Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The terms of the AGPL are pretty easy to comply with

drewdevault.com

Post reply on HN
Print view View original

221–230 of 341 posts

Re: The terms of the AGPL are pretty easy to comply with

#221

Post by euroq »

teddyh wrote: post #211
nomel wrote: post #204

Earlier quoted context omitted.

Unfortunately, many software companies obtain their revenue through the exchange of money for their software. This is like asking McDonals do stop serving food (and possibly recall all of the eaten burgers?).

A company which sells that much software can certainly afford to re-implement an AGPL component; or at least implement a good enough stub implementation to make the software run acceptably. Especially if, as Chris DiBona of Google claims, all AGPL software is useless and unneeded. However, the point was that releasing the proprietary (oh so secret) source code is never the only option, and it is indeed false scaremon…

> A company which sells that much software can certainly afford to re-implement an AGPL component; or at least implement a good enough stub implementation to make the software run acceptably.

If you ever work at a software company, you'll understand that you never have enough time to do what you want, and you have to pick and choose the most valuable tasks and go with those. Rewriting perfectly working code is never valuable.

Re: The terms of the AGPL are pretty easy to comply with

#222

Post by teddyh »

euroq wrote: post #221
teddyh wrote: post #211

Earlier quoted context omitted.

A company which sells that much software can certainly afford to re-implement an AGPL component; or at least implement a good enough stub implementation to make the software run acceptably. Especially if, as Chris DiBona of Google claims, all AGPL software is useless and unneeded. However, the point was that releasing the proprietary (oh so secret) source code is never the only option, and it is indeed false scaremon…

> A company which sells that much software can certainly afford to re-implement an AGPL component; or at least implement a good enough stub implementation to make the software run acceptably. If you ever work at a software company, you'll understand that you never have enough time to do what you want, and you have to pick and choose the most valuable tasks and go with those. Rewriting perfectly working code is never…

> If you ever work at a software company

No personal attacks, please.

I do, in fact, work at a tech company, and do, in fact, write a lot of code to do my job. However, it is not a software company, as it does not sell proprietary software directly.

> Rewriting perfectly working code is never valuable.

It might be far more valuable than the other option, i.e. releasing the proprietary software under a free software license. An AGPL licensing issue will only ever, in a worst case scenario, force you to choose one of those two options, no more.

Re: The terms of the AGPL are pretty easy to comply with

#223

Post by kube-system »

cycloptic wrote: post #217
kube-system wrote: post #215

Earlier quoted context omitted.

No, there are plenty of circumstances where there laws and/or contractual obligations other than software licenses become involved in software development which can conflict. See healthcare, government, finance, regulated industries, etc.

And that is still a choice, but your lawmakers have made it for you. Alternatively, you can choose not to develop for those industries.

I think you'll find few people who are willing to make changes to those things just to implement an AGPL library --- and even fewer who would call it a "simple solution".

Re: The terms of the AGPL are pretty easy to comply with

#224

Post by teddyh »

nomel wrote: post #220
teddyh wrote: post #211

Earlier quoted context omitted.

A company which sells that much software can certainly afford to re-implement an AGPL component; or at least implement a good enough stub implementation to make the software run acceptably. Especially if, as Chris DiBona of Google claims, all AGPL software is useless and unneeded. However, the point was that releasing the proprietary (oh so secret) source code is never the only option, and it is indeed false scaremon…

> afford to re-implement an AGPL component > good enough stub implementation to make the software run acceptably This is what the company I work for does, and most that I've heard about do, but preemptively.

Great! You, and all who do so, are then protected from ever having to face any problems from AGPL.

Re: The terms of the AGPL are pretty easy to comply with

#225

Post by JoshTriplett »

p0llard wrote: post #197
JoshTriplett wrote: post #99

Earlier quoted context omitted.

You're conflating "talking to a server over a socket" with "linking to a library". The former, as a general rule, does not create a derivative work. It's specifically called out in the GPL FAQ as something that does not create a derivative work. (Another case that doesn't is fork/exec of a separate program.) The latter, linking a library, is why the distinction between the GPL and LGPL exists. As a general rule, if y…

> The former, as a general rule, does not create a derivative work. It's specifically called out in the GPL FAQ as something that does not create a derivative work. Could you point me in the direction of a court ruling establishing this general rule? I couldn't find anything after a quick search. You didn't mention this part of the GPL FAQ (directly after the part you talked about): > But if the semantics of the comm…

Courts also generally consider things like long-standing precedent and decades of industry practice, as well as estoppel. It's a practice that everyone in an industry has done for decades, which matches the general consensus understanding throughout the FOSS developer community, in addition to being the interpretation of the authors of the license.

As I understand it, the rationale for that FAQ entry was that a blanket statement that communication over a socket never creates a derivative work would allow for things like "what if we built a stub that just moves a shared library out-of-process and copies memory back and forth over a socket", or other similar tricks.

Of course, if Oracle v. Google holds as case law (which we'll find out any month now), then the software world turns upside-down and inside-out, and much of the industry will have cases against each other over "API copyrights"; in that world, I have no idea where this would fall.

Re: The terms of the AGPL are pretty easy to comply with

#226

Post by tyrion »

cic48 wrote: post #33
xyzzy_plugh wrote: post #12

> Obligatory: I’m not a lawyer; this is for informational purposes only. and > Google states that if, for example, Google Maps used PostGIS as its data store, and PostGIS used the AGPL, Google would be required to release the Google Maps code. This is not true. They would be required to release their PostGIS patches in this situation. AGPL does not extend the GPL in that it makes the Internet count as a form of linki…

I’ve taken AGPL through two FAANG reviews. Both arrived at the same very-much-not-FUD legal conclusion. Paragraph 1 of section 13 requires modifications to be disclosed and source code for them to be offered to remote users. The license uses the term of art Corresponding Source for this. Corresponding Source is defined in section 1 in a crystal clear way. Two separate teams of lawyers concluded that they could cohere…

Wouldn't it be a good idea to "fix" the AGPL in order to make it clearer?

It seems to me that every time there is a discussion around GNU licenses many people have no idea how to interpret them and then decide not to use them out of fear. It does not seem to me that this is in the interest of the GNU project. Why not fix this?

Re: The terms of the AGPL are pretty easy to comply with

#227

Post by debiandev »

tptacek wrote: post #173
debiandev wrote: post #120

Earlier quoted context omitted.

> AGPL is unchallenged in court. The risk to being wrong about it as huge. It’s risk aversion, not ideology, and it’s important to remember that identifying an argument as part of legal review does not call it the correct one. Anyone who’s ever worked with legal matters knows there is no such thing as “correct,” there are rulings. The existence of the argument condemns the license for FAANG, not its validity. Having…

No, companies are not happy to discuss, modify, and sign new contracts every day. They are quite hesitant to. At Matasano, it became our practice simply to tell new clients we'd be happy to sign their paper and not ours, because we'd lose weeks just to get to the point where their legal would consider looking at our contracts. At my last company, we non-negotiably used our own contracts, and budgeted a month to legal…

> No, companies are not happy to discuss, modify, and sign new contracts every day. They are quite hesitant to.

[citation needed]

> And, what's more, the contracts we're talking about are all basically pro-forma.

I had very custom employment contracts with 2 well-known large tech companies. When asking to remove some clauses and add new ones they did not flinch at the ask and let me have meetings with their lawyers.

I have many other examples but a quick search on the internet can show how many contract-related discussions happen between large companies, suppliers, local governments & so on

Matasano is not the size of a FAANG and similar or maybe it has a small legal team by choice.

Re: The terms of the AGPL are pretty easy to comply with

#228

Post by tptacek »

debiandev wrote: post #227
tptacek wrote: post #173

Earlier quoted context omitted.

No, companies are not happy to discuss, modify, and sign new contracts every day. They are quite hesitant to. At Matasano, it became our practice simply to tell new clients we'd be happy to sign their paper and not ours, because we'd lose weeks just to get to the point where their legal would consider looking at our contracts. At my last company, we non-negotiably used our own contracts, and budgeted a month to legal…

> No, companies are not happy to discuss, modify, and sign new contracts every day. They are quite hesitant to. [citation needed] > And, what's more, the contracts we're talking about are all basically pro-forma. I had very custom employment contracts with 2 well-known large tech companies. When asking to remove some clauses and add new ones they did not flinch at the ask and let me have meetings with their lawyers.…

The authors of AGPL packages are also not the size of a FAANG! That's the point! If they were, they wouldn't be negotiating AGPL with Google; they'd be negotiating an actual contract.

(I have zero problem with AGPL and happily use it myself for things, but I use it the same way I feel most of my peers use it, as an explicit "no, FAANG, you can't use this code, pay me instead" marker.)

Re: The terms of the AGPL are pretty easy to comply with

#229

Post by kube-system »

AnthonyMouse wrote: post #219
kube-system wrote: post #218

Earlier quoted context omitted.

A PC at a desk with a keyboard and mouse is very clearly not a device "device for use only by remote users". The person used their PC when they were in office, and would be using it if not for the current pandemic. If the device is sitting in a rack in a closet, that is a device intended for use only by remote users.

You still seem to be missing the point that your arguments are irrelevant since you would have to make them in court which is fraught with uncertainty and unreasonably burdensome even if you win. And I doubt Microsoft would agree to the premise that you could avoid the "no servers" restriction just by putting the server at a desk and plugging in a keyboard and mouse that nobody has touched in months.

> your arguments are irrelevant since you would have to make them in court

This is simply not the case. Relationship matters a LOT here.

Microsoft's license is not like the GPL/AGPL in that there can be many random parties to it. There's not 10,000 forks of Windows each with a different rights owner who might hop out of the woodwork looking for a quick buck. The only relevant parties to their EULA are you and MS. If you are an enterprise doing existing business with MS (i.e. you aren't already pirating Windows), you simply aren't going to end up in court over some contract technicality taken out of context.

The danger to the AGPL is that there's unclarity in the language AND some rando you don't know and don't do any business with could potentially exploit it.

Re: The terms of the AGPL are pretty easy to comply with

#230

Post by bsder »

api wrote: post #91
xyzzy_plugh wrote: post #12

> Obligatory: I’m not a lawyer; this is for informational purposes only. and > Google states that if, for example, Google Maps used PostGIS as its data store, and PostGIS used the AGPL, Google would be required to release the Google Maps code. This is not true. They would be required to release their PostGIS patches in this situation. AGPL does not extend the GPL in that it makes the Internet count as a form of linki…

I've seen the same phobia to a lesser degree around the plain old GPL. Lawyers think, and not unreasonably, in terms of risk. Is there a risk you might be dragged into court? If so, that's a very expensive risk. Is the library or application worth this risk? If not, then ditch it. It's not an unreasonable fear either given past events like the SCO/Linux lawsuit. IBM had deep enough pockets to fight it and win. Anyone…

Embedded is generally quite serious about this.

It's not even whether you comply, the issue is that if your company is getting bought you do NOT want the deal to get hung up over software licenses.

Post reply on HN