4 ms·

> Cloud providers must share contributions To be really strict: AGPL only mandates that contributions be shared with the user. The freedom of users is more imp

by rakoo 6y ago

> Cloud providers must share contributions To be really strict: AGPL only mandates that contributions be shared with the user. The freedom of users is more important than the freedom of developers. Of course an upstream maintainer can be a user and get the contributions.

kevincox 6y ago
They have to be shared to the user under the same license. So any user could publish the changes publicly.
- LukeShu 6y ago
  Sure, but there might be out-of-band reasons for users to not do that. For instance, grsecurity will sell you a security-hardening-patched Linux kernel. You, as the user/customer, have the right to take those GPL patches, and share them publicly. But if you do so, grsecurity will blacklist you as a customer, and you won't be able to get any more patches from them.
  - m4rtink 6y ago
    Didn't that preaty much out grsecurity into (an even bigger) obscurity as no one sane will touch a logic bomb like this, not to mention build their business on it ?
  - josephcsible 6y ago
    There's a strong case to be made that grsecurity is violating the GPL by doing that: https://perens.com/2017/06/28/warning-grsecurity-potential-contributory-infringement-risk-for-customers/ https://perens.com/2017/06/28/warning-grsecurity-potential-c...
  - pabs3 6y ago
    IIRC one of grsec's customers did already leak their patches, I can't find the Twitter thread or other discussions about it any more though.
  - p1necone 6y ago
    This just seems like a blatant violation of the license on grsecuritys part. The license requires them to allow people to share the code. "Technically you could share the code, and then we'll blacklist you" isn't letting people share the code, "technically" their customers can do anything. This sounds like the reasoning of a petulant elementary school kid, not a professional security company.
    - plorntus 6y ago
      It sounds pretty reasonable to be honest, youre allowed to share the code and theres no legal reprocussions for doing so but the company should be able to just stop sending you stuff if you do?
      - tremon 6y ago
        The GPL states that the company isn't allowed to distribute their modifications with those legal repercussions in the first place: You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice [..] and give any other recipients of the Program a copy of this License along with the Program. This is section 1 of the GPLv2 [1]. This plainly states that if The Company is distributing their code under GPLv2, their customers are plainly permitted to "copy and distribute verbatim copies of the Program's source code". Their whole business model is based on a tortuous reading of this part of section 2: If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Their claim is that they are shipping their patch set as a separate work from the Linux kernel, so that they're not bound by the requirement that "the distribution of the whole must be on the terms of this License", and they're free to choose whatever license they want for their patch set. However, since their patch set is in no way a separate work on its own, only a lawyer could make that case without blinking. [1] https://www.gnu.org/licenses/old-licenses/gpl-2.0.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.html
open0 6y ago
The line between user and developer is blurry, especially in the context of software that exposes its configuration entirely as some part of its core function. > The freedom of users is more important than the freedom of developers. What exactly is this "freedom" that users are benefiting from? Is this the part where we invoke some negative right? That's called "control".
- josephcsible 6y ago
  You have it backwards. The "control" you're speaking of is actually the thing that the AGPL withholds, so if you care about users having freedom but not control, then it's exactly what you want.
ex_amazon_sde 6y ago
> The freedom of users is more important than the freedom of developers. This is misleading. All developers are users as well. Having to use closed source services and tools impacts us a lot.
- rakoo 6y ago
  No, developers are not always users. I might be working on an accounting software for a big company and never use it. In that case the (A)GPL guarantees that the company is in control of their data and processes.
  - ex_amazon_sde 6y ago
    > I might be working on an accounting software for a big company and never use it. Obviously. But you are using other FOSS directly or indirectly.

by rakoo 6y ago

kevincox 6y ago

They have to be shared to the user under the same license. So any user could publish the changes publicly.

LukeShu 6y ago
Sure, but there might be out-of-band reasons for users to not do that. For instance, grsecurity will sell you a security-hardening-patched Linux kernel. You, as the user/customer, have the right to take those GPL patches, and share them publicly. But if you do so, grsecurity will blacklist you as a customer, and you won't be able to get any more patches from them.
- m4rtink 6y ago
  Didn't that preaty much out grsecurity into (an even bigger) obscurity as no one sane will touch a logic bomb like this, not to mention build their business on it ?
- josephcsible 6y ago
  There's a strong case to be made that grsecurity is violating the GPL by doing that: https://perens.com/2017/06/28/warning-grsecurity-potential-contributory-infringement-risk-for-customers/ https://perens.com/2017/06/28/warning-grsecurity-potential-c...
- pabs3 6y ago
  IIRC one of grsec's customers did already leak their patches, I can't find the Twitter thread or other discussions about it any more though.
- p1necone 6y ago
  This just seems like a blatant violation of the license on grsecuritys part. The license requires them to allow people to share the code. "Technically you could share the code, and then we'll blacklist you" isn't letting people share the code, "technically" their customers can do anything. This sounds like the reasoning of a petulant elementary school kid, not a professional security company.
  - plorntus 6y ago
    It sounds pretty reasonable to be honest, youre allowed to share the code and theres no legal reprocussions for doing so but the company should be able to just stop sending you stuff if you do?
    - tremon 6y ago
      The GPL states that the company isn't allowed to distribute their modifications with those legal repercussions in the first place: You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice [..] and give any other recipients of the Program a copy of this License along with the Program. This is section 1 of the GPLv2 [1]. This plainly states that if The Company is distributing their code under GPLv2, their customers are plainly permitted to "copy and distribute verbatim copies of the Program's source code". Their whole business model is based on a tortuous reading of this part of section 2: If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Their claim is that they are shipping their patch set as a separate work from the Linux kernel, so that they're not bound by the requirement that "the distribution of the whole must be on the terms of this License", and they're free to choose whatever license they want for their patch set. However, since their patch set is in no way a separate work on its own, only a lawyer could make that case without blinking. [1] https://www.gnu.org/licenses/old-licenses/gpl-2.0.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.html

open0 6y ago

The line between user and developer is blurry, especially in the context of software that exposes its configuration entirely as some part of its core function. > The freedom of users is more important than the freedom of developers. What exactly is this "freedom" that users are benefiting from? Is this the part where we invoke some negative right? That's called "control".

josephcsible 6y ago
You have it backwards. The "control" you're speaking of is actually the thing that the AGPL withholds, so if you care about users having freedom but not control, then it's exactly what you want.

ex_amazon_sde 6y ago

> The freedom of users is more important than the freedom of developers. This is misleading. All developers are users as well. Having to use closed source services and tools impacts us a lot.

rakoo 6y ago
No, developers are not always users. I might be working on an accounting software for a big company and never use it. In that case the (A)GPL guarantees that the company is in control of their data and processes.
- ex_amazon_sde 6y ago
  > I might be working on an accounting software for a big company and never use it. Obviously. But you are using other FOSS directly or indirectly.