7 ms·

Scratching Square off my list of service providers. I bet half of their datacenter software is in some way or the other using AGPL-licensed stuff; hypocrisy is

by bitL 7y ago

Scratching Square off my list of service providers. I bet half of their datacenter software is in some way or the other using AGPL-licensed stuff; hypocrisy is just insane.

callahad 7y ago
Is that plausible? I thought MongoDB was the only major, industrially successful AGPL project, and they relicensed last year to SSPL.
- brobdingnagians 7y ago
  iText and Ghostscript use AGPL, but both have alternative licensing under commercial licenses. There really aren't many important AGPL projects and they are easy to avoid.
  - mcny 7y ago
    I anal but My personal opinion is that if you use the ghostscript binaries by someone else and your software simply wants to create a PDF (for example) using ghostscript that is already installed on that machine, then it doesn't make sense to say I have to give the people who interact with the software my software's source.
mfer 7y ago
It might be GPL but I would guess it's not AGPL. AGPL requires you to open source the code to run the service. They've not done that. Their legal people are likely on top of this. It's not hard to run a SaaS and avoid all AGPL
- pas 7y ago
  How does "linking" works in this regard? If I have an internal AGPL service do I have to open source that too? I mean my end users never interact with that service. They interact with a - let's say - proprietary one. And that service is the client to the AGPL service. Or anything AGPL touches turns into AGPL? What is considered touching? If I use an AGPL firewall do the packets turn into AGPL? If I use an AGPL log aggregator? Or an AGPL centralized identity management thing every other service that auths turns into AGPL?
  - megous 7y ago
    https://www.gnu.org/licenses/agpl-3.0.html https://www.gnu.org/licenses/agpl-3.0.html 13
    - pas 7y ago
      https://news.ycombinator.com/item?id=20122666 https://news.ycombinator.com/item?id=20122666 Furthermore the combining with other works is not clear in on GPL3 cases. When combining happens and when doesn't? What happens if I combine it with proprietary software?
  - jsty 7y ago
    This is half the reason why many large companies have prohibitions on using AGPL code - no one is quite sure exactly what counts as 'interacting remotely', and thus what would be in scope for the source release requirements. In the absence of any case law to clarify the situation, many orgs just prefer not to bring in that uncertainty in the first place.
    - bitL 7y ago
      Usually AGPL products are dual licensed, allowing development of sustainable free software businesses, so I suspect the real reason is that companies simply don't want to pay for commercial licenses.
      - mfer 7y ago
        Companies often pay for commercial licenses and to use SaaS. Just look at the number of companies paying for Oracle or support from a GNU/Linux vendor like Ubuntu or Red Hat. I wonder if it's about control. With a SaaS you can switch to a competitor. It's possible to switch between GNU/Linux distros and the companies that support them. Change is possible. This can protect you from a vendor tanking or who has bad behavior. Oracle is an outlier. They aren't going away. There's enough business to keep them around. And, many companies are trying to get away from them slowly. When you have an AGPL and commercial dual license it puts that vendor in control. Do big businesses like putting others in a position of power and control over them? If that business is small or a startup do they want to have that as a hard dependency? Is it a risk to the big business? This isn't about paying for commercial licenses. It's about risk mitigation. Something big businesses do a lot of.
- 0x0 7y ago
  Didn't debian change to the AGPL version of ghostscript in a patch security update? If you use imagemagick or other pdf related libraries that maks use of ghostscript, this could happen easier than you think.
  - klez 7y ago
    > Didn't debian change to the AGPL version of ghostscript in a patch security update? Mostly, yes[0]. Parts of the package are under BSD, others FreeType license, others GPL etc. I don't know which ones are used in imagemagick, so I can't say whether AGPL "infected" it. [0] https://metadata.ftp-master.debian.org/changelogs//main/g/ghostscript/ghostscript_9.26a~dfsg-0+deb9u3_copyright https://metadata.ftp-master.debian.org/changelogs//main/g/gh...
kelp 7y ago
Up until 2 years ago, I ran Squares Production Engineering Infrastructure group, this included all datacenters and networking. Included automation for both. Most of our stack was CentOS, MySQL, ruby and java. The DC automation, such as it was, was mostly homegrown layers on top of kickstart. I don’t know of anything we depended on that was AGPL. I guess there is probably some berkelydb floating around, and the datastores team uses mongo for an internal app. AFIK, they still mostly run on this stack but are moving to k8s, then k8s on cloud. I know nothing about the new legal change, but do know I often had to talk legal down from being overly cautious and paranoid about other technical issues they didn’t understand.
bongobongo 7y ago
As a consumer I actively avoid vendors who use Square, anyways (at least whenever I can). Way too creeped out by their data harvesting and tracking of purchases. I made the mistake of choosing "email me my receipt" years ago and have been paying for it ever since. As far as I'm concerned, Square is garbage.

by bitL 7y ago

Scratching Square off my list of service providers. I bet half of their datacenter software is in some way or the other using AGPL-licensed stuff; hypocrisy is just insane.

callahad 7y ago

Is that plausible? I thought MongoDB was the only major, industrially successful AGPL project, and they relicensed last year to SSPL.

brobdingnagians 7y ago
iText and Ghostscript use AGPL, but both have alternative licensing under commercial licenses. There really aren't many important AGPL projects and they are easy to avoid.
- mcny 7y ago
  I anal but My personal opinion is that if you use the ghostscript binaries by someone else and your software simply wants to create a PDF (for example) using ghostscript that is already installed on that machine, then it doesn't make sense to say I have to give the people who interact with the software my software's source.

mfer 7y ago

It might be GPL but I would guess it's not AGPL. AGPL requires you to open source the code to run the service. They've not done that. Their legal people are likely on top of this. It's not hard to run a SaaS and avoid all AGPL

pas 7y ago
How does "linking" works in this regard? If I have an internal AGPL service do I have to open source that too? I mean my end users never interact with that service. They interact with a - let's say - proprietary one. And that service is the client to the AGPL service. Or anything AGPL touches turns into AGPL? What is considered touching? If I use an AGPL firewall do the packets turn into AGPL? If I use an AGPL log aggregator? Or an AGPL centralized identity management thing every other service that auths turns into AGPL?
- megous 7y ago
  https://www.gnu.org/licenses/agpl-3.0.html https://www.gnu.org/licenses/agpl-3.0.html 13
  - pas 7y ago
    https://news.ycombinator.com/item?id=20122666 https://news.ycombinator.com/item?id=20122666 Furthermore the combining with other works is not clear in on GPL3 cases. When combining happens and when doesn't? What happens if I combine it with proprietary software?
- jsty 7y ago
  This is half the reason why many large companies have prohibitions on using AGPL code - no one is quite sure exactly what counts as 'interacting remotely', and thus what would be in scope for the source release requirements. In the absence of any case law to clarify the situation, many orgs just prefer not to bring in that uncertainty in the first place.
  - bitL 7y ago
    Usually AGPL products are dual licensed, allowing development of sustainable free software businesses, so I suspect the real reason is that companies simply don't want to pay for commercial licenses.
    - mfer 7y ago
      Companies often pay for commercial licenses and to use SaaS. Just look at the number of companies paying for Oracle or support from a GNU/Linux vendor like Ubuntu or Red Hat. I wonder if it's about control. With a SaaS you can switch to a competitor. It's possible to switch between GNU/Linux distros and the companies that support them. Change is possible. This can protect you from a vendor tanking or who has bad behavior. Oracle is an outlier. They aren't going away. There's enough business to keep them around. And, many companies are trying to get away from them slowly. When you have an AGPL and commercial dual license it puts that vendor in control. Do big businesses like putting others in a position of power and control over them? If that business is small or a startup do they want to have that as a hard dependency? Is it a risk to the big business? This isn't about paying for commercial licenses. It's about risk mitigation. Something big businesses do a lot of.
0x0 7y ago
Didn't debian change to the AGPL version of ghostscript in a patch security update? If you use imagemagick or other pdf related libraries that maks use of ghostscript, this could happen easier than you think.
- klez 7y ago
  > Didn't debian change to the AGPL version of ghostscript in a patch security update? Mostly, yes[0]. Parts of the package are under BSD, others FreeType license, others GPL etc. I don't know which ones are used in imagemagick, so I can't say whether AGPL "infected" it. [0] https://metadata.ftp-master.debian.org/changelogs//main/g/ghostscript/ghostscript_9.26a~dfsg-0+deb9u3_copyright https://metadata.ftp-master.debian.org/changelogs//main/g/gh...

kelp 7y ago

Up until 2 years ago, I ran Squares Production Engineering Infrastructure group, this included all datacenters and networking. Included automation for both. Most of our stack was CentOS, MySQL, ruby and java. The DC automation, such as it was, was mostly homegrown layers on top of kickstart. I don’t know of anything we depended on that was AGPL. I guess there is probably some berkelydb floating around, and the datastores team uses mongo for an internal app. AFIK, they still mostly run on this stack but are moving to k8s, then k8s on cloud. I know nothing about the new legal change, but do know I often had to talk legal down from being overly cautious and paranoid about other technical issues they didn’t understand.

bongobongo 7y ago

As a consumer I actively avoid vendors who use Square, anyways (at least whenever I can). Way too creeped out by their data harvesting and tracking of purchases. I made the mistake of choosing "email me my receipt" years ago and have been paying for it ever since. As far as I'm concerned, Square is garbage.