16 ms·

> Obligatory: I’m not a lawyer; this is for informational purposes only. and > Google states that if, for example, Google Maps used PostGIS as its data store,

> Obligatory: I’m not a lawyer; this is for informational purposes only. and > Google states that if, for example, Google Maps used PostGIS as its data store, and PostGIS used the AGPL, Google would be required to release the Google Maps code. This is not true. They would be required to release their PostGIS patches in this situation. AGPL does not extend the GPL in that it makes the Internet count as a form of linking which creates a derivative work, as Google implies, but rather that it makes anyone who uses the the software via the Internet entitled to its source code. This is the problem: I've fought with IP lawyers we've had on retainer who always boil it down to: "It doesn't matter. We're not going to court to find out." Is it FUD? Yes. But I am also not a lawyer, and I can only do so much to fight upwards as an IC. I've seen this exact mindset at every company I've ever worked for or with. The real fear is that once you have an AGPL dependency, it's _possible_ that it makes it way into something you really don't want to release publicly, and now you have a huge mess of a problem. The easy solution: don't use software with that license. (FWIW I hate this, and fully believe competent developers can not shoot themselves in the foot so extravagantly, but alas.)

ddevault 6y ago
>This is the problem: I've fought with IP lawyers we've had on retainer who always boil it down to: "It doesn't matter. We're not going to court to find out." This is incredibly stupid. By this logic your business can't do literally anything. The AGPL simply does not do what Google states it does, and a basic reading of the AGPL text readily and clearly confirms this fact. A more realistic explanation for why Google shouldn't use AGPL software is because of their giant monorepo development style. If they import a third-party codebase into their monorepo and don't put big shouty warnings next to it, it seems really easy for it to start to leak into other modules. So maybe the following is true: if you use monorepos, and you vendor third-party code into them, then using AGPL'd software is risky. But this statement does not (and should not, monorepos are dumb) apply to most companies.
- objclxt 6y ago
  > a basic reading of the AGPL text readily and clearly confirms this fact. But that reading has never been tested in court, so from counsel’s perspective why risk it? No competent lawyer would take the AGPL at prima facie, they’re going to look for case law - and there isn’t any.
  - ddevault 6y ago
    Why risk anything? On the grand scale of things, effectively nothing has been tested in court. This is no grounds for making baseless statements about a license which are unsupported by its text.
    - yodon 6y ago
      Case law, also known as judicial decisions made in courtrooms by individual non-technical judges that then become legal precedent followed by all other judges, is a huge thing. If you look back to the founding of the EFF Electronic Frontier Foundation, it's genesis was the realization that an enormous amount of technology-privacy-critical legal precedent was being set in remote courtrooms where poorly equipped attorneys on both sides were arguing in front of uninformed judges who would then set precedent for the entire country. Most areas of law have enormous amounts of case law precedent. Privacy (originally) and the AGPL (today) are areas where the lack of any prior case law makes the legal risks (as in legal uncertainties) somewhere between much higher and effectively infinite. That isn't the case with most other areas where case law precedent results in far more conventionally bounded risks/uncertainties.
    - tptacek 6y ago
      The statements you're responding to were, taking the commenter at their word, informed by lawyers, while yours, taking you at your word, were not. We need to revisit the definition of the word "baseless".
- tylerhou 6y ago
  > a basic reading of the AGPL text readily and clearly confirms this fact. Not trying to be rude, but are you a lawyer? To interpret such a license with potentially huge legal ramifications, I would rather listen to lawyers than laypeople.
  - woofie11 6y ago
    Then listen to Eben Moglen, who wrote it, and is a brilliant law professor at Columbia :)
    - durin42 6y ago
      Or listen to Daniel Berlin, who's both an accomplished GCC hacker and a lawyer: https://news.ycombinator.com/item?id=9956542 https://news.ycombinator.com/item?id=9956542 https://news.ycombinator.com/item?id=13979443 https://news.ycombinator.com/item?id=13979443 This isn't settled law, and DannyBee would be quick to point out that the practice of law has a major component of risk management.
      - woofie11 6y ago
        I don't think Daniel contradicts Eben, at least in the link here... There are good rationales and bad rationales for a decision. Google made a good decision with a bad rationale. Daniel made a good decision with a good rationale. Why does this matter? If I'm running my own business, my business context won't be the same as Google's. There are times to pick AGPL, and times to not pick it, and that requires accurately understanding the law.
        joshuamorton 6y ago
        You realize that Daniel works for Google, and is one of the people who makes such decisions about OSS for Google, so if you think he made the decision with a good rationale, then so did Google, since his decision was Google's.
        6y ago
- oefrha 6y ago
  If your basic reading of the AGPL text readily and clearly confirms something that multiple IP lawyers independently found dubious, and you're not a lawyer, I'd rather trust the lawyers, thanks.
  - ddevault 6y ago
    [citation needed]
    - oefrha 6y ago
      Lawyers typically don't publish internal legal reviews online, so I can't give you a citation you can access. But if you believe everyone around here sharing their legal review results (e.g. https://news.ycombinator.com/item?id=23967469 https://news.ycombinator.com/item?id=23967469) are lying to you then there really isn't much point in coming here to "discuss".
- cic48 6y ago
  Perhaps people would listen more readily if you didn’t ascribe malevolent falsehoods to routine risk management and identified any idea other than your own as intellectually deficient. There are reasons and advantages to monorepos in some circumstances that you haven’t considered, for example, because you haven’t been exposed to them. Binary dumb/not dumb across the board is a junior engineer argument, and you’re better than that. I’ve followed you for a while, Drew, and it’s a recurring theme. Respectfully, you could stand to listen from time to time. This is one of those times.
woofie11 6y ago
AGPL software isn't designed to be used as a dependency to a proprietary system. It's designed to be used in an open ecosystem. That's kind of the point. * If you expect your code to be used as a dependency to a proprietary system, don't use the AGPL. * If you are building a stand-alone system, or tools for an open ecosystem, use the AGPL. That's a question of suitability-to-purpose. Although this use is permitted, AGPL simply isn't a good license for PostGIS (which is correctly licensed under the GPL). It is a great license for end-user applications. It's also nice for dual-licensing. Licenses aren't something to get ideological about; it's more of a right-tool-for-the-right-job kind of thing. If you use a hammer with screws, you'll get hurt. Same thing with using BSD where AGPL fits, or AGPL where BSD fits.
- SpicyLemonZest 6y ago
  I agree with what you're saying, but it contradicts the source article, which insists that Google is spreading FUD by saying it can't use AGPL dependencies in its proprietary systems.
  - woofie11 6y ago
    Yeah, it's complex: * The article is right that Google IS spreading FUD. They're making legal statements which are probably false to minimize usage of the AGPL outside of Google. * Google came to a sensible conclusion, that THEY shouldn't use the AGPL * Google's articulated reasons don't hold legal water, and following Google's lead and interpretation causes many companies to mislicense their code It's a right tool for the right job kind of thing, and AGPL is not the right tool for Google's job. I've used all sorts of license in projects I've worked on. It's always a pragmatic evaluation. Right now, I'm working on a project which, pending legal review, should be AGPL. Any other license would be business suicide. AGPL gets us the ecosystem we'll need, without having to unfairly compete with our own code.
    - SpicyLemonZest 6y ago
      Maybe I'm misunderstanding. It sounds like you agree that companies with proprietary code can't link GPL libraries, and Google's statements don't suggest any problem for companies which don't care about keeping their code proprietary.
cic48 6y ago
I’ve taken AGPL through two FAANG reviews. Both arrived at the same very-much-not-FUD legal conclusion. Paragraph 1 of section 13 requires modifications to be disclosed and source code for them to be offered to remote users. The license uses the term of art Corresponding Source for this. Corresponding Source is defined in section 1 in a crystal clear way. Two separate teams of lawyers concluded that they could coherently argue the Corresponding Source definition implied not only the modified AGPL software, but also stuff that merely _uses_ it, on the basis that “scripts to control” among other things implies the infrastructure most shops build around software, such as Borg configuration and possibly by extension Borg. After all, a modified version of PostGIS is only useful to run in context, and Corresponding Source requires the context. AGPL is unchallenged in court. The risk to being wrong about it as huge. It’s risk aversion, not ideology, and it’s important to remember that identifying an argument as part of legal review does not call it the correct one. Anyone who’s ever worked with legal matters knows there is no such thing as “correct,” there are rulings. The existence of the argument condemns the license for FAANG, not its validity. Testing that validity against a claim is perilous. Perhaps if random engineers stopped calling legal opinion FUD and falsehoods and took a moment to listen to the feedback from lawyers who didn’t write the license, we’d get somewhere with finding a palatable license for all parties. Instead, we get a holy war. Strong disagree on developers not shooting themselves in the foot. If it’s on GitHub, it ships. If you think about licenses in your day to day engineering, you are the 1%.
- pydry 6y ago
  The holy war could be avoided if Google simply paid authors of AGPL code they wanted to use instead of going on a tirade against the license. I think half the reason it exists is to make it deliberately risky for FAANGs etc. because they're exactly the ones who SHOULD be ponying up to support the open source ecosystem they rely upon.
  - knorker 6y ago
    They do, but it requires the existance of a dual license for that project, which usually requires copyright reassignment was put in place from the project's inception. The current maintainer can't just sell a copy under non-AGPL if there are other copyright holders (contributors).
asdgasdg 6y ago
>This is the problem: I've fought with IP lawyers we've had on retainer who always boil it down to: "It doesn't matter. We're not going to court to find out." That's not really an argument, the lawyers are just pulling rank on you.
api 6y ago
I've seen the same phobia to a lesser degree around the plain old GPL. Lawyers think, and not unreasonably, in terms of risk. Is there a risk you might be dragged into court? If so, that's a very expensive risk. Is the library or application worth this risk? If not, then ditch it. It's not an unreasonable fear either given past events like the SCO/Linux lawsuit. IBM had deep enough pockets to fight it and win. Anyone else would have folded or been ruined. It makes it hard to be anything but 100% "libre" (almost public domain) or commercial and closed source. Being 100% libre means someone big can (and sometimes does) just take your work and put their name on it and monetize it. This wasn't much of a problem years ago, but it's a growing issue now. Being 100% commercial is of course the opposite. We're excluding the middle, to great detriment, and we really need a workable legal solution that won't scare lawyers.
- zrm 6y ago
  But isn't the middle ground requiring copyright assignment and then dual licensing? Oh dear, your company's lawyers are afraid of the AGPL? Well then pay the project for a commercial license.
  - nine_k 6y ago
    For that, the project should offer a commercial license in the first place.
  - api 6y ago
    That can work but it has to be low friction and reasonably priced. Many people who do dual licensing charge waaaaay too much.
- nine_k 6y ago
  I agree with this analysis, and I think that dual licensing can help here. That is, something is free is you want to use it in a copyleft-compatible fashion, and costs serious money for a commercial license if you want to go proprietary. Even SQLite, which is public domain, offers a commercial "warranty of title" [1] if your company requires a guarantee that there can't be a lawsuit regarding the use of this software. [1]: https://www.hwaci.com/cgi-bin/license-step1 https://www.hwaci.com/cgi-bin/license-step1
skissane 6y ago
> This is the problem: I've fought with IP lawyers we've had on retainer who always boil it down to: And I think most engineers would rather be doing other things than arguing with their employer's legal team. Their legal opinions may or may not be correct, but it doesn't really matter either way, because you are unlikely to change their mind. If Legal says "AGPL is not allowed", you don't waste your time arguing with them or begging for an exception, you just go look for an alternative component with a license they'll accept. (If, hypothetically, one's employer's legal team were saying things completely outside the norm of the industry, it might be worth making an issue of it – but, banning AGPL is certainly well within the norm of the industry.)
jpalomaki 6y ago
Back-in-the-days MySQL had the view of GPL that if your application strictly required MySQL database, the GPL license would extend to it. Even if the app would only connected to the database over network. ”A license is required if [...] You have a commercial application that ONLY works with MySQL and ships the application with the MySQL server. This is because we view this as linking even if it is done over the network.”[1] Not sure if they ever actually enforced this rule. I wrote this just to point out that different companies can view these licenses differently. If company chooses AGPL, they clearly want to block certain use cases. I would be cautious when trying to dance around the limitations. [1] http://ww2.cs.lamar.edu/doc/mysql/manual_Licensing_and_Support.html http://ww2.cs.lamar.edu/doc/mysql/manual_Licensing_and_Suppo...

ddevault 6y ago

>This is the problem: I've fought with IP lawyers we've had on retainer who always boil it down to: "It doesn't matter. We're not going to court to find out." This is incredibly stupid. By this logic your business can't do literally anything. The AGPL simply does not do what Google states it does, and a basic reading of the AGPL text readily and clearly confirms this fact. A more realistic explanation for why Google shouldn't use AGPL software is because of their giant monorepo development style. If they import a third-party codebase into their monorepo and don't put big shouty warnings next to it, it seems really easy for it to start to leak into other modules. So maybe the following is true: if you use monorepos, and you vendor third-party code into them, then using AGPL'd software is risky. But this statement does not (and should not, monorepos are dumb) apply to most companies.

objclxt 6y ago
> a basic reading of the AGPL text readily and clearly confirms this fact. But that reading has never been tested in court, so from counsel’s perspective why risk it? No competent lawyer would take the AGPL at prima facie, they’re going to look for case law - and there isn’t any.
- ddevault 6y ago
  Why risk anything? On the grand scale of things, effectively nothing has been tested in court. This is no grounds for making baseless statements about a license which are unsupported by its text.
  - yodon 6y ago
    Case law, also known as judicial decisions made in courtrooms by individual non-technical judges that then become legal precedent followed by all other judges, is a huge thing. If you look back to the founding of the EFF Electronic Frontier Foundation, it's genesis was the realization that an enormous amount of technology-privacy-critical legal precedent was being set in remote courtrooms where poorly equipped attorneys on both sides were arguing in front of uninformed judges who would then set precedent for the entire country. Most areas of law have enormous amounts of case law precedent. Privacy (originally) and the AGPL (today) are areas where the lack of any prior case law makes the legal risks (as in legal uncertainties) somewhere between much higher and effectively infinite. That isn't the case with most other areas where case law precedent results in far more conventionally bounded risks/uncertainties.
  - tptacek 6y ago
    The statements you're responding to were, taking the commenter at their word, informed by lawyers, while yours, taking you at your word, were not. We need to revisit the definition of the word "baseless".
tylerhou 6y ago
> a basic reading of the AGPL text readily and clearly confirms this fact. Not trying to be rude, but are you a lawyer? To interpret such a license with potentially huge legal ramifications, I would rather listen to lawyers than laypeople.
- woofie11 6y ago
  Then listen to Eben Moglen, who wrote it, and is a brilliant law professor at Columbia :)
  - durin42 6y ago
    Or listen to Daniel Berlin, who's both an accomplished GCC hacker and a lawyer: https://news.ycombinator.com/item?id=9956542 https://news.ycombinator.com/item?id=9956542 https://news.ycombinator.com/item?id=13979443 https://news.ycombinator.com/item?id=13979443 This isn't settled law, and DannyBee would be quick to point out that the practice of law has a major component of risk management.
    - woofie11 6y ago
      I don't think Daniel contradicts Eben, at least in the link here... There are good rationales and bad rationales for a decision. Google made a good decision with a bad rationale. Daniel made a good decision with a good rationale. Why does this matter? If I'm running my own business, my business context won't be the same as Google's. There are times to pick AGPL, and times to not pick it, and that requires accurately understanding the law.
      - joshuamorton 6y ago
        You realize that Daniel works for Google, and is one of the people who makes such decisions about OSS for Google, so if you think he made the decision with a good rationale, then so did Google, since his decision was Google's.
        6y ago
oefrha 6y ago
If your basic reading of the AGPL text readily and clearly confirms something that multiple IP lawyers independently found dubious, and you're not a lawyer, I'd rather trust the lawyers, thanks.
- ddevault 6y ago
  [citation needed]
  - oefrha 6y ago
    Lawyers typically don't publish internal legal reviews online, so I can't give you a citation you can access. But if you believe everyone around here sharing their legal review results (e.g. https://news.ycombinator.com/item?id=23967469 https://news.ycombinator.com/item?id=23967469) are lying to you then there really isn't much point in coming here to "discuss".
cic48 6y ago
Perhaps people would listen more readily if you didn’t ascribe malevolent falsehoods to routine risk management and identified any idea other than your own as intellectually deficient. There are reasons and advantages to monorepos in some circumstances that you haven’t considered, for example, because you haven’t been exposed to them. Binary dumb/not dumb across the board is a junior engineer argument, and you’re better than that. I’ve followed you for a while, Drew, and it’s a recurring theme. Respectfully, you could stand to listen from time to time. This is one of those times.

woofie11 6y ago

AGPL software isn't designed to be used as a dependency to a proprietary system. It's designed to be used in an open ecosystem. That's kind of the point. * If you expect your code to be used as a dependency to a proprietary system, don't use the AGPL. * If you are building a stand-alone system, or tools for an open ecosystem, use the AGPL. That's a question of suitability-to-purpose. Although this use is permitted, AGPL simply isn't a good license for PostGIS (which is correctly licensed under the GPL). It is a great license for end-user applications. It's also nice for dual-licensing. Licenses aren't something to get ideological about; it's more of a right-tool-for-the-right-job kind of thing. If you use a hammer with screws, you'll get hurt. Same thing with using BSD where AGPL fits, or AGPL where BSD fits.

SpicyLemonZest 6y ago
I agree with what you're saying, but it contradicts the source article, which insists that Google is spreading FUD by saying it can't use AGPL dependencies in its proprietary systems.
- woofie11 6y ago
  Yeah, it's complex: * The article is right that Google IS spreading FUD. They're making legal statements which are probably false to minimize usage of the AGPL outside of Google. * Google came to a sensible conclusion, that THEY shouldn't use the AGPL * Google's articulated reasons don't hold legal water, and following Google's lead and interpretation causes many companies to mislicense their code It's a right tool for the right job kind of thing, and AGPL is not the right tool for Google's job. I've used all sorts of license in projects I've worked on. It's always a pragmatic evaluation. Right now, I'm working on a project which, pending legal review, should be AGPL. Any other license would be business suicide. AGPL gets us the ecosystem we'll need, without having to unfairly compete with our own code.
  - SpicyLemonZest 6y ago
    Maybe I'm misunderstanding. It sounds like you agree that companies with proprietary code can't link GPL libraries, and Google's statements don't suggest any problem for companies which don't care about keeping their code proprietary.

cic48 6y ago

I’ve taken AGPL through two FAANG reviews. Both arrived at the same very-much-not-FUD legal conclusion. Paragraph 1 of section 13 requires modifications to be disclosed and source code for them to be offered to remote users. The license uses the term of art Corresponding Source for this. Corresponding Source is defined in section 1 in a crystal clear way. Two separate teams of lawyers concluded that they could coherently argue the Corresponding Source definition implied not only the modified AGPL software, but also stuff that merely _uses_ it, on the basis that “scripts to control” among other things implies the infrastructure most shops build around software, such as Borg configuration and possibly by extension Borg. After all, a modified version of PostGIS is only useful to run in context, and Corresponding Source requires the context. AGPL is unchallenged in court. The risk to being wrong about it as huge. It’s risk aversion, not ideology, and it’s important to remember that identifying an argument as part of legal review does not call it the correct one. Anyone who’s ever worked with legal matters knows there is no such thing as “correct,” there are rulings. The existence of the argument condemns the license for FAANG, not its validity. Testing that validity against a claim is perilous. Perhaps if random engineers stopped calling legal opinion FUD and falsehoods and took a moment to listen to the feedback from lawyers who didn’t write the license, we’d get somewhere with finding a palatable license for all parties. Instead, we get a holy war. Strong disagree on developers not shooting themselves in the foot. If it’s on GitHub, it ships. If you think about licenses in your day to day engineering, you are the 1%.

pydry 6y ago
The holy war could be avoided if Google simply paid authors of AGPL code they wanted to use instead of going on a tirade against the license. I think half the reason it exists is to make it deliberately risky for FAANGs etc. because they're exactly the ones who SHOULD be ponying up to support the open source ecosystem they rely upon.
- knorker 6y ago
  They do, but it requires the existance of a dual license for that project, which usually requires copyright reassignment was put in place from the project's inception. The current maintainer can't just sell a copy under non-AGPL if there are other copyright holders (contributors).

asdgasdg 6y ago

>This is the problem: I've fought with IP lawyers we've had on retainer who always boil it down to: "It doesn't matter. We're not going to court to find out." That's not really an argument, the lawyers are just pulling rank on you.

api 6y ago

I've seen the same phobia to a lesser degree around the plain old GPL. Lawyers think, and not unreasonably, in terms of risk. Is there a risk you might be dragged into court? If so, that's a very expensive risk. Is the library or application worth this risk? If not, then ditch it. It's not an unreasonable fear either given past events like the SCO/Linux lawsuit. IBM had deep enough pockets to fight it and win. Anyone else would have folded or been ruined. It makes it hard to be anything but 100% "libre" (almost public domain) or commercial and closed source. Being 100% libre means someone big can (and sometimes does) just take your work and put their name on it and monetize it. This wasn't much of a problem years ago, but it's a growing issue now. Being 100% commercial is of course the opposite. We're excluding the middle, to great detriment, and we really need a workable legal solution that won't scare lawyers.

zrm 6y ago
But isn't the middle ground requiring copyright assignment and then dual licensing? Oh dear, your company's lawyers are afraid of the AGPL? Well then pay the project for a commercial license.
- nine_k 6y ago
  For that, the project should offer a commercial license in the first place.
- api 6y ago
  That can work but it has to be low friction and reasonably priced. Many people who do dual licensing charge waaaaay too much.
nine_k 6y ago
I agree with this analysis, and I think that dual licensing can help here. That is, something is free is you want to use it in a copyleft-compatible fashion, and costs serious money for a commercial license if you want to go proprietary. Even SQLite, which is public domain, offers a commercial "warranty of title" [1] if your company requires a guarantee that there can't be a lawsuit regarding the use of this software. [1]: https://www.hwaci.com/cgi-bin/license-step1 https://www.hwaci.com/cgi-bin/license-step1

skissane 6y ago

> This is the problem: I've fought with IP lawyers we've had on retainer who always boil it down to: And I think most engineers would rather be doing other things than arguing with their employer's legal team. Their legal opinions may or may not be correct, but it doesn't really matter either way, because you are unlikely to change their mind. If Legal says "AGPL is not allowed", you don't waste your time arguing with them or begging for an exception, you just go look for an alternative component with a license they'll accept. (If, hypothetically, one's employer's legal team were saying things completely outside the norm of the industry, it might be worth making an issue of it – but, banning AGPL is certainly well within the norm of the industry.)

jpalomaki 6y ago

Back-in-the-days MySQL had the view of GPL that if your application strictly required MySQL database, the GPL license would extend to it. Even if the app would only connected to the database over network. ”A license is required if [...] You have a commercial application that ONLY works with MySQL and ships the application with the MySQL server. This is because we view this as linking even if it is done over the network.”[1] Not sure if they ever actually enforced this rule. I wrote this just to point out that different companies can view these licenses differently. If company chooses AGPL, they clearly want to block certain use cases. I would be cautious when trying to dance around the limitations. [1] http://ww2.cs.lamar.edu/doc/mysql/manual_Licensing_and_Support.html http://ww2.cs.lamar.edu/doc/mysql/manual_Licensing_and_Suppo...