4 ms·

thank you! the easy / "obvious" choice was to close source but this was not really something we wanted to consider. we're in the privacy first space and we want

thank you! the easy / "obvious" choice was to close source but this was not really something we wanted to consider. we're in the privacy first space and we want to stay fully open source. AGPL should hopefully protect us better from similar commercial threats in the future

jarofgreen 6y ago
Hello, can you confirm exactly what you are doing here? If it's AGPL with no CLA or anything, how are you doing "They can purchase a commercial license to remove the copyleft restrictions"? EDIT: Asking because I'm genuinely interested in this issue and am currently making license choices myself - not trying to have a go!
- markosaric 6y ago
  For now we just changed to AGPL as a defensive move to avoid these threats. It was an unplanned move that we didn't even think about few days ago. Next step is really to consider what we want to do in the future and if necessary add a CLA before we merge next contribution. We never planned to do any commercial licenses (we're focused on our Cloud offering) but it seems like a valid option in case of these corporations who want to resell our product but not open source their modifications.
  - jarofgreen 6y ago
    I see. I would definitely urge you to consider this very soon: AFAIK you can't do any commercial licenses with AGPL without A) some form of dual license and CLA or B) just never accepting pull requests from anyone. But also, does this also apply to your own cloud hosted offering? Without sorting this out, all the software in your cloud hosting product now has to be fully open-source. And I get that's your philosophy, but would there not be any tiny bit you want to keep closed - maybe the anti-fraud stuff around your billing system, for instance? This seems a key point that I'm very interested in, so sorry for pushing!
    - Conan_Kudo 6y ago
      AGPL doesn't work the way you think it does. An anti-fraud system service can easily communicate with Plausible over a network connection through an IPC interchange (HTTP, gRPC, etc.) without triggering that issue. The extension to Plausible to support that itself would be AGPL, but the anti-fraud service itself would not have to be.
      - jarofgreen 6y ago
        Yes - I was thinking of internal code, not an external service. But yeah, knowledge of what would or would not be covered by AGPL seems crucial here.
        Conan_Kudo 6y ago
        You'd probably want to be able to communicate with multiple anti-fraud systems anyway, so I would expect it to be something plugged into Plausible and not part of Plausible itself.
  - blackorzar 6y ago
    Hello markosaric, Have you thought on requiring contributions to be dual licensed MIT + AGPL? This would avoid you the need of a CLA because you can use MIT to incorporate the contribution to your cloud solution and/or to sell a license to a corporation that would like to keep their modifications closed. This would also lower the barrier to contributors due they don't need to sign the CLA.
    - camkego 6y ago
      This is an insightful comment about how to achieve certain uses without CLAs, nice to learn about this.
    - markosaric 6y ago
      thanks! that's a good point and makes sense to do!
    - markosaric 6y ago
      Do you have any examples of projects doing this? Thanks!
- eeZah7Ux 6y ago
  > how are you doing "They can purchase a commercial license to remove the copyleft restrictions"? This is incorrect. If you own copyright on something you can transfer those rights to other people in any way you want. I can give you a copy of my software under AGPL and another copy under a completely different license and the two things are independent from each other. There isn't a "remove the copyleft restrictions" mechanism. You can simply give out a new copy with a closed license that allows, for example, execution as a service, static linking, dynamic linking but no copy.
  - auggierose 6y ago
    The problem is contributions by others, of course.
  - kelnos 6y ago
    Right, but if you accept outside contributions, and those contributors give you their changes under the AGPL as well, you cannot relicense their work under terms other than the AGPL. You can get around this by requiring copyright assignment from all contributors, or by making contributors sign an agreement that allows you to do what you want to do.

jarofgreen 6y ago

Hello, can you confirm exactly what you are doing here? If it's AGPL with no CLA or anything, how are you doing "They can purchase a commercial license to remove the copyleft restrictions"? EDIT: Asking because I'm genuinely interested in this issue and am currently making license choices myself - not trying to have a go!

markosaric 6y ago
For now we just changed to AGPL as a defensive move to avoid these threats. It was an unplanned move that we didn't even think about few days ago. Next step is really to consider what we want to do in the future and if necessary add a CLA before we merge next contribution. We never planned to do any commercial licenses (we're focused on our Cloud offering) but it seems like a valid option in case of these corporations who want to resell our product but not open source their modifications.
- jarofgreen 6y ago
  I see. I would definitely urge you to consider this very soon: AFAIK you can't do any commercial licenses with AGPL without A) some form of dual license and CLA or B) just never accepting pull requests from anyone. But also, does this also apply to your own cloud hosted offering? Without sorting this out, all the software in your cloud hosting product now has to be fully open-source. And I get that's your philosophy, but would there not be any tiny bit you want to keep closed - maybe the anti-fraud stuff around your billing system, for instance? This seems a key point that I'm very interested in, so sorry for pushing!
  - Conan_Kudo 6y ago
    AGPL doesn't work the way you think it does. An anti-fraud system service can easily communicate with Plausible over a network connection through an IPC interchange (HTTP, gRPC, etc.) without triggering that issue. The extension to Plausible to support that itself would be AGPL, but the anti-fraud service itself would not have to be.
    - jarofgreen 6y ago
      Yes - I was thinking of internal code, not an external service. But yeah, knowledge of what would or would not be covered by AGPL seems crucial here.
      - Conan_Kudo 6y ago
        You'd probably want to be able to communicate with multiple anti-fraud systems anyway, so I would expect it to be something plugged into Plausible and not part of Plausible itself.
- blackorzar 6y ago
  Hello markosaric, Have you thought on requiring contributions to be dual licensed MIT + AGPL? This would avoid you the need of a CLA because you can use MIT to incorporate the contribution to your cloud solution and/or to sell a license to a corporation that would like to keep their modifications closed. This would also lower the barrier to contributors due they don't need to sign the CLA.
  - camkego 6y ago
    This is an insightful comment about how to achieve certain uses without CLAs, nice to learn about this.
  - markosaric 6y ago
    thanks! that's a good point and makes sense to do!
  - markosaric 6y ago
    Do you have any examples of projects doing this? Thanks!
eeZah7Ux 6y ago
> how are you doing "They can purchase a commercial license to remove the copyleft restrictions"? This is incorrect. If you own copyright on something you can transfer those rights to other people in any way you want. I can give you a copy of my software under AGPL and another copy under a completely different license and the two things are independent from each other. There isn't a "remove the copyleft restrictions" mechanism. You can simply give out a new copy with a closed license that allows, for example, execution as a service, static linking, dynamic linking but no copy.
- auggierose 6y ago
  The problem is contributions by others, of course.
- kelnos 6y ago
  Right, but if you accept outside contributions, and those contributors give you their changes under the AGPL as well, you cannot relicense their work under terms other than the AGPL. You can get around this by requiring copyright assignment from all contributors, or by making contributors sign an agreement that allows you to do what you want to do.