Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AGPL License

en.wikipedia.org

Post reply on HN
Print view View original

101–110 of 111 posts

Re: AGPL License

#101

Post by tyingq »

theawesomekhan wrote: post #6

Google does not allow usage of AGPL code. https://opensource.google/docs/using/agpl-policy/

Seems shortsighted. There are categories of software where even corporate drones shouldn't worry about AGPL. The ThoughtWorks tech radar is a decent example: https://github.com/thoughtworks/build-your-own-radar

Maybe you modified it to use some new data source, and to display it for internal use. Say O365 as a custom data source. You aren't giving away any real secret sauce by sharing your modifications. Anything sensitive is probably the actual data, not the code.

The license warrants caution. But not an outright ban.

Re: AGPL License

#102

Post by jandrewrogers »

the8472 wrote: post #70
jandrewrogers wrote: post #59

Earlier quoted context omitted.

The mechanics of putting a tarball somewhere on the Internet are simple and cheap, but that action also directly and indirectly greatly increases the potential for liability . This effectively requires the organization to create additional management and processes to mitigate this increased potential for liability. It is a headache many organizations want to avoid or can't afford. Yes, "dumping source code" is simple…

Which liabilities? Most open source licenses come with a WITHOUT WARRANTY OF ANY KIND clause.

Open sourcing creates multiple classes of risk outside the scope of the license which any properly run company must manage.

As a couple elementary examples, it greatly increases your exposure to claims of patent and copyright infringement based on the actions of your employees, both intentional and inadvertent. It significantly increases the risk that the company's trade secrets and other non-public IP accidentally end up in the public domain. You must ensure that open sourced code does not come in conflict with contractual agreements with other parties. And that is after you get every outside stakeholder in the business's strategic objectives to sign-off on it, which isn't always easy.

When an organization decides to open source a bit of code, they have to run a formal diligence process to ensure there is minimal risk of any of the above and then put a process in place to help ensure that going forward. I've seen this process at multiple companies, it is not lightweight and involves lots of lawyers and documentation that would never happen otherwise. Many companies decide it isn't worth the money or distraction.

Re: AGPL License

#103

Post by nycdotnet »

gruez wrote: post #37
Dayshine wrote: post #29

Earlier quoted context omitted.

What improvements? AGPL requires open-sourcing your entire project (authentication, payment platform, etc) just to link to a backend PDF processing library. AGPL does not have a linking exception.

Putting it in a microservice should get around that, right?

That’s the difference about the AGPL - you have to open source the things that call it too. Putting it in a microservice is literally the thing that AGPL was written to prevent you from doing to work around it

Re: AGPL License

#104

Post by skissane »

theawesomekhan wrote: post #6

Google does not allow usage of AGPL code. https://opensource.google/docs/using/agpl-policy/

A lot of other companies have the same policy. Google is unusual in being publicly open about it. Most companies, internal policies on what open source licenses are allowed are maintained by the legal department and as such are company confidential by default.

Re: AGPL License

#105

Post by skissane »

tyingq wrote: post #101
theawesomekhan wrote: post #6

Google does not allow usage of AGPL code. https://opensource.google/docs/using/agpl-policy/

Seems shortsighted. There are categories of software where even corporate drones shouldn't worry about AGPL. The ThoughtWorks tech radar is a decent example: https://github.com/thoughtworks/build-your-own-radar Maybe you modified it to use some new data source, and to display it for internal use. Say O365 as a custom data source. You aren't giving away any real secret sauce by sharing your modifications. Anything sen…

> Seems shortsighted. There are categories of software where even corporate drones shouldn't worry about AGPL... The license warrants caution. But not an outright ban.

The problem with a policy of "AGPL is allowed sometimes but not others" is who makes the judgement call on when it is appropriate and when it isn't? Can you trust the engineer implementing/consuming the component – and the average engineer isn't very familiar with licensing issues – to make that judgement call, especially when there could be significant legal and financial risks of getting it wrong? Probably not. So then the policy has to be "you can use AGPL but you have to ask for approval".

But, that's not too different from an AGPL ban – most bans have a process to ask for an exception. And, in practice, it de facto amounts to a ban, because most people will probably decide to just use some non-AGPL alternative instead of asking for formal approval (which probably has to go via legal and relatively senior management).

Re: AGPL License

#106

Post by Nullabillity »

ansgri wrote: post #72
ben-schaaf wrote: post #27

Earlier quoted context omitted.

I never understand this. I get not wanting to build a community around a project, handling contributions, etc. But why not just dump the source code somewhere?

Because it's huge (perceived) risk for (often) little gain. These projects (I'm especially familiar with research) aren't known for code quality and following best practices regarding security etc. So you open yourself for shaming and casual hacking for some unquantifiable benefit of open-source contributions.

> and following best practices regarding security

Who cares, as long as you make it clear that it's a pure research project?

The problem with Actix was that they marketed it as production-ready.

Re: AGPL License

#107

Post by lonelappde »

api wrote: post #73
thomzane wrote: post #64

Earlier quoted context omitted.

The thing about modern code is that anyone can take a project, turn it's function into a webpage, and charge money without revealing that you could run the program on your own machine. If you license all of your code under the AGPLv3, you will at least see if someone is using it out in the wild and maybe even get some contributions to your project.

This is called "SaaSification" and there is a debate over to what extent it violates the spirit of open source and what if anything ought to be done about it.

How is it different in spirit from taking a product, adding a feature to it, and distributing? It's still removing freedom from the user. That's what the AGPL is for, for removing runtime host as an excuse to not let users control their use of software.

Re: AGPL License

#108

Post by lonelappde »

afiori wrote: post #85
juuul wrote: post #21

Earlier quoted context omitted.

That's not entirely true. GPLv3 and AGPLv3 have explicit clauses that allow the linking of GPLv3 and AGPLv3 code into a single work without violating either license: https://en.wikipedia.org/wiki/Affero_General_Public_License#... You're right about GPLv2 though.

But GPLv2 is the one that allows for tivoization, and whether that violates the spirit of free code does not have a consensus.

Nothing has consensus, that's why there are so many licenses.

Re: AGPL License

#109

Post by lonelappde »

brazzy wrote: post #46
daurnimator wrote: post #8

Earlier quoted context omitted.

What did you replace it with? Why wouldn't iText deserve your money if you were using it in your commercial product?

> Why wouldn't iText deserve your money if you were using it in your commercial product? Because they're not even saying how much money. "Call us for a quote" usually means "Let's start the sales dance in which we try to gauge how much we can fleece you for", which also means it's not going to be a quick answer. For me it means the software is immediately categorized as "to be considered only once all other options h…

Hunting for a replacement seems more work than making a phone call.

Re: AGPL License

#110

Post by nycdotnet »

nycdotnet wrote: post #103
gruez wrote: post #37

Earlier quoted context omitted.

Putting it in a microservice should get around that, right?

That’s the difference about the AGPL - you have to open source the things that call it too. Putting it in a microservice is literally the thing that AGPL was written to prevent you from doing to work around it

I’m getting downvoted, but this is the stance of the company behind a popular AGPL library mentioned in this comments page based on emails I received from them after asking the same question.
Post reply on HN