Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AGPL License

en.wikipedia.org

Post reply on HN
Print view View original

51–60 of 111 posts

Re: AGPL License

#51

Post by eesmith »

Dayshine wrote: post #36
MichaelApproved wrote: post #35

Earlier quoted context omitted.

> A research project might be collecting sensitive personal information. The data being processed (personal info) has nothing to do with the source code. You can release the code while keeping the data private.

The source code will indicate where/how the data is input, processed and stored. It might help an attacker compromise the application in any number of ways. There's non-trivial risk there, enough to make it an ethical concern. So, in order to use AGPL software, you have to open source your entire source code, which means you have to go through a long and arduous risk assessment which will likely decide you can't.

You only have to open source the AGPL'ed code if it's providing a networked service.

Many academics and charities don't provide services, so it doesn't affect them.

When you write "enough to make it an ethical concern", is that a hypothetical concern of your own making?

Many academics must go through institutional review boards or other ethics committees.

Many academics also develop and distribute free software for analyzing sensitive data where IRB oversight is required.

If what you are saying is a real concern, then I expect it would have been brought up long ago.

Can you point to examples?

I believe your argument is equivalent to those saying that Linux-based free OSes cannot be used for secure platforms because the source code is available, so anyone can potentially break in.

So why is it that many people doing research which requires IRB oversight use Linux-based OSes?

I agree with tokai - you're arguing for security-by-obscurity, and there's no evidence that that increases security.

I think the evidence shows that the ethical concerns you suggest don't actually exist.

Re: AGPL License

#52

Post by Dayshine »

arghwhat wrote: post #41
Dayshine wrote: post #28

Earlier quoted context omitted.

A research project might be collecting sensitive personal information. A charity might have a public but internal management system for staff or related organisations to organise on. In either case, being open source increases security risk.

> In either case, being open source increases security risk. This is blatantly false. Any claim that closed source is provides any form of security is entirely a claim in security by obscurity. If open sourcing your code presents any risk to sensitive personal information, then that means that you are already grossly mishandling this information. Whether or not your open source your code at this point doesn't matter—…

> If open sourcing your code presents any risk to sensitive personal information, then that means that you are already grossly mishandling this information

This is also clearly false.

For example, take this scenario:

- You use web framework Omega, but minimise indicators of this (suppress HTTP headers, etc).

- At 2am, a critical security vulnerability is discovered for Omega and a patch is released shortly after.

- Malicious actors scrape GitHub to find sites that use Omega, and try compromise them.

- At 9am, you apply this patch.

If your project is open source, there is a 7 hour window where you are clearly and publicly broadcasting that you are vulnerable.

If your project is not, there is a 7 hour window where you are vulnerable, but this is not easily apparent to attackers.

How would you prevent this risk?

Re: AGPL License

#53

Post by anyzen »

zeveb wrote: post #25
theawesomekhan wrote: post #6

Google does not allow usage of AGPL code. https://opensource.google/docs/using/agpl-policy/

Sounds like it's working as intended: preventing services from restricting the rights of their users to run, modify & share source code.

This! I am quite sure that most projects, in exchange for some negligible part of Google's money, would be more than happy to offer the software under a different license. My guess is that it's the difficulty of ensuring that the new license terms are not breached (the license would need to be checked by lawyers, approved,...) that is the real deal breaker.

Not that I sympathise with Google here, they can afford to give something back to FOSS (not just when it advances their agenda).

Re: AGPL License

#54

Post by smarx007 »

I was thinking that ALGPL is a worthy addition. We need a licence that still applies to use in microservices and other code that is not shared with the user but still shows consideration for investment into proprietary code and only limits its provisions to the code under the given license. I would gladly license my work under ALGPL if it existed.

Re: AGPL License

#56

Post by anyzen »

Dayshine wrote: post #52
arghwhat wrote: post #41

Earlier quoted context omitted.

> In either case, being open source increases security risk. This is blatantly false. Any claim that closed source is provides any form of security is entirely a claim in security by obscurity. If open sourcing your code presents any risk to sensitive personal information, then that means that you are already grossly mishandling this information. Whether or not your open source your code at this point doesn't matter—…

> If open sourcing your code presents any risk to sensitive personal information, then that means that you are already grossly mishandling this information This is also clearly false. For example, take this scenario: - You use web framework Omega, but minimise indicators of this (suppress HTTP headers, etc). - At 2am, a critical security vulnerability is discovered for Omega and a patch is released shortly after. - M…

It doesn't work that way. Attackers don't check if you are using "Omega", they check if you are vulnerable. There is simply no difference if you are hiding framework indicators here.

Well - unless there is a targeted attack _against you_. In this case the attacker will search for known vulnerabilities in Omega and maybe even try to come up with some new ones. Having source helps the attackers here, but then again, it has helped researchers fix the vulnerabilities too. So it's a mixed blessing.

Re: AGPL License

#57

Post by andybak »

brazzy wrote: post #46
daurnimator wrote: post #8

Earlier quoted context omitted.

What did you replace it with? Why wouldn't iText deserve your money if you were using it in your commercial product?

> Why wouldn't iText deserve your money if you were using it in your commercial product? Because they're not even saying how much money. "Call us for a quote" usually means "Let's start the sales dance in which we try to gauge how much we can fleece you for", which also means it's not going to be a quick answer. For me it means the software is immediately categorized as "to be considered only once all other options h…

I agree with your feelings on this last point. I wonder how it's working out for them as I imagine it's a turn off for corporate buyers as well as lone devs and small shops.

Re: AGPL License

#58

Post by protanopia »

zeveb wrote: post #25
theawesomekhan wrote: post #6

Google does not allow usage of AGPL code. https://opensource.google/docs/using/agpl-policy/

Sounds like it's working as intended: preventing services from restricting the rights of their users to run, modify & share source code.

IMO, the goal of open source licenses is to encourage more usage of open source. If AGPL is preventing companies from using it, then it is accomplishing the opposite.

Re: AGPL License

#59

Post by jandrewrogers »

ben-schaaf wrote: post #27
zeveb wrote: post #22

Earlier quoted context omitted.

Why would charities and academic institutions be writing anything but free software?

I never understand this. I get not wanting to build a community around a project, handling contributions, etc. But why not just dump the source code somewhere?

The mechanics of putting a tarball somewhere on the Internet are simple and cheap, but that action also directly and indirectly greatly increases the potential for liability. This effectively requires the organization to create additional management and processes to mitigate this increased potential for liability. It is a headache many organizations want to avoid or can't afford.

Yes, "dumping source code" is simple and cheap. Managing the implications of doing so are not. I know of many cases where companies backed away from open sourcing software due to the overhead it would entail, even when they could afford it in principle.

Re: AGPL License

#60

Post by dec0dedab0de »

andybak wrote: post #57
brazzy wrote: post #46

Earlier quoted context omitted.

> Why wouldn't iText deserve your money if you were using it in your commercial product? Because they're not even saying how much money. "Call us for a quote" usually means "Let's start the sales dance in which we try to gauge how much we can fleece you for", which also means it's not going to be a quick answer. For me it means the software is immediately categorized as "to be considered only once all other options h…

I agree with your feelings on this last point. I wonder how it's working out for them as I imagine it's a turn off for corporate buyers as well as lone devs and small shops.

I imagine it's a turn off for corporate buyers as well as lone devs and small shops.

The request a quote style of pricing is almost exclusively for corporate buyers. It allows them to go out to lunch and get the purchasing department involved and make management feel like an important part of the process.

Post reply on HN