17 ms·

I enforced the AGPL on my code

215 points by jandeboevrie 6y ago

tobyhinloopen 6y ago
So they didn’t bother and shut down the site. Well that’s fine I suppose
- ginko 6y ago
  Wouldn't they still have to release the source code retroactively for hosting previously? Not sure how the AGPL handles this.
  - rcxdude 6y ago
    Probably not. The consequence of violating the (A)GPL is you lose the right to use, distribute, and modify the software. They could in principle be sued because they were violating the license while the website is up but you'd need to demonstrate losses and you couldn't force the release, only get some compensation (though you could try to use that as leverage to settle for the release of the code). (IANAL, etc)
    - tpxl 6y ago
      >you'd need to demonstrate losses Aren't losses trivial to demonstrate: You didn't get the source code. And in the happy case you can be made whole just by them releasing the code, which is easy if it wasn't modified such that it contains proprietary shit.
      - _ph_ 6y ago
        Losses are paid in money. So you need to specify a certain monetary value and have the court to agree. While it would be the easiest for settling the case to just release the modified source, I don't think you can enforce that.
    - _ph_ 6y ago
      Right, I think that is a common misconception. A license like the AGPL cannot force people to release their modifications, it can only force people not using the AGPL-licensed software. At best you can sue for damages due to unlicensed usage.
    - mr_toad 6y ago
      > you'd need to demonstrate losses Depending on the jurisdiction and circumstances there may also be statutory damages, punitive damages and exemplary damages.
  - eeZah7Ux 6y ago
    No
  - madjam002 6y ago
    Doesn't AGPL only _require_ you to distribute the source code when requested? Sure they violated it when the author requested the source code, but surely you'd need to demonstrate that other requests were made over the duration of when the site was up where they refused to provide the source code.
    - garmaine 6y ago
      You also have to notify that it is under the AGPL and provide access (e.g. a link) to the license. Technically the source code could be behind an ask-wall though.
  - dspillett 6y ago
    IIRC (A)GPL stipulates that you need to make available source, on request, to the people who use your version. This is often interpreted as you need to release publicly, but that is not the case. If I'm remembering rightly then the author can't make them give him a copy of the code at this point, but one of their users could. If they have/had no users that care, there is no more that they need to do. Unless the author having visited their site counts as them being a user of the code protected by the license, then it swings back the other way.
    - aronpye 6y ago
      Don’t you always have to provide author attribution and a link to the licence?
      - dspillett 6y ago
        Many less restrictive open source licenses require attribution, that is far from unique to GPL flavours.
    - dec0dedab0de 6y ago
      Visiting the site probably counts as using it. I think to get around that there would need to be a separate paywall
      - toyg 6y ago
        “Visiting the site” does not count as distributing it under the GPL: “ Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying”. If you don’t distribute the work, you don’t need to provide sources.
        justinclift 6y ago
        The case here is the AGPL though, not the GPL.
        6y ago
midasz 6y ago
What a weird reaction by that company. The time it took them to discuss it, investigate, and respond could've easily been used to comply with the license. I'm already happy with my current hosting but they've been added to my shitlist either way.
- muyuu 6y ago
  They probably had hacks in the code they didn't want to show, but all in all I suspect they were making so little they just thought it wasn't worth continuing with it. Most of these sites simply vanish at some point, with kind of defeats the purpose of using them to simplify their operation as you need to be ready to look for an alternative on short notice and it's a security concern. OTOH what are the chances that the code changes would be of any use to the author?
  - necovek 6y ago
    I would guess hacks and potentially secrets (passwords).
  - belorn 6y ago
    We can only speculate, but my suspicion is that they simply felt a bit ashamed. Telling a person they have been breaking the law for years, especially if they have a personal need to feel professional, can easily send them into panic mode. Removing the site and any record of it gives them a way to put it behind them.
    - saagarjha 6y ago
      Right, but now they have a blog post written about them…
- coddle-hark 6y ago
  Not necessarily. If they were to comply fully they’d need to release appropriately licensed source code for all previous versions of the site too. As in, the OP could say: “I visited your site X days ago, please provide the source for the code I ran”.
toyg 6y ago
Duplicate of https://news.ycombinator.com/item?id=24837686 https://news.ycombinator.com/item?id=24837686
AnonHP 6y ago
> Four days later, they responded, stating that they had discussed internally and decided to take the site offline. > That concludes our conversation, they took down their site and never complied with the license. I think they're not violating it now, but have done for a few years. This makes me wonder what their thinking was. Did they decide to take it down because of potential/unknown (to them) legal implications of using it for three years without providing a way to get the source? Or did they think this site is done because of legal issues and then go to the drawing board for creating a different site with a lot more changes (to avoid detection) so that they don’t have to comply with this at all?
- dmurray 6y ago
  Sounds more like nobody paid for the service, so they decided not to spend any more time on it.
- knorker 6y ago
  > This makes me wonder what their thinking was. Did they decide to take it down because of potential/unknown (to them) legal implications of using it for three years without providing a way to get the source? Probably. Maybe combined with asking an actual lawyer who likely would look at the license go NO NO NO NO, SHUT IT DOWN NOW, AND NEVER TOUCH AGPL AGAIN! Speaking from experience.
bartread 6y ago
> I license all my personall stuff under the GPL and AGPL (where applicable) and dislike the permissive licenses (MIT, 3 clause BSD, X11, Apache) because they allow people to take your stuff and never contribute back. I prefer strong copyleft licenses that force you to contribute. Here is a good article going into permissive vs copyleft licensing. This is a fair point, however the way it seems to end up working is that people just don't use the software due to the viral nature of GPL and AGPL. I'd be happy enough to contribute modifications back to projects under GPL and AGPL but, the reality is, if I embed some GPL or AGPL component, service, or product into my site or service we're now in this (at best) legal grey area where we have to figure out how much of what I've done is a modification, and how much is distinct, and there's a risk I just have to hand it all over (whch I don't want to do). It quickly becomes enough of a nightmare to deal with that it's easier to either (a) find an alternative that uses a permissive license, or (b) build something oneself that offers the required functionality. It's a shame because it leads to, I think, both OSS and corporations losing out. It would be great if there was some sort of middle ground license that protected against corporate abuse, and forced corporations to hand over changes without the risk of having to hand over large tranches of their other IP. I'm not sure what that would be though, or whether it could be made to work.
- toyg 6y ago
  The minute it is required to hand over anything, even a single line of code, you will find someone raising the objection you mentioned (“it’s too burdensome to figure out if I have to release 6 characters or 5 characters!”). Stock corporate lawyers don’t like uncertainty, and the smallest of grey areas will be seized upon to block anything “in order to protect the company”. The reality is that in 99.99999% of the cases, nobody will ever come after you for trying to do the right thing. If you engage the GPL community in good faith, things will work out fine with minimum fuss. So no, we don’t need another license, we just need people willing to do the right thing.
  - _ph_ 6y ago
    The problem with GPL is, that it doesn't only require you to hand over any modifications to the GPL code - this would be easily to do, but to any code in a product built containing GPL code. And that is where the problems usually start. The reality is, not everyone agrees what the reality is and especially a company which takes licenses serious will be very careful to check, whether using GPL code is possible in a project. And no, we don't need another license, there are plenty of licenses available which resolve the issues. Be it the permissive licenses (MIT, BSD, ...) or GPL with linking exceptions.
murgindrag 6y ago
... and despite all the doom-and-gloom, that's how most AGPL / GPL enforcement goes in practice. People fix the issue. Everyone moves on. A few legally naive organizations avoid AGPL due to perceived liability. I have yet to see a case with that million-dollar payout. Perhaps lightening will strike and you'll be the first, or perhaps there's minimal risk because that's not how laws work. (Disclaimer: Above applies to common law jurisdictions, like GB and US; I have no idea about French legislative law, Asian courts, etc.).
- erk__ 6y ago
  If you want to be sure it works in the EU I guess you could use the EUPL instead of AGPL which gives many of the same gurantees, but fits into european law.
- speeder 6y ago
  Problem is not always this is possible. See the infamous case of someone using scumvm to make games for console... To make a console game you need to follow an NDA that you won't release source to avoid revealing the API, thus you can't make a GPL console engine unless it is dual license.
- user5994461 6y ago
  Wrote an article on the French law, a major case on GPL reached court last year https://thehftguy.com/2020/09/15/french-judge-rules-gpl-license-to-be-inapplicable-in-french-copyright-court/ https://thehftguy.com/2020/09/15/french-judge-rules-gpl-lice... GPL was found to be inapplicable in French copyright court, however it should be applicable under contract law. The developers lost 9 years and a good chunk of money suing, they even had to pay some legal fees.
  - alisonkisk 6y ago
    Is this largely because no one previously thought to consider the GPL, a US legal invention, under French law? The English speaking tech industry often forgets other countries are other countries. How could they spend 9 years and 14000 Euros on a dispute that should have been settled in 1 day by any French lawyer? ("Licenses don't apply to counterfeit law in France; a license is treated as a contract")
Arkanosis 6y ago
Last year, I enforced the CC-BY license. It's not even a copyleft license, but the outcome was similar. Affinord, a cheese seller, used on their own website a photograph I had shared under the CC-BY license on Wikimedia Commons, without any attribution (the only thing required by the license). So I sent them an email saying that I was very happy they used my photograph and explaining how the CC-BY works, asking them to fix the attribution issue. I never got an answer to my email, but the next day, the photograph had been taken down :-(
- jrootabega 6y ago
  I think one or more of a few things may have happened - The license was too ambiguous or unproven for them. Some companies refuse to use json.org libraries because of the "Don't Be Evil" clause - They didn't want to show an attribution in their marketing materials. (I agree it would be kind of weird as a potential customer.) - If they kept it up and credited you it might be evidence of their previous violation and evidence that they knew about it.
  - cbsks 6y ago
    I think a likely explanation is that the non-technical person who got the email thought it would just be easier to remove the image than try to figure out how to add the proper attribution to the website.
    - neltnerb 6y ago
      And they were almost certainly correct... that's probably what I'd do if the image was not especially important. But I'd also create my own graphics in the first place.
classics2 6y ago
Why would anyone touch such a toxic piece of software?
belorn 6y ago
I am reminded of an story posted here on HN many years ago about a professional photographer who published photos under cc by-nc with an option to buy for commercial use. The amount of infringements online were massive to the point where they had no chance to even respond to them all, and most of the time when they did inform an infringer who used the content on websites or advertisement campaigns the company either removed the content or ignored the author. The amount of piracy done by companies is pretty significant and there is sadly not many ways to prevent it.
- oliwarner 6y ago
  There are, you hire a company to track down public usage, and scaring infringers into reparative licensing fees with the threat of court time. I think we all hate these companies, but they have a place if their methods are fair (eg let you C&D without payment if the usage isn't too gross).
  - echelon 6y ago
    Seems pretty trivial to automate too. There are an abundance of search APIs, content detection has gotten easier, and keywords probably get you 90% of the way there.
    - oliwarner 6y ago
      You can automate the detection but if you try to automate the scare-o-gram you can come across as a scammy douchebag. It can hurt business if you start threatening nunneries and schools, and persistent threats could be considered harassment; get you in trouble. As much as I hate agents, they're good for taking flack. You can publicly fire them if they make children cry, etc. You'll still want to keep an eye on them but might be worth the disengagement just for general mental-load purposes. Let you focus on direct customers rather than even worrying about infringement.
      - echelon 6y ago
        I agree 100%. The big players in the content ID space have turned the practice into something inhuman. I think this would better serve long tail, mom and pop. In the hands of media empires and conglomerates, it just wantonly hurts people.
Fumtumi 6y ago
I personally would have liked to see my code being used by someone else (even a company) instead of it being deleted. Nonetheless, the blog author decided to use AGPL, i do respect that fully. General speaking, i always try to contribute back but holy shit is that shitty. There are enough projects out there were people don't want to add features because they don't need it, they don't care or whatever. You hit so fast a point were it is much easier to fork it and keep the fork up to date than contributing back :| One project did a great job, came up with the idea on how to make money from it (not successful) by removing the docker images and making the docker images private. I get it but do you think he would be happy for a PR which adds proper documentation on how to build those docker images? Or a multi stage docker build which will take care of building it for you? -> no Every person getting born has to learn the open source software mentality fresh. We have so many people and minds which have not yet learned this and there will always be a percentage of people of it.
eplanit 6y ago
AGPL sounds quite toothless regarding enforceability, and very unattractive from an open source user's perspective. If my changes aren't visible in the UI, I doubt I'd respect the terms, either. Author should choose a more explicit, enforceable licensing model (which would likely make their product expensive and even more unattractive).
jeffrallen 6y ago
Tldr: "I enforced my rights and some people lost access to a useful thing in their own language." Bravo dude. Look, it doesn't have to be dramatic. Make things you love and put them into the world, let the karma take care of itself, don't waste time begging for credit. People who are worth getting respect from will respect your work. Rude people won't, but why do you care about rude people anyway?
- saagarjha 6y ago
  The company could have chosen to open source their work, but they didn't. So I think you have the blame pointing the wrong way. By the way, the reason that most people AGPL is not for credit (and you can see in the blog post, credit was not enough to satisfy the author) but because they think that users of software should be able to have access to its source.
  - jeffrallen 6y ago
    The company was rude. My point is the author choose to expend effort dealing with them. He could have instead used that effort for something that made him happy. Open source can be a source of joy and sharing, if you want it to be.
paulcarroty 6y ago
I'm definitely not a GNU fanboy, but AGPL is the best open license if you're scared about heavily commercial usage from 3rd party. There's another options, like proprietary license, proprietary must-have addons/parts/kernel - here you losing fame & contributors.
- knorker 6y ago
  AGPL scares away both users and contributors. I would not touch either with a 10 meter pole. So no, it's not the best license. Case in point: This story is about how someone would rather not use the product at all, than be subject to the AGPL. Same with me as an employee, and as a hobby individual. AGPL is good at one thing only: scaring away people.
  - paulcarroty 6y ago
    Seems like you still don't understand - the license designed to scare people like you :) Mostly big corps.
    - knorker 6y ago
      It's designed to scare away open source hobby programmers? And users? This seems like "avoid success at all costs". The way I see it there are two kinds of potential AGPL software users and contributors: 1. Those who have not read and/or understood the license, and just go with it. They likely will be fine, because who's going to sue John Doe who built his first website in PHP, but didn't publish his AWS script for launching mongoDB? 2. People who nope the fuck out when they read the license, and don't become contributors or users. (1) are violating the license. (2) are not using it at all. So what an AGPL software author does is take the pool of potential users and contributors, and divides them into those who nope out, and those who violate the license. And is that really good honest work you can be proud of? That reminds me more of the music industry of 15 years ago. They gave their customers two options: Have to deal with spinning plastic, or pirate. In this comparison the former is "nope, guess I won't listen to that band, then". AGPL software authors often make the point you are: Well nobody is using plastic, and so what if they pirate the software? They're not profiteering on it, and it was free anyway. Just make a license that says it's not allowed to be used by companies of size greater than X.
Liberion 6y ago
Uh, a lot of people are missing the point on AGPL here. AGPL wasn't meant to be easily used in every project by every individual or company out there, it was meant exactly for the effect it's having: Making you skip it if you're not willing to contribute back, while keeping the abiliy to free software creators to easily use it.
- heavyset_go 6y ago
  I agree, this is the reason that I release software under the AGPL: I intend for consumers of my projects to adhere to the terms of the licenses they were released under, otherwise I wouldn't have released them at all.
- mr_toad 6y ago
  Another point that people seem to be overlooking is that even if the software had been released under a more permissive licence like the BSD licence the site still would have been in violation of it because they didn’t provide attribution, and even had the temerity to claim the code was theirs. In all likelihood the outcome would have been the same regardless of what licence was used.
fuball63 6y ago
How does the AGPL differ from some of the other cloud protected licenses that have been discussed here recently? Specifically, the polyform licenses[1] and the TimescaleDB license[2]? [1]https://polyformproject.org/licenses/ https://polyformproject.org/licenses/ [2]https://blog.timescale.com/blog/building-open-source-business-in-cloud-era-v2/ https://blog.timescale.com/blog/building-open-source-busines...
- andreareina 6y ago
  These licenses inherently restrict fields of endeavor, the AGPL does not.
- behindsight 6y ago
  AGPL is compatible with the OSI's definition of "open-source". Those other two licenses you listed are either fully non-commercial (polyform) or have a clause preventing cloud hosting SaaS (timescale). I am not going to get into discussion about who has the right to define "open-source", but having the right to commercially profit off of the software is one of the key OSI defined tenets which those two licenses lack. In the end, AGPL may be able to achieve the same goal of preventing parasitic SaaS solutions that don't contribute back into the community.
- kmeisthax 6y ago
  The AGPL, like the GPL, does not restrict your Four Freedoms (unlimited use, modification, distribution, and distribution of modifications). Both, however, require you to distribute source code and sublicense when certain conditions are met. The conditions are just different: GPL requires that you fulfill the copyleft when you give people a copy of the program while AGPL expands that to making it available over a network. Both of these ultimately let you have the same Freedoms as long as you don't take action to restrict anyone else's. Whether or not a copyleft can be considered to be Free is a long-standing argument between the "GNU" and "BSD" schools of thought, albeit the former has long since won out in the broader marketplace of Free Software. I personally hold copyleft as Free, because the conditions that you have to satisfy in order to exercise your freedoms are marginal. In contrast, Polyform and TimescaleDB place a whole host of permanent restrictions on user freedom. It's not "oh you need to give someone the source if you're also giving them a binary", it's "you can't ever host this on a cloud server without paying us". You are defining a particular use of the software that only you can enjoy and nobody else can.
X6S1x6Okd1st 6y ago
Well that seemed not worth it.
Seb-C 6y ago
I am a developer that contributes to open source both by releasing projects and helping fixing bugs and improving stuff whenever I can. I always release my own open source projects under permissive licences like MIT. I even did some WTFPL in the past. I like free software and open source because of freedom. Restrictive licenses are the opposite of that. It is perfectly fine to me if a company decides to not release a change. They probably have good reasons to do that. And if they don't, then it is just a dumb decision that will end up costing them more anyway.
- tpxl 6y ago
  >I like free software and open source because of freedom. The MIT license is less free than GPL in the sense that as a user of MIT software I don't get to see the source, modify, and distribute it, whereas with the GPL I can. The MIT license is more free in the sense that as a developer I don't have to give those freedoms to my users. It's perfectly fine to prefer developer freedoms over user freedoms, but be aware of both of them.
  - Seb-C 6y ago
    As far as I understand the licences, this is not true. You can do all of that with the MIT licence, but you are not forced to release everything that uses it at MIT.
- mempko 6y ago
  > They probably have good reasons to do that. And if they don't, then it is just a dumb decision that will end up costing them more anyway. I love this Faith Based Model of software development...

215 points by jandeboevrie 6y ago

tobyhinloopen 6y ago

So they didn’t bother and shut down the site. Well that’s fine I suppose

ginko 6y ago
Wouldn't they still have to release the source code retroactively for hosting previously? Not sure how the AGPL handles this.
- rcxdude 6y ago
  Probably not. The consequence of violating the (A)GPL is you lose the right to use, distribute, and modify the software. They could in principle be sued because they were violating the license while the website is up but you'd need to demonstrate losses and you couldn't force the release, only get some compensation (though you could try to use that as leverage to settle for the release of the code). (IANAL, etc)
  - tpxl 6y ago
    >you'd need to demonstrate losses Aren't losses trivial to demonstrate: You didn't get the source code. And in the happy case you can be made whole just by them releasing the code, which is easy if it wasn't modified such that it contains proprietary shit.
    - _ph_ 6y ago
      Losses are paid in money. So you need to specify a certain monetary value and have the court to agree. While it would be the easiest for settling the case to just release the modified source, I don't think you can enforce that.
  - _ph_ 6y ago
    Right, I think that is a common misconception. A license like the AGPL cannot force people to release their modifications, it can only force people not using the AGPL-licensed software. At best you can sue for damages due to unlicensed usage.
  - mr_toad 6y ago
    > you'd need to demonstrate losses Depending on the jurisdiction and circumstances there may also be statutory damages, punitive damages and exemplary damages.
- eeZah7Ux 6y ago
  No
- madjam002 6y ago
  Doesn't AGPL only _require_ you to distribute the source code when requested? Sure they violated it when the author requested the source code, but surely you'd need to demonstrate that other requests were made over the duration of when the site was up where they refused to provide the source code.
  - garmaine 6y ago
    You also have to notify that it is under the AGPL and provide access (e.g. a link) to the license. Technically the source code could be behind an ask-wall though.
- dspillett 6y ago
  IIRC (A)GPL stipulates that you need to make available source, on request, to the people who use your version. This is often interpreted as you need to release publicly, but that is not the case. If I'm remembering rightly then the author can't make them give him a copy of the code at this point, but one of their users could. If they have/had no users that care, there is no more that they need to do. Unless the author having visited their site counts as them being a user of the code protected by the license, then it swings back the other way.
  - aronpye 6y ago
    Don’t you always have to provide author attribution and a link to the licence?
    - dspillett 6y ago
      Many less restrictive open source licenses require attribution, that is far from unique to GPL flavours.
  - dec0dedab0de 6y ago
    Visiting the site probably counts as using it. I think to get around that there would need to be a separate paywall
    - toyg 6y ago
      “Visiting the site” does not count as distributing it under the GPL: “ Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying”. If you don’t distribute the work, you don’t need to provide sources.
      - justinclift 6y ago
        The case here is the AGPL though, not the GPL.
        6y ago

midasz 6y ago

What a weird reaction by that company. The time it took them to discuss it, investigate, and respond could've easily been used to comply with the license. I'm already happy with my current hosting but they've been added to my shitlist either way.

muyuu 6y ago
They probably had hacks in the code they didn't want to show, but all in all I suspect they were making so little they just thought it wasn't worth continuing with it. Most of these sites simply vanish at some point, with kind of defeats the purpose of using them to simplify their operation as you need to be ready to look for an alternative on short notice and it's a security concern. OTOH what are the chances that the code changes would be of any use to the author?
- necovek 6y ago
  I would guess hacks and potentially secrets (passwords).
- belorn 6y ago
  We can only speculate, but my suspicion is that they simply felt a bit ashamed. Telling a person they have been breaking the law for years, especially if they have a personal need to feel professional, can easily send them into panic mode. Removing the site and any record of it gives them a way to put it behind them.
  - saagarjha 6y ago
    Right, but now they have a blog post written about them…
coddle-hark 6y ago
Not necessarily. If they were to comply fully they’d need to release appropriately licensed source code for all previous versions of the site too. As in, the OP could say: “I visited your site X days ago, please provide the source for the code I ran”.

toyg 6y ago

Duplicate of https://news.ycombinator.com/item?id=24837686 https://news.ycombinator.com/item?id=24837686

AnonHP 6y ago

> Four days later, they responded, stating that they had discussed internally and decided to take the site offline. > That concludes our conversation, they took down their site and never complied with the license. I think they're not violating it now, but have done for a few years. This makes me wonder what their thinking was. Did they decide to take it down because of potential/unknown (to them) legal implications of using it for three years without providing a way to get the source? Or did they think this site is done because of legal issues and then go to the drawing board for creating a different site with a lot more changes (to avoid detection) so that they don’t have to comply with this at all?

dmurray 6y ago
Sounds more like nobody paid for the service, so they decided not to spend any more time on it.
knorker 6y ago
> This makes me wonder what their thinking was. Did they decide to take it down because of potential/unknown (to them) legal implications of using it for three years without providing a way to get the source? Probably. Maybe combined with asking an actual lawyer who likely would look at the license go NO NO NO NO, SHUT IT DOWN NOW, AND NEVER TOUCH AGPL AGAIN! Speaking from experience.

bartread 6y ago

> I license all my personall stuff under the GPL and AGPL (where applicable) and dislike the permissive licenses (MIT, 3 clause BSD, X11, Apache) because they allow people to take your stuff and never contribute back. I prefer strong copyleft licenses that force you to contribute. Here is a good article going into permissive vs copyleft licensing. This is a fair point, however the way it seems to end up working is that people just don't use the software due to the viral nature of GPL and AGPL. I'd be happy enough to contribute modifications back to projects under GPL and AGPL but, the reality is, if I embed some GPL or AGPL component, service, or product into my site or service we're now in this (at best) legal grey area where we have to figure out how much of what I've done is a modification, and how much is distinct, and there's a risk I just have to hand it all over (whch I don't want to do). It quickly becomes enough of a nightmare to deal with that it's easier to either (a) find an alternative that uses a permissive license, or (b) build something oneself that offers the required functionality. It's a shame because it leads to, I think, both OSS and corporations losing out. It would be great if there was some sort of middle ground license that protected against corporate abuse, and forced corporations to hand over changes without the risk of having to hand over large tranches of their other IP. I'm not sure what that would be though, or whether it could be made to work.

toyg 6y ago
The minute it is required to hand over anything, even a single line of code, you will find someone raising the objection you mentioned (“it’s too burdensome to figure out if I have to release 6 characters or 5 characters!”). Stock corporate lawyers don’t like uncertainty, and the smallest of grey areas will be seized upon to block anything “in order to protect the company”. The reality is that in 99.99999% of the cases, nobody will ever come after you for trying to do the right thing. If you engage the GPL community in good faith, things will work out fine with minimum fuss. So no, we don’t need another license, we just need people willing to do the right thing.
- _ph_ 6y ago
  The problem with GPL is, that it doesn't only require you to hand over any modifications to the GPL code - this would be easily to do, but to any code in a product built containing GPL code. And that is where the problems usually start. The reality is, not everyone agrees what the reality is and especially a company which takes licenses serious will be very careful to check, whether using GPL code is possible in a project. And no, we don't need another license, there are plenty of licenses available which resolve the issues. Be it the permissive licenses (MIT, BSD, ...) or GPL with linking exceptions.

murgindrag 6y ago

... and despite all the doom-and-gloom, that's how most AGPL / GPL enforcement goes in practice. People fix the issue. Everyone moves on. A few legally naive organizations avoid AGPL due to perceived liability. I have yet to see a case with that million-dollar payout. Perhaps lightening will strike and you'll be the first, or perhaps there's minimal risk because that's not how laws work. (Disclaimer: Above applies to common law jurisdictions, like GB and US; I have no idea about French legislative law, Asian courts, etc.).

erk__ 6y ago
If you want to be sure it works in the EU I guess you could use the EUPL instead of AGPL which gives many of the same gurantees, but fits into european law.
speeder 6y ago
Problem is not always this is possible. See the infamous case of someone using scumvm to make games for console... To make a console game you need to follow an NDA that you won't release source to avoid revealing the API, thus you can't make a GPL console engine unless it is dual license.
user5994461 6y ago
Wrote an article on the French law, a major case on GPL reached court last year https://thehftguy.com/2020/09/15/french-judge-rules-gpl-license-to-be-inapplicable-in-french-copyright-court/ https://thehftguy.com/2020/09/15/french-judge-rules-gpl-lice... GPL was found to be inapplicable in French copyright court, however it should be applicable under contract law. The developers lost 9 years and a good chunk of money suing, they even had to pay some legal fees.
- alisonkisk 6y ago
  Is this largely because no one previously thought to consider the GPL, a US legal invention, under French law? The English speaking tech industry often forgets other countries are other countries. How could they spend 9 years and 14000 Euros on a dispute that should have been settled in 1 day by any French lawyer? ("Licenses don't apply to counterfeit law in France; a license is treated as a contract")

Arkanosis 6y ago

Last year, I enforced the CC-BY license. It's not even a copyleft license, but the outcome was similar. Affinord, a cheese seller, used on their own website a photograph I had shared under the CC-BY license on Wikimedia Commons, without any attribution (the only thing required by the license). So I sent them an email saying that I was very happy they used my photograph and explaining how the CC-BY works, asking them to fix the attribution issue. I never got an answer to my email, but the next day, the photograph had been taken down :-(

jrootabega 6y ago
I think one or more of a few things may have happened - The license was too ambiguous or unproven for them. Some companies refuse to use json.org libraries because of the "Don't Be Evil" clause - They didn't want to show an attribution in their marketing materials. (I agree it would be kind of weird as a potential customer.) - If they kept it up and credited you it might be evidence of their previous violation and evidence that they knew about it.
- cbsks 6y ago
  I think a likely explanation is that the non-technical person who got the email thought it would just be easier to remove the image than try to figure out how to add the proper attribution to the website.
  - neltnerb 6y ago
    And they were almost certainly correct... that's probably what I'd do if the image was not especially important. But I'd also create my own graphics in the first place.

classics2 6y ago

Why would anyone touch such a toxic piece of software?

belorn 6y ago

I am reminded of an story posted here on HN many years ago about a professional photographer who published photos under cc by-nc with an option to buy for commercial use. The amount of infringements online were massive to the point where they had no chance to even respond to them all, and most of the time when they did inform an infringer who used the content on websites or advertisement campaigns the company either removed the content or ignored the author. The amount of piracy done by companies is pretty significant and there is sadly not many ways to prevent it.

oliwarner 6y ago
There are, you hire a company to track down public usage, and scaring infringers into reparative licensing fees with the threat of court time. I think we all hate these companies, but they have a place if their methods are fair (eg let you C&D without payment if the usage isn't too gross).
- echelon 6y ago
  Seems pretty trivial to automate too. There are an abundance of search APIs, content detection has gotten easier, and keywords probably get you 90% of the way there.
  - oliwarner 6y ago
    You can automate the detection but if you try to automate the scare-o-gram you can come across as a scammy douchebag. It can hurt business if you start threatening nunneries and schools, and persistent threats could be considered harassment; get you in trouble. As much as I hate agents, they're good for taking flack. You can publicly fire them if they make children cry, etc. You'll still want to keep an eye on them but might be worth the disengagement just for general mental-load purposes. Let you focus on direct customers rather than even worrying about infringement.
    - echelon 6y ago
      I agree 100%. The big players in the content ID space have turned the practice into something inhuman. I think this would better serve long tail, mom and pop. In the hands of media empires and conglomerates, it just wantonly hurts people.

Fumtumi 6y ago

I personally would have liked to see my code being used by someone else (even a company) instead of it being deleted. Nonetheless, the blog author decided to use AGPL, i do respect that fully. General speaking, i always try to contribute back but holy shit is that shitty. There are enough projects out there were people don't want to add features because they don't need it, they don't care or whatever. You hit so fast a point were it is much easier to fork it and keep the fork up to date than contributing back :| One project did a great job, came up with the idea on how to make money from it (not successful) by removing the docker images and making the docker images private. I get it but do you think he would be happy for a PR which adds proper documentation on how to build those docker images? Or a multi stage docker build which will take care of building it for you? -> no Every person getting born has to learn the open source software mentality fresh. We have so many people and minds which have not yet learned this and there will always be a percentage of people of it.

eplanit 6y ago

AGPL sounds quite toothless regarding enforceability, and very unattractive from an open source user's perspective. If my changes aren't visible in the UI, I doubt I'd respect the terms, either. Author should choose a more explicit, enforceable licensing model (which would likely make their product expensive and even more unattractive).

jeffrallen 6y ago

Tldr: "I enforced my rights and some people lost access to a useful thing in their own language." Bravo dude. Look, it doesn't have to be dramatic. Make things you love and put them into the world, let the karma take care of itself, don't waste time begging for credit. People who are worth getting respect from will respect your work. Rude people won't, but why do you care about rude people anyway?

saagarjha 6y ago
The company could have chosen to open source their work, but they didn't. So I think you have the blame pointing the wrong way. By the way, the reason that most people AGPL is not for credit (and you can see in the blog post, credit was not enough to satisfy the author) but because they think that users of software should be able to have access to its source.
- jeffrallen 6y ago
  The company was rude. My point is the author choose to expend effort dealing with them. He could have instead used that effort for something that made him happy. Open source can be a source of joy and sharing, if you want it to be.

paulcarroty 6y ago

I'm definitely not a GNU fanboy, but AGPL is the best open license if you're scared about heavily commercial usage from 3rd party. There's another options, like proprietary license, proprietary must-have addons/parts/kernel - here you losing fame & contributors.

knorker 6y ago
AGPL scares away both users and contributors. I would not touch either with a 10 meter pole. So no, it's not the best license. Case in point: This story is about how someone would rather not use the product at all, than be subject to the AGPL. Same with me as an employee, and as a hobby individual. AGPL is good at one thing only: scaring away people.
- paulcarroty 6y ago
  Seems like you still don't understand - the license designed to scare people like you :) Mostly big corps.
  - knorker 6y ago
    It's designed to scare away open source hobby programmers? And users? This seems like "avoid success at all costs". The way I see it there are two kinds of potential AGPL software users and contributors: 1. Those who have not read and/or understood the license, and just go with it. They likely will be fine, because who's going to sue John Doe who built his first website in PHP, but didn't publish his AWS script for launching mongoDB? 2. People who nope the fuck out when they read the license, and don't become contributors or users. (1) are violating the license. (2) are not using it at all. So what an AGPL software author does is take the pool of potential users and contributors, and divides them into those who nope out, and those who violate the license. And is that really good honest work you can be proud of? That reminds me more of the music industry of 15 years ago. They gave their customers two options: Have to deal with spinning plastic, or pirate. In this comparison the former is "nope, guess I won't listen to that band, then". AGPL software authors often make the point you are: Well nobody is using plastic, and so what if they pirate the software? They're not profiteering on it, and it was free anyway. Just make a license that says it's not allowed to be used by companies of size greater than X.

Liberion 6y ago

Uh, a lot of people are missing the point on AGPL here. AGPL wasn't meant to be easily used in every project by every individual or company out there, it was meant exactly for the effect it's having: Making you skip it if you're not willing to contribute back, while keeping the abiliy to free software creators to easily use it.

heavyset_go 6y ago
I agree, this is the reason that I release software under the AGPL: I intend for consumers of my projects to adhere to the terms of the licenses they were released under, otherwise I wouldn't have released them at all.
mr_toad 6y ago
Another point that people seem to be overlooking is that even if the software had been released under a more permissive licence like the BSD licence the site still would have been in violation of it because they didn’t provide attribution, and even had the temerity to claim the code was theirs. In all likelihood the outcome would have been the same regardless of what licence was used.

fuball63 6y ago

How does the AGPL differ from some of the other cloud protected licenses that have been discussed here recently? Specifically, the polyform licenses[1] and the TimescaleDB license[2]? [1]https://polyformproject.org/licenses/ https://polyformproject.org/licenses/ [2]https://blog.timescale.com/blog/building-open-source-business-in-cloud-era-v2/ https://blog.timescale.com/blog/building-open-source-busines...

andreareina 6y ago
These licenses inherently restrict fields of endeavor, the AGPL does not.
behindsight 6y ago
AGPL is compatible with the OSI's definition of "open-source". Those other two licenses you listed are either fully non-commercial (polyform) or have a clause preventing cloud hosting SaaS (timescale). I am not going to get into discussion about who has the right to define "open-source", but having the right to commercially profit off of the software is one of the key OSI defined tenets which those two licenses lack. In the end, AGPL may be able to achieve the same goal of preventing parasitic SaaS solutions that don't contribute back into the community.
kmeisthax 6y ago
The AGPL, like the GPL, does not restrict your Four Freedoms (unlimited use, modification, distribution, and distribution of modifications). Both, however, require you to distribute source code and sublicense when certain conditions are met. The conditions are just different: GPL requires that you fulfill the copyleft when you give people a copy of the program while AGPL expands that to making it available over a network. Both of these ultimately let you have the same Freedoms as long as you don't take action to restrict anyone else's. Whether or not a copyleft can be considered to be Free is a long-standing argument between the "GNU" and "BSD" schools of thought, albeit the former has long since won out in the broader marketplace of Free Software. I personally hold copyleft as Free, because the conditions that you have to satisfy in order to exercise your freedoms are marginal. In contrast, Polyform and TimescaleDB place a whole host of permanent restrictions on user freedom. It's not "oh you need to give someone the source if you're also giving them a binary", it's "you can't ever host this on a cloud server without paying us". You are defining a particular use of the software that only you can enjoy and nobody else can.

X6S1x6Okd1st 6y ago

Well that seemed not worth it.

Seb-C 6y ago

I am a developer that contributes to open source both by releasing projects and helping fixing bugs and improving stuff whenever I can. I always release my own open source projects under permissive licences like MIT. I even did some WTFPL in the past. I like free software and open source because of freedom. Restrictive licenses are the opposite of that. It is perfectly fine to me if a company decides to not release a change. They probably have good reasons to do that. And if they don't, then it is just a dumb decision that will end up costing them more anyway.

tpxl 6y ago
>I like free software and open source because of freedom. The MIT license is less free than GPL in the sense that as a user of MIT software I don't get to see the source, modify, and distribute it, whereas with the GPL I can. The MIT license is more free in the sense that as a developer I don't have to give those freedoms to my users. It's perfectly fine to prefer developer freedoms over user freedoms, but be aware of both of them.
- Seb-C 6y ago
  As far as I understand the licences, this is not true. You can do all of that with the MIT licence, but you are not forced to release everything that uses it at MIT.
mempko 6y ago
> They probably have good reasons to do that. And if they don't, then it is just a dumb decision that will end up costing them more anyway. I love this Faith Based Model of software development...