Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The terms of the AGPL are pretty easy to comply with

drewdevault.com

Post reply on HN
Print view View original

301–310 of 341 posts

Re: The terms of the AGPL are pretty easy to comply with

#301

Post by jgilias »

simion314 wrote: post #171
jgilias wrote: post #34

So. From the POW of a total lay person as far as it comes to law. Someone writes a blog post with an 'IANAL' disclaimer on top saying that what Google's army of lawyers have gathered from reading a legal document is false, and I should favor his interpretation instead. I don't know, I'm not exactly convinced.

>Someone writes a blog post with an 'IANAL' disclaimer on top saying that what Google's army of lawyers have gathered from reading a legal document is false, and I should favor his interpretation instead. I don't know, I'm not exactly convinced. Microsoft with their giant army of lawyers also said GPL is a cancer and they promoted this idea a lot but today Microsoft "loves" GPL. I think you can conclude that you shou…

I was not actually talking about the totality of Google's verdict about AGPL. For some projects in some companies it might just be the right license to use. Rather, I was talking about the particular example of Google Maps and PostGIS.

Google's army of lawyers say: If PostGIS 'this' => Google Maps must be 'this'. And the author says, 'no, that's false'. Someone must be wrong here. And if I had to place a bet on which side is more likely to have gotten it the way a court of law might interpret it, I'd put my bet on a bunch of people with law degrees.

Re: The terms of the AGPL are pretty easy to comply with

#302

Post by xtracto »

mr_toad wrote: post #289
alex_young wrote: post #35

Companies like MongoDB release a 'free' version using AGPL and a commercial version under no such provision, and use this in marketing material to convince commercial users to buy licensing so they can incorporate their DB into web based products. If this distinction is without merit for those simply using MongoDB as an unmodified DB, this seems like it wouldn't actually work so well as a sales tool.

Current versions of MongoDB are not available under an AGPL at all. It is effectively no longer open source. Older, (unpatched) versions are still AGPL, but there were no commercial restrictions at that stage.

The current free license has this interesting snippet:

13. Offering the Program as a Service. If you make the functionality of the Program or a modified version available to third parties as a service, you must make the Service Source Code available via network download to everyone at no charge, under the terms of this License. Making the functionality of the Program or modified version available to third parties as a service includes, without limitation, enabling third parties to interact with the functionality of the Program or modified version remotely through a computer network, offering a service the value of which entirely or primarily derives from the value of the Program or modified version, or offering a service that accomplishes for users the primary purpose of the Program or modified version.

“Service Source Code” means the Corresponding Source for the Program or the modified version, and the Corresponding Source for all programs that you use to make the Program or modified version available as a service, including, without limitation, management software, user interfaces, application program interfaces, automation software, monitoring software, backup software, storage software and hosting software, all such that a user could run an instance of the service using the Service Source Code you make available.

I know a bunch of startups using Mongo... i wonder if i could make them give me their systems source, given this clause.

Re: The terms of the AGPL are pretty easy to comply with

#303

Post by zaarn »

teddyh wrote: post #300
yencabulator wrote: post #275

Earlier quoted context omitted.

I doubt "turn off Google Maps until we reimplement it from scratch" is an acceptable business continuity risk.

Google could certainly afford to implement a stub replacement library as a contingency plan, in case they really would be that worried about it.

The obvious solution is to completely reimplement the AGPL-ed software on your own, as a stub, in case the AGPL-ed software you want to use goes nuclear on you. Surely this will not cost a lot of developer time.

Re: The terms of the AGPL are pretty easy to comply with

#304

Post by PeterisP »

mr_toad wrote: post #286
dathinab wrote: post #81

Earlier quoted context omitted.

Wrt. GPLv2 what counts as derived work is a mess. LGPL mainly exists because statically linking a library into a binary (especially with link time optimizations enabled) will somewhat modify the binary code of the linked library in the way it is placed in which some lawyers use to argue that static linking is always a derived work. So LGPL let's you rest in peace if you need static linking. (I also have read argument…

I think that RMS was fairly clear that he thought that linked code was a derived work as far as the GPL was concerned, and that’s why the LGPL was created.

A license and its drafters can't decide or change what is considered derived work - that's a core concept of copyright law where any nuances could be dependent on the jurisdiction but not on any particular licence.

What LGPL can do is to reassure people by providing specific permission to use the code in some resulting work, no matter if it turns out that it actually is derived work (in which case the licence would grant you the rights you need) or not, in which case you don't need the permission, but it doesn't hurt to have it.

Re: The terms of the AGPL are pretty easy to comply with

#305

Post by jobigoud »

woofie11 wrote: post #288
zchrykng wrote: post #105

Earlier quoted context omitted.

The article points out that Drew believes it isn't the case. Until this stuff is tested in court, there isn't a lawyer worth the name who would guarantee that. The language isn't precise enough to be 100% sure how courts will interpret it, and the downside risk is monumentally huge for a company like Google if the ruling goes against them.

> downside risk is monumentally huge for a company like Google if the ruling goes against them The downside risk is damages. Those usually aren't monumentally huge. There's a calculation, but they're based on how much damage was done: 1) How much did Google profit from the code? 2) How much did the other party lose? 3) Are statutory damages greater? Pick the highest of the three. If it's intentional -- and in this ca…

Plus the cost of rewriting the project with a different dependency.

Re: The terms of the AGPL are pretty easy to comply with

#306

Post by zeveb »

joshuamorton wrote: post #207
ran3824692 wrote: post #205

Earlier quoted context omitted.

The point people keep talking about here as risky are: what is a derivative work, and what constitutes complete and complete corresponding source definition. Both of those things HAVE been tested. complete corresponding source definition is the same in gplv3, almost exactly the same in gplv2. Derivative work is a general copyright thing tested in many cases. The extra paragraph doesn't have anything to do with them.…

Derivative work and complete corresponding source has not been tested w.r.t. Google's monorepo (or similar situations), because under the terms of the gplv2/3, Google doesn't distribute any software. There's an entire class of tooling to make sure that GPL-tainted software isn't distributed ( https://opensource.google/docs/thirdparty/licenses/#restrict... ), but because the class of software that Google distributes u…

> There's an entire class of tooling to make sure that GPL-tainted software isn't distributed

Amazing the lengths people go to in order to avoid sharing and treating others well! Imagine if they did the opposite: imagine if they just freely shared their source code.

Re: The terms of the AGPL are pretty easy to comply with

#307

Post by simion314 »

knorker wrote: post #295
simion314 wrote: post #210

Earlier quoted context omitted.

Only if your decide you need a lawyer.

:-P It's OK to drive drunk, as long as you put a blindfold on so you can't see that you're drunk?

I mean use your judgement, say you want to do npm install X, do you call your lawyers all the time or use your judgement?

Don't do X because Google is doing it, think for yourself and if you consider that you are not sure then ask for an expert. My point is if Microsoft says GPL is evil and you believe that and later when MS is open sourcing stuff and contributing to Linux you will have to admit that maybe MS had a giant interest to say that. those interests changed so MS changed, you should have never listen to MS without thinking for yourself and considering what MS interests are.

Re: The terms of the AGPL are pretty easy to comply with

#308

Post by knorker »

simion314 wrote: post #307
knorker wrote: post #295

Earlier quoted context omitted.

:-P It's OK to drive drunk, as long as you put a blindfold on so you can't see that you're drunk?

I mean use your judgement, say you want to do npm install X, do you call your lawyers all the time or use your judgement? Don't do X because Google is doing it, think for yourself and if you consider that you are not sure then ask for an expert. My point is if Microsoft says GPL is evil and you believe that and later when MS is open sourcing stuff and contributing to Linux you will have to admit that maybe MS had a g…

> I mean use your judgement, say you want to do npm install X, do you call your lawyers all the time or use your judgement?

Before starting to use code for my business, I'd check the license, yes. Almost all the time it's a standard one, so I know approximately that yes BSD, MIT, GPL, etc… means. Though I have to be careful about BSD with advertising clause.

Before starting to depend on code for my business, yes I would make sure that I am not violating a license.

Your "only if you decide you need a lawyer" seems to be saying that your opinion is necessarily right. You don't decide if you need a lawyer, you either do or you don't. And you make the right choice or you don't. (and their guidance is right or it isn't)

> Don't do X because Google is doing it, think for yourself and if you consider that you are not sure then ask for an expert.

Sure. You can peruse the AGPL, and if you think your amateur interpretation of this legally untested license does not add unacceptable risk, then you can choose to go ahead with it.

Google got sued for reimplementing an API. And they may lose (currently awaiting the supreme court).

People have been suing much smaller companies for GPL violations. It's a matter of time before someone sues for perceived AGPL violation due to what Google's lawyers are describing.

> My point is if Microsoft says GPL is evil and you believe that and later when MS is open sourcing stuff and contributing to Linux you will have to admit that maybe MS had a giant interest to say that.

Yup. That doesn't mean they're factually wrong. But yes there's the aspect of "It's hard to make someone understand that they are wrong when their income depends on them not understanding it".

But just because someone has a reason to do something, doesn't mean they did it. It's not an argument about correctness.

Re: The terms of the AGPL are pretty easy to comply with

#309

Post by kube-system »

woofie11 wrote: post #298
kube-system wrote: post #278

Earlier quoted context omitted.

ITAR? Any contract work under an NDA? Sensitive government work? Any code that implements trade secrets? Any custom enterprise software with hard-coded exceptions for controlled data? You can certainly use open source in regulated industries -- the question is, can they risk the legal possibility of being forced to open source the rest of their stack if the a court determines AGPL requires it.

I'm not saying everything done is open source. I'm saying it's less common in regulated industries. NDA / sensitive government work -> FOIA makes restrictions tough. I can request government source code. Trade secrets -> The government can't really keep trade secrets. I guess if I were working with classified code? Hard-coded exceptions -> Not specific to regulated industries but bad design. Legal possibility -> This…

FOIA has a substantial list of exemptions, and many of them would apply to a lot of code that the government uses.

Above, I was referring to trade secrets in the private sector, but actually, that is one of the FOIA exemptions too.

Also, a lot of code running in production is poorly designed. I'd bet the vast majority of it is poorly designed.

Damages are one part of it, but you also have to return to compliance, which means you either have to follow the license or stop using the code. Given that the AGPL doesn't have linking exceptions, the concern is that might be all of an organization's code.

That's not to say that you can't use open source in industries where these might be concerns -- almost all other common open source licenses don't have this problem.

Re: The terms of the AGPL are pretty easy to comply with

#310

Post by dekhn »

Back when I was a postdoc I talked to my advisor about GPL and BSD. The advisor (who was a supremely intelligent person) said the simplest, clearest possible thing I could imagine: "I wouldn't license software under GPL because I read the GPL license and couldn't understand what it was saying. I read the BSD license and it was totally clear. I want to license something using a license that makes technical sense to me."

The fact that we see pages and pages of hackers arguing over what the implications of a license family (GPL and AGPL) are based on the legal text suggests that many people don't understand the GPL.

Post reply on HN