Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Minio Changes License to AGPL

github.com

Post reply on HN
Print view View original

141–150 of 150 posts

Re: Minio Changes License to AGPL

#141

Post by eloff »

enriquto wrote: post #137
eloff wrote: post #49

Earlier quoted context omitted.

A lot of companies I've worked for had a blanket ban on AGPL. This is not a problem with the license, it's a problem with those companies. But it's still going to be a pain for the people who work there.

> This is not a problem with the license, it's a problem with those companies. But it's still going to be a pain for the people who work there. This sounds like a general problem, unrelated to licensing. If you work in companies with shitty policies, you are in for a world of pain.

These are big companies you would recognize. Shitty policies seem to go with the territory in large companies.

Re: Minio Changes License to AGPL

#142

Post by CaptainOSS »

orra wrote: post #9
bobthebuilders wrote: post #4

Yet another Rust project sinking to the depths of closed source.

The AGPL is free and open source. It's a strong copyleft licence.

AGPL is a “weak” copyleft license, not strong. It basically means not all derivatives need to be open sourced. If you modify AGPL code but never distribute it or provide it as a service over a network to users, you don’t have to provide source.

Re: Minio Changes License to AGPL

#143

Post by rad_gruchalski »

d110af5ccf wrote: post #132
rad_gruchalski wrote: post #34

Earlier quoted context omitted.

I didn’t downvote you. No, that’s not the case. Here’s a better explanation: https://writing.kemitchell.com/2021/01/24/Reading-AGPL.html Basically, if you ever need to use agpl stuff, do not embed or add your proprietary ip to a modified version. Use a sidecar. Only embed features you don’t care about.

I don't think that essay supports what you said. (It's incredibly well written by the way, thanks for linking it.) Near the end it asks: > If you build a larger web service by combining network services that call each other over HTTP, rather than libraries or snippets of code linked or pasted together, does “Corresponding Source” include the source for those other services? What if each service is containerized, enca…

To comply with the license, the Evil Corp would be required to share their modifications giving anybody who sees this as their market advantage the ability to do exactly the same thus diminishing the advantage. The Evil Corp would not be required to share the code which talks to the modified GPL'd library.

That's the spirit of this license and everything is working as intended.

But it's a good line of thought. Here's another thought experiment. When compiling say golang or Rust program, all dependencies end up being compiled into a single standalone binary. If a dependency of a dependency pulls in an unmodified GPL module, what impact does it have on our resulting binary? The common understanding is: if we're asked to share the code of the GPL dependency, we can share the original unmodified dependency and we're not required to share our code using the dependency.

Until we're proven otherwise, we should stick to that common understanding.

Re: Minio Changes License to AGPL

#144

Post by orra »

CaptainOSS wrote: post #142
orra wrote: post #9

Earlier quoted context omitted.

The AGPL is free and open source. It's a strong copyleft licence.

AGPL is a “weak” copyleft license, not strong. It basically means not all derivatives need to be open sourced. If you modify AGPL code but never distribute it or provide it as a service over a network to users, you don’t have to provide source.

> If you modify AGPL code but never distribute it

No free or open source license requires private modifications to be shared. Doing so would violate your privacy, and goes against the 'you can use this software for any purpose' requirement.

> or [never] provide it as a service over a network to users, you don’t have to provide source.

Hell, AGPL is one of the few licenses that does require you to share modifications, if you provide it as a network service. Again: strong copyleft.

Re: Minio Changes License to AGPL

#145

Post by CaptainOSS »

orra wrote: post #144
CaptainOSS wrote: post #142

Earlier quoted context omitted.

AGPL is a “weak” copyleft license, not strong. It basically means not all derivatives need to be open sourced. If you modify AGPL code but never distribute it or provide it as a service over a network to users, you don’t have to provide source.

> If you modify AGPL code but never distribute it No free or open source license requires private modifications to be shared. Doing so would violate your privacy, and goes against the 'you can use this software for any purpose' requirement. > or [never] provide it as a service over a network to users, you don’t have to provide source. Hell, AGPL is one of the few licenses that does require you to share modifications,…

after further research, you are correct that AGPLv3 is a "stronger" copyleft license. LGPL3 is a "weak" copyleft.

Re: Minio Changes License to AGPL

#146

Post by Benjamin_Dobell »

wegs2 wrote: post #136
Benjamin_Dobell wrote: post #112

Earlier quoted context omitted.

> Anyone can take an existing Apache 2.0 project and change the license to AGPL 3.0. No, you cannot. The very page you've linked to makes this clear: > Apache 2 software can therefore be included in GPLv3 projects, because the GPLv3 license accepts our software into GPLv3 works This is precisely what I've written. You can also apply the AGPLv3, you cannot remove the Apache 2.0. The contributions made under Apache 2.0…

You're reading it wrong. If we were to read this like a piece of computer code, the incompatibility would be mutual. GPL code does not permit further restrictions. "You cannot remove Apache 2.0" would be a further restriction. Ergo, you couldn't incorporate. It's just that this isn't how you read or interpret legal text. The linked page is correct. You can incorporate/sublicense Apache code into GPL code. You can't d…

You really don't seem to understand this at all.

Please, please stop telling people they can go ahead and do something.

Also, please stop suggesting that reading a license is a bad idea. That's horrible advice. (For readers, see comment below).

We're expected to sign/accept agreements near daily. The very nature of legal agreements is such that they must be written in a fashion that is clear in it's meaning, or else there's ambiguity in its interpretation, which means courts are not going to enforce it.

Of course it's ideal to sit down with a lawyer when doing so. However, it's pathetically idealistic to pretend that every open source project on Github has done just that.

The Apache 2.0 is its own license. There's nothing in the Apache 2.0 license about the GPL.

GPL was written by the GNU Foundation and they have their own interpretation about what licenses are compatible. Seems as that list isn't incorporated in the license itself, they're nothing more than guidelines.

However, let's see what GNU have to say about the Apache 2.0 license (https://www.gnu.org/licenses/license-list.en.html#apache2):

> This is a free software license, compatible with version 3 of the GNU GPL.

> Please note that this license is not compatible with GPL version 2, because it has some requirements that are not in that GPL version. These include certain patent termination and indemnification provisions. The patent termination provision is a good thing, which is why we recommend the Apache 2.0 license for substantial programs over other lax permissive licenses.

Even the GNU Foundation acknowledge that extra requirements of the Apache 2.0 make the license incompatible with the GPLv2. They do however claim it's GPLv3 compatible.

Great, their interpretation is that GPLv3 software can include Apache 2.0 software. Good on them. GNU Foundation (and the Apache Software Foundation) are not involved in the legal agreement made between a contributor and an open source project. Their opinion is irrelevant. The open source project has to adhere to the legal agreements they have made!

Licenses aren't magic, they're the same as every other agreement two parties make. If you want to update the terms of an agreement you've made with someone - you need a new agreement, with all parties involved!

Note that it's not uncommon for EULAs to contain clauses stating they're free to arbitrarily alter the terms, time and time again these clauses have been ruled as invalid.

In this case, by removing the Apache 2.0 license text, and not adhering to the terms of the Apache 2.0, Minio are not adhering to agreement they've made with contributors. It's really that simple. What the GNU Foundation claim is irrelevant, they're not a party involved in that agreement.

I could write a license right now:

> By adhering to this totally legit license, you're also in adherence with all other agreements you've ever made, but like, you don't need to follow their terms anymore, just our terms. Is all good. Don't worry.

That's not how licenses work. It's complete insanity that anyone could possibly think that a third-party has the right to alter the agreement, or interpretation of an agreement you've made with someone else.

Mind you, the GNU Foundation aren't stupid, nowhere do they claim that the GPLv3 can supplant Apache 2.0. They just say they'll permit Apache 2.0 in GPLv3 software. They most certainly do not claim you no longer need to honour the Apache 2.0. That's nonsense.

Stop, just stop it.

EDIT: Just to clarify, here is what the Apache 2.0 license says about incorporating Apache 2.0 licensed software in another project with a different license:

> You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.

Note that they specifically permit that, as long as you continue to comply with the conditions of Apache 2.0 license.

> The linked page is correct. You can incorporate/sublicense Apache code into GPL code. You can't do the reverse.

That's not what Minio have done! Have you opened the link?

They deleted the Apache 2.0 license from the entire repo. Removing the Apache 2.0 license is an egregious violation of the Apache 2.0 license's terms.

Re: Minio Changes License to AGPL

#147

Post by Benjamin_Dobell »

wegs2 wrote: post #138
Benjamin_Dobell wrote: post #114

Earlier quoted context omitted.

On the topic of software engineers exhibiting poor comprehension... > IANAL, but you're obviously not one either. That ought to have been clear from the first two sentences of my comment. > I can't imagine any court will care about 4b being on a per-file versus per-repo basis. You can imagine all you like. I'll leave that to the courts themselves. Suggesting people (even with a superfluous IANAL disclaimer) make lega…

Most of this is nonsense, but I'll point out a few things: > "Infringement and damages are unrelated concepts" No. They're the same concept. Infringement is okay if there are no damages. That's how a lawyer reads a contract. You're merely confusing types of damages. There are many ways to calculate damages. You're describing statutory damages. You usually run the calculation all ways, and take the greatest number whi…

Stop intertwining complete nonsense with tropes in order to try add credibility to your outrageous claims.

- IANAL.

- Get a lawyer.

- You probably know a lawyer.

Thank you for adding absolutely nothing to the conversation. The only common theme is that you think you shouldn't interpret a license yourself and act upon that.

What little substance is present in your comments is however in direct contradiction to that. You proceed to interpret a license, and tell people that violating it is fine, because the courts will probably think it's fine.

What? I just really hope anyone reading this can see through the tropes and realise you're in no position to be giving out advice.

The only advice I've given is read the licence, and to the best of your ability, act with accordance with the license. I'm 100% okay with that.

EDIT:

> Look into your social network. I have 3 or 4 lawyers who went to the same college I did. When I have a legal question, I do call them up.

> My experience is that for a volunteer project, open source, or similar, most lawyers are glad to chat.

These claims are highly dubious.

There are several lawyers in my extended family. I went to school with many more. They most certainly are not "glad to chat" about legal matters. Giving out any advice that may be construed as legal advice is a huge deal for them. You either know highly unprofessional lawyers, or you're making this up.

Re: Minio Changes License to AGPL

#148

Post by random5634 »

jen20 wrote: post #121
random5634 wrote: post #116

Earlier quoted context omitted.

Except of course the corporate folks who are licensing under AGPL who can and do then take contributors code and make available a commercial version that no one else is allowed to make available. AGPL is a poison pill license that creates a very distorted open source model - better example is "shared source" - you can look but can't really use it in you own ops. The whole AGPLv3 / GPLv3 thing was such a mess - a big…

> Except of course the corporate folks who are licensing under AGPL who can and do then take contributors code and make available a commercial version that no one else is allowed to make available. This is only true if there is a CLA, and contributors sign it.

The work around folks use is to claim just new stuff is agpl and skip contribs sign off. After stuff is mixed gets harder to pull apart. AWS just had to go through that exercise with elastic search

Re: Minio Changes License to AGPL

#149

Post by thecatwhisperer »

eloff wrote: post #49
enriquto wrote: post #15

Earlier quoted context omitted.

> You only have a problem if you modify anything in the source code of minio that you host. And even in that case, you only need to share your modifications of minio, not anything about the rest of your system. Doesn't seem too much of a problem, to begin with.

A lot of companies I've worked for had a blanket ban on AGPL. This is not a problem with the license, it's a problem with those companies. But it's still going to be a pain for the people who work there.

I don't agree it is a problem with the companies. The issue most companies (and their lawyers) have is that this has not (afaik) really been tested in court. So, sure _you_ may state that we should be fine if are are not modifying the code or directly linking, etc, etc, but the interpretation of the license is still _very_ open. Until legal precedent is set, most companies are not willing to take the risk. And why should they?

Many companies (our included) consider AGPL to be a poison pill. and until someone gets sued and the courts set precedent...

Re: Minio Changes License to AGPL

#150

Post by Quekid5 »

yjftsjthsd-h wrote: post #91
Quekid5 wrote: post #3

Is there a CLA or similar? Maybe I missed it, but I couldn't find anything in the CONTRIBUTING.md document. Or did they literally get every past contributor to agree?

Probably not necessary if they stack the licenses, since Apache 2.0 and AGPL are apparently compatible. That is, they can just add the terms of the AGPL in addition to Apache 2.0. (IANAL)

IANAL too, but my understanding is that you cannot just "relicense".

You can add your own license to any changes you make and add your own license headers, but absolutely cannot change any existing license headers, etc.

Post reply on HN