4 ms·

The AGPL doesn't guarantee that you'll get contributions back. For the very few companies who are willing to touch AGPL code, they only need to make the change

The AGPL doesn't guarantee that you'll get contributions back. For the very few companies who are willing to touch AGPL code, they only need to make the changes available (e.g. a CD in the post is sufficient). Very few companies are willing to use it, because it creates an almost unassailable hurdle in lots of industries. It's also highly at risk at making a bunch of other projects AGPL as well.

black_puppydog 6y ago
<edit> Using "you" in the general "one" sense, not to attack you personally of course </edit> > it creates an almost unassailable hurdle in lots of industries. It's intended to be a hurdle, if you want to build a business on other people's work and not contribute back. Be a player that benefits the ecosystem or go away and build the product from scratch if you think you can. > a CD in the post is sufficient Yeah, it would be. If they make valuable contributions to the source code, they'll soon realize that just dumping those on github will have the same effect and save them a full time employee for burning CDs. If the contributions are not valuable, the problem will likely solve itself when the company goes bust.
ddevault 6y ago
It does nothing of the sort. This is propeganda that mega-corps want you to believe because they are unable to rip off AGPL software effectively. Organizations like Google can afford to not use AGPL software (they can just write their own software), but it costs them money, so they refuse to use AGPL software and spread propeganda that it's impossible to do so, to weaken its market penetration and ensure that they have greater access to software without the responsibility to contribute back. In actual fact, being compliant with AGPL software is extremely easy. Nothing at all is expected of you if you just ship it into production as-is. And if you modify it, the only obligation is to send the modifications upstream as patches. That's it. Surely any company is capable of completing such a trivial feat.
- xyzzy_plugh 6y ago
  You're glossing over the fact that being compliant with AGPL requires more competence than the vast majority of software jobs. I know you could competently integrate or use AGPL software, and I might be able to do it (while repeatedly referencing armchair lawyers on stackoverflow), but there is still a risk I fuck it up and my (or my employer's) competitive advantage is in jeopardy. You are right that AGPL is easy if you can just run it as-is. The real problems start with libraries. If I link an AGPL PDF-generating library with my monolith service which runs financial reports over my business, what happens? Do I need to now publish my SQL queries that access sensitively named tables? Maybe that reveals new secret projects we're working on, or perhaps security incident mitigations underway. Sure, there are countless ways to architect my way out of those problems, but what if I don't have the resources to do that right now? The small obligation becomes a large burden pretty quickly. (The real solution to the above problems is to pay for the corporate license that removes the AGPL obligation, but that assumes you can afford to do so) AGPL is fundamentally scary to lawyers and management because they're afraid someone will sink the ship. Sure it's mostly FUD, but there are some serious valid concerns.
  - ddevault 6y ago
    >If I link an AGPL PDF-generating library with my monolith service which runs financial reports over my business, what happens? No one uses AGPL for libraries, except maybe by mistake. LGPL is used for this purpose. >Do I need to now publish my SQL queries that access sensitively named tables? No. The FAQ from GNU makes how this works pretty clear: https://www.gnu.org/licenses/gpl-faq.html#AGPLv3InteractingRemotely https://www.gnu.org/licenses/gpl-faq.html#AGPLv3InteractingR... The AGPL is not viral in the sense that all client software accessing an AGPL-licensed service are required to use the AGPL, but rather, such clients are entitled to the source of that service. It puts no obligations whatsoever on client software. https://www.gnu.org/licenses/gpl-faq.html#AGPLv3InteractingRemotely https://www.gnu.org/licenses/gpl-faq.html#AGPLv3InteractingR... Maybe you should actually read up on the AGPL license before you make assumptions about it? It seems like you don't really understand it.
    - xyzzy_plugh 6y ago
- pabs3 6y ago
  > the only obligation is to send the modifications upstream as patches That is incorrect, the modifications have to go to users not upstream. All the GNU copyleft licenses are like this.
  - ddevault 6y ago
    Sorry, you're right, thanks for the correction. In practice, sending the patches upstream is the easiest way to be compliant, though.
- tannhaeuser 6y ago
  You're probably right (and also, I find your comment further below regarding interpretation of AGPL insightful, insofar as it touches on a point in AGPL that would impose limits onto unrelated code, and that some people consider unenforceable). Just wanted to mention that I believe AGPL is sometimes considered with a dual-license scheme in the hope that enterprises buy the commercial license, or to avoid a situation where a commercial third party benefits from a piece of software disproportionally, or to the detriment of the project's funding (such as providing pure hosting), whether contributions are upstreamed or not. Not being able to express clearly what you're after - cash or code - makes AGPL suboptimal. It's a reality that software without funding and maintenance only goes into bitrot mode, so why not come out straight and sell potential customers maintenance and support? Clearly, the software licensing universe needs additional considerations today compared to the time when Affero/AGPL was conceived.

black_puppydog 6y ago

<edit> Using "you" in the general "one" sense, not to attack you personally of course </edit> > it creates an almost unassailable hurdle in lots of industries. It's intended to be a hurdle, if you want to build a business on other people's work and not contribute back. Be a player that benefits the ecosystem or go away and build the product from scratch if you think you can. > a CD in the post is sufficient Yeah, it would be. If they make valuable contributions to the source code, they'll soon realize that just dumping those on github will have the same effect and save them a full time employee for burning CDs. If the contributions are not valuable, the problem will likely solve itself when the company goes bust.

ddevault 6y ago

It does nothing of the sort. This is propeganda that mega-corps want you to believe because they are unable to rip off AGPL software effectively. Organizations like Google can afford to not use AGPL software (they can just write their own software), but it costs them money, so they refuse to use AGPL software and spread propeganda that it's impossible to do so, to weaken its market penetration and ensure that they have greater access to software without the responsibility to contribute back. In actual fact, being compliant with AGPL software is extremely easy. Nothing at all is expected of you if you just ship it into production as-is. And if you modify it, the only obligation is to send the modifications upstream as patches. That's it. Surely any company is capable of completing such a trivial feat.

xyzzy_plugh 6y ago
You're glossing over the fact that being compliant with AGPL requires more competence than the vast majority of software jobs. I know you could competently integrate or use AGPL software, and I might be able to do it (while repeatedly referencing armchair lawyers on stackoverflow), but there is still a risk I fuck it up and my (or my employer's) competitive advantage is in jeopardy. You are right that AGPL is easy if you can just run it as-is. The real problems start with libraries. If I link an AGPL PDF-generating library with my monolith service which runs financial reports over my business, what happens? Do I need to now publish my SQL queries that access sensitively named tables? Maybe that reveals new secret projects we're working on, or perhaps security incident mitigations underway. Sure, there are countless ways to architect my way out of those problems, but what if I don't have the resources to do that right now? The small obligation becomes a large burden pretty quickly. (The real solution to the above problems is to pay for the corporate license that removes the AGPL obligation, but that assumes you can afford to do so) AGPL is fundamentally scary to lawyers and management because they're afraid someone will sink the ship. Sure it's mostly FUD, but there are some serious valid concerns.
- ddevault 6y ago
  >If I link an AGPL PDF-generating library with my monolith service which runs financial reports over my business, what happens? No one uses AGPL for libraries, except maybe by mistake. LGPL is used for this purpose. >Do I need to now publish my SQL queries that access sensitively named tables? No. The FAQ from GNU makes how this works pretty clear: https://www.gnu.org/licenses/gpl-faq.html#AGPLv3InteractingRemotely https://www.gnu.org/licenses/gpl-faq.html#AGPLv3InteractingR... The AGPL is not viral in the sense that all client software accessing an AGPL-licensed service are required to use the AGPL, but rather, such clients are entitled to the source of that service. It puts no obligations whatsoever on client software. https://www.gnu.org/licenses/gpl-faq.html#AGPLv3InteractingRemotely https://www.gnu.org/licenses/gpl-faq.html#AGPLv3InteractingR... Maybe you should actually read up on the AGPL license before you make assumptions about it? It seems like you don't really understand it.
  - xyzzy_plugh 6y ago
pabs3 6y ago
> the only obligation is to send the modifications upstream as patches That is incorrect, the modifications have to go to users not upstream. All the GNU copyleft licenses are like this.
- ddevault 6y ago
  Sorry, you're right, thanks for the correction. In practice, sending the patches upstream is the easiest way to be compliant, though.
tannhaeuser 6y ago
You're probably right (and also, I find your comment further below regarding interpretation of AGPL insightful, insofar as it touches on a point in AGPL that would impose limits onto unrelated code, and that some people consider unenforceable). Just wanted to mention that I believe AGPL is sometimes considered with a dual-license scheme in the hope that enterprises buy the commercial license, or to avoid a situation where a commercial third party benefits from a piece of software disproportionally, or to the detriment of the project's funding (such as providing pure hosting), whether contributions are upstreamed or not. Not being able to express clearly what you're after - cash or code - makes AGPL suboptimal. It's a reality that software without funding and maintenance only goes into bitrot mode, so why not come out straight and sell potential customers maintenance and support? Clearly, the software licensing universe needs additional considerations today compared to the time when Affero/AGPL was conceived.