8 ms·

Even though we use Grafana only internally and there would be no problem with AGPLv3 in theory I see big meetings with legal coming up which might result in us

by jabiko 5y ago

Even though we use Grafana only internally and there would be no problem with AGPLv3 in theory I see big meetings with legal coming up which might result in us not being able to use it anymore. I could image that its the same with other corporations. In the end that might hurt the popularity of Grafana quite a lot.

globular-toast 5y ago
There should be no problem with it even if you use it externally. It's about time companies stopped seeing open source as freely exploitable. Every company that uses open source software should be obliged to contribute, or pay for proprietary software.
bboreham 5y ago
Would you consider paying for a licence to use it?
- jabiko 5y ago
  Honestly, I have no idea. I think if there would be a possibility to pay money to have what we are doing reviewed by Grafana and be "certified" to be withing what they consider acceptable under the AGPL that might actually be a good option
  - bboreham 5y ago
    What about just paying for a commercial licence to use it to meet your needs?
    - jabiko 5y ago
      I have no Idea. Realistically its probably not the license cost but the one time and the perpetual operational overhead associated with the license that's going to be the problem.
      - peterbonney 5y ago
        That makes zero business sense. Your first post is about the one time and perpetual operational overhead associated with operating under the prior FOSS license (yes, you’re saying it’s the new license that’s a problem, but since the situation arose while operating under the prior conditions then implicitly those conditions carried this very overhead). Operating under any license carried an overhead, unless you simply choose to not read (or to read and ignore) the fine print.
        jabiko 5y ago
        > Your first post is about the one time and perpetual operational overhead associated with operating under the prior FOSS license My first post is about the fact that even though the planned use case would be 100% compliant to the AGPLv3 license the fear that is associated with that license could prevent such use. > That makes zero business sense Purchasing a license in that case while not strictly necessary might be seen as an insurance. So that makes business sense. In the end though I highly doubt that's whats going to happen. The most likely outcome is that we just get told to get rid of Grafana and use something else.
        peterbonney 5y ago
        > In the end though I highly doubt that's whats going to happen. The most likely outcome is that we just get told to get rid of Grafana and use something else. Whatever you replace it with will have the same licensing overhead. Again, this makes no sense. If you said we can’t afford to pay for it, fine. But you explicitly said you don’t think cost is an issue. Maybe I’m making the wrong inference, but it sounds like you’re afraid your higher ups just don’t want to have any restrictions placed on whatever business need it is that Grafana is filling for you. If I haven’t misunderstood that fear, then I regret to say that any software product other than one you build and maintain yourselves will come with some restrictions or the possibility of future restrictions. When I say this makes no business sense, that’s what I’m trying to get at: other than (potentially) licensing cost, any Grafana substitute will come with the same issues, plus switching costs. So unless there is a FOSS product that provides a better solution to your problem, by definition switching will be more costly than maintaining status quo. Or am I missing the point?
- t-writescode 5y ago
  If I was in charge of the money, assuming it’s a reasonable price for on-prem Grafana, I would pay for a license to Grafana, just to not have the licensing stress.
dvfjsdhgfv 5y ago
In a large number of cases, this is not an issue at all. Just like we all use GPL-ed kernel and a ton of other stuff. There is also no problem with making AGPL-based services available to customers. The caveat is that when you modify AGPL-based code, you need to make the source of these modifications available, too. For some reason, this scares Amazon a lot. Developers know that and use AGPL when they don't want to be screwed by AWS.
- jsdwarf 5y ago
  I don't get why Amazon should be scared by AGPL. I mean all of their services run on GPLed Linux, why should they be scared by a GPLed Grafana?Even if they had to open-source their Grafana contributions, they could do this in a way that they are worthless for potential competitors (e.g. if the contribution depends on a proprietary Amazon system)
  - yorwba 5y ago
    > they could do this in a way that they are worthless for potential competitors (e.g. if the contribution depends on a proprietary Amazon system) That is not allowed. """The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.""" (Emphasis on that last part mine.) """Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software.""" If Amazon modifies Grafana so it depends on a proprietary Amazon system, the source code for that system is included in the Corresponding Source, and if they allow users to interact with that modified version, they need to provide them with access to the proprietary system's source code.
188201 5y ago
I think that's misunderstanding of AGPL. For internal use, AGPL does not require to share the proprietary part. If a company develop an proprietary UI and use Loki as backend, this is not serving Loki directly to customer, so that does not require company to release their code. It is similar to GPL. Dynamic linking to a GPL software does not require the developer releasing their code. Only provider serving Loki instance directly to customer required to share the code. Only Amazon is upset that they cannot just host a popular open source project directly on their cloud. Maybe they could pay a license fee for dual licensing arrangement, which is a better way to support open source startup.
- klintcho 5y ago
  This might be the case. However there is an additional risk and process component: - you might not want to risk because you don't have lawyers etc in your company. - even if you have lawyers etc in your company, if there are 2 alternatives one which is just an MIT license, you'll probably go for that one because you don't want to have a 1.5 month review of the use of this AGPL licensed alternative. In general things like this https://github.com/xdspacelab/openvslam/wiki/Termination-of-the-release https://github.com/xdspacelab/openvslam/wiki/Termination-of-... (repo with 3k stars), an effort terminated because of some traces of GPL code MIGHT be somewhere in there comes to light. Even though Grafana etc are mostly tools, for my startup I would probably not risk any of this (for my own sake and also for any kind of due diligence in case it ever gets acquired)
  - aulin 5y ago
    did not follow the events of openvslam, wouldn't they be required to still release the source code of the previously public version as GPL? also once the doubt is there, why not rerelease as GPL?
- tamalsaha001 5y ago
  That does not seem to be the case. From [1] The difference between the AGPL and traditional GPL is simple: The AGPL seeks to close a "loophole" that allows a company or organization to modify GPL'ed software and use it to provide a service — but without actually distributing changes. So a company can take a package like, say, WordPress and modify the software significantly to sell a service — but hold back changes because it's not technically "distributing" or "propagating" the software. The AGPL goes a bit further and says that if the program is "intended to interact with users through a computer network" and if the version that you received gives users "the opportunity to request transmission to that user of the Program's complete source code," you have to maintain that functionality and distribute the modified version. [1] https://www.networkworld.com/article/2229265/is-the-affero-gpl-unfriendly-to-hobbyists-.html https://www.networkworld.com/article/2229265/is-the-affero-g...
drdaeman 5y ago
Cannot be helped - that's just fear of the unknown. If legal is familiar with AGPL, like they are with GPL, BSD or Apache, they should see no issue. This change does not really affect anyone except for the very small number of people/companies that make their own changes to software and make this software available online to others. If you aren't such a company and legal would still say you guys can't use e.g. Grafana anymore... the truth will be that it's some incompetent (or severely underhanded, where they can't do any research and err on the side of caution) legal department, failing at their jobs.
- gen220 5y ago
  Many devs at Google routinely use GPLv3 code, in GNU Emacs, to make an example. Unless you’re repackaging Grafana into an app bundle for customers to use, there’s no violation occurring here, right?
  - kevincox 5y ago
    GPL and AGPL are very different here. If a developer uses GPL Emacs to write a server that uses GPL libraries and Google runs that sever in their datacenter it is very clear that Google doesn't have to release any source code. However Google's argument is that if they make a web application that uses AGPL MongoDB as a backend it is unclear if 1. The user is interacting with MongoDB over a network and 2. do they need to release the code of their server. It appears that the answers are 1. Yes and 2. No but apparently Google isn't confident to use that in court. (Or at least they don't see enough benefits for that risk)
jchw 5y ago
While many are dismissing your concerns, I do think this is a valid point, at least to some degree. For example, Google institutes a blanket ban on all AGPL code: https://opensource.google/docs/using/agpl-policy/ https://opensource.google/docs/using/agpl-policy/ Now, one can read into why exactly this may be, though I have a strong feeling it is simply due to the fact that enforcing correct use of the license is harder than usual. Even if you use it alongside only compatible licenses, like GPLv3, it presumably would make the entire distribution subject to AGPLv3 restrictions. GPLv3 virility is a little easier to deal with, and of interesting note the Bazel build system contains some awareness of licenses. https://docs.bazel.build/versions/0.24.0/be/functions.html#licenses https://docs.bazel.build/versions/0.24.0/be/functions.html#l... On the other hand, one might view this as a benefit. So, I guess it depends on who you ask, really. It's not clear that big corporations would necessarily have an easier time with SSPL or TSL either. Note: IANAL, please do not take my understanding of how these software licenses work as fact :)
- raegis 5y ago
  I suspect this is not a popular opinion, but Google's AGPL policy reads like FUD to me. From the first paragraph: "...extremely difficult for Google to comply with..." and "...presents a huge risk to Google..." and later in the document is the best part: "This viral effect requires that the complete corresponding source code...". All from a company which built itself on GPL software. This reminds me of Steve Ballmer ranting about Linux being a virus 20 years ago. More: "Do not install AGPL-licensed programs on your workstation, Google-issued laptop, or Google-issued phone without explicit authorization from the Open Source Programs Office." Assuming Google follows its own policy, this just creates a hassle for its employees. Worse, Google making this public sends a strong anti-AGPL message to other companies. I'd bet $10 RStudio server (AGPL) is installed somewhere at Google (perhaps the commercial version). But other organizations with less sophisticated legal departments might just ban RStudio completely following Google's lead. I would not call Google irresponsible here, but I think it could act more responsibly.
  - gpanders 5y ago
    It is absolutely FUD. https://drewdevault.com/2020/07/27/Anti-AGPL-propaganda.html https://drewdevault.com/2020/07/27/Anti-AGPL-propaganda.html

by jabiko 5y ago

globular-toast 5y ago

There should be no problem with it even if you use it externally. It's about time companies stopped seeing open source as freely exploitable. Every company that uses open source software should be obliged to contribute, or pay for proprietary software.

bboreham 5y ago

Would you consider paying for a licence to use it?

jabiko 5y ago
Honestly, I have no idea. I think if there would be a possibility to pay money to have what we are doing reviewed by Grafana and be "certified" to be withing what they consider acceptable under the AGPL that might actually be a good option
- bboreham 5y ago
  What about just paying for a commercial licence to use it to meet your needs?
  - jabiko 5y ago
    I have no Idea. Realistically its probably not the license cost but the one time and the perpetual operational overhead associated with the license that's going to be the problem.
    - peterbonney 5y ago
      That makes zero business sense. Your first post is about the one time and perpetual operational overhead associated with operating under the prior FOSS license (yes, you’re saying it’s the new license that’s a problem, but since the situation arose while operating under the prior conditions then implicitly those conditions carried this very overhead). Operating under any license carried an overhead, unless you simply choose to not read (or to read and ignore) the fine print.
      - jabiko 5y ago
        > Your first post is about the one time and perpetual operational overhead associated with operating under the prior FOSS license My first post is about the fact that even though the planned use case would be 100% compliant to the AGPLv3 license the fear that is associated with that license could prevent such use. > That makes zero business sense Purchasing a license in that case while not strictly necessary might be seen as an insurance. So that makes business sense. In the end though I highly doubt that's whats going to happen. The most likely outcome is that we just get told to get rid of Grafana and use something else.
        peterbonney 5y ago
        > In the end though I highly doubt that's whats going to happen. The most likely outcome is that we just get told to get rid of Grafana and use something else. Whatever you replace it with will have the same licensing overhead. Again, this makes no sense. If you said we can’t afford to pay for it, fine. But you explicitly said you don’t think cost is an issue. Maybe I’m making the wrong inference, but it sounds like you’re afraid your higher ups just don’t want to have any restrictions placed on whatever business need it is that Grafana is filling for you. If I haven’t misunderstood that fear, then I regret to say that any software product other than one you build and maintain yourselves will come with some restrictions or the possibility of future restrictions. When I say this makes no business sense, that’s what I’m trying to get at: other than (potentially) licensing cost, any Grafana substitute will come with the same issues, plus switching costs. So unless there is a FOSS product that provides a better solution to your problem, by definition switching will be more costly than maintaining status quo. Or am I missing the point?
t-writescode 5y ago
If I was in charge of the money, assuming it’s a reasonable price for on-prem Grafana, I would pay for a license to Grafana, just to not have the licensing stress.

dvfjsdhgfv 5y ago

In a large number of cases, this is not an issue at all. Just like we all use GPL-ed kernel and a ton of other stuff. There is also no problem with making AGPL-based services available to customers. The caveat is that when you modify AGPL-based code, you need to make the source of these modifications available, too. For some reason, this scares Amazon a lot. Developers know that and use AGPL when they don't want to be screwed by AWS.

jsdwarf 5y ago
I don't get why Amazon should be scared by AGPL. I mean all of their services run on GPLed Linux, why should they be scared by a GPLed Grafana?Even if they had to open-source their Grafana contributions, they could do this in a way that they are worthless for potential competitors (e.g. if the contribution depends on a proprietary Amazon system)
- yorwba 5y ago
  > they could do this in a way that they are worthless for potential competitors (e.g. if the contribution depends on a proprietary Amazon system) That is not allowed. """The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.""" (Emphasis on that last part mine.) """Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software.""" If Amazon modifies Grafana so it depends on a proprietary Amazon system, the source code for that system is included in the Corresponding Source, and if they allow users to interact with that modified version, they need to provide them with access to the proprietary system's source code.

188201 5y ago

I think that's misunderstanding of AGPL. For internal use, AGPL does not require to share the proprietary part. If a company develop an proprietary UI and use Loki as backend, this is not serving Loki directly to customer, so that does not require company to release their code. It is similar to GPL. Dynamic linking to a GPL software does not require the developer releasing their code. Only provider serving Loki instance directly to customer required to share the code. Only Amazon is upset that they cannot just host a popular open source project directly on their cloud. Maybe they could pay a license fee for dual licensing arrangement, which is a better way to support open source startup.

klintcho 5y ago
This might be the case. However there is an additional risk and process component: - you might not want to risk because you don't have lawyers etc in your company. - even if you have lawyers etc in your company, if there are 2 alternatives one which is just an MIT license, you'll probably go for that one because you don't want to have a 1.5 month review of the use of this AGPL licensed alternative. In general things like this https://github.com/xdspacelab/openvslam/wiki/Termination-of-the-release https://github.com/xdspacelab/openvslam/wiki/Termination-of-... (repo with 3k stars), an effort terminated because of some traces of GPL code MIGHT be somewhere in there comes to light. Even though Grafana etc are mostly tools, for my startup I would probably not risk any of this (for my own sake and also for any kind of due diligence in case it ever gets acquired)
- aulin 5y ago
  did not follow the events of openvslam, wouldn't they be required to still release the source code of the previously public version as GPL? also once the doubt is there, why not rerelease as GPL?
tamalsaha001 5y ago
That does not seem to be the case. From [1] The difference between the AGPL and traditional GPL is simple: The AGPL seeks to close a "loophole" that allows a company or organization to modify GPL'ed software and use it to provide a service — but without actually distributing changes. So a company can take a package like, say, WordPress and modify the software significantly to sell a service — but hold back changes because it's not technically "distributing" or "propagating" the software. The AGPL goes a bit further and says that if the program is "intended to interact with users through a computer network" and if the version that you received gives users "the opportunity to request transmission to that user of the Program's complete source code," you have to maintain that functionality and distribute the modified version. [1] https://www.networkworld.com/article/2229265/is-the-affero-gpl-unfriendly-to-hobbyists-.html https://www.networkworld.com/article/2229265/is-the-affero-g...

drdaeman 5y ago

Cannot be helped - that's just fear of the unknown. If legal is familiar with AGPL, like they are with GPL, BSD or Apache, they should see no issue. This change does not really affect anyone except for the very small number of people/companies that make their own changes to software and make this software available online to others. If you aren't such a company and legal would still say you guys can't use e.g. Grafana anymore... the truth will be that it's some incompetent (or severely underhanded, where they can't do any research and err on the side of caution) legal department, failing at their jobs.

gen220 5y ago
Many devs at Google routinely use GPLv3 code, in GNU Emacs, to make an example. Unless you’re repackaging Grafana into an app bundle for customers to use, there’s no violation occurring here, right?
- kevincox 5y ago
  GPL and AGPL are very different here. If a developer uses GPL Emacs to write a server that uses GPL libraries and Google runs that sever in their datacenter it is very clear that Google doesn't have to release any source code. However Google's argument is that if they make a web application that uses AGPL MongoDB as a backend it is unclear if 1. The user is interacting with MongoDB over a network and 2. do they need to release the code of their server. It appears that the answers are 1. Yes and 2. No but apparently Google isn't confident to use that in court. (Or at least they don't see enough benefits for that risk)

jchw 5y ago

While many are dismissing your concerns, I do think this is a valid point, at least to some degree. For example, Google institutes a blanket ban on all AGPL code: https://opensource.google/docs/using/agpl-policy/ https://opensource.google/docs/using/agpl-policy/ Now, one can read into why exactly this may be, though I have a strong feeling it is simply due to the fact that enforcing correct use of the license is harder than usual. Even if you use it alongside only compatible licenses, like GPLv3, it presumably would make the entire distribution subject to AGPLv3 restrictions. GPLv3 virility is a little easier to deal with, and of interesting note the Bazel build system contains some awareness of licenses. https://docs.bazel.build/versions/0.24.0/be/functions.html#licenses https://docs.bazel.build/versions/0.24.0/be/functions.html#l... On the other hand, one might view this as a benefit. So, I guess it depends on who you ask, really. It's not clear that big corporations would necessarily have an easier time with SSPL or TSL either. Note: IANAL, please do not take my understanding of how these software licenses work as fact :)

raegis 5y ago
I suspect this is not a popular opinion, but Google's AGPL policy reads like FUD to me. From the first paragraph: "...extremely difficult for Google to comply with..." and "...presents a huge risk to Google..." and later in the document is the best part: "This viral effect requires that the complete corresponding source code...". All from a company which built itself on GPL software. This reminds me of Steve Ballmer ranting about Linux being a virus 20 years ago. More: "Do not install AGPL-licensed programs on your workstation, Google-issued laptop, or Google-issued phone without explicit authorization from the Open Source Programs Office." Assuming Google follows its own policy, this just creates a hassle for its employees. Worse, Google making this public sends a strong anti-AGPL message to other companies. I'd bet $10 RStudio server (AGPL) is installed somewhere at Google (perhaps the commercial version). But other organizations with less sophisticated legal departments might just ban RStudio completely following Google's lead. I would not call Google irresponsible here, but I think it could act more responsibly.
- gpanders 5y ago
  It is absolutely FUD. https://drewdevault.com/2020/07/27/Anti-AGPL-propaganda.html https://drewdevault.com/2020/07/27/Anti-AGPL-propaganda.html