8 ms·

Why the GNU Affero GPL

32 points by tjr 17y ago

asimjalis 17y ago
So if I write a program that web scrapes a server that contains code with the GNU Affero GPL, do I have to open source my web scraper as well?
- tptacek 17y ago
  No.
  - asimjalis 17y ago
    Did you read the article? "The GNU Affero General Public License is a modified version of the ordinary GNU GPL version 3. It has one added requirement: if you run the program on a server and let other users communicate with it there, your server must also allow them to download the source code corresponding to the program that it's running. If what's running there is your modified version of the program, the server's users must get the source code as you modified it." So if I write a program that is a front-end to a server that uses software with this license then my front-end program would also be affected by the license and will need to be open sourced. That seems like a straightforward implication.
gaius 17y ago
A shot across Google's bow?
Estragon 17y ago
I predict this won't be nearly as successful as the GPL has been. The incentives don't line up the same way as they did for desktop software.
- Maro 17y ago
  The point of the AGPL is to have companies like Google (who use heavily modified GPL'd codebases such as the Linux kernel or Mysql, but don't redistribute it, hence do not have to share back under the GPL) start sharing back as [if] projects switch to AGPL'd codebases.
glymor 17y ago
The AGPL was released in 2002. So this isn't a new development. It adds a requirement (section 2.d) that if the software contains a source download feature that feature has to be retained.
rlpb 17y ago
It's interesting that rms objects to SaaS on software freedom grounds. I'd never really considered this before.
- sigzero 17y ago
  That has been going on for a while now. I don't agree with him at all on this but...that isn't anything new.
  - loup-vaillant 17y ago
    May I ask you to be more specific? I would like to know what you disagree with, and why.
- blasdel 17y ago
  But he only cares about whether your application code generating responses on the server and the javascript running in your browser is Free under his definition. That in and of itself is not unreasonable — except that unlike every single other user on the planet, RMS doesn't give two shits about your data in a SaaS environment. The AGPL completely ignores what users actually care about the freedom of (data export), and focuses on stuff that's completely irrelevant (backend data munging). It may be simply because he has never used a rich web app, out of abject fear. He normally surfs the web via emacs+gnus+smtp+aliases+wget — he is not one of us, you can't argue with him on normal terms.
tptacek 17y ago
The AGPL makes straightforward commercial sense (we use it for our open source product, Flint). It keeps your code bona fide open source, so people who want to use and extend it noncommercially can do so without worrying about you at all; the code is genuinely free. At the same time, it means that people who would attempt to commercialize your code must at least do so on a level playing field with you. They can't take your code, improve it, and withhold those improvements. AGPL is much better than a "noncommercial" license, because code that can't be used commercially isn't open. "Noncommercial" licenses are deceptive; they suggest that you have an incentive to improve other people's code, but really you can only benefit the owners. And it's better than the BSD license, which fails in exactly the opposite direction. People who are reflexively anti-GPL tend not to know much about the security software industry, where intense VC funding and rafts of "me-too" products have plagued the major open source projects (Snort, Nessus, etc). If your code is ever going to really be worth something, and you MIT/BSD it, expect someone else to make a lot more money off it than you do.
- bretthoerner 17y ago
  Do you have open source contributers sign changes over to you, or do you consider their contributions a "loss"? In other words, you can't take AGPL contributions and dual license them in your product, right? (I don't mean to imply this is bad, I'm glad you helped explain a use of the AGPL and I'm just curious.)
  - Maro 17y ago
    The same problem exists if you try to sell a commercial license to a GPL'd codebase. I think if you plan to sell commercial licenses, you can't accept "outside' contributions without having the contributors sign them over.
    - bretthoerner 17y ago
      Sure, I'm curious what they do and why. It's not often I get to ask someone with an open source actual product.
    - 17y ago
mseebach 17y ago
The AGPL breaks with what's IMO is a central tenet in free software: The input and output to and of the software is not covered in any way by the license. The license covers distribution, not usage. The AGPL introduces such language as "interacting with it remotely through a computer network". If my database software is AGPL (and I've for some reason modified it) and my webserver is regular GPL, does accessing my blog-webapp (that talks to the DB) constitute "interacting" with the database? What if my blog is generated statically from the DB, triggered by uploading a new post through the web-interface? What if the trigger is cron? If a dataset can be uploaded directly into a software program using HTTP PUT, sure, that's covered. But what if the protocol requires e-mailing the dataset to a clerk who then feeds it in? Server software is used by letting people access it over networks. If you don't want people to use your software freely, for whatever purpose, commercial or not, free software is not for you.
- tptacek 17y ago
  This is a whole lot of what-iffing about a really straightforward idea. If you're going to incorporate my code into yours, and you're going to sell access to the resulting product as a web site, you need to make your code available. You can't host my code and your extensions on a website to evade the GPL. Agree with this or disagree with it, but it clearly isn't a plot to get the GPL to infect program outputs.
- Maro 17y ago
  I think such overcomplications are unnecessary. If the DB software is AGPL and you modify the source code, then run a service over it (eg. a webmail service) then you have to put the modified DB source code up on your FTP server. Takes less time then arguing about it here on HN.
- lkijuhyghjm 17y ago
  The difference between distributing and using your software. If I had a site where people could watch the pirate copies of movies for free - would the MPAA not care, because I'm not distributing the movies I'm just 'using' them.
tzs 17y ago
A key aspect of GPL is that you trigger its source distribution requirement by doing something that requires permission of the copyright holder. This is key because it makes GPL fundamentally different from a EULA. As the FSF notes, licenses for proprietary software try to take away your freedoms, whereas GPL adds to them. This works because GPL only imposes requirements on you when you do something that the law otherwise disallows. The typical EULA tries to stop you from doing things the law otherwise allows. If you obtain a legitimate copy of a GPL program and completely ignore the license, but only do things that copyright law allows you to do without needing the permission of the copyright holder, such as running the program, or making modifications to adapt it to run on your specific machine, you will not be in violation of the license--because the license only expands your copyright rights. Affero GPL's requirement to distribute source is triggered by letting someone communicate with your running copy of the program. That's something that does NOT require the copyright owner's permission in copyright law. That's taking away a freedom we have under copyright law--and puts Affero GPL squarely in the EULA category. The FSF seriously compromised their principles when they accepted Affero GPL.
- loup-vaillant 17y ago
  This is precisely because they compromised their principles with the AGPL that they didn't make it their main licence. They felt they had to let people make such a compromise, for some software. The problem with software which have significant influence over the network is that it's "users" might not be the owners. Effectively, freedom 0 and the other three are in conflict. (My freedom to run the software is in conflict with your right to study it). If I recall correctly, the FSF itself says AGPL software is not really free software.
- blasdel 17y ago
  Thank you! I've been making exactly this point over and over (http://searchyc.com/agpl+eula http://searchyc.com/agpl+eula), it's nice to see someone else noticing the same bullshit. Freedom Zero is the freedom to run the program, for any purpose

32 points by tjr 17y ago

So if I write a program that web scrapes a server that contains code with the GNU Affero GPL, do I have to open source my web scraper as well?

tptacek 17y ago
No.
- asimjalis 17y ago
  Did you read the article? "The GNU Affero General Public License is a modified version of the ordinary GNU GPL version 3. It has one added requirement: if you run the program on a server and let other users communicate with it there, your server must also allow them to download the source code corresponding to the program that it's running. If what's running there is your modified version of the program, the server's users must get the source code as you modified it." So if I write a program that is a front-end to a server that uses software with this license then my front-end program would also be affected by the license and will need to be open sourced. That seems like a straightforward implication.

gaius 17y ago

A shot across Google's bow?

Estragon 17y ago

I predict this won't be nearly as successful as the GPL has been. The incentives don't line up the same way as they did for desktop software.

Maro 17y ago
The point of the AGPL is to have companies like Google (who use heavily modified GPL'd codebases such as the Linux kernel or Mysql, but don't redistribute it, hence do not have to share back under the GPL) start sharing back as [if] projects switch to AGPL'd codebases.

glymor 17y ago

The AGPL was released in 2002. So this isn't a new development. It adds a requirement (section 2.d) that if the software contains a source download feature that feature has to be retained.

rlpb 17y ago

It's interesting that rms objects to SaaS on software freedom grounds. I'd never really considered this before.

sigzero 17y ago
That has been going on for a while now. I don't agree with him at all on this but...that isn't anything new.
- loup-vaillant 17y ago
  May I ask you to be more specific? I would like to know what you disagree with, and why.
blasdel 17y ago
But he only cares about whether your application code generating responses on the server and the javascript running in your browser is Free under his definition. That in and of itself is not unreasonable — except that unlike every single other user on the planet, RMS doesn't give two shits about your data in a SaaS environment. The AGPL completely ignores what users actually care about the freedom of (data export), and focuses on stuff that's completely irrelevant (backend data munging). It may be simply because he has never used a rich web app, out of abject fear. He normally surfs the web via emacs+gnus+smtp+aliases+wget — he is not one of us, you can't argue with him on normal terms.

tptacek 17y ago

The AGPL makes straightforward commercial sense (we use it for our open source product, Flint). It keeps your code bona fide open source, so people who want to use and extend it noncommercially can do so without worrying about you at all; the code is genuinely free. At the same time, it means that people who would attempt to commercialize your code must at least do so on a level playing field with you. They can't take your code, improve it, and withhold those improvements. AGPL is much better than a "noncommercial" license, because code that can't be used commercially isn't open. "Noncommercial" licenses are deceptive; they suggest that you have an incentive to improve other people's code, but really you can only benefit the owners. And it's better than the BSD license, which fails in exactly the opposite direction. People who are reflexively anti-GPL tend not to know much about the security software industry, where intense VC funding and rafts of "me-too" products have plagued the major open source projects (Snort, Nessus, etc). If your code is ever going to really be worth something, and you MIT/BSD it, expect someone else to make a lot more money off it than you do.

bretthoerner 17y ago
Do you have open source contributers sign changes over to you, or do you consider their contributions a "loss"? In other words, you can't take AGPL contributions and dual license them in your product, right? (I don't mean to imply this is bad, I'm glad you helped explain a use of the AGPL and I'm just curious.)
- Maro 17y ago
  The same problem exists if you try to sell a commercial license to a GPL'd codebase. I think if you plan to sell commercial licenses, you can't accept "outside' contributions without having the contributors sign them over.
  - bretthoerner 17y ago
    Sure, I'm curious what they do and why. It's not often I get to ask someone with an open source actual product.
  - 17y ago

mseebach 17y ago

The AGPL breaks with what's IMO is a central tenet in free software: The input and output to and of the software is not covered in any way by the license. The license covers distribution, not usage. The AGPL introduces such language as "interacting with it remotely through a computer network". If my database software is AGPL (and I've for some reason modified it) and my webserver is regular GPL, does accessing my blog-webapp (that talks to the DB) constitute "interacting" with the database? What if my blog is generated statically from the DB, triggered by uploading a new post through the web-interface? What if the trigger is cron? If a dataset can be uploaded directly into a software program using HTTP PUT, sure, that's covered. But what if the protocol requires e-mailing the dataset to a clerk who then feeds it in? Server software is used by letting people access it over networks. If you don't want people to use your software freely, for whatever purpose, commercial or not, free software is not for you.

tptacek 17y ago
This is a whole lot of what-iffing about a really straightforward idea. If you're going to incorporate my code into yours, and you're going to sell access to the resulting product as a web site, you need to make your code available. You can't host my code and your extensions on a website to evade the GPL. Agree with this or disagree with it, but it clearly isn't a plot to get the GPL to infect program outputs.
Maro 17y ago
I think such overcomplications are unnecessary. If the DB software is AGPL and you modify the source code, then run a service over it (eg. a webmail service) then you have to put the modified DB source code up on your FTP server. Takes less time then arguing about it here on HN.
lkijuhyghjm 17y ago
The difference between distributing and using your software. If I had a site where people could watch the pirate copies of movies for free - would the MPAA not care, because I'm not distributing the movies I'm just 'using' them.

tzs 17y ago

A key aspect of GPL is that you trigger its source distribution requirement by doing something that requires permission of the copyright holder. This is key because it makes GPL fundamentally different from a EULA. As the FSF notes, licenses for proprietary software try to take away your freedoms, whereas GPL adds to them. This works because GPL only imposes requirements on you when you do something that the law otherwise disallows. The typical EULA tries to stop you from doing things the law otherwise allows. If you obtain a legitimate copy of a GPL program and completely ignore the license, but only do things that copyright law allows you to do without needing the permission of the copyright holder, such as running the program, or making modifications to adapt it to run on your specific machine, you will not be in violation of the license--because the license only expands your copyright rights. Affero GPL's requirement to distribute source is triggered by letting someone communicate with your running copy of the program. That's something that does NOT require the copyright owner's permission in copyright law. That's taking away a freedom we have under copyright law--and puts Affero GPL squarely in the EULA category. The FSF seriously compromised their principles when they accepted Affero GPL.

loup-vaillant 17y ago
This is precisely because they compromised their principles with the AGPL that they didn't make it their main licence. They felt they had to let people make such a compromise, for some software. The problem with software which have significant influence over the network is that it's "users" might not be the owners. Effectively, freedom 0 and the other three are in conflict. (My freedom to run the software is in conflict with your right to study it). If I recall correctly, the FSF itself says AGPL software is not really free software.
blasdel 17y ago
Thank you! I've been making exactly this point over and over (http://searchyc.com/agpl+eula http://searchyc.com/agpl+eula), it's nice to see someone else noticing the same bullshit. Freedom Zero is the freedom to run the program, for any purpose