sold, then some time after, MariaDB was created as a fork, and you could switch between them. Then at one point MariaDB diverged sufficiently that you could no longer "effortlessly" (kinda) switch between them, by now they're separate but MariaDB's origin is still MySQL obviously.
I had the same immediate reaction. It's a completely nonsensical comparison which just demonstrates the author is extremely confused about the relationship between MySQL and MariaDB, in terms of their corporate entities and project structures.
That said, it seems to be a common point of confusion among FOSS die-hards, but still super unfortunate to see it repeated in this context!
Are you maybe confusing “downstream” with “mainstream”? Being “downstream” of a product means that you are a derivative of that product (your upstream), taking in basically all of their code and adding your own on top.
"Vinyl cache" is an interesting name. I wonder what other candidates the maintainers considered? I was secretly hoping they would name it "Veneer Cache" or something similar to "varnish".
The operational wrinkle nobody mentions in the rename is that the same vulnerability now ships under two version trains. VSV00019 was just patched as Vinyl 9.0.1 and as Varnish 8.0.2 and 6.0.18, so anyone pinning a version in their package manager has to figure out which lineage their distro actually tracks before the next CVE lands.
The one positive of this is it seems to have livened up the open source project (Vinyl Cache). Features that haven't been added for years are now being worked on, whether they step on the toes of the commercial offering or not.
This was published in April, and we are far from consensus on what is “varnish”. Lots of distributions are now packaging vinyl and calling it varnish, some are pointing to the varnish repo instead (Fedora, Homebrew).
I’d left a comment last time, but haven’t tracked it since: https://news.ycombinator.com/item?id=47728216
This article links to a previous one[0] (by Poul) which states:
> I will also state for the record, that there are no hard feelings between Varnish Software and the FOSS project.
I wonder if that is still the case now. (this article is fairly diplomatically written, but I'd imagine it must be pretty frustrating)
[0] https://vinyl-cache.org/organization/20-years.html#years
Well I guess the enterprise side of varnish was quite beneficial to him (and the core devs) over that time. If something gives you financial freedom over 10+ years to work on a thing you love, you can't be mad at all of it.
But if FOSS is deeply encoded into your DNA, you become pretty protective once you realize your project may become extinct sometimes in the future.
It sounds like Varnish Cache is kind of a distribution of Vinyl Cache. It's based on the FOSS project with its own downstream patches.
On another topic:
> The Varnish Cache FOSS software was initiated and sponsored by the Norvegian newspaper Verdens Gang. They hired a company called “Linpro” to handle the logistics and me to write the code.
> From Linpro grew the company Varnish Software
> IP-Lawyers still insist that Varnish Software owns the Varnish Cache name
Consultants came in a just assumed the IP? It sounds like a pretty complicated cross-border ordeal, but that is still quite a leap.
> What is Varnish Cache?
> Varnish Cache is a distribution of the open-source Vinyl Cache project, made for the modern cloud: ready for Kubernetes, with built-in TLS support, and a long-term-support release cadence with extra modules and tooling layered on top.
(https://www.varnish.org/index.html)
Well there you go...
What a mess... It's sad that the community has to suffer the consequences of a company holding the trademark hostage.
The comparison with MySQL/MariaDB is unfortunate, given that since the "split" MariaDB has shown itself to be every bit the corporate owned "FOSS" project while its supporters still harp on about how terrible oracle is for OSS, without actually acknowledging the real history of each respective project and accompanying company.
Given that MariaDB the company is now owned by a private equity firm, I doubt it's going to get better.
Still got Percona, but I'm not sure what their status is at the moment.
To me the biggest "unknown" with Percona is that MariaDB (the company) bought out Codership (the creators of Galera Cluster, which XtraDB Cluster is based on) and it doesn't seem to be OSS any more.
I'm sure for some shops this will drive them to pay for the same feature in MariaDB cluster, but I'm more likely to just transition to MySQL Group Replication.
This is my whole point about MariaDB - they are steadily making their OSS software completely dependent on the company (paid) versions for anything beyond toy scale.
I don't think your last sentence is fair. Many workloads don't need something like Galera, as standard async replication scales to extreme levels, and you can achieve excellent HA with external orchestration and/or proxies. FOSS MariaDB is definitely not toy-scale only.
Oracle has also been guilty of locking modern table stakes behind the MySQL Enterprise / Heatwave pay gate, such as vector indexes and JS stored procedures. And while they've recently announced more of this stuff will move to FOSS soon, at the same time their response rate to new bug reports has become worse than ever before, which is deeply worrying.
And a couple days ago Oracle announced that they're nonsensically changing their MySQL versioning/LTS naming yet again. So now the way you identify an LTS is "major version is an even-numbered last two digits of a year, while minor version is exactly 4 to represent LTS releases always being in April." So for example MySQL 28.4 will be LTS, but 28.7 and 28.10 are not. But prior to this, 9.7 and 8.4 are LTS, and 8.0 was de facto LTS but now EOL. It's bizarre. I wish I was joking!
> And while they've recently announced more of this stuff will move to FOSS soon, at the same time their response rate to new bug reports has become worse than ever before, which is deeply worrying.
A huge chunk[1] of the MySQL developers were laid off (and also large amounts of QA etc.), so it's not surpising at all that they are struggling to keep the lights on. There are talks about an external group trying to form to take more ownership, but so far, your best bets are MariaDB or Postgres, depending on whether you think MySQL 5.1 was the epitome of relational databases or not.
[1] From what I gather, about 75%. In the first wave.
> Many workloads don't need something like Galera [etc...]
This continues the faulty line of thinking that open source is just for hobby-level projects or early startup throwaway infrastructure. So many open-core models rely on this falsehood to rationalize their decisions. It should be possible to run large-scale important Internet things on Open Source code, too, for a variety of reasons.
> This continues the faulty line of thinking that open source is just for hobby-level projects or early startup throwaway infrastructure.
How so? I don't understand your comment at all. A huge chunk of the world's economy runs on async replication in FOSS MySQL/MariaDB, my whole point was that you literally don't need Galera to do that.
> such as vector indexes and JS stored procedures
So, the stuff that basically appeals to people chasing the AI dragon, and has zero practical use for 99.999% of developers making real products?
> I wish I was joking!
I wish I could care even a little bit about such minutiae.
If you've ever had to work with nontrivial procs in MySQL/MariaDB, it's immediately clear how the status quo is deficient there, and why e.g. Postgres's multi-language support is so much better in comparison.
And how is it "minutiae" to be able to figure out "is my database version actually supported"? This is the fourth versioning scheme they've used in less than a decade, that's a bit nuts I think.
I would happily write stored procs using the current language support for a decade without pay, before I'd subject myself to putting javascript in a fucking database engine.
> And how is it "minutiae" to be able to figure out "is my database version actually supported"?
Remembering "8.4", "9.7" and ".4" just doesn't seem like a particularly big deal to me. The number* has only changed 3 times in the last 10 years.
I don't like JS either, but lots of people do. And if you're expanding a DB beyond SQL-only, JS is an obvious first choice before adding further languages from there. (The MySQL feature is called "Multilingual Engine Component" and not "JavaScript Engine Component".)
As for the versioning, it's a nightmare for third party vendors like me, because it will absolutely increase the number of companies who are unintentionally running unsupported non-LTS "innovation" releases because they can't keep all these versioning changes straight. The major-version only changed 3 times in the past decade because 8.0 was "evergreen" for most of that time, which was also not a good strategy, yet the most obvious solution (SemVer) is always ignored by Oracle in favor of more confusing alternatives.
Does Fastly still uses Vinyl Cache? Wondering who else is using it as well in production.
They are using a fork, although nobody _really_ knows how up-to-date it is.
Last I heard they were migrating to WASM based edge compute that could read Varnish configs but not sure how far they got
does the mysql/mariadb comparison actually make sense? mysql is not really a downstream distro of mariadb (maaybe even the opposite?) so i thought i understood the situation as presented until that paragraph
The way I remember it, was that MySQL was sold, then some time after, MariaDB was created as a fork, and you could switch between them. Then at one point MariaDB diverged sufficiently that you could no longer "effortlessly" (kinda) switch between them, by now they're separate but MariaDB's origin is still MySQL obviously.
Yes Monty started MySQL then forked when either Sun or Oracle acquired it.
My, Maria, and Max are his kids. There is MaxScale which is a L7 SQL proxy/loadbalancer
I had the same immediate reaction. It's a completely nonsensical comparison which just demonstrates the author is extremely confused about the relationship between MySQL and MariaDB, in terms of their corporate entities and project structures.
That said, it seems to be a common point of confusion among FOSS die-hards, but still super unfortunate to see it repeated in this context!
mysql was pretty much the downstream thing that everybody used back then.
MySQL has never been downstream of MariaDB.
I am talking pre mariadb times.
Are you maybe confusing “downstream” with “mainstream”? Being “downstream” of a product means that you are a derivative of that product (your upstream), taking in basically all of their code and adding your own on top.
It definitely sounds more musical to my ears.
In Canada, we pronounce it Vinyl CachÉE.
Can you write that phonetically?
Gesundheit.
"Vinyl cache" is an interesting name. I wonder what other candidates the maintainers considered? I was secretly hoping they would name it "Veneer Cache" or something similar to "varnish".
And the bike shed absolutely MUST be painted blue
How about Shellac Cache
Vinyl flooring etc is at least related to varnishing floors?
So its not a cache for my record collection ;(
The operational wrinkle nobody mentions in the rename is that the same vulnerability now ships under two version trains. VSV00019 was just patched as Vinyl 9.0.1 and as Varnish 8.0.2 and 6.0.18, so anyone pinning a version in their package manager has to figure out which lineage their distro actually tracks before the next CVE lands.