5 ms·

This is half the reason why many large companies have prohibitions on using AGPL code - no one is quite sure exactly what counts as 'interacting remotely', and

by jsty 7y ago

This is half the reason why many large companies have prohibitions on using AGPL code - no one is quite sure exactly what counts as 'interacting remotely', and thus what would be in scope for the source release requirements. In the absence of any case law to clarify the situation, many orgs just prefer not to bring in that uncertainty in the first place.

bitL 7y ago
Usually AGPL products are dual licensed, allowing development of sustainable free software businesses, so I suspect the real reason is that companies simply don't want to pay for commercial licenses.
- mfer 7y ago
  Companies often pay for commercial licenses and to use SaaS. Just look at the number of companies paying for Oracle or support from a GNU/Linux vendor like Ubuntu or Red Hat. I wonder if it's about control. With a SaaS you can switch to a competitor. It's possible to switch between GNU/Linux distros and the companies that support them. Change is possible. This can protect you from a vendor tanking or who has bad behavior. Oracle is an outlier. They aren't going away. There's enough business to keep them around. And, many companies are trying to get away from them slowly. When you have an AGPL and commercial dual license it puts that vendor in control. Do big businesses like putting others in a position of power and control over them? If that business is small or a startup do they want to have that as a hard dependency? Is it a risk to the big business? This isn't about paying for commercial licenses. It's about risk mitigation. Something big businesses do a lot of.
AnthonyMouse 7y ago
This is the section about "interacting remotely": > Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software. This Corresponding Source shall include the Corresponding Source for any work covered by version 3 of the GNU General Public License that is incorporated pursuant to the following paragraph. So that's about who you have to give the source code to if you modify the program, right? But isn't the salient point there that it only matters if you make modifications? Why should anybody who is using the software unmodified care about that at all? And all the stuff about "what is linking" would be the same as it is for the ordinary GPL, would it not? The "Source Code" section of both licenses are word for word identical, anyway. It all seems like a lot of FUD from people who don't like the AGPL because it requires them to follow the spirit of the ordinary GPL when they actually do make modifications but then use them in a public-facing service instead of distributing them as a software product, i.e. when it does exactly what it's intended to do.
- jillesvangurp 7y ago
  That's your interpretation and that's the problem because you might be wrong in some subtle way that a lawyer could exploit. Also, you are looking at a single paragraph, there's a lot more to this and it includes notions of linking, derivative works, distribution, etc. Lawyers really don't like having a lot of open questions around this stuff and some of the more extreme interpretations would be very disruptive for any business that wants to keep parts of their software proprietary. The other point is that the intention of this license is explicitly to prevent people commercializing software licensed this way through proprietary extensions, additions, etc. The whole point of the license is to make that difficult/impossible. If you use AGPL software, you have to respect this intention. Gplv3 is also not that popular with legal departments for the same reason. Even Gplv2 is generally frowned upon but better understood since there is a fair bit of case law around it and known ways of dealing with it when e.g. shipping binary kernel modules with an OS, which is one of those legally grey areas where you have to depend on legal interpretations of the license. Gplv3 was explicitly written to close some of those loopholes in Gplv2: they were unintentional. So, this is not FUD but basically lawyers doing their jobs and they are fairly consistent in their reservations with respect to this license across the industry. You talk to lawyers in any fortune 500 company and they'll probably will be very reluctant to sign off on any AGPL dependencies.
  - AnthonyMouse 7y ago
    You're arguing that companies should fear the license because there is uncertainty and you doubt that an unproblematic interpretation is accurate, but that that isn't FUD. It's fear, uncertainty and doubt. > The other point is that the intention of this license is explicitly to prevent people commercializing software licensed this way through proprietary extensions, additions, etc. The whole point of the license is to make that difficult/impossible. If you use AGPL software, you have to respect this intention. That may be true, but why should you care if you are not actually doing that and are only using the software without modification? > Even Gplv2 is generally frowned upon but better understood since there is a fair bit of case law around it It is pretty uncommon for there to be existing caselaw interpreting a given software license. Proprietary software licenses are commonly unique to the software, sometimes even unique to the customer. If this is a concern then shouldn't a widely used form license like the AGPL be an advantage, because then it's more likely the first time a court has to interpret the text will be in somebody else's case and not yours? > So, this is not FUD but basically lawyers doing their jobs and they are fairly consistent in their reservations with respect to this license across the industry. You talk to lawyers in any fortune 500 company and they'll probably will be very reluctant to sign off on any AGPL dependencies. Have you experienced asking lawyers for their opinions on contract text? You'll generally get back a document identifying various concerns with just about every provision in the text, because that's their job. For example, here's a fun provision from the Windows 10 license: > [you may not] use the software as server software, for commercial hosting, make the software available for simultaneous use by multiple users over a network, install the software on a server and allow users to access it remotely, or install the software on a device for use only by remote users; What does that mean? How will a court interpret it? Should corporations avoid Microsoft Windows as a result, because they might violate some interpretation of the license and then be liable for copyright infringement? Lawyers having concerns about license terms is par for the course. What you haven't established is what makes the AGPL unusual in that regard, as compared with the above or a hundred other provisions in various other licenses.

by jsty 7y ago

bitL 7y ago

Usually AGPL products are dual licensed, allowing development of sustainable free software businesses, so I suspect the real reason is that companies simply don't want to pay for commercial licenses.

mfer 7y ago
Companies often pay for commercial licenses and to use SaaS. Just look at the number of companies paying for Oracle or support from a GNU/Linux vendor like Ubuntu or Red Hat. I wonder if it's about control. With a SaaS you can switch to a competitor. It's possible to switch between GNU/Linux distros and the companies that support them. Change is possible. This can protect you from a vendor tanking or who has bad behavior. Oracle is an outlier. They aren't going away. There's enough business to keep them around. And, many companies are trying to get away from them slowly. When you have an AGPL and commercial dual license it puts that vendor in control. Do big businesses like putting others in a position of power and control over them? If that business is small or a startup do they want to have that as a hard dependency? Is it a risk to the big business? This isn't about paying for commercial licenses. It's about risk mitigation. Something big businesses do a lot of.

AnthonyMouse 7y ago

This is the section about "interacting remotely": > Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software. This Corresponding Source shall include the Corresponding Source for any work covered by version 3 of the GNU General Public License that is incorporated pursuant to the following paragraph. So that's about who you have to give the source code to if you modify the program, right? But isn't the salient point there that it only matters if you make modifications? Why should anybody who is using the software unmodified care about that at all? And all the stuff about "what is linking" would be the same as it is for the ordinary GPL, would it not? The "Source Code" section of both licenses are word for word identical, anyway. It all seems like a lot of FUD from people who don't like the AGPL because it requires them to follow the spirit of the ordinary GPL when they actually do make modifications but then use them in a public-facing service instead of distributing them as a software product, i.e. when it does exactly what it's intended to do.

jillesvangurp 7y ago
That's your interpretation and that's the problem because you might be wrong in some subtle way that a lawyer could exploit. Also, you are looking at a single paragraph, there's a lot more to this and it includes notions of linking, derivative works, distribution, etc. Lawyers really don't like having a lot of open questions around this stuff and some of the more extreme interpretations would be very disruptive for any business that wants to keep parts of their software proprietary. The other point is that the intention of this license is explicitly to prevent people commercializing software licensed this way through proprietary extensions, additions, etc. The whole point of the license is to make that difficult/impossible. If you use AGPL software, you have to respect this intention. Gplv3 is also not that popular with legal departments for the same reason. Even Gplv2 is generally frowned upon but better understood since there is a fair bit of case law around it and known ways of dealing with it when e.g. shipping binary kernel modules with an OS, which is one of those legally grey areas where you have to depend on legal interpretations of the license. Gplv3 was explicitly written to close some of those loopholes in Gplv2: they were unintentional. So, this is not FUD but basically lawyers doing their jobs and they are fairly consistent in their reservations with respect to this license across the industry. You talk to lawyers in any fortune 500 company and they'll probably will be very reluctant to sign off on any AGPL dependencies.
- AnthonyMouse 7y ago
  You're arguing that companies should fear the license because there is uncertainty and you doubt that an unproblematic interpretation is accurate, but that that isn't FUD. It's fear, uncertainty and doubt. > The other point is that the intention of this license is explicitly to prevent people commercializing software licensed this way through proprietary extensions, additions, etc. The whole point of the license is to make that difficult/impossible. If you use AGPL software, you have to respect this intention. That may be true, but why should you care if you are not actually doing that and are only using the software without modification? > Even Gplv2 is generally frowned upon but better understood since there is a fair bit of case law around it It is pretty uncommon for there to be existing caselaw interpreting a given software license. Proprietary software licenses are commonly unique to the software, sometimes even unique to the customer. If this is a concern then shouldn't a widely used form license like the AGPL be an advantage, because then it's more likely the first time a court has to interpret the text will be in somebody else's case and not yours? > So, this is not FUD but basically lawyers doing their jobs and they are fairly consistent in their reservations with respect to this license across the industry. You talk to lawyers in any fortune 500 company and they'll probably will be very reluctant to sign off on any AGPL dependencies. Have you experienced asking lawyers for their opinions on contract text? You'll generally get back a document identifying various concerns with just about every provision in the text, because that's their job. For example, here's a fun provision from the Windows 10 license: > [you may not] use the software as server software, for commercial hosting, make the software available for simultaneous use by multiple users over a network, install the software on a server and allow users to access it remotely, or install the software on a device for use only by remote users; What does that mean? How will a court interpret it? Should corporations avoid Microsoft Windows as a result, because they might violate some interpretation of the license and then be liable for copyright infringement? Lawyers having concerns about license terms is par for the course. What you haven't established is what makes the AGPL unusual in that regard, as compared with the above or a hundred other provisions in various other licenses.