The terms of the AGPL are pretty easy to comply with • Hacker News Board

Re: The terms of the AGPL are pretty easy to comply with

#281

Post by kube-system » Tue, Jul 28, 2020, 1:31 AM UTC

AnthonyMouse wrote: post #246

kube-system wrote: post #229

Earlier quoted context omitted.

> your arguments are irrelevant since you would have to make them in court This is simply not the case. Relationship matters a LOT here. Microsoft's license is not like the GPL/AGPL in that there can be many random parties to it. There's not 10,000 forks of Windows each with a different rights owner who might hop out of the woodwork looking for a quick buck. The only relevant parties to their EULA are you and MS. If…

But now your argument has nothing to do with the AGPL at all and everything to do with not doing business with disagreeable people. And many free software projects require copyright assignment (e.g. the FSF requires this), so in all of those cases you're not dealing with 10,000 different parties, only the one. If that party is litigious then it doesn't really matter which license they use, they'll still be able to fi…

> But now your argument has nothing to do with the AGPL at all and everything to do with not doing business with disagreeable people.

The ability for anyone to contribute is an inherent and intended feature of the AGPL, and it's something unique when compared to a traditional EULA for commercial software. The potential risks to this model might not be intentional, but they are nonetheless a result of the design.

>And many free software projects require copyright assignment (e.g. the FSF requires this), so in all of those cases you're not dealing with 10,000 different parties, only the one

To your point about arguments having nothing to do with the AGPL -- this is not part of the AGPL, and many AGPL projects do not have a copyright assignment agreement.

The bottom line of my point is -- risk is amplified by uncertainty.

[A little bit of uncertainty] * [a bunch of organizations who DGAF about us at all] = [possibly a significant concern]

[A little bit of uncertainty] * [one organization with a profitable, existing, and predictable relationship] = [disagreements are probably being settled by an invoice not a lawsuit]

Re: The terms of the AGPL are pretty easy to comply with

#282

Post by foobiekr » Tue, Jul 28, 2020, 1:43 AM UTC

yencabulator wrote: post #275

teddyh wrote: post #193

Earlier quoted context omitted.

> Being wrong about AGPL, you have to release a lot of code That is also false scaremongering. You always have the option to simply cease distributing until you have re-implemented the AGPL code yourself.

I doubt "turn off Google Maps until we reimplement it from scratch" is an acceptable business continuity risk.

And most companies do resourcing months in advance on top of that. AGPL could have solved all of this with an explicit redress clause that wasn't effectively unbounded downside risk.

Re: The terms of the AGPL are pretty easy to comply with

#283

Post by zzo38computer » Tue, Jul 28, 2020, 1:45 AM UTC

I use software with GPL and AGPL, and may even contribute, but when I write my own software, I make it to be the public domain instead, because I don't like copyright, and because public domain will make it we don't have to worry about the license conditions, in case it may be confusing.

I have a program which links with AGPL software. My program is itself public domain, and is released only as source code, but I would think if anyone distributes it, or makes it available to access over the network, that they would have to do so in a way which is not contrary to AGPL. If you know how it is work, then hopefully you can comment too, to say what parts I did wrong, I suppose.

Re: The terms of the AGPL are pretty easy to comply with

#284

Post by foobiekr » Tue, Jul 28, 2020, 1:46 AM UTC

jrockway wrote: post #150

waisbrot wrote: post #122

Earlier quoted context omitted.

By this reasoning, if I run some AGPL software on GCP, wouldn't that place all of GCP under AGPL? I've written "scripts to control" the AGPL software, so my stuff is AGPL and Google's cloud offering is to run my code automatically so all of GCP is a "script to control".

That's unlikely. You're falling into the common trap of assuming laws and computer source code work the same way -- you have a set of instructions that you evaluate from top to bottom until you get an answer. The law doesn't really work that way; there are laws, but there are also reasonable humans deeply embedded in the process. So in your case, you'd have to be the author of some AGPL software, have some third part…

Thank you for taking the time to spell this out.

Re: The terms of the AGPL are pretty easy to comply with

#285

Post by kube-system » Tue, Jul 28, 2020, 2:07 AM UTC

cycloptic wrote: post #239

kube-system wrote: post #223

Earlier quoted context omitted.

I think you'll find few people who are willing to make changes to those things just to implement an AGPL library --- and even fewer who would call it a "simple solution".

I don't disagree with that. My point is that historically, it's been their choice and as a result it's been mostly their loss. When there is will to use the software, but they refuse to take the time to understand the licensing or dismiss it as not being simple enough, the other corporate entities behind it will gladly overcharge them for some kind of proprietary license or legal consultancy scheme.

Proprietary licenses aren't the only alternative to the risk of the AGPL (whether real or perceived). For example: I've never heard of a corporate lawyer having finding issue with an MIT or Apache license.

I've run into lots of libraries over my career with vague, conflicting, or otherwise questionable licenses. So far, 100% of the time I've been able to easily find an alternative open source project with a better, more clear, license. If both get the job done, I'll pick the one that doesn't keep me up at night every time.

Re: The terms of the AGPL are pretty easy to comply with

#286

Post by mr_toad » Tue, Jul 28, 2020, 3:44 AM UTC

dathinab wrote: post #81

p0llard wrote: post #66

Earlier quoted context omitted.

> For example, if I build an extension which works with Chrome and Firefox, over a well-defined API, that's an independent work. AGPL/GPL/LGPL does not apply. > If I have two pieces of code which mutually rely on each other and form a common system, and for example call back-and-forth, or have APIs specific to each other, that generally does form a derivative work. So why does the LGPL/Linking Exception exist at all?…

Wrt. GPLv2 what counts as derived work is a mess. LGPL mainly exists because statically linking a library into a binary (especially with link time optimizations enabled) will somewhat modify the binary code of the linked library in the way it is placed in which some lawyers use to argue that static linking is always a derived work. So LGPL let's you rest in peace if you need static linking. (I also have read argument…

I think that RMS was fairly clear that he thought that linked code was a derived work as far as the GPL was concerned, and that’s why the LGPL was created.

Re: The terms of the AGPL are pretty easy to comply with

#287

Post by woofie11 » Tue, Jul 28, 2020, 3:45 AM UTC

joshuamorton wrote: post #266

woofie11 wrote: post #201

Earlier quoted context omitted.

I don't think Daniel contradicts Eben, at least in the link here... There are good rationales and bad rationales for a decision. Google made a good decision with a bad rationale. Daniel made a good decision with a good rationale. Why does this matter? If I'm running my own business, my business context won't be the same as Google's. There are times to pick AGPL, and times to not pick it, and that requires accurately…

You realize that Daniel works for Google, and is one of the people who makes such decisions about OSS for Google, so if you think he made the decision with a good rationale, then so did Google, since his decision was Google's.

I did not realize that. I read the one link. That's all I know about Daniel. He sounded reasonable there and what he wrote made sense.

There are quite a few logical leaps between:

1) Daniel writing a reasonable post on HN 2) Daniel being correct in everything he does 3) Daniel making all decisions for Google 4) Daniel being the one who handles all communications about those decisions

All I know is #1.

The logic chain can break at any of those points. Perhaps Google made the decision with good rationale which was simplified or changed for communications. Perhaps someone else at Google decided. Etc. I don't know.

Some of Google's policies, viewed from the outside, look crazy ("Do not install AGPL-licensed programs on your workstation, Google-issued laptop, or Google-issued phone without explicit authorization from the Open Source Programs Office."), but may have valid justifications too. For example, Google could have automated systems which do audits which would choke on this sort of thing.

What I do know is that many companies have an irrational, unjustified fear of the AGPL, and that it often makes good business sense.

I also trust Eben for his legal judgement. He's brilliant, and usually right.

Re: The terms of the AGPL are pretty easy to comply with

#288

Post by woofie11 » Tue, Jul 28, 2020, 3:50 AM UTC

zchrykng wrote: post #105

sstangl wrote: post #94

Earlier quoted context omitted.

Google's interpretation implies their belief that if their PostgreSQL server uses AGPL code, then every service using that PostgreSQL server must also be AGPL. The article points out that that is not the case. If you are using AGPL code as a library, however, then your application as a whole must be under an AGPL-compatible license. It's just that connecting to a server does not constitute linking in the GPL, and the…

The article points out that Drew believes it isn't the case. Until this stuff is tested in court, there isn't a lawyer worth the name who would guarantee that. The language isn't precise enough to be 100% sure how courts will interpret it, and the downside risk is monumentally huge for a company like Google if the ruling goes against them.

> downside risk is monumentally huge for a company like Google if the ruling goes against them

The downside risk is damages. Those usually aren't monumentally huge. There's a calculation, but they're based on how much damage was done:

1) How much did Google profit from the code?

2) How much did the other party lose?

3) Are statutory damages greater?

Pick the highest of the three. If it's intentional -- and in this case it isn't -- you triple it. You might toss in legal fees.

#1 is the relative cost to going with an alternative solution (build in-house, license, etc.). #2 is usually zero for AGPL code. #3 is pocket change for Google. So you're likely to go with the cost of not having gone with AGPL in the first place, twice (once in damages, and once for the migration).

Re: The terms of the AGPL are pretty easy to comply with

#289

Post by mr_toad » Tue, Jul 28, 2020, 4:20 AM UTC

alex_young wrote: post #35

Companies like MongoDB release a 'free' version using AGPL and a commercial version under no such provision, and use this in marketing material to convince commercial users to buy licensing so they can incorporate their DB into web based products. If this distinction is without merit for those simply using MongoDB as an unmodified DB, this seems like it wouldn't actually work so well as a sales tool.

Current versions of MongoDB are not available under an AGPL at all. It is effectively no longer open source.

Older, (unpatched) versions are still AGPL, but there were no commercial restrictions at that stage.

Re: The terms of the AGPL are pretty easy to comply with

#290

Post by lmm » Tue, Jul 28, 2020, 4:41 AM UTC

yencabulator wrote: post #277

AnthonyMouse wrote: post #159

Earlier quoted context omitted.

Right. That's really the issue -- it's not that the risk isn't there, it's that the risk is always there, so it's an isolated demand for rigor. For example, here's the Windows 10 license: > c. Restrictions. The device manufacturer or installer and Microsoft reserve all rights (such as rights under intellectual property laws) not expressly granted in this agreement. For example, this license does not give you any righ…

> Are they now in violation of the license? Maybe they are. But not doing that would have killed the company , so the uncertainty was likely considered acceptable. The punishment for violating a Microsoft license is paying Microsoft more money. The cost of not doing that would have likely been more. The punishment for building your SaaS on AGPL code and having court decide on the virality on a non-favorable way is mu…

> The punishment for building your SaaS on AGPL code and having court decide on the virality on a non-favorable way is much more severe, and cannot in general be immediately solved with a little extra money transferred between two companies.

This is also FUD. There's no guarantee that Microsoft wouldn't stand on their rights, demand their statutory $50k/infringement, and refuse to sell you any more licenses going forward. It's not likely they'd do that - but it's not likely that the author of an AGPL library would do it either.