6 ms·

I'm not an expert in licenses, could someone weight in and explain how the AGPLv3 was being abused? Did the mentioned companies follow the spirit of the licens

by vslira 8y ago

I'm not an expert in licenses, could someone weight in and explain how the AGPLv3 was being abused? Did the mentioned companies follow the spirit of the license and were getting away with something the company didn't like or were they just improperly distributing the software, regardless of licensing terms? Also: "So while the SSPL isn’t all that different from the GNU GPLv3,(...) [it] explicitly states that anybody who wants to offer MongoDB as a service (..) needs to either get a commercial license or open source the service to give back the community." Doesn't AGPLv3 already require open sourcing server side implementations? Thanks in advance

shadowmint 8y ago
https://webassets.mongodb.com/_com_assets/legal/SSPL-compared-to-AGPL.pdf?_ga=2.32522554.548222804.1539700834-1057506187.1539700834 https://webassets.mongodb.com/_com_assets/legal/SSPL-compare... “Service Source Code” means the Corresponding Source for the Program or the modified version, and the Corresponding Source for all programs that you use to make the Program or modified version available as a service, including, without limitation, management software, user interfaces, application program interfaces, automation software, monitoring software, backup software, storage software and hosting software, all such that a user could run an instance of the service using the Service Source Code you make available.” ^ not the same.
- notacoward 8y ago
  The "all programs you use" clause seems to make it extremely viral, perhaps unprecedentedly so. It seems to me that anyone not willing to comply with AGPL would be even less likely to comply with this. Not sure how that's supposed to be a good outcome, even for Mongo.
  - amyjess 8y ago
    This sounds like a violation of provision 9 of the Open Source Definition and the DFSG. It's going to backfire hard when distros start removing Mongo from their main repos.
    - Symbiote 8y ago
      Why would they? They don't make a Mongo service available. Neither do most users who install Mongo from a Linux distribution repository. (Thanks for the explanation, "DFSG" passed over me the first time I read this. "Debian Free Software Guidelines".)
      - amyjess 8y ago
        Distributions like Debian, Fedora, Ubuntu, etc. require that all software in their core repos be FOSS. It's not about their legal obligations but about their own policies forbidding proprietary software in their core repos. Since the new Mongo license violates rule 9 of the DFSG, it is considered proprietary software by Debian's definition, and that means Debian's FOSS policy will require Mongo to be moved out of the core repos and into the non-free repo. Fedora and Ubuntu have their own policies which will have the same effect.
    - pas 8y ago
      Mongo already provides their own repos, and recommends using that for install and updates. I don't think they care or anyone seriously wanting to develop something on/around Mongo does either.
      - gshipley 8y ago
        The same can be said for docker?
        pas 8y ago
        Yes, though I think their enterprise efforts are truly different offerings, and Kubernetes probably surprised them a bit there.
  - pas 8y ago
    Why is it viral? It doesn't require those other stuff to also be available under this license, just as source-available. Which means this is basically AGPL++.
- kstrauser 8y ago
  That... is an impressive load of shit. So because I want to host MongoDB, I have to offer up the source for the Linux distro used to host the Jenkins server that I use to test it, huh. Last week I was debating whether MongoDB is now completely obsoleted by PostgreSQL’s JSON datatype. As of now, I consider that no longer a debate.
  - rmc 8y ago
    Couldn't you just say "I run Jenkins available from https://blah.com https://blah.com and Ubuntu from https://blah.com" https://blah.com"? Doesn't sound too strenuous
    - kstrauser 8y ago
      If you've never had to enumerate every piece of software you've installed, you might not think so. In practice, it's a major PITA. And what if you're using a closed-source CI/CD or monitoring system, so that you can't comply with their bizarre terms? No, I think the real goal here is to make it effectively impossible to use this in a business setting without buying a commercial license. I'm glad Linus and RMS didn't see it that way.
- nebulous1 8y ago
  Original: your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software.
- mbreese 8y ago
  Also from the license, w.r.t. "Corresponding Source" definition: === However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. === Not that this makes the issue any more clear or enforceable...
DannyBee 8y ago
Speaking as a lawyer: There was no abuse, there was only mongo not being able to make money in all cases they wanted to. That's what they see as abuse. It isn't. While they complain of bad actors, bad actors always act bad. This will not disincentivize them (they are also often in a lot of interesting jurisdictions that would make it hard anyway). Instead, this is really about making it completely unpalatable for normal actors to not pay mongo in every single case. Otherwise, one has to believe that mongo is going to go off and sue a bunch of people now, which would be a horribly stupid business model.
- mrkurt 8y ago
  Speaking as not a lawyer: there is lots of abuse of OSS infrastructure from big tech corps — because the AGPL isn't equipped for everything-as-a-service eating software licensing. If "abuse" were license violations, they wouldn't have to use a new license. Abuse is often legal.
  - DannyBee 8y ago
    What is your definition of "abuse"? This feels a lot like when i hear about "GPL" abuse when it was specifically not designed for what people think is abuse (and that's not my view but stallman's). Similarly, AGPL was not designed to require every piece of software around a piece of AGPL software to be open sourced. Deliberately so. Not doing so is not "abuse". You may have different goals, and that's actually fine! But it doesn't make following the license and what it was meant for abuse. I'll also point out: In the history of my work on open source, by far the largest legal abusers of open source are startups. By many orders of magnitude. This is real abuse in the sense of clear license non-compliance. I worked on M&A at a variety of companies that acquired all sorts of different kind/stages of startups. They rarely are compliant with even simple notice licenses (IE don't bother to post notices), let alone any of the more restrictive licenses. Large corps often have legal departments that try to understand and consider and figure out what to do, even if they do it wrong. So to me, every time i hear "large company open source abusers" i kind of laugh, because IMHO getting the startups to stop abusing open source would have a much more significant difference on OSS than getting 2 or 3 large companies to stop "abusing" it.

by vslira 8y ago

shadowmint 8y ago

https://webassets.mongodb.com/_com_assets/legal/SSPL-compared-to-AGPL.pdf?_ga=2.32522554.548222804.1539700834-1057506187.1539700834 https://webassets.mongodb.com/_com_assets/legal/SSPL-compare... “Service Source Code” means the Corresponding Source for the Program or the modified version, and the Corresponding Source for all programs that you use to make the Program or modified version available as a service, including, without limitation, management software, user interfaces, application program interfaces, automation software, monitoring software, backup software, storage software and hosting software, all such that a user could run an instance of the service using the Service Source Code you make available.” ^ not the same.

notacoward 8y ago
The "all programs you use" clause seems to make it extremely viral, perhaps unprecedentedly so. It seems to me that anyone not willing to comply with AGPL would be even less likely to comply with this. Not sure how that's supposed to be a good outcome, even for Mongo.
- amyjess 8y ago
  This sounds like a violation of provision 9 of the Open Source Definition and the DFSG. It's going to backfire hard when distros start removing Mongo from their main repos.
  - Symbiote 8y ago
    Why would they? They don't make a Mongo service available. Neither do most users who install Mongo from a Linux distribution repository. (Thanks for the explanation, "DFSG" passed over me the first time I read this. "Debian Free Software Guidelines".)
    - amyjess 8y ago
      Distributions like Debian, Fedora, Ubuntu, etc. require that all software in their core repos be FOSS. It's not about their legal obligations but about their own policies forbidding proprietary software in their core repos. Since the new Mongo license violates rule 9 of the DFSG, it is considered proprietary software by Debian's definition, and that means Debian's FOSS policy will require Mongo to be moved out of the core repos and into the non-free repo. Fedora and Ubuntu have their own policies which will have the same effect.
  - pas 8y ago
    Mongo already provides their own repos, and recommends using that for install and updates. I don't think they care or anyone seriously wanting to develop something on/around Mongo does either.
    - gshipley 8y ago
      The same can be said for docker?
      - pas 8y ago
        Yes, though I think their enterprise efforts are truly different offerings, and Kubernetes probably surprised them a bit there.
- pas 8y ago
  Why is it viral? It doesn't require those other stuff to also be available under this license, just as source-available. Which means this is basically AGPL++.
kstrauser 8y ago
That... is an impressive load of shit. So because I want to host MongoDB, I have to offer up the source for the Linux distro used to host the Jenkins server that I use to test it, huh. Last week I was debating whether MongoDB is now completely obsoleted by PostgreSQL’s JSON datatype. As of now, I consider that no longer a debate.
- rmc 8y ago
  Couldn't you just say "I run Jenkins available from https://blah.com https://blah.com and Ubuntu from https://blah.com" https://blah.com"? Doesn't sound too strenuous
  - kstrauser 8y ago
    If you've never had to enumerate every piece of software you've installed, you might not think so. In practice, it's a major PITA. And what if you're using a closed-source CI/CD or monitoring system, so that you can't comply with their bizarre terms? No, I think the real goal here is to make it effectively impossible to use this in a business setting without buying a commercial license. I'm glad Linus and RMS didn't see it that way.
nebulous1 8y ago
Original: your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software.
mbreese 8y ago
Also from the license, w.r.t. "Corresponding Source" definition: === However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. === Not that this makes the issue any more clear or enforceable...

DannyBee 8y ago

Speaking as a lawyer: There was no abuse, there was only mongo not being able to make money in all cases they wanted to. That's what they see as abuse. It isn't. While they complain of bad actors, bad actors always act bad. This will not disincentivize them (they are also often in a lot of interesting jurisdictions that would make it hard anyway). Instead, this is really about making it completely unpalatable for normal actors to not pay mongo in every single case. Otherwise, one has to believe that mongo is going to go off and sue a bunch of people now, which would be a horribly stupid business model.

mrkurt 8y ago
Speaking as not a lawyer: there is lots of abuse of OSS infrastructure from big tech corps — because the AGPL isn't equipped for everything-as-a-service eating software licensing. If "abuse" were license violations, they wouldn't have to use a new license. Abuse is often legal.
- DannyBee 8y ago
  What is your definition of "abuse"? This feels a lot like when i hear about "GPL" abuse when it was specifically not designed for what people think is abuse (and that's not my view but stallman's). Similarly, AGPL was not designed to require every piece of software around a piece of AGPL software to be open sourced. Deliberately so. Not doing so is not "abuse". You may have different goals, and that's actually fine! But it doesn't make following the license and what it was meant for abuse. I'll also point out: In the history of my work on open source, by far the largest legal abusers of open source are startups. By many orders of magnitude. This is real abuse in the sense of clear license non-compliance. I worked on M&A at a variety of companies that acquired all sorts of different kind/stages of startups. They rarely are compliant with even simple notice licenses (IE don't bother to post notices), let alone any of the more restrictive licenses. Large corps often have legal departments that try to understand and consider and figure out what to do, even if they do it wrong. So to me, every time i hear "large company open source abusers" i kind of laugh, because IMHO getting the startups to stop abusing open source would have a much more significant difference on OSS than getting 2 or 3 large companies to stop "abusing" it.