13 ms·

I applaud this decision. I would like to see all major SaaSS projects be AGPLv3. End users still have freedom to user, modify, and distribute the software. Clo

I applaud this decision. I would like to see all major SaaSS projects be AGPLv3. End users still have freedom to user, modify, and distribute the software. Cloud providers must share contributions. This is how I like it.

rakoo 6y ago
> Cloud providers must share contributions To be really strict: AGPL only mandates that contributions be shared with the user. The freedom of users is more important than the freedom of developers. Of course an upstream maintainer can be a user and get the contributions.
- kevincox 6y ago
  They have to be shared to the user under the same license. So any user could publish the changes publicly.
  - LukeShu 6y ago
    Sure, but there might be out-of-band reasons for users to not do that. For instance, grsecurity will sell you a security-hardening-patched Linux kernel. You, as the user/customer, have the right to take those GPL patches, and share them publicly. But if you do so, grsecurity will blacklist you as a customer, and you won't be able to get any more patches from them.
    - m4rtink 6y ago
      Didn't that preaty much out grsecurity into (an even bigger) obscurity as no one sane will touch a logic bomb like this, not to mention build their business on it ?
    - josephcsible 6y ago
      There's a strong case to be made that grsecurity is violating the GPL by doing that: https://perens.com/2017/06/28/warning-grsecurity-potential-contributory-infringement-risk-for-customers/ https://perens.com/2017/06/28/warning-grsecurity-potential-c...
    - pabs3 6y ago
      IIRC one of grsec's customers did already leak their patches, I can't find the Twitter thread or other discussions about it any more though.
    - p1necone 6y ago
      This just seems like a blatant violation of the license on grsecuritys part. The license requires them to allow people to share the code. "Technically you could share the code, and then we'll blacklist you" isn't letting people share the code, "technically" their customers can do anything. This sounds like the reasoning of a petulant elementary school kid, not a professional security company.
      - plorntus 6y ago
        It sounds pretty reasonable to be honest, youre allowed to share the code and theres no legal reprocussions for doing so but the company should be able to just stop sending you stuff if you do?
        tremon 6y ago
        The GPL states that the company isn't allowed to distribute their modifications with those legal repercussions in the first place: You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice [..] and give any other recipients of the Program a copy of this License along with the Program. This is section 1 of the GPLv2 [1]. This plainly states that if The Company is distributing their code under GPLv2, their customers are plainly permitted to "copy and distribute verbatim copies of the Program's source code". Their whole business model is based on a tortuous reading of this part of section 2: If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Their claim is that they are shipping their patch set as a separate work from the Linux kernel, so that they're not bound by the requirement that "the distribution of the whole must be on the terms of this License", and they're free to choose whatever license they want for their patch set. However, since their patch set is in no way a separate work on its own, only a lawyer could make that case without blinking. [1] https://www.gnu.org/licenses/old-licenses/gpl-2.0.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.html
- open0 6y ago
  The line between user and developer is blurry, especially in the context of software that exposes its configuration entirely as some part of its core function. > The freedom of users is more important than the freedom of developers. What exactly is this "freedom" that users are benefiting from? Is this the part where we invoke some negative right? That's called "control".
  - josephcsible 6y ago
    You have it backwards. The "control" you're speaking of is actually the thing that the AGPL withholds, so if you care about users having freedom but not control, then it's exactly what you want.
- ex_amazon_sde 6y ago
  > The freedom of users is more important than the freedom of developers. This is misleading. All developers are users as well. Having to use closed source services and tools impacts us a lot.
  - rakoo 6y ago
    No, developers are not always users. I might be working on an accounting software for a big company and never use it. In that case the (A)GPL guarantees that the company is in control of their data and processes.
    - ex_amazon_sde 6y ago
      > I might be working on an accounting software for a big company and never use it. Obviously. But you are using other FOSS directly or indirectly.
watermelon0 6y ago
I have a question regarding AGPL, that I couldn't answer by Googling or reading the license. Let's say that Postgres server is licensed under AGPL, and I modify it to my needs. I have a closed source web application, that is publicly accessible, and uses Postgres for storing data. a) Do I need to publish source code of my version of Postgres? b) Does my application (which relies on Postgres, and my patches) need to also be under AGPL, and be available in source code form to all my users/visitors?
- eitland 6y ago
  I've tried really hard to understand this a few times and yesterday or early today or something I found an interesting thread here: https://news.ycombinator.com/item?id=11354475 https://news.ycombinator.com/item?id=11354475 reitanqild seems to misunderstand and the other posters fill in with more information. If the information in that thread is correct and I read it correctly it is totally fine to use an AGPL server that touches connects to a lot of stuff, it won't affect any of that. Only if you somehow touches the codebase of the AGPL licensed code by modifying it or creating a combined work then the AGPL will take effect in the same way as today - except that allowing access to a running instance over a network will trigger it too, not only distribution of the binaries or the code.
  - Jarwain 6y ago
    Would an extension like citus or timescaledb or opengis be considered a combined work for AGPL purposes?
- SSLy 6y ago
  1) Yes 2) Nope
- w4rh4wk5 6y ago
  Assuming a client has no direct access to the Postgres server, I'd say you neither need to publish your changes to Postgres, nor put the web application under AGPL. Just because your web application uses Postgres as a storage for data, in a way it could also just use SQLite or MariaDB instead, does not make it a "derivative work". #notalawyer
jrv 6y ago
That sounds nice in theory, but the reality is also that a lot of more permissively licensed (BSD / Apache) projects now cannot use (most) parts of Grafana / Loki / Tempo anymore, since realistically they won't be able to or want to switch to the AGPL as well (because of all the pain that would incur on others, in turn). That means that basically the whole free code sharing idea goes out of the window, at least in one direction – Grafana can of course still integrate code from more permissively licensed projects into their codebase.
- Seirdy 6y ago
  That's kind of the point. The purpose of MIT/BSD is to enable nonfree derivative works; the purpose of the AGPL is to only allow free derivatives. AGPL maximizes freedom by prohibiting further restriction of it; it's a local maxima of "user freedom" as a function of "developer freedom". If you want to use AGPL software in your project, you're free to relicense under AGPL.
  - josephcsible 6y ago
    I agree with the substance of what you said, but I'm going to nitpick a bit of wording: what you call "developer freedom" isn't freedom at all, and is more rightly called power. http://www.gnu.org/philosophy/freedom-or-power.en.html http://www.gnu.org/philosophy/freedom-or-power.en.html
    - spoonjim 6y ago
      Arguing over which one is “freedom” is a petty exercise in trying to claim the moral high ground. Instead, it’s more objective and accurate to say that GPL and BSD represent two different ideologies, and that the AGPL is definitely designed to promulgate the “GPL” ideology, so that it’s inability to be incorporated into BSD-licensed software is a feature and not a bug from the perspective of the people who choose to license their code as AGPL.
      - quadrangle 6y ago
pvorb 6y ago
But if my proprietary SaaS only uses Grafana for monitoring but its key purpose is doing something else entirely, I can no longer use Grafana unless I also publish my SaaS under AGPLv3, right? What if I release my own SaaS as AGPLv3? Do others, who rely on it, also have to license their software under AGPLv3? I think this kills many business cases. Am I missing some key point?
- HideousKojima 6y ago
  >I can no longer use Grafana unless I also publish my SaaS under AGPLv3, right? If you link to it directly from your code then yes, unless you're willing to pay Grafana for a commercial license (assuming they offer one or you can negotiate one with them). If you have Grafana running on your servers but you aren't using the code in your own applications then you're generally fine (the GPL is generally recognized as ending where a process ends). And that's the point of the GPL/AGPL, you get the code for free, with the only expectation being that you pass it on if you make any changes.
  - pvorb 6y ago
    That was also my understanding of the GPL, but the AGPL is for me to understand.
    - pmontra 6y ago
      If your server runs Linux you don't have to distribute the source code of Linux to the users of the services running on it. If Linux was AGPL you would have to. And yet, you would not have to distribute the source of your closed source software running on the server.
      - tremon 6y ago
        If Linux was AGPL you would have to You wouldn't, as system interfaces are specifically excluded as an AGPL enforcement domain. But if the Linux kernel was AGPL, you would have to supply the source code to your NFS clients, since those clients would be served directly by the kernel.
sneak 6y ago
I view the AGPL as a nonfree license; I think more permissive licenses are better, because I believe in software freedom. Companies are right to avoid the AGPL.
- LambdaComplex 6y ago
  You believe in freedom for who, exactly? Freedom for the users of software? Or freedom for corporations who benefit from denying access to the source code of that software? The Free Software Foundation exists to protect the former at the expense of the latter.
  - sneak 6y ago
    You are dragging anti-corporate ideology into a very simple matter. Corporations are sometimes users, and individual people often benefit from denying access to the source code of software that is used to provide a service. Providing a service is fundamentally different from providing software.
    - LambdaComplex 6y ago
      > individual people often benefit from denying access to the source code of software that is used to provide a service To the detriment of the users of that service--which are the people that the FSF aims to protect.
      - sneak 6y ago
        That's a very simplistic and, I think inaccurate view of the matter. My customers, for example, to whom I provide service, are not infringed upon in any way because I use private forks of GPL software in the provision of my services.
        LambdaComplex 6y ago
        > My customers, for example, to whom I provide service, are not infringed upon in any way The issue is that I—and, more importantly, your customers—must simply take your word for it, since we're unable to confirm or deny it for ourselves if you don't make the source available. When dealing with large corporations, taking such statements at face value is pretty foolish.
yarg 6y ago
Certainly they should share - but must stretches things a little far. Much in the same way as Amazon should provide their low-tech workers with livable conditions - but unless the law and applicable contracts specify otherwise, there's no must about it. Cloud providers are doing an end run around the intention of the GPL - but not around its legal constraints. (And before we consider possibilities otherwise, it might be more pertinent to at least attempt to punish companies in blatant violation - like the multitude of router manufactures routinely shipping GPL derived software without reasonable access to source.)

rakoo 6y ago

> Cloud providers must share contributions To be really strict: AGPL only mandates that contributions be shared with the user. The freedom of users is more important than the freedom of developers. Of course an upstream maintainer can be a user and get the contributions.

kevincox 6y ago
They have to be shared to the user under the same license. So any user could publish the changes publicly.
- LukeShu 6y ago
  Sure, but there might be out-of-band reasons for users to not do that. For instance, grsecurity will sell you a security-hardening-patched Linux kernel. You, as the user/customer, have the right to take those GPL patches, and share them publicly. But if you do so, grsecurity will blacklist you as a customer, and you won't be able to get any more patches from them.
  - m4rtink 6y ago
    Didn't that preaty much out grsecurity into (an even bigger) obscurity as no one sane will touch a logic bomb like this, not to mention build their business on it ?
  - josephcsible 6y ago
    There's a strong case to be made that grsecurity is violating the GPL by doing that: https://perens.com/2017/06/28/warning-grsecurity-potential-contributory-infringement-risk-for-customers/ https://perens.com/2017/06/28/warning-grsecurity-potential-c...
  - pabs3 6y ago
    IIRC one of grsec's customers did already leak their patches, I can't find the Twitter thread or other discussions about it any more though.
  - p1necone 6y ago
    This just seems like a blatant violation of the license on grsecuritys part. The license requires them to allow people to share the code. "Technically you could share the code, and then we'll blacklist you" isn't letting people share the code, "technically" their customers can do anything. This sounds like the reasoning of a petulant elementary school kid, not a professional security company.
    - plorntus 6y ago
      It sounds pretty reasonable to be honest, youre allowed to share the code and theres no legal reprocussions for doing so but the company should be able to just stop sending you stuff if you do?
      - tremon 6y ago
        The GPL states that the company isn't allowed to distribute their modifications with those legal repercussions in the first place: You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice [..] and give any other recipients of the Program a copy of this License along with the Program. This is section 1 of the GPLv2 [1]. This plainly states that if The Company is distributing their code under GPLv2, their customers are plainly permitted to "copy and distribute verbatim copies of the Program's source code". Their whole business model is based on a tortuous reading of this part of section 2: If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Their claim is that they are shipping their patch set as a separate work from the Linux kernel, so that they're not bound by the requirement that "the distribution of the whole must be on the terms of this License", and they're free to choose whatever license they want for their patch set. However, since their patch set is in no way a separate work on its own, only a lawyer could make that case without blinking. [1] https://www.gnu.org/licenses/old-licenses/gpl-2.0.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.html
open0 6y ago
The line between user and developer is blurry, especially in the context of software that exposes its configuration entirely as some part of its core function. > The freedom of users is more important than the freedom of developers. What exactly is this "freedom" that users are benefiting from? Is this the part where we invoke some negative right? That's called "control".
- josephcsible 6y ago
  You have it backwards. The "control" you're speaking of is actually the thing that the AGPL withholds, so if you care about users having freedom but not control, then it's exactly what you want.
ex_amazon_sde 6y ago
> The freedom of users is more important than the freedom of developers. This is misleading. All developers are users as well. Having to use closed source services and tools impacts us a lot.
- rakoo 6y ago
  No, developers are not always users. I might be working on an accounting software for a big company and never use it. In that case the (A)GPL guarantees that the company is in control of their data and processes.
  - ex_amazon_sde 6y ago
    > I might be working on an accounting software for a big company and never use it. Obviously. But you are using other FOSS directly or indirectly.

watermelon0 6y ago

I have a question regarding AGPL, that I couldn't answer by Googling or reading the license. Let's say that Postgres server is licensed under AGPL, and I modify it to my needs. I have a closed source web application, that is publicly accessible, and uses Postgres for storing data. a) Do I need to publish source code of my version of Postgres? b) Does my application (which relies on Postgres, and my patches) need to also be under AGPL, and be available in source code form to all my users/visitors?

eitland 6y ago
I've tried really hard to understand this a few times and yesterday or early today or something I found an interesting thread here: https://news.ycombinator.com/item?id=11354475 https://news.ycombinator.com/item?id=11354475 reitanqild seems to misunderstand and the other posters fill in with more information. If the information in that thread is correct and I read it correctly it is totally fine to use an AGPL server that touches connects to a lot of stuff, it won't affect any of that. Only if you somehow touches the codebase of the AGPL licensed code by modifying it or creating a combined work then the AGPL will take effect in the same way as today - except that allowing access to a running instance over a network will trigger it too, not only distribution of the binaries or the code.
- Jarwain 6y ago
  Would an extension like citus or timescaledb or opengis be considered a combined work for AGPL purposes?
SSLy 6y ago
1) Yes 2) Nope
w4rh4wk5 6y ago
Assuming a client has no direct access to the Postgres server, I'd say you neither need to publish your changes to Postgres, nor put the web application under AGPL. Just because your web application uses Postgres as a storage for data, in a way it could also just use SQLite or MariaDB instead, does not make it a "derivative work". #notalawyer

jrv 6y ago

That sounds nice in theory, but the reality is also that a lot of more permissively licensed (BSD / Apache) projects now cannot use (most) parts of Grafana / Loki / Tempo anymore, since realistically they won't be able to or want to switch to the AGPL as well (because of all the pain that would incur on others, in turn). That means that basically the whole free code sharing idea goes out of the window, at least in one direction – Grafana can of course still integrate code from more permissively licensed projects into their codebase.

Seirdy 6y ago
That's kind of the point. The purpose of MIT/BSD is to enable nonfree derivative works; the purpose of the AGPL is to only allow free derivatives. AGPL maximizes freedom by prohibiting further restriction of it; it's a local maxima of "user freedom" as a function of "developer freedom". If you want to use AGPL software in your project, you're free to relicense under AGPL.
- josephcsible 6y ago
  I agree with the substance of what you said, but I'm going to nitpick a bit of wording: what you call "developer freedom" isn't freedom at all, and is more rightly called power. http://www.gnu.org/philosophy/freedom-or-power.en.html http://www.gnu.org/philosophy/freedom-or-power.en.html
  - spoonjim 6y ago
    Arguing over which one is “freedom” is a petty exercise in trying to claim the moral high ground. Instead, it’s more objective and accurate to say that GPL and BSD represent two different ideologies, and that the AGPL is definitely designed to promulgate the “GPL” ideology, so that it’s inability to be incorporated into BSD-licensed software is a feature and not a bug from the perspective of the people who choose to license their code as AGPL.
    - quadrangle 6y ago

pvorb 6y ago

But if my proprietary SaaS only uses Grafana for monitoring but its key purpose is doing something else entirely, I can no longer use Grafana unless I also publish my SaaS under AGPLv3, right? What if I release my own SaaS as AGPLv3? Do others, who rely on it, also have to license their software under AGPLv3? I think this kills many business cases. Am I missing some key point?

HideousKojima 6y ago
>I can no longer use Grafana unless I also publish my SaaS under AGPLv3, right? If you link to it directly from your code then yes, unless you're willing to pay Grafana for a commercial license (assuming they offer one or you can negotiate one with them). If you have Grafana running on your servers but you aren't using the code in your own applications then you're generally fine (the GPL is generally recognized as ending where a process ends). And that's the point of the GPL/AGPL, you get the code for free, with the only expectation being that you pass it on if you make any changes.
- pvorb 6y ago
  That was also my understanding of the GPL, but the AGPL is for me to understand.
  - pmontra 6y ago
    If your server runs Linux you don't have to distribute the source code of Linux to the users of the services running on it. If Linux was AGPL you would have to. And yet, you would not have to distribute the source of your closed source software running on the server.
    - tremon 6y ago
      If Linux was AGPL you would have to You wouldn't, as system interfaces are specifically excluded as an AGPL enforcement domain. But if the Linux kernel was AGPL, you would have to supply the source code to your NFS clients, since those clients would be served directly by the kernel.

sneak 6y ago

I view the AGPL as a nonfree license; I think more permissive licenses are better, because I believe in software freedom. Companies are right to avoid the AGPL.

LambdaComplex 6y ago
You believe in freedom for who, exactly? Freedom for the users of software? Or freedom for corporations who benefit from denying access to the source code of that software? The Free Software Foundation exists to protect the former at the expense of the latter.
- sneak 6y ago
  You are dragging anti-corporate ideology into a very simple matter. Corporations are sometimes users, and individual people often benefit from denying access to the source code of software that is used to provide a service. Providing a service is fundamentally different from providing software.
  - LambdaComplex 6y ago
    > individual people often benefit from denying access to the source code of software that is used to provide a service To the detriment of the users of that service--which are the people that the FSF aims to protect.
    - sneak 6y ago
      That's a very simplistic and, I think inaccurate view of the matter. My customers, for example, to whom I provide service, are not infringed upon in any way because I use private forks of GPL software in the provision of my services.
      - LambdaComplex 6y ago
        > My customers, for example, to whom I provide service, are not infringed upon in any way The issue is that I—and, more importantly, your customers—must simply take your word for it, since we're unable to confirm or deny it for ourselves if you don't make the source available. When dealing with large corporations, taking such statements at face value is pretty foolish.

yarg 6y ago

Certainly they should share - but must stretches things a little far. Much in the same way as Amazon should provide their low-tech workers with livable conditions - but unless the law and applicable contracts specify otherwise, there's no must about it. Cloud providers are doing an end run around the intention of the GPL - but not around its legal constraints. (And before we consider possibilities otherwise, it might be more pertinent to at least attempt to punish companies in blatant violation - like the multitude of router manufactures routinely shipping GPL derived software without reasonable access to source.)