6 ms·

Question: suppose Google had code running on their servers that was licensed under AGPL. AFAIK that means they have to release the code running on their server(

by tabeth 9y ago

Question: suppose Google had code running on their servers that was licensed under AGPL. AFAIK that means they have to release the code running on their server(s) , but because Google's code is proprietary and closed what would happen? A whistle blower notices and exposes them? Seems that unless someone is dumb enough to use AGPL, commercialize it and open source their code they would never be caught. Same with most licenses, really.

matte_black 9y ago
I have a hard time believing anything would happen at all.
- blattimwind 9y ago
  "Why is there AGPL coming out of your servers, Google?" — "That isn't AGPL, that's uh.. MIT, MIT from the MIT'ed open source we're using". On a slightly more serious note: that's what legal is for; engineers don't get to do it, and if they do, they'll take the fall for it, not Google.
Promarged 9y ago
> ...they would never be caught Well I think most companies need stronger guarantees than "[probably] never be caught".
coldtea 9y ago
>Question: suppose Google had code running on their servers that was licensed under AGPL. AFAIK that means they have to release the code, but because Google's code is proprietary and closed what would happen? A whistle blower notices and exposes them? I don't think they have to do anything, even if they did had AGPL. The license is only relevant if they distribute the source (or a product written in it), not as to what they privately do with it on their servers. Now, if they had used that code on, say, Android, that's a different thing.
- spicyj 9y ago
  AGPL is unlike other licenses in that it actually would matter if they use it on their servers.
- mseebach 9y ago
  No, that's the point of AGPL. It extends rights to users of a hosted application, as well a users of hosted applications linked to it. As the linked motivation states, "Even if you think you aren’t linking to anything important, it still presents a huge risk to Google because of how integrated much of our code is".
- dpq 9y ago
  This is incorrect, as far as I know. The FSF page [1] says as much. IANAL, but the relevant portion of the license appears to be this: You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways: d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements. [2] [1] https://www.gnu.org/licenses/why-affero-gpl.en.html https://www.gnu.org/licenses/why-affero-gpl.en.html [2] https://www.gnu.org/licenses/agpl-3.0.en.html https://www.gnu.org/licenses/agpl-3.0.en.html So basically yeah, Google would have to distribute the source code as well. Hence the ban.
- dalbasal 9y ago
  The lines between "distribute the source (or a product written in it)" and "what you privately do on your servers" is (I think) hard to discern for a lot of Google's code. If I have open source code that estimates your shoes size based on your IP address, and I make a website that will output your result... which category of code is this? What if I use this code to customize the UI for a shoe store? Honest question, is there an established way of deciding whether something counts as "distributed"? Is it simply a question of what machine it runs on?
AndrewDucker 9y ago
It would be obvious if they were running something which is very similar to an existing AGPL application. If they changed it significantly then you'd probably have to rely on whistleblowers.
mseebach 9y ago
It's pretty hard for someone externally to discover this, but Google has 20k+ software engineers, and I believe they all have access to the monorepo. All it takes is a single person with a grudge to leak a single screenshot to the right people, and Google is facing an immense lawsuit.
- jacques_chester 9y ago
  I am not a lawyer, but I expect that the core defences to such a lawsuit would be showing that you had a policy against using such code, showing you take active measures to avoid introducing it and showing rapid action if someone brings an example to your attention. I don't think it would be an "enormous lawsuit", except against the individual trying to maliciously introduce code against policy in order to harm their employer. Torts ahoy.
  - mseebach 9y ago
    Yes, I agree that this policy provides reasonable guards against someone introducing AGPL by accident, or even maliciously. But I took GP's point to imply a hypothetical where Google decides to more or less actively flaunt the restriction.
    - jacques_chester 9y ago
      Ah, I see I was a bit narrowly focused. btw -- "flout" is usually what's meant in terms of breaking laws, rules etc. It's basically a pedant's dream, which is doubly appropriate in a legal context.
bryanlarsen 9y ago
Absolutely nothing would happen. If Google put Citus (for example) on their servers, they would have to release the source code for Citus and everything it's linked to, which might include PostgresSQL but wouldn't include anything else. It's a pretty big stretch to believe that just checking Citus into their monorepo, exposing it to the world and accessing it from an internal service would constitute a link and require release of any of their proprietary code. Google may not want to take that risk, but that risk is miniscule IMO. IANAL.
- onli 9y ago
  Right. Any other interpretation is the "GPL is cancer"-FUD propagated by enemies of free licenses, like Microsoft under Balmer. Though lawyers like to err on this side of license interpretation.
  - CogitoCogito 9y ago
    Why is this being down-voted? It's totally correct. GPLed code linked into a program doesn't magically make the program GPLed. The GPL guarantees that as long as you provide the source code of your code under the GPL, you automatically get a license to use other GPLed code in your code. If you use GPLed code, but don't provide your code under the GPL, then you are probably infringing copyrights. That can be mitigated (assuming you're honorable and don't just hide it) by possibly paying the authors of the GPLed code to get a license under different terms, or possibly removing the code in question and maybe paying the original authors, or by fighting in court and possibly being forced to stop distributing the code and then removing the code and paying fines, or (as many assume is the only option) releasing their own code under the GPL as well. The details of what would occur almost certainly depend on the circumstances (was it known, when was it known, was it on purpose, did it have any real effect or was it a random bit of source code that was basically unused, etc.) and jurisdiction as well. Regardless it's definitely not the case that the GPL just magically infects any code it touches. That is a ridiculous simplification that is mostly spread by ignorance or those spreading FUD. Hell the GPL doesn't even do anything at all until the programs themselves is distributed. It's perfectly reasonable to prefer other licenses over the GPL, but let's not make up reasons to dislike it.
gourou 9y ago
Has this ever happened? A company having to open-source their whole software because of using AGPL?
_ph_ 9y ago
Obeying the terms of a license correctly is not about getting "cought", but a thing of integrity. If a certain license is incompatible with how a company runs their business, then completely staying away from software licensed by that license is the honest and right thing to do.
mikekchar 9y ago
This comes up often and is easily misunderstood: > AFAIK that means they have to release the code running on their server(s) This is incorrect. If they want to comply with the license, then that is what they have to do. They don't have to comply with the license. You never have to comply with a license. However, by not complying with the license, you are infringing on copyright. If they sue you then you may get an injunction to stop using the software, and/or you may have to pay money. It's certainly not a good situation to be in, but it's copyright infringement -- no more and no less.
johannes1234321 9y ago
Why shouldn't I kill somebody? - what could happen? A whistleblower notices and exposes me? Yes, one ignore laws and licenses, but aside from ethic reasons you will typically run into problems sooner or later.

by tabeth 9y ago

matte_black 9y ago

I have a hard time believing anything would happen at all.

blattimwind 9y ago
"Why is there AGPL coming out of your servers, Google?" — "That isn't AGPL, that's uh.. MIT, MIT from the MIT'ed open source we're using". On a slightly more serious note: that's what legal is for; engineers don't get to do it, and if they do, they'll take the fall for it, not Google.

Promarged 9y ago

> ...they would never be caught Well I think most companies need stronger guarantees than "[probably] never be caught".

coldtea 9y ago

>Question: suppose Google had code running on their servers that was licensed under AGPL. AFAIK that means they have to release the code, but because Google's code is proprietary and closed what would happen? A whistle blower notices and exposes them? I don't think they have to do anything, even if they did had AGPL. The license is only relevant if they distribute the source (or a product written in it), not as to what they privately do with it on their servers. Now, if they had used that code on, say, Android, that's a different thing.

spicyj 9y ago
AGPL is unlike other licenses in that it actually would matter if they use it on their servers.
mseebach 9y ago
No, that's the point of AGPL. It extends rights to users of a hosted application, as well a users of hosted applications linked to it. As the linked motivation states, "Even if you think you aren’t linking to anything important, it still presents a huge risk to Google because of how integrated much of our code is".
dpq 9y ago
This is incorrect, as far as I know. The FSF page [1] says as much. IANAL, but the relevant portion of the license appears to be this: You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways: d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements. [2] [1] https://www.gnu.org/licenses/why-affero-gpl.en.html https://www.gnu.org/licenses/why-affero-gpl.en.html [2] https://www.gnu.org/licenses/agpl-3.0.en.html https://www.gnu.org/licenses/agpl-3.0.en.html So basically yeah, Google would have to distribute the source code as well. Hence the ban.
dalbasal 9y ago
The lines between "distribute the source (or a product written in it)" and "what you privately do on your servers" is (I think) hard to discern for a lot of Google's code. If I have open source code that estimates your shoes size based on your IP address, and I make a website that will output your result... which category of code is this? What if I use this code to customize the UI for a shoe store? Honest question, is there an established way of deciding whether something counts as "distributed"? Is it simply a question of what machine it runs on?

AndrewDucker 9y ago

It would be obvious if they were running something which is very similar to an existing AGPL application. If they changed it significantly then you'd probably have to rely on whistleblowers.

mseebach 9y ago

It's pretty hard for someone externally to discover this, but Google has 20k+ software engineers, and I believe they all have access to the monorepo. All it takes is a single person with a grudge to leak a single screenshot to the right people, and Google is facing an immense lawsuit.

jacques_chester 9y ago
I am not a lawyer, but I expect that the core defences to such a lawsuit would be showing that you had a policy against using such code, showing you take active measures to avoid introducing it and showing rapid action if someone brings an example to your attention. I don't think it would be an "enormous lawsuit", except against the individual trying to maliciously introduce code against policy in order to harm their employer. Torts ahoy.
- mseebach 9y ago
  Yes, I agree that this policy provides reasonable guards against someone introducing AGPL by accident, or even maliciously. But I took GP's point to imply a hypothetical where Google decides to more or less actively flaunt the restriction.
  - jacques_chester 9y ago
    Ah, I see I was a bit narrowly focused. btw -- "flout" is usually what's meant in terms of breaking laws, rules etc. It's basically a pedant's dream, which is doubly appropriate in a legal context.

bryanlarsen 9y ago

Absolutely nothing would happen. If Google put Citus (for example) on their servers, they would have to release the source code for Citus and everything it's linked to, which might include PostgresSQL but wouldn't include anything else. It's a pretty big stretch to believe that just checking Citus into their monorepo, exposing it to the world and accessing it from an internal service would constitute a link and require release of any of their proprietary code. Google may not want to take that risk, but that risk is miniscule IMO. IANAL.

onli 9y ago
Right. Any other interpretation is the "GPL is cancer"-FUD propagated by enemies of free licenses, like Microsoft under Balmer. Though lawyers like to err on this side of license interpretation.
- CogitoCogito 9y ago
  Why is this being down-voted? It's totally correct. GPLed code linked into a program doesn't magically make the program GPLed. The GPL guarantees that as long as you provide the source code of your code under the GPL, you automatically get a license to use other GPLed code in your code. If you use GPLed code, but don't provide your code under the GPL, then you are probably infringing copyrights. That can be mitigated (assuming you're honorable and don't just hide it) by possibly paying the authors of the GPLed code to get a license under different terms, or possibly removing the code in question and maybe paying the original authors, or by fighting in court and possibly being forced to stop distributing the code and then removing the code and paying fines, or (as many assume is the only option) releasing their own code under the GPL as well. The details of what would occur almost certainly depend on the circumstances (was it known, when was it known, was it on purpose, did it have any real effect or was it a random bit of source code that was basically unused, etc.) and jurisdiction as well. Regardless it's definitely not the case that the GPL just magically infects any code it touches. That is a ridiculous simplification that is mostly spread by ignorance or those spreading FUD. Hell the GPL doesn't even do anything at all until the programs themselves is distributed. It's perfectly reasonable to prefer other licenses over the GPL, but let's not make up reasons to dislike it.

gourou 9y ago

Has this ever happened? A company having to open-source their whole software because of using AGPL?

_ph_ 9y ago

Obeying the terms of a license correctly is not about getting "cought", but a thing of integrity. If a certain license is incompatible with how a company runs their business, then completely staying away from software licensed by that license is the honest and right thing to do.

mikekchar 9y ago

This comes up often and is easily misunderstood: > AFAIK that means they have to release the code running on their server(s) This is incorrect. If they want to comply with the license, then that is what they have to do. They don't have to comply with the license. You never have to comply with a license. However, by not complying with the license, you are infringing on copyright. If they sue you then you may get an injunction to stop using the software, and/or you may have to pay money. It's certainly not a good situation to be in, but it's copyright infringement -- no more and no less.

johannes1234321 9y ago

Why shouldn't I kill somebody? - what could happen? A whistleblower notices and exposes me? Yes, one ignore laws and licenses, but aside from ethic reasons you will typically run into problems sooner or later.