5 ms·

What a weird reaction by that company. The time it took them to discuss it, investigate, and respond could've easily been used to comply with the license. I'm a

by midasz 6y ago

What a weird reaction by that company. The time it took them to discuss it, investigate, and respond could've easily been used to comply with the license. I'm already happy with my current hosting but they've been added to my shitlist either way.

muyuu 6y ago
They probably had hacks in the code they didn't want to show, but all in all I suspect they were making so little they just thought it wasn't worth continuing with it. Most of these sites simply vanish at some point, with kind of defeats the purpose of using them to simplify their operation as you need to be ready to look for an alternative on short notice and it's a security concern. OTOH what are the chances that the code changes would be of any use to the author?
- necovek 6y ago
  I would guess hacks and potentially secrets (passwords).
- belorn 6y ago
  We can only speculate, but my suspicion is that they simply felt a bit ashamed. Telling a person they have been breaking the law for years, especially if they have a personal need to feel professional, can easily send them into panic mode. Removing the site and any record of it gives them a way to put it behind them.
  - saagarjha 6y ago
    Right, but now they have a blog post written about them…
coddle-hark 6y ago
Not necessarily. If they were to comply fully they’d need to release appropriately licensed source code for all previous versions of the site too. As in, the OP could say: “I visited your site X days ago, please provide the source for the code I ran”.
- danhor 6y ago
  But taking it offline doesn't solve that issue. OP can still say that.
- aronpye 6y ago
  Do the GPL licences specify any archival requirements? I would have thought that when you stop distributing the product containing the source code the responsibility to continue hosting the source code ends too?
  - dragonwriter 6y ago
    > Do the GPL licences specify any archival requirements? I would have thought that when you stop distributing the product containing the source code the responsibility to continue hosting the source code ends too? It doesn't cure the past violation, but a whole lot of legal importance rest on knowing violation, and continuing after being informed of the violation can, in addition to being evidence that you violation after the notice was intentional, weaken your argument that the violation before was not, so stopping a violation once you are informed of it reduces, though does not entirely eliminate, the legal risk. So, a hard stop on use when you are informed your currente use may be illegal is a perfectly sensible response in most cases even if you are evaluating whether your use was illegal and whether, if it was, you should, in the long term, either stop the use permanently or conform to whatever legal requirements attach to use.
- teddyh 6y ago
  No, that’s not how it works. If someone runs a web site with code released under the AGPL, but they have removed the source code download link, they have violated the AGPL, and therefore violated copyright law. There is no way out for them by offering to send source code after the fact. The copyright holder can choose not to pursue the matter if the web site hosters send the source code, but that has nothing to do with the requirements in the actual AGPL.
  - coddle-hark 6y ago
    You’re right, thanks for the correction.
danpalmer 6y ago
> and respond could've easily been used to comply with the license I agree it's a weird reaction to take the site down when pushed, and try to get away with it to begin with, but I also think that them removing the site entirely was a very likely outcome from the beginning, and probably the best move for that company. If they missed the AGPL requirement from day 1 (likely) and they're developing at the typical level of a small business who misses things like licencing requirements, then their source code is likely not something they can release. It's likely to have hard-coded credentials, and it's even possible that the licence for their translations don't allow them to distribute them elsewhere! They might have conflicting licences. As unsatisfying as it is, taking the site down is a reasonable step – it mostly addresses the complainant's request by ceasing to violate the AGPL.
knorker 6y ago
> could've easily been used to comply with the license. The AGPL is pretty much impossibly to comply with. Read the part about "Corresponding Source" and think about just how much Corresponding Source is out there. E.g.: If this company ran the service on AWS, then the source code for their provisioning scripts for AWS to run the service would be in scope. And those scripts probably pull in internal libraries. Or not. You may find out after a multi-year court battle that this part of the AGPL is unenforcable. Who knows? It's lose-lose anyway. It's absolutely not worth it to run AGPL. It's not a weird reaction at all. It's probably the only possible action.
- atq2119 6y ago
  This feels like the kind of scaremongering that was common about open source on general a few decades ago. A script that calls a piece of software is not a derived work. Otherwise, all build systems that have ever been used with GCC would have to be GPL-licensed. Why would your example be different?
  - kazinator 6y ago
    > A script that calls a piece of software is not a derived work If that script relies on that software, it is a derived work. If that script is GPLed, then that software must be GPL-compatible, or else it must be interpreted as falling under the "system library exception". > all build systems that have ever been used with GCC would have to be GPL-licensed. The tools required to build GCC on a proprietary OS can be regarded as landing under the system exception. It would almost certainly be a GPL violation to add a patch to GCC which causes it to require a third-party proprietary program or script in order to build (something not coming from a target system itself).
    - atq2119 6y ago
      You misunderstood the comparison. I was talking about build systems that invoke GCC as part of building another program. This is comparable to a provisioning script.
  - 6y ago
kazinator 6y ago
Complying with the AGPL license actively (continuing to use it, and redistributing the modified source) is only possible if the modifications are GPL-compatible. It could be that the time it took to discuss and investigate the issue led them to realize that they don't want to release the material, or possibly cannot. If a program is only GPLed, then it can be put into service with GPL-incompatible changes. In that form, it cannot be redistributed, but since that is not required, there is no problem. If a program is AGPLed and is put into service with GPL-incompatible changes, then there is a double problem. It must be redistributed, but in its present form it cannot.

by midasz 6y ago

muyuu 6y ago

They probably had hacks in the code they didn't want to show, but all in all I suspect they were making so little they just thought it wasn't worth continuing with it. Most of these sites simply vanish at some point, with kind of defeats the purpose of using them to simplify their operation as you need to be ready to look for an alternative on short notice and it's a security concern. OTOH what are the chances that the code changes would be of any use to the author?

necovek 6y ago
I would guess hacks and potentially secrets (passwords).
belorn 6y ago
We can only speculate, but my suspicion is that they simply felt a bit ashamed. Telling a person they have been breaking the law for years, especially if they have a personal need to feel professional, can easily send them into panic mode. Removing the site and any record of it gives them a way to put it behind them.
- saagarjha 6y ago
  Right, but now they have a blog post written about them…

coddle-hark 6y ago

Not necessarily. If they were to comply fully they’d need to release appropriately licensed source code for all previous versions of the site too. As in, the OP could say: “I visited your site X days ago, please provide the source for the code I ran”.

danhor 6y ago
But taking it offline doesn't solve that issue. OP can still say that.
aronpye 6y ago
Do the GPL licences specify any archival requirements? I would have thought that when you stop distributing the product containing the source code the responsibility to continue hosting the source code ends too?
- dragonwriter 6y ago
  > Do the GPL licences specify any archival requirements? I would have thought that when you stop distributing the product containing the source code the responsibility to continue hosting the source code ends too? It doesn't cure the past violation, but a whole lot of legal importance rest on knowing violation, and continuing after being informed of the violation can, in addition to being evidence that you violation after the notice was intentional, weaken your argument that the violation before was not, so stopping a violation once you are informed of it reduces, though does not entirely eliminate, the legal risk. So, a hard stop on use when you are informed your currente use may be illegal is a perfectly sensible response in most cases even if you are evaluating whether your use was illegal and whether, if it was, you should, in the long term, either stop the use permanently or conform to whatever legal requirements attach to use.
teddyh 6y ago
No, that’s not how it works. If someone runs a web site with code released under the AGPL, but they have removed the source code download link, they have violated the AGPL, and therefore violated copyright law. There is no way out for them by offering to send source code after the fact. The copyright holder can choose not to pursue the matter if the web site hosters send the source code, but that has nothing to do with the requirements in the actual AGPL.
- coddle-hark 6y ago
  You’re right, thanks for the correction.

danpalmer 6y ago

> and respond could've easily been used to comply with the license I agree it's a weird reaction to take the site down when pushed, and try to get away with it to begin with, but I also think that them removing the site entirely was a very likely outcome from the beginning, and probably the best move for that company. If they missed the AGPL requirement from day 1 (likely) and they're developing at the typical level of a small business who misses things like licencing requirements, then their source code is likely not something they can release. It's likely to have hard-coded credentials, and it's even possible that the licence for their translations don't allow them to distribute them elsewhere! They might have conflicting licences. As unsatisfying as it is, taking the site down is a reasonable step – it mostly addresses the complainant's request by ceasing to violate the AGPL.

knorker 6y ago

> could've easily been used to comply with the license. The AGPL is pretty much impossibly to comply with. Read the part about "Corresponding Source" and think about just how much Corresponding Source is out there. E.g.: If this company ran the service on AWS, then the source code for their provisioning scripts for AWS to run the service would be in scope. And those scripts probably pull in internal libraries. Or not. You may find out after a multi-year court battle that this part of the AGPL is unenforcable. Who knows? It's lose-lose anyway. It's absolutely not worth it to run AGPL. It's not a weird reaction at all. It's probably the only possible action.

atq2119 6y ago
This feels like the kind of scaremongering that was common about open source on general a few decades ago. A script that calls a piece of software is not a derived work. Otherwise, all build systems that have ever been used with GCC would have to be GPL-licensed. Why would your example be different?
- kazinator 6y ago
  > A script that calls a piece of software is not a derived work If that script relies on that software, it is a derived work. If that script is GPLed, then that software must be GPL-compatible, or else it must be interpreted as falling under the "system library exception". > all build systems that have ever been used with GCC would have to be GPL-licensed. The tools required to build GCC on a proprietary OS can be regarded as landing under the system exception. It would almost certainly be a GPL violation to add a patch to GCC which causes it to require a third-party proprietary program or script in order to build (something not coming from a target system itself).
  - atq2119 6y ago
    You misunderstood the comparison. I was talking about build systems that invoke GCC as part of building another program. This is comparable to a provisioning script.
- 6y ago

kazinator 6y ago

Complying with the AGPL license actively (continuing to use it, and redistributing the modified source) is only possible if the modifications are GPL-compatible. It could be that the time it took to discuss and investigate the issue led them to realize that they don't want to release the material, or possibly cannot. If a program is only GPLed, then it can be put into service with GPL-incompatible changes. In that form, it cannot be redistributed, but since that is not required, there is no problem. If a program is AGPLed and is put into service with GPL-incompatible changes, then there is a double problem. It must be redistributed, but in its present form it cannot.