Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AGPL License

en.wikipedia.org

Post reply on HN
Print view View original

31–40 of 111 posts

Re: AGPL License

#31

Post by Dayshine »

eitland wrote: post #30

My questions are: - if I allow users to use an AGPL product on my server and that AGPL licensed product connect to a commercially licensed application server or database on my intranet, will that be a problem? - will it be a problem if the commercial application server connects to the AGPL licensed product to fetch data? Except for these two points I now feel I'm starting to understand the AGPL, kind of.

My understanding is you can simplify it into roughly three tiers of "connection":

1. Same application, dll linked

2. Same computer, IPC linked

3. Different computer, HTTP/etc linked

Companies that use AGPL will tell you that all three are covered by AGPL.

More reasonable people will tell you that 1 is definitely covered, and 2 is a grey area.

Re: AGPL License

#32

Post by ghaff »

ben-schaaf wrote: post #27
zeveb wrote: post #22

Earlier quoted context omitted.

Why would charities and academic institutions be writing anything but free software?

I never understand this. I get not wanting to build a community around a project, handling contributions, etc. But why not just dump the source code somewhere?

Because it’s effort. People will want you to make enhancements and maybe expect changes. It may link to proprietary libraries. Open source is not really just about dumping code on GitHub.

Re: AGPL License

#33

Post by msla »

ghaff wrote: post #32
ben-schaaf wrote: post #27

Earlier quoted context omitted.

I never understand this. I get not wanting to build a community around a project, handling contributions, etc. But why not just dump the source code somewhere?

Because it’s effort. People will want you to make enhancements and maybe expect changes. It may link to proprietary libraries. Open source is not really just about dumping code on GitHub.

https://gist.github.com/richhickey/1563cddea1002958f96e7ba95...

> Open Source is Not About You

> The only people entitled to say how open source 'ought' to work are people who run projects, and the scope of their entitlement extends only to their own projects.

https://news.ycombinator.com/item?id=18538123

Re: AGPL License

#34

Post by eitland »

Dayshine wrote: post #31
eitland wrote: post #30

My questions are: - if I allow users to use an AGPL product on my server and that AGPL licensed product connect to a commercially licensed application server or database on my intranet, will that be a problem? - will it be a problem if the commercial application server connects to the AGPL licensed product to fetch data? Except for these two points I now feel I'm starting to understand the AGPL, kind of.

My understanding is you can simplify it into roughly three tiers of "connection": 1. Same application, dll linked 2. Same computer, IPC linked 3. Different computer, HTTP/etc linked Companies that use AGPL will tell you that all three are covered by AGPL. More reasonable people will tell you that 1 is definitely covered, and 2 is a grey area.

I've recently read someone who I think is affiliated with FSF say that MongoDB(?)and others have misinterpreted the AGPL intentionally to create necessary FUD to sell commercial licenses, so this is my opinion as well but when I tried to find out on the FSF page earlier this week the was still not a word in the FAQ about it.

Re: AGPL License

#35

Post by MichaelApproved »

Dayshine wrote: post #28
zeveb wrote: post #22

Earlier quoted context omitted.

Why would charities and academic institutions be writing anything but free software?

A research project might be collecting sensitive personal information. A charity might have a public but internal management system for staff or related organisations to organise on. In either case, being open source increases security risk.

> A research project might be collecting sensitive personal information.

The data being processed (personal info) has nothing to do with the source code. You can release the code while keeping the data private.

Re: AGPL License

#36

Post by Dayshine »

MichaelApproved wrote: post #35
Dayshine wrote: post #28

Earlier quoted context omitted.

A research project might be collecting sensitive personal information. A charity might have a public but internal management system for staff or related organisations to organise on. In either case, being open source increases security risk.

> A research project might be collecting sensitive personal information. The data being processed (personal info) has nothing to do with the source code. You can release the code while keeping the data private.

The source code will indicate where/how the data is input, processed and stored. It might help an attacker compromise the application in any number of ways.

There's non-trivial risk there, enough to make it an ethical concern.

So, in order to use AGPL software, you have to open source your entire source code, which means you have to go through a long and arduous risk assessment which will likely decide you can't.

Re: AGPL License

#37

Post by gruez »

Dayshine wrote: post #29
xtf wrote: post #26

Earlier quoted context omitted.

They also can use and improve it and give these improvements back to the source.

What improvements? AGPL requires open-sourcing your entire project (authentication, payment platform, etc) just to link to a backend PDF processing library. AGPL does not have a linking exception.

Putting it in a microservice should get around that, right?

Re: AGPL License

#38

Post by merb »

theawesomekhan wrote: post #13
daurnimator wrote: post #8

Earlier quoted context omitted.

What did you replace it with? Why wouldn't iText deserve your money if you were using it in your commercial product?

We are awaiting a response from IText for the license, but for now Apache PDFBox got us the same results

you won't use itext, their quotes are hilarious.

Re: AGPL License

#39

Post by pheug »

zeveb wrote: post #22
Dayshine wrote: post #20

If you're considering adopting AGPL and the reason is to prevent commercial abuse of your work: Please consider adding a non-commercial use exemption, for charities and academic research. These organisations can't afford the cost of open-sourcing their entire project.

Why would charities and academic institutions be writing anything but free software?

They could be using some third-party code/services with closed source or under proprietary/non-AGPL-compatible license, and thus they can't open-source those parts under AGPL, as AGPL demands, even if they wanted to.

Re: AGPL License

#40

Post by tokai »

Dayshine wrote: post #36
MichaelApproved wrote: post #35

Earlier quoted context omitted.

> A research project might be collecting sensitive personal information. The data being processed (personal info) has nothing to do with the source code. You can release the code while keeping the data private.

The source code will indicate where/how the data is input, processed and stored. It might help an attacker compromise the application in any number of ways. There's non-trivial risk there, enough to make it an ethical concern. So, in order to use AGPL software, you have to open source your entire source code, which means you have to go through a long and arduous risk assessment which will likely decide you can't.

Security through obscurity is not security at all.

https://en.wikipedia.org/wiki/Kerckhoffs's_principle

Post reply on HN