Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The terms of the AGPL are pretty easy to comply with

drewdevault.com

Post reply on HN
Print view View original

241–250 of 341 posts

Re: The terms of the AGPL are pretty easy to comply with

#241

Post by cogman10 »

vslira wrote: post #206
cic48 wrote: post #33

Earlier quoted context omitted.

I’ve taken AGPL through two FAANG reviews. Both arrived at the same very-much-not-FUD legal conclusion. Paragraph 1 of section 13 requires modifications to be disclosed and source code for them to be offered to remote users. The license uses the term of art Corresponding Source for this. Corresponding Source is defined in section 1 in a crystal clear way. Two separate teams of lawyers concluded that they could cohere…

> AGPL is unchallenged in court What would be the cheapest way to settle this? Can I found a SaaS company that uses AGPL code, grow to ~100 usd/month and basically ask the FSF to sue me? Even if the legal fees alone amount to tens of thousand dollars, that should be low enough that a small company or a motivated (and financially secure) individual could try.

Bit harder than that mostly because the court system is designed to avoid universally "resolved" issues as much as possible.

The first hurdle is to get it into federal court (since you probably want this tested beyond your current state). To do that, you'll need someone from out of state to sue you.

The next hurdle is how to get this case resolved in other federal courts. You could either setup the same scenario for each district (requiring that your 2 parties have businesses in 2 states in each of the districts) or you could try to appeal all the way to the supreme court. Tricky, because this really isn't likely to be a case that the SC would take up (it'd need the lower courts to disagree with each other. Further, they'll usually not do it unless the district courts also disagree).

Overall, the whole thing would be super expensive to pull off.

Re: The terms of the AGPL are pretty easy to comply with

#242

Post by woofie11 »

tzs wrote: post #115
woofie11 wrote: post #43

Earlier quoted context omitted.

Eben Moglen wrote the AGPL. There's a standard process courts use to figure this stuff out. Intent fits into it. Eben Moglen clearly states what he meant in many talks. Courts favor intended interpretation of a contract. That makes the risk pretty small.

In the case of ambiguity in a contract, courts look at the intent of the parties to the contract. In almost all cases Moglen will not be a party, and at least one of the actual parties will not be aware of those talks or their content, so Moglen's talks on the matter won't really be of much use. Courts will also look at the bargaining power of the parties. If the party offering the contract is a lot more powerful tha…

It's a little more complex than that. The intent of the parties /drafting/ the contract do matter. Public writings clarifying the intent do as well.

Re: The terms of the AGPL are pretty easy to comply with

#243

Post by michaelmrose »

euroq wrote: post #221
teddyh wrote: post #211

Earlier quoted context omitted.

A company which sells that much software can certainly afford to re-implement an AGPL component; or at least implement a good enough stub implementation to make the software run acceptably. Especially if, as Chris DiBona of Google claims, all AGPL software is useless and unneeded. However, the point was that releasing the proprietary (oh so secret) source code is never the only option, and it is indeed false scaremon…

> A company which sells that much software can certainly afford to re-implement an AGPL component; or at least implement a good enough stub implementation to make the software run acceptably. If you ever work at a software company, you'll understand that you never have enough time to do what you want, and you have to pick and choose the most valuable tasks and go with those. Rewriting perfectly working code is never…

Every GPL violation that I've ever heard about remedied was remedied over time often months to years. If you never create derivative works you don't intend to share you will never have an issue. If you do clearly and obviously conspire to break the law you can probably still negotiate yourself enough time to comply with the law and retain the rights to your own software after having tried to get away with breaking the law.

Re: The terms of the AGPL are pretty easy to comply with

#244

Post by woofie11 »

kube-system wrote: post #215
cycloptic wrote: post #208

Earlier quoted context omitted.

That is still a choice. It may just be that your boss is ignoring your input and making the choice for you, which is a different problem.

No, there are plenty of circumstances where there laws and/or contractual obligations other than software licenses become involved in software development which can conflict. See healthcare, government, finance, regulated industries, etc.

I've worked in several of those industries. Oddly enough, open source was always easier there. I'd challenge you to find a regulation which prevents open source in any of those industries.

I think the one exception -- and this was an extreme example -- was the firmware of a medical device which could endanger human lives if modified. Things were locked down.

But generically? I'm batting maybe 75% with open source in highly-regulated industries.

Re: The terms of the AGPL are pretty easy to comply with

#245

Post by jcranmer »

p0llard wrote: post #197
JoshTriplett wrote: post #99

Earlier quoted context omitted.

You're conflating "talking to a server over a socket" with "linking to a library". The former, as a general rule, does not create a derivative work. It's specifically called out in the GPL FAQ as something that does not create a derivative work. (Another case that doesn't is fork/exec of a separate program.) The latter, linking a library, is why the distinction between the GPL and LGPL exists. As a general rule, if y…

> The former, as a general rule, does not create a derivative work. It's specifically called out in the GPL FAQ as something that does not create a derivative work. Could you point me in the direction of a court ruling establishing this general rule? I couldn't find anything after a quick search. You didn't mention this part of the GPL FAQ (directly after the part you talked about): > But if the semantics of the comm…

> I think it's also worth noting that "derivative work" is an established legal term

The last case I could find that substantially attacks the question of what constitutes a "derivative work" in the case of software was in 1994 (!), and I can't find any case that tries to answer it in the case of software libraries (whose only purpose is to be used in larger works). There are tests for determining "derivative work", but a) minor circuit split there and b) they're difficult to apply. In the context of what we're talking about here, it is not an established legal term. In such cases, courts are going to lean more heavily on consensus interpretation.

There's a not-well-understood interplay here between the rights of authors to control derivative works; extending analogies copyrightable and non-copyrightable elements of literary works (well-established) to software (far less so); fair use; and general contract principles (specifically, selling a product confers necessary rights to use it). Our current legal understanding of the situation is almost entirely based on an informal consensus rather than any case law, and there is wide potential for a single oddball case completely wrecking everything... like Google v Oracle.

> Determining what constitutes "intimiate enough" sounds pretty difficult and open to interpretation

I read that generally as suggesting a mens rea approach: if you're building IPC in such a way as to specifically avoid meeting license obligations, you should be considered in violation. If instead you're using it in a more well-defined and sanctioned API boundary, you're probably okay.

Re: The terms of the AGPL are pretty easy to comply with

#246

Post by AnthonyMouse »

kube-system wrote: post #229
AnthonyMouse wrote: post #219

Earlier quoted context omitted.

You still seem to be missing the point that your arguments are irrelevant since you would have to make them in court which is fraught with uncertainty and unreasonably burdensome even if you win. And I doubt Microsoft would agree to the premise that you could avoid the "no servers" restriction just by putting the server at a desk and plugging in a keyboard and mouse that nobody has touched in months.

> your arguments are irrelevant since you would have to make them in court This is simply not the case. Relationship matters a LOT here. Microsoft's license is not like the GPL/AGPL in that there can be many random parties to it. There's not 10,000 forks of Windows each with a different rights owner who might hop out of the woodwork looking for a quick buck. The only relevant parties to their EULA are you and MS. If…

But now your argument has nothing to do with the AGPL at all and everything to do with not doing business with disagreeable people.

And many free software projects require copyright assignment (e.g. the FSF requires this), so in all of those cases you're not dealing with 10,000 different parties, only the one. If that party is litigious then it doesn't really matter which license they use, they'll still be able to find an excuse to cause you grief.

Re: The terms of the AGPL are pretty easy to comply with

#247

Post by cycloptic »

tptacek wrote: post #228
debiandev wrote: post #227

Earlier quoted context omitted.

> No, companies are not happy to discuss, modify, and sign new contracts every day. They are quite hesitant to. [citation needed] > And, what's more, the contracts we're talking about are all basically pro-forma. I had very custom employment contracts with 2 well-known large tech companies. When asking to remove some clauses and add new ones they did not flinch at the ask and let me have meetings with their lawyers.…

The authors of AGPL packages are also not the size of a FAANG! That's the point! If they were, they wouldn't be negotiating AGPL with Google; they'd be negotiating an actual contract. (I have zero problem with AGPL and happily use it myself for things, but I use it the same way I feel most of my peers use it, as an explicit "no, FAANG, you can't use this code, pay me instead" marker.)

>If they were, they wouldn't be negotiating AGPL with Google; they'd be negotiating an actual contract.

This would stop being true if (and when) FAANG figured out how to effectively use AGPL internally. In my opinion, this is inevitable as long as software continues to be published under this license. From their perspective it seems they don't even have to do anything besides wait for other smaller companies to get in legal disputes and set a precedent. Or better yet, wait for a potential acquisition to come along that happens to have won one of these disputes.

Re: The terms of the AGPL are pretty easy to comply with

#248

Post by michaelmrose »

kube-system wrote: post #229
AnthonyMouse wrote: post #219

Earlier quoted context omitted.

You still seem to be missing the point that your arguments are irrelevant since you would have to make them in court which is fraught with uncertainty and unreasonably burdensome even if you win. And I doubt Microsoft would agree to the premise that you could avoid the "no servers" restriction just by putting the server at a desk and plugging in a keyboard and mouse that nobody has touched in months.

> your arguments are irrelevant since you would have to make them in court This is simply not the case. Relationship matters a LOT here. Microsoft's license is not like the GPL/AGPL in that there can be many random parties to it. There's not 10,000 forks of Windows each with a different rights owner who might hop out of the woodwork looking for a quick buck. The only relevant parties to their EULA are you and MS. If…

Historically Microsoft has been an offensively litigious actor that paid as much attention to the rule of law and ethics in the scope of their area of business as the average drug dealer does in theirs.

If relationship counts then surely the fact that you will be dealing with one of the worst actors in IT doesn't help your argument much.

Re: The terms of the AGPL are pretty easy to comply with

#250

Post by icey »

debiandev wrote: post #227
tptacek wrote: post #173

Earlier quoted context omitted.

No, companies are not happy to discuss, modify, and sign new contracts every day. They are quite hesitant to. At Matasano, it became our practice simply to tell new clients we'd be happy to sign their paper and not ours, because we'd lose weeks just to get to the point where their legal would consider looking at our contracts. At my last company, we non-negotiably used our own contracts, and budgeted a month to legal…

> No, companies are not happy to discuss, modify, and sign new contracts every day. They are quite hesitant to. [citation needed] > And, what's more, the contracts we're talking about are all basically pro-forma. I had very custom employment contracts with 2 well-known large tech companies. When asking to remove some clauses and add new ones they did not flinch at the ask and let me have meetings with their lawyers.…

From doing many sales negotiations with companies, my experience has been nobody is _happy_ to modify their contracts. Full stop. They can be convinced to do so if you've got appropriate leverage, but time with lawyers is expensive, and hard to automate (currently). Employment contract changes are not the same as commercial contracts, nor the same as IP arrangements.
Post reply on HN