4 ms·

It's too bad they went with the AGPL, which is a vague and problematic license. For example, by a strict reading, it would seem that you can make changes, add t

It's too bad they went with the AGPL, which is a vague and problematic license. For example, by a strict reading, it would seem that you can make changes, add the relevant functionality to link to the changed source code, then stick a proxy in front that removes the link and be in the clear. It also seems you could give the modified version to someone, and they could offer a service based on it without forwarding the source offer to end users. It's also unclear regarding upstreaming, and the "virality" of the source distribution requirement. As far as I can tell, for non-CLA projects, effectively there is no way for upstream to be exempt from the AGPL article 13 provisions, which means any AGPLed project that takes contributions needs to build in the source code offer functionality into the canonical version or else they'd be violating their own license (read: that of every other contributor, which is why this is a problem). Additionally, unless the software is written so that it can package its own source as-running and distribute it to every user, using the AGPL puts your users at risk unless you make it a proper click-through license that users must agree to before usage. Due to its nature, the AGPL is an EULA, not a free software copyleft license. Unlike other open source licenses, it is not a mere copyright license. Users need to be aware of its provisions of it, as they are liable for violations not strictly only by distribution, but also if they just run AGPLed software and happen to make a trivial modification, like editing a single template. This is, in concept, going into the "you shall not run this software on more than X cores" proprietary territory, because it makes the critical change of imposing on requirements outside of distribution, so users need to be aware of it just like they need to click-through proprietary EULAs. The AGPL really is not a good license. I wish people would stop treating it as a magic cure for the "SaaS loophole". Using it has deep consequences for your users and how the software must behave, and it isn't legally tested in a way that guarantees it even will protect you how you think it will. I hope people using it know what they're getting into. Here's a personal example of an AGPL problem, and how I violated it (as far as I can tell) by doing nothing out of the ordinary. I run dspam on my mail server. dspam is AGPLed (I did not know this). I use Gentoo Linux, so I just installed it, but due to politics/inertia Gentoo considers the AGPL as default-accept (which is supposed to be reserved for licenses that are free enough that users need not be concerned about), so I was not prompted to accept it during package installation (like I would have for proprietary packages). Unfortunately, Gentoo is a meta distro. They also carry patches for dspam. This means that by installing dspam, I was patching dspam and compiling it, thus triggering AGPL Clause 13. This means I was liable to make dspam source offers to all my users. Unfortunately, the definition of "user" is unclear, and it could encompass "anyone who sends me email through SMTP which gets delivered through a dspam filter" (or at least "anyone who has an inbox filtered with dspam", which includes a few other people on my server). Obviously I was unaware of all of this, and did nothing other than "emerge dspam" and configure it. So now I have potentially violated the AGPL (as have all Gentoo dspam users).

jka 6y ago
Could you provide more background/references for the click-through licensing scenario you mention? The relevant GNU FAQ entry[1] seems to indicate that click-through licensing isn't required (or forbidden, either). [1] - https://www.gnu.org/licenses/gpl-faq.html#ClickThrough https://www.gnu.org/licenses/gpl-faq.html#ClickThrough
- marcan_42 6y ago
  Click-through licensing is absolutely not required nor recommended for their other licenses, like the GPL. The FSF's oficial position is that the AGPL is a Free Software license, which means it meets all Free Software requirements. This is understandable, as it is their license. I disagree. Freedom 0 is the ability to run the software however you want, and the AGPL imposes requirements here (if you modify it without distributing it then you are required to offer source when you use it, which is a requirement that goes beyond traditional copyright licensing). So while they are correct in saying that click-through licensing is silly for typical permissive/copyleft licenses, I strongly disagree that the AGPL is such a license. It's fundamentally different, and I've already given an example of how being unaware of it has potentially put me in noncompliance. The whole point of click-through not being necessary for users is that for all those other licenses, no restrictions are imposed on end-users as long as direct distribution of the code does not occur. The AGPL imposes such restrictions.
throwaway99120 6y ago
Please stop with this FUD. AGPL is written by lawyers and well understood by other lawyers. I worked with IP/software license lawyers and AGPL works just fine.
- marcan_42 6y ago
  The AGPL is written by basically ~one lawyer as far as I know, has never been properly tested, has absolutely not been evaluated by people who should care (like the Gentoo team; as a metadistribution they are in a unique position regarding licensing different from other distros). Almost everything I read about it falls into two camps: * Most people in free software: The FSF wrote it, therefore it's fine, because the FSF are trustworthy when it comes to freedom%. All server open source projects should use it, it'll magically protect us from the SaaS loophole, and there is nothing to worry about if you're not an evil corporation. * Most every big corp: the AGPL is a ginormous can of worms and we aren't touching it with a 1 mile pole. Nope. Stay away. Guess what? Reality is in between those two extremes. The problems with the AGPL are widely underreported in the free software world, and almost nobody has taken a close look at its wording and what it really means. "Leave it to the lawyers" but then nobody ever actually goes and asks a lawyer for a clean take on it. We should do better. The FSF has done a terrible job of educating people on exactly what the AGPL requires and how it interacts with typical free software project development and deployment workflows. If you haven't asked a lawyer about this then maybe you should think twice before slapping it on your project. Relicensing after the fact is a very costly ordeal. % The FSF, through their "Respects your Freedom" hardware rubber-stamping program and its absolutely broken requirements, which actively encourages reduction in user freedom, makes it much harder to detect hidden proprietary backdoors, and hurts projects that are actually aiming for maximum openness, have amply proved that they are not infallible and are not to be trusted without careful review of their policies and projects. I can go into a whole different tangent about this, but my point is, don't treat the FSF as the good guys by default. Look at what it is they're doing exactly and all of its consequences.

jka 6y ago

Could you provide more background/references for the click-through licensing scenario you mention? The relevant GNU FAQ entry[1] seems to indicate that click-through licensing isn't required (or forbidden, either). [1] - https://www.gnu.org/licenses/gpl-faq.html#ClickThrough https://www.gnu.org/licenses/gpl-faq.html#ClickThrough

marcan_42 6y ago
Click-through licensing is absolutely not required nor recommended for their other licenses, like the GPL. The FSF's oficial position is that the AGPL is a Free Software license, which means it meets all Free Software requirements. This is understandable, as it is their license. I disagree. Freedom 0 is the ability to run the software however you want, and the AGPL imposes requirements here (if you modify it without distributing it then you are required to offer source when you use it, which is a requirement that goes beyond traditional copyright licensing). So while they are correct in saying that click-through licensing is silly for typical permissive/copyleft licenses, I strongly disagree that the AGPL is such a license. It's fundamentally different, and I've already given an example of how being unaware of it has potentially put me in noncompliance. The whole point of click-through not being necessary for users is that for all those other licenses, no restrictions are imposed on end-users as long as direct distribution of the code does not occur. The AGPL imposes such restrictions.

throwaway99120 6y ago

Please stop with this FUD. AGPL is written by lawyers and well understood by other lawyers. I worked with IP/software license lawyers and AGPL works just fine.

marcan_42 6y ago
The AGPL is written by basically ~one lawyer as far as I know, has never been properly tested, has absolutely not been evaluated by people who should care (like the Gentoo team; as a metadistribution they are in a unique position regarding licensing different from other distros). Almost everything I read about it falls into two camps: * Most people in free software: The FSF wrote it, therefore it's fine, because the FSF are trustworthy when it comes to freedom%. All server open source projects should use it, it'll magically protect us from the SaaS loophole, and there is nothing to worry about if you're not an evil corporation. * Most every big corp: the AGPL is a ginormous can of worms and we aren't touching it with a 1 mile pole. Nope. Stay away. Guess what? Reality is in between those two extremes. The problems with the AGPL are widely underreported in the free software world, and almost nobody has taken a close look at its wording and what it really means. "Leave it to the lawyers" but then nobody ever actually goes and asks a lawyer for a clean take on it. We should do better. The FSF has done a terrible job of educating people on exactly what the AGPL requires and how it interacts with typical free software project development and deployment workflows. If you haven't asked a lawyer about this then maybe you should think twice before slapping it on your project. Relicensing after the fact is a very costly ordeal. % The FSF, through their "Respects your Freedom" hardware rubber-stamping program and its absolutely broken requirements, which actively encourages reduction in user freedom, makes it much harder to detect hidden proprietary backdoors, and hurts projects that are actually aiming for maximum openness, have amply proved that they are not infallible and are not to be trusted without careful review of their policies and projects. I can go into a whole different tangent about this, but my point is, don't treat the FSF as the good guys by default. Look at what it is they're doing exactly and all of its consequences.