Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The terms of the AGPL are pretty easy to comply with

drewdevault.com

Post reply on HN
Print view View original

141–150 of 341 posts

Re: The terms of the AGPL are pretty easy to comply with

#141

Post by woofie11 »

SpicyLemonZest wrote: post #65
woofie11 wrote: post #56

Earlier quoted context omitted.

Yeah, it's complex: * The article is right that Google IS spreading FUD. They're making legal statements which are probably false to minimize usage of the AGPL outside of Google. * Google came to a sensible conclusion, that THEY shouldn't use the AGPL * Google's articulated reasons don't hold legal water, and following Google's lead and interpretation causes many companies to mislicense their code It's a right tool f…

Maybe I'm misunderstanding. It sounds like you agree that companies with proprietary code can't link GPL libraries, and Google's statements don't suggest any problem for companies which don't care about keeping their code proprietary.

> It sounds like you agree that companies with proprietary code can't link GPL libraries

No. This is incorrect. One cannot create derivative works with AGPL code. Linking does not necessarily create a derivative work. Whether or not it does depends on the specific case, and the degree to which the code intertwines. If I have an AGPL back-end and a proprietary front-end for an online photoeditor, that's probably a problem. If I have an AGPL database and a proprietary web app using it, that's generally not a problem.

Even in the photoeditor case, it only becomes a problem at distribution. For an internal tool, AGPL+proprietary is often okay (depending on who the internal team is). AGPL means a consumer-facing web app becomes a problem.

There is a sensible decision path for avoiding linking, but it has nothing to do with this. The arguments are:

1) Engineers aren't lawyers. For a big company, it's easier to have a hard rule (no AGPL) than to train engineers to be lawyers. For small companies, more nuance is okay.

2) AGPL is as much a legal mechanism as a social signaling mechanism. If I'm using a tool not the way the authors intended for me to use -- in an open ecosystem -- that creates its own problems.

Re: The terms of the AGPL are pretty easy to comply with

#142

Post by jeffbee »

waisbrot wrote: post #122
cic48 wrote: post #33

Earlier quoted context omitted.

I’ve taken AGPL through two FAANG reviews. Both arrived at the same very-much-not-FUD legal conclusion. Paragraph 1 of section 13 requires modifications to be disclosed and source code for them to be offered to remote users. The license uses the term of art Corresponding Source for this. Corresponding Source is defined in section 1 in a crystal clear way. Two separate teams of lawyers concluded that they could cohere…

By this reasoning, if I run some AGPL software on GCP, wouldn't that place all of GCP under AGPL? I've written "scripts to control" the AGPL software, so my stuff is AGPL and Google's cloud offering is to run my code automatically so all of GCP is a "script to control".

Some companies do read the AGPL that broadly. That's why Square requires its own customers to not use AGPL software. https://squareup.com/us/en/legal/general/pos

Re: The terms of the AGPL are pretty easy to comply with

#143

Post by saagarjha »

tzs wrote: post #135
saagarjha wrote: post #112

Earlier quoted context omitted.

Surely the user source entitlement also applies if I interact with the software without a network in between? Otherwise, that would make AGPL a strangely more-but-also-less permissive license than GPL…

It is almost literally GPLv3 with the interactive remote network source obligation added in. If you diff GPLv3 and AGPLv3, the differences are (ignoring differences that are just in the name of the license): 1. The preamble has a few differences where they describe why they wrote each license and what ills they are trying to address. 2. In the actual terms and conditions, the first 13 sections and last 4 sections are…

Then I guess I am confused by this statement:

> The user source entitlement only applies to users remotely interacting with the software through a computer network.

It applies to all users under the GPLv3 as well, is certainly more than just those interacting with it over a computer network, right?

Re: The terms of the AGPL are pretty easy to comply with

#144

Post by rjmunro »

waisbrot wrote: post #122
cic48 wrote: post #33

Earlier quoted context omitted.

I’ve taken AGPL through two FAANG reviews. Both arrived at the same very-much-not-FUD legal conclusion. Paragraph 1 of section 13 requires modifications to be disclosed and source code for them to be offered to remote users. The license uses the term of art Corresponding Source for this. Corresponding Source is defined in section 1 in a crystal clear way. Two separate teams of lawyers concluded that they could cohere…

By this reasoning, if I run some AGPL software on GCP, wouldn't that place all of GCP under AGPL? I've written "scripts to control" the AGPL software, so my stuff is AGPL and Google's cloud offering is to run my code automatically so all of GCP is a "script to control".

It would mean that because GCP is not itself under AGPL, you are not complying with the license, so you could be sued by the maker of the software for copying it to GCP. You are doing the copying, you are breaking the copyrights.

Re: The terms of the AGPL are pretty easy to comply with

#145

Post by jeffbee »

pydry wrote: post #69
cic48 wrote: post #33

Earlier quoted context omitted.

I’ve taken AGPL through two FAANG reviews. Both arrived at the same very-much-not-FUD legal conclusion. Paragraph 1 of section 13 requires modifications to be disclosed and source code for them to be offered to remote users. The license uses the term of art Corresponding Source for this. Corresponding Source is defined in section 1 in a crystal clear way. Two separate teams of lawyers concluded that they could cohere…

The holy war could be avoided if Google simply paid authors of AGPL code they wanted to use instead of going on a tirade against the license. I think half the reason it exists is to make it deliberately risky for FAANGs etc. because they're exactly the ones who SHOULD be ponying up to support the open source ecosystem they rely upon.

Well, this is the heart of the issue. Chris DiBona has publicly stated that AGPL software just isn't valuable enough to care about. The authors of such software tend to overestimate its utility.

https://www.theregister.com/2011/03/31/google_on_open_source...

Re: The terms of the AGPL are pretty easy to comply with

#146

Post by rando832 »

knorker wrote: post #60

> Obligatory: I’m not a lawyer; this is for informational purposes only That's the main point, though. You aren't, in fact, a lawyer. And this is not, in fact legal advice. You are presumably expert in a non-legal field, and you are giving expert opinion on something you are not an expert on. The GPL is tested. The LGPL less so, but lawyers seem to be more comfortable with it. There's the extra complexity that Google…

And Microsoft said all GPL was a cancer and unamerican and viral and disallowed it from about 50k engineer's computers due to "legal risk of GPL virality", and this was when they were by far the biggest software company. Wait, they lied? It was all FUD and really about threatening their business model. They changed their policies and actually said publicly they were wrong. Is it so hard to believe?

Re: The terms of the AGPL are pretty easy to comply with

#147

Post by TAForObvReasons »

saagarjha wrote: post #89
jeffbee wrote: post #83

Earlier quoted context omitted.

The AGPL virality is considered such a big risk, and the "scripts to control" clause is considered so sweeping and vague, that Google has its own internal version of R that won't download AGPL libraries from CRAN, because just looking looking at the performance stats from production services in R using an AGPL library could taint the source code of the service itself. Nobody knows.

> because just looking looking at the performance stats from production services in R using an AGPL library could taint the source code of the service itself I think this is what is being referred to as "FUD". Anyone can go after you for some sort of supposed license issue, but at some point you need to consider that many of these are extremely far-fetched and serve only to quite literally add FUD around AGPL.

The true misrepresentation is:

> Anyone can go after you for some sort of supposed license issue

Suppose the software in question is MIT licensed. There are certain requirements, none of them involve users having to decide between releasing their source code or paying fees. Remedying most MIT project license violations usually involves adding a disclosure somewhere in the website.

As a whole, for reasonably large companies it's a lot easier to just pick a non-AGPL project (and make one if it doesn't exist) than to bother with these questions.

Re: The terms of the AGPL are pretty easy to comply with

#148

Post by heavyset_go »

pydry wrote: post #69
cic48 wrote: post #33

Earlier quoted context omitted.

I’ve taken AGPL through two FAANG reviews. Both arrived at the same very-much-not-FUD legal conclusion. Paragraph 1 of section 13 requires modifications to be disclosed and source code for them to be offered to remote users. The license uses the term of art Corresponding Source for this. Corresponding Source is defined in section 1 in a crystal clear way. Two separate teams of lawyers concluded that they could cohere…

The holy war could be avoided if Google simply paid authors of AGPL code they wanted to use instead of going on a tirade against the license. I think half the reason it exists is to make it deliberately risky for FAANGs etc. because they're exactly the ones who SHOULD be ponying up to support the open source ecosystem they rely upon.

I release my open-source software under the AGPL with the option for different licensing upon discussion or negotiation, partly for this reason. The other reason is that common open-source licenses are generally incompatible with one another, and I'm happy to overcome those incompatibilities via alternative licensing for other open-source projects.

Re: The terms of the AGPL are pretty easy to comply with

#149

Post by api »

zrm wrote: post #125
api wrote: post #91

Earlier quoted context omitted.

I've seen the same phobia to a lesser degree around the plain old GPL. Lawyers think, and not unreasonably, in terms of risk. Is there a risk you might be dragged into court? If so, that's a very expensive risk. Is the library or application worth this risk? If not, then ditch it. It's not an unreasonable fear either given past events like the SCO/Linux lawsuit. IBM had deep enough pockets to fight it and win. Anyone…

But isn't the middle ground requiring copyright assignment and then dual licensing? Oh dear, your company's lawyers are afraid of the AGPL? Well then pay the project for a commercial license.

That can work but it has to be low friction and reasonably priced. Many people who do dual licensing charge waaaaay too much.

Re: The terms of the AGPL are pretty easy to comply with

#150

Post by jrockway »

waisbrot wrote: post #122
cic48 wrote: post #33

Earlier quoted context omitted.

I’ve taken AGPL through two FAANG reviews. Both arrived at the same very-much-not-FUD legal conclusion. Paragraph 1 of section 13 requires modifications to be disclosed and source code for them to be offered to remote users. The license uses the term of art Corresponding Source for this. Corresponding Source is defined in section 1 in a crystal clear way. Two separate teams of lawyers concluded that they could cohere…

By this reasoning, if I run some AGPL software on GCP, wouldn't that place all of GCP under AGPL? I've written "scripts to control" the AGPL software, so my stuff is AGPL and Google's cloud offering is to run my code automatically so all of GCP is a "script to control".

That's unlikely. You're falling into the common trap of assuming laws and computer source code work the same way -- you have a set of instructions that you evaluate from top to bottom until you get an answer. The law doesn't really work that way; there are laws, but there are also reasonable humans deeply embedded in the process. So in your case, you'd have to be the author of some AGPL software, have some third party install it on GCP, and then sue Google to get the GCP source code. Google would send a representative that says "this is a generic platform where anyone can run any computer program they want; we don't suggest that users run this AGPL program, and we have no way to detect that they're running it; this is an issue between Company X and the author." The judge and jury would then see that Google has absolutely no control over that license infringement, and would probably not award you their source code. It would just be unreasonable to any normal person for Google to be involved in your contract; they took no action to enter into a contract with you, after all. No cloud platform could ever exist if they automatically became parties to random software contracts. The legal system would take all of that into account when deciding how to make you whole.

Similar arguments would involve suing Intel for copyright infringement because their memory controller copied copyrighted information from RAM into cache. That's copying! But ultimately, Intel is just infrastructure; some user got the copyrighted data into RAM and knew full well that CPUs copy it into cache from time to time. That doesn't make Intel a party to your copyright infringement lawsuit, even though they did instruct the infringer's device to make a copy without your permission. It simply isn't reasonable -- no efficient CPUs could be manufactured if you won your lawsuit. So it's unlikely a court would hold Intel responsible.

Finally, there is the classic "if you read this, you owe me $50." You just did! But any court would find that an unenforceable contract because you didn't really consent to it. So I won't be suing you for $50. The world couldn't function if I could do things like this. So contract law exists without that particular contract being valid.

Post reply on HN