Square’s terms of service forbid use of AGPL-licensed software in online stores • Hacker News Board

Re: Square’s terms of service forbid use of AGPL-licensed software in online stores

#71

Post by jhauris » Thu, Jun 06, 2019, 1:51 PM UTC

Dayshine wrote: post #44

papaf wrote: post #38

Earlier quoted context omitted.

That's not true although it is easy to misunderstand AGPL in this way. You only have to provide the source of derivative work, and only to users of your service. So only the micro service using AGPL code. If you use an AGPL database for example, you don't have to provide any source code unless you change the source code of the database. This idea was behind the business models of Rethink DB and Mongo DB.

Except AGPL doesn't have the linking exception from LGPL, so your entire application is covered. A microservice doesn't get around it if it's tightly coupled. It would only be enough if your main application was not dependent on the AGPL microservice (e.g. you have another image processing microservice that provides perfect parity).

IANAL, but the source distribution requirement from network use only comes into play if the original AGPL work is modified. Section 13 of the AGPL seems to be the only part of the license that deals with remote network access, and it specifies modified versions. Everywhere else the discussion is around "convey", which in the definitions specifically excludes interaction over a network.

Re: Square’s terms of service forbid use of AGPL-licensed software in online stores

#72

Post by ceejayoz » Thu, Jun 06, 2019, 1:54 PM UTC

rambojazz wrote: post #63

merb wrote: post #59

Earlier quoted context omitted.

I see that aswell. else, google would need to provide the source code for gcloud, since I can run agpl software on top of their compute nodes... like wtf?

BTW, isn't this the exact purpose of the new MongoDB license?

No, not at all.

MongoDB's new license targets scenarios where Google would provide a hosted MongoDB service to their customers (like Amazon's RDS offering, for example). It has no impact on individual customers personally spinning up their own MongoDB on their own set of servers for their own use.

Re: Square’s terms of service forbid use of AGPL-licensed software in online stores

#73

Post by danShumway » Thu, Jun 06, 2019, 2:01 PM UTC

bibinou wrote: post #39

This concerns the Online Store, which is their Squarespace clone: https://squareup.com/us/en/online-store not Square Payments.

> By using Square Point of Sale, Customer Engagement, Appointments or Employee Management, Square Online Store, and any associated products and services (the “Services”)

It looks like it's a lot broader than just the Online Store, although it doesn't mention Payments specifically.

Still, "any associated products and services" sure seems like it would cover Payments as well? What's the dividing line for a product that's associated with the Online Store?

EDIT: This specific clause is listed under section 3 "Online Store", so it does seem likely to me that it's not meant to apply across the entire TOS.

Still a weird restriction for the online store, but given that there's also a non-disparagement clause right under it, it's certainly not the most egregious thing in this license.

Re: Square’s terms of service forbid use of AGPL-licensed software in online stores

#74

Post by Beltiras » Thu, Jun 06, 2019, 2:05 PM UTC

nabla9 wrote: post #35

bubblethink wrote: post #30

Earlier quoted context omitted.

And even if there were liability concerns due to copyleft or other clauses in AGPL, singling out AGPL makes no sense. If they want to avoid copyleft, it should be better phrased like so.

It's almost like they used some kind of AI software to scan legal documents, then it found sentence fragments like " .. opportunity for all users interacting with your Program through a computer network ..". You need artificial stupidity to misunderstand the "Interacting with Program through a computer network" in the way Square seems to understand it. Distributing software via online store is not interacting with th…

Some would maintain that being a legal analyst requires you to be artificially stupid because you are looking for loopholes and trying to avoid being trapped by ridiculous edge cases, whereas AI is trying to find a general solution that will work in 6-9s cases.

Re: Square’s terms of service forbid use of AGPL-licensed software in online stores

#75

Post by geggam » Thu, Jun 06, 2019, 2:05 PM UTC

Operyl wrote: post #42

nroah wrote: post #20

Earlier quoted context omitted.

He's mocking the fact that the title says APGL instead of AGPL

Some days I wonder if my brain is just wired significantly differently than most people. These single letter shift typos rarely even register in my mind. Hell, my mind registers words with 2-3 letters off perfectly fine. What usually gets me is when sentence structure is significantly off, not this kind of stuff.

Same

Re: Square’s terms of service forbid use of AGPL-licensed software in online stores

#76

Post by 0x0 » Thu, Jun 06, 2019, 2:14 PM UTC

mfer wrote: post #28

bitL wrote: post #10

Scratching Square off my list of service providers. I bet half of their datacenter software is in some way or the other using AGPL-licensed stuff; hypocrisy is just insane.

It might be GPL but I would guess it's not AGPL. AGPL requires you to open source the code to run the service. They've not done that. Their legal people are likely on top of this. It's not hard to run a SaaS and avoid all AGPL

Didn't debian change to the AGPL version of ghostscript in a patch security update? If you use imagemagick or other pdf related libraries that maks use of ghostscript, this could happen easier than you think.

Re: Square’s terms of service forbid use of AGPL-licensed software in online stores

#77

Post by resoluteteeth » Thu, Jun 06, 2019, 2:36 PM UTC

nabla9 wrote: post #22

This makes absolutely no sense. I'm almost certain that Square lawyers fucked up big time. They looked at the AGPL and completely misunderstood the context. There is no way in hell anyone can interpret AGPL in a way that makes Square responsible for any license violations their customers make selling software.

I think this is about including AGPL code in a website that you have hosted by Square. They are probably worried that if AGPL code is included, this will result in Square sending it to browsers together along with their own proprietary code, which could be interpreted as an AGPL violation by Square.

Honestly they are probably correct to be worried about this because it's pretty unclear whether or not it would be covered. At the very least, by making it against the TOS it is clear that it's the users fault not theirs if there is a violation.

Re: Square’s terms of service forbid use of AGPL-licensed software in online stores

#78

Post by rambojazz » Thu, Jun 06, 2019, 2:36 PM UTC

ceejayoz wrote: post #72

rambojazz wrote: post #63

Earlier quoted context omitted.

BTW, isn't this the exact purpose of the new MongoDB license?

No, not at all. MongoDB's new license targets scenarios where Google would provide a hosted MongoDB service to their customers (like Amazon's RDS offering, for example). It has no impact on individual customers personally spinning up their own MongoDB on their own set of servers for their own use.

My comment was a reply to the parent comment, not a reference to the article. What the parent comment says sounds like the true purpose of the new mongo license.

Re: Square’s terms of service forbid use of AGPL-licensed software in online stores

#79

Post by wolco » Thu, Jun 06, 2019, 2:42 PM UTC

jrootabega wrote: post #17

atomlib wrote: post #9

What's APGL? Anti Personnel Grenade Launchers?

Basically, if you use the software to expose a service, your service becomes subject to the same terms as if you were distributing the code behind it.

What if you don't own the service?

Re: Square’s terms of service forbid use of AGPL-licensed software in online stores

#80

Post by AnthonyMouse » Thu, Jun 06, 2019, 2:50 PM UTC

jsty wrote: post #50

pas wrote: post #37

Earlier quoted context omitted.

How does "linking" works in this regard? If I have an internal AGPL service do I have to open source that too? I mean my end users never interact with that service. They interact with a - let's say - proprietary one. And that service is the client to the AGPL service. Or anything AGPL touches turns into AGPL? What is considered touching? If I use an AGPL firewall do the packets turn into AGPL? If I use an AGPL log ag…

This is half the reason why many large companies have prohibitions on using AGPL code - no one is quite sure exactly what counts as 'interacting remotely', and thus what would be in scope for the source release requirements. In the absence of any case law to clarify the situation, many orgs just prefer not to bring in that uncertainty in the first place.

This is the section about "interacting remotely":

> Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software. This Corresponding Source shall include the Corresponding Source for any work covered by version 3 of the GNU General Public License that is incorporated pursuant to the following paragraph.

So that's about who you have to give the source code to if you modify the program, right? But isn't the salient point there that it only matters if you make modifications? Why should anybody who is using the software unmodified care about that at all?

And all the stuff about "what is linking" would be the same as it is for the ordinary GPL, would it not? The "Source Code" section of both licenses are word for word identical, anyway.

It all seems like a lot of FUD from people who don't like the AGPL because it requires them to follow the spirit of the ordinary GPL when they actually do make modifications but then use them in a public-facing service instead of distributing them as a software product, i.e. when it does exactly what it's intended to do.