Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The terms of the AGPL are pretty easy to comply with

drewdevault.com

Post reply on HN
Print view View original

201–210 of 341 posts

Re: The terms of the AGPL are pretty easy to comply with

#201

Post by woofie11 »

durin42 wrote: post #131
woofie11 wrote: post #61

Earlier quoted context omitted.

Then listen to Eben Moglen, who wrote it, and is a brilliant law professor at Columbia :)

Or listen to Daniel Berlin, who's both an accomplished GCC hacker and a lawyer: https://news.ycombinator.com/item?id=9956542 https://news.ycombinator.com/item?id=13979443 This isn't settled law, and DannyBee would be quick to point out that the practice of law has a major component of risk management.

I don't think Daniel contradicts Eben, at least in the link here...

There are good rationales and bad rationales for a decision. Google made a good decision with a bad rationale. Daniel made a good decision with a good rationale. Why does this matter? If I'm running my own business, my business context won't be the same as Google's. There are times to pick AGPL, and times to not pick it, and that requires accurately understanding the law.

Re: The terms of the AGPL are pretty easy to comply with

#202

Post by jkaplowitz »

DannyBee wrote: post #188

I haven't commented on HN in a while, but this article actually pretty much complains about me, since I wrote the text in question and enabled the policy to be released. So i'm just going to say: 1. The author claims the Google states something, then doesn't actually quote anything google stated, but instead writes their own interpretation of the words and a made up example. That's not a good start. 2. Having set up…

Thanks for having publiished these policies publicly! You gave a pretty clear summary of Google's motivations for banning AGPL on HN five and three years ago two of the previous times this came up, and having worked at Google 2011-2015 (including some interactions there with you), your public explanations of why from back then are extremely credible and rational given the logistics of what's easy and hard inside Google.

https://news.ycombinator.com/item?id=9956542

https://news.ycombinator.com/item?id=13979443

Not that I'm surprised, as you've always been pretty forthright and honest. Thanks for continuing to be that way.

Re: The terms of the AGPL are pretty easy to comply with

#203

Post by DasIch »

saagarjha wrote: post #109
michaelcampbell wrote: post #19

Truth or falsehoods aside, the reason one of the places I have worked (large 10's of k's of employees, big legal staff) refused to let us use AGPL is that it had never been decided in court, and they didn't want to be the ones to foot that bill. "No" is pretty cheap, and they were pretty good at it.

> "No" is pretty cheap Now, is it really? Paying a team of software engineers to recreate every AGPL project surely isn't…

Nobody is using every AGPL project and there aren't that many AGPL projects to begin with.

The problem is not just the risk associated with AGPL, it's also that the benefit is actually quite small. I think most companies would be a lot more willing to use AGPL, if there were any compelling projects using it.

Re: The terms of the AGPL are pretty easy to comply with

#204

Post by nomel »

teddyh wrote: post #193
rblatz wrote: post #165

Earlier quoted context omitted.

The remedy for a violation is also in play. Private contract between two companies, cutting a 10 figure check makes it all better. Being wrong about AGPL, you have to release a lot of code that you really don't want to release, that is very important to your core business. That's the other side, uncertainty with acceptable error bars vs uncertainty with unacceptable error bars.

> Being wrong about AGPL, you have to release a lot of code That is also false scaremongering. You always have the option to simply cease distributing until you have re-implemented the AGPL code yourself.

Unfortunately, many software companies obtain their revenue through the exchange of money for their software. This is like asking McDonals do stop serving food (and possibly recall all of the eaten burgers?).

Re: The terms of the AGPL are pretty easy to comply with

#205

Post by ran3824692 »

joshuamorton wrote: post #177
ran3824692 wrote: post #166

Earlier quoted context omitted.

> They do, however, very often use existing language, and custom language is minimized. Guess what, AGPL does that too. Its only 1 paragraph different than GPL. > Where contracts are often almost entirely standard per-company "standard per-company", means custom and used used throughout the company. That doesn't make it less risky, and its not like these things don't constantly change and are hugely complicated, just…

> Guess what, AGPL does that too. Its only 1 paragraph different than GPL. Yes, and the point is that paragraph is particularly risky and untested. > Citation needed. I gave an example.

The point people keep talking about here as risky are: what is a derivative work, and what constitutes complete and complete corresponding source definition. Both of those things HAVE been tested. complete corresponding source definition is the same in gplv3, almost exactly the same in gplv2. Derivative work is a general copyright thing tested in many cases. The extra paragraph doesn't have anything to do with them. To recap: 99% of the license is tested, and the "risk" everyone is discussing are about the parts that have already been tested. Basically, what Drew wrote is true.

Re: The terms of the AGPL are pretty easy to comply with

#206

Post by vslira »

cic48 wrote: post #33
xyzzy_plugh wrote: post #12

> Obligatory: I’m not a lawyer; this is for informational purposes only. and > Google states that if, for example, Google Maps used PostGIS as its data store, and PostGIS used the AGPL, Google would be required to release the Google Maps code. This is not true. They would be required to release their PostGIS patches in this situation. AGPL does not extend the GPL in that it makes the Internet count as a form of linki…

I’ve taken AGPL through two FAANG reviews. Both arrived at the same very-much-not-FUD legal conclusion. Paragraph 1 of section 13 requires modifications to be disclosed and source code for them to be offered to remote users. The license uses the term of art Corresponding Source for this. Corresponding Source is defined in section 1 in a crystal clear way. Two separate teams of lawyers concluded that they could cohere…

> AGPL is unchallenged in court

What would be the cheapest way to settle this? Can I found a SaaS company that uses AGPL code, grow to ~100 usd/month and basically ask the FSF to sue me? Even if the legal fees alone amount to tens of thousand dollars, that should be low enough that a small company or a motivated (and financially secure) individual could try.

Re: The terms of the AGPL are pretty easy to comply with

#207

Post by joshuamorton »

ran3824692 wrote: post #205
joshuamorton wrote: post #177

Earlier quoted context omitted.

> Guess what, AGPL does that too. Its only 1 paragraph different than GPL. Yes, and the point is that paragraph is particularly risky and untested. > Citation needed. I gave an example.

The point people keep talking about here as risky are: what is a derivative work, and what constitutes complete and complete corresponding source definition. Both of those things HAVE been tested. complete corresponding source definition is the same in gplv3, almost exactly the same in gplv2. Derivative work is a general copyright thing tested in many cases. The extra paragraph doesn't have anything to do with them.…

Derivative work and complete corresponding source has not been tested w.r.t. Google's monorepo (or similar situations), because under the terms of the gplv2/3, Google doesn't distribute any software.

There's an entire class of tooling to make sure that GPL-tainted software isn't distributed (https://opensource.google/docs/thirdparty/licenses/#restrict...), but because the class of software that Google distributes under the GPL is limited (can you think of any?), this is workable, and such things can be isolated.

That doesn't work if the definition of "distribution" is broadened significantly. Then the derivative work questions (which aren't as cut and dry as you claim) do suddenly matter a lot more.

Re: The terms of the AGPL are pretty easy to comply with

#208

Post by cycloptic »

kube-system wrote: post #199
cycloptic wrote: post #181

Earlier quoted context omitted.

The simple solution there is to not make a proprietary product to begin with. Sorry, not trying to be snarky, but that (among other things) is the price you pay for that decision. It's baffling to me how some companies are so resistant to having to conduct legal reviews to use open source, which in a lot of cases will directly make them money, but at the same time these companies will gladly wave a giant NDA at someo…

It's not always a choice. There are people who cannot open source their software due to other legal, organizational, or practical factors.

That is still a choice. It may just be that your boss is ignoring your input and making the choice for you, which is a different problem.

Re: The terms of the AGPL are pretty easy to comply with

#209

Post by raphlinus »

DannyBee wrote: post #188

I haven't commented on HN in a while, but this article actually pretty much complains about me, since I wrote the text in question and enabled the policy to be released. So i'm just going to say: 1. The author claims the Google states something, then doesn't actually quote anything google stated, but instead writes their own interpretation of the words and a made up example. That's not a good start. 2. Having set up…

I can confirm what Danny says here.

It's a shame the original article has such flaws in its argumentation, because at the core of it I think there are some good points. Notably, other people don't have to blindly follow Google's example and reasoning. In fact, as discussed here, there are good reasons not to. For one, because Google is so highly integrated (with Borg and its monorepo, not to mention custom approaches to security), it's harder to use AGPL software without risking linking. Most other users outside Google would just apt-get a package or the like. And of course the business risk to Google is large simply because of their scale.

You can even disagree with Google's decision not to use AGPL, but they have openly explained their reasoning, and I think that adds to the discourse.

Disclosure: I used to work at Google, and was fairly actively involved with open-source activities in different capacities while I was there. I am also on record as sharply criticizing Google when I believe that is warranted. This is just not one of those times.

Re: The terms of the AGPL are pretty easy to comply with

#210

Post by simion314 »

knorker wrote: post #189
simion314 wrote: post #171

Earlier quoted context omitted.

>Someone writes a blog post with an 'IANAL' disclaimer on top saying that what Google's army of lawyers have gathered from reading a legal document is false, and I should favor his interpretation instead. I don't know, I'm not exactly convinced. Microsoft with their giant army of lawyers also said GPL is a cancer and they promoted this idea a lot but today Microsoft "loves" GPL. I think you can conclude that you shou…

> you should use your own brain to decide I think you mean "your own lawyers". And my experience says that the AGPL opinion among these experts are about as one-sided as scientists and climate change. But you're suggesting to armchair lawyer it?

Only if your decide you need a lawyer.
Post reply on HN