10 ms·

Let's say I use Minio in a SaaS app and allow my end users to upload directly to it. With this AGPL license change, is this now considered to be a form of distr

by jabo 5y ago

Let's say I use Minio in a SaaS app and allow my end users to upload directly to it. With this AGPL license change, is this now considered to be a form of distribution, that would then require me to open source the rest of my SaaS app?

throwaway888abc 5y ago
Same question for same situation
rad_gruchalski 5y ago
You only have a problem if you modify anything in the source code of minio that you host.
- enriquto 5y ago
  > You only have a problem if you modify anything in the source code of minio that you host. And even in that case, you only need to share your modifications of minio, not anything about the rest of your system. Doesn't seem too much of a problem, to begin with.
  - rad_gruchalski 5y ago
    That’s right.
  - jnwatson 5y ago
    Or put a proxy in front of it.
    - rad_gruchalski 5y ago
      Indeed. I predict that year 2022 will be the year of a sidecar protocol proxy service.
  - eloff 5y ago
    A lot of companies I've worked for had a blanket ban on AGPL. This is not a problem with the license, it's a problem with those companies. But it's still going to be a pain for the people who work there.
    - marcinzm 5y ago
      Or for people who work at companies that have those companies as close clients.
    - jasonhansel 5y ago
      If more high-value projects adopt the AGPL, legal departments may be motivated to revisit those bans.
      - atq2119 5y ago
        Yes, this is the main reason to welcome these recent adoptions of AGPL. Blanket bans of licenses are bad for free software. More pressure to revisit them is a good thing.
      - wegs2 5y ago
        I drove a revisiting like this in more than one organization. Fitting decisions like this around the status quo makes no sense. It's exactly actions like this which change the status quo. I'm happy to say there are dozens of organizations without AGPL bans thanks to one useful piece of code I wrote. Most are small, but one is in the tens of billions of dollars in valuation.
    - chithanh 5y ago
      Most companies who publish AGPL software also offer a paid commercial license, so it is accept AGPL (and contribute in kind) or pay (and contribute in money). I don't think this is bad forcing companies to choose between these two (or abandon the software), and they are fully responsible to making lives of people who work there easier.
    - enriquto 5y ago
      > This is not a problem with the license, it's a problem with those companies. But it's still going to be a pain for the people who work there. This sounds like a general problem, unrelated to licensing. If you work in companies with shitty policies, you are in for a world of pain.
- jabo 5y ago
  Based on [1] it sounds like even if you "link" to AGPL licensed code over a network, unmodified or not, it would require you to also license your own code as AGPL? That sounds pretty far reaching, if I'm reading it correctly. [1] https://softwareengineering.stackexchange.com/a/107931/28221 https://softwareengineering.stackexchange.com/a/107931/28221
  - rad_gruchalski 5y ago
    I didn’t downvote you. No, that’s not the case. Here’s a better explanation: https://writing.kemitchell.com/2021/01/24/Reading-AGPL.html https://writing.kemitchell.com/2021/01/24/Reading-AGPL.html Basically, if you ever need to use agpl stuff, do not embed or add your proprietary ip to a modified version. Use a sidecar. Only embed features you don’t care about.
    - d110af5ccf 5y ago
      I don't think that essay supports what you said. (It's incredibly well written by the way, thanks for linking it.) Near the end it asks: > If you build a larger web service by combining network services that call each other over HTTP, rather than libraries or snippets of code linked or pasted together, does “Corresponding Source” include the source for those other services? What if each service is containerized, encapsulated in its own operating system? Do those operating systems count as “System Libraries” or “generally available programs” shield the application code they run? Note that the author is asking a question here. It's not entirely clear (AFAIK, IANAL, etc) what precisely constitutes "linking" when it comes to the (A)GPL. A thought experiment. Evil Corp takes a GPL licensed program and modifies it to communicate via file descriptors instead of linking with it at compile time and directly calling its functions. They proceed to distribute a separate proprietary product that makes use of the GPL program for many of its core functions. They claim that this isn't a violation of the GPL because they haven't "linked" with any GPL'd code. This is clearly a violation of the spirit of the GPL, but is it a violation of the letter?
      - rad_gruchalski 5y ago
jcadam 5y ago
If my layman's reading of the affero license is accurate (ha!), I think it only affects you if you run minio with (your) custom modifications, in which case you would have to make the source of your custom minio fork available. It shouldn't affect the source of other services on your system.
- tapirl 5y ago
  available to public? Or the end users?
- chii 5y ago
  it's unclear what counts as derivative work (which would "infect" your closed source program). I'd say only clarifiable by having case laws or precedents, which currently dont exist yet.
temp667 5y ago
Correct - you would need to open source your entire app (or at least a strong arguement can be made that you must do so). "The primary risk presented by AGPL is that any product or service that depends on AGPL-licensed code, or includes anything copied or derived from AGPL-licensed code, may be subject to the virality of the AGPL license. " Almost all larger places have very strict bans on evening touching AGPL - https://opensource.google/docs/using/agpl-policy/ https://opensource.google/docs/using/agpl-policy/ The contributors can of course license commercially, so this has made it a popular sort of "shared source" type license - you can look at the code, but can't use it in your own projects unless they are open source too or pay for the commercial license.
- enriquto 5y ago
  > you can look at the code, but can't use it in your own projects unless they are open source too or pay for the commercial license. Please, stop spreading ridiculous FUD. You can use copylefted code in your own projects without any restriction. It is only when you distribute this copylefted code (e.g., by letting users run it in your computer) that you need to publish your modifications to it. And then, this is only relevant when you have modified the copylefted code; otherwise you just need to distribute code that is public elsewhere, which is a non-issue.
  - MaxBarraclough 5y ago
    > It is only when you distribute this copylefted code (e.g., by letting users run it in your computer) that you need to publish your modifications to it. I don't know if that was a typo, but letting users run the software on your computer, isn't 'distribution' in the usual sense. What you said sounds true of the GPL, but doesn't give a complete account of the AGPL. From the FSF: [0] > The GNU Affero General Public License is a modified version of the ordinary GNU GPL version 3. It has one added requirement: if you run a modified program on a server and let other users communicate with it there, your server must also allow them to download the source code corresponding to the modified version running there. [0] https://www.gnu.org/licenses/why-affero-gpl.html https://www.gnu.org/licenses/why-affero-gpl.html

by jabo 5y ago

throwaway888abc 5y ago

Same question for same situation

rad_gruchalski 5y ago

You only have a problem if you modify anything in the source code of minio that you host.

enriquto 5y ago
> You only have a problem if you modify anything in the source code of minio that you host. And even in that case, you only need to share your modifications of minio, not anything about the rest of your system. Doesn't seem too much of a problem, to begin with.
- rad_gruchalski 5y ago
  That’s right.
- jnwatson 5y ago
  Or put a proxy in front of it.
  - rad_gruchalski 5y ago
    Indeed. I predict that year 2022 will be the year of a sidecar protocol proxy service.
- eloff 5y ago
  A lot of companies I've worked for had a blanket ban on AGPL. This is not a problem with the license, it's a problem with those companies. But it's still going to be a pain for the people who work there.
  - marcinzm 5y ago
    Or for people who work at companies that have those companies as close clients.
  - jasonhansel 5y ago
    If more high-value projects adopt the AGPL, legal departments may be motivated to revisit those bans.
    - atq2119 5y ago
      Yes, this is the main reason to welcome these recent adoptions of AGPL. Blanket bans of licenses are bad for free software. More pressure to revisit them is a good thing.
    - wegs2 5y ago
      I drove a revisiting like this in more than one organization. Fitting decisions like this around the status quo makes no sense. It's exactly actions like this which change the status quo. I'm happy to say there are dozens of organizations without AGPL bans thanks to one useful piece of code I wrote. Most are small, but one is in the tens of billions of dollars in valuation.
  - chithanh 5y ago
    Most companies who publish AGPL software also offer a paid commercial license, so it is accept AGPL (and contribute in kind) or pay (and contribute in money). I don't think this is bad forcing companies to choose between these two (or abandon the software), and they are fully responsible to making lives of people who work there easier.
  - enriquto 5y ago
    > This is not a problem with the license, it's a problem with those companies. But it's still going to be a pain for the people who work there. This sounds like a general problem, unrelated to licensing. If you work in companies with shitty policies, you are in for a world of pain.
jabo 5y ago
Based on [1] it sounds like even if you "link" to AGPL licensed code over a network, unmodified or not, it would require you to also license your own code as AGPL? That sounds pretty far reaching, if I'm reading it correctly. [1] https://softwareengineering.stackexchange.com/a/107931/28221 https://softwareengineering.stackexchange.com/a/107931/28221
- rad_gruchalski 5y ago
  I didn’t downvote you. No, that’s not the case. Here’s a better explanation: https://writing.kemitchell.com/2021/01/24/Reading-AGPL.html https://writing.kemitchell.com/2021/01/24/Reading-AGPL.html Basically, if you ever need to use agpl stuff, do not embed or add your proprietary ip to a modified version. Use a sidecar. Only embed features you don’t care about.
  - d110af5ccf 5y ago
    I don't think that essay supports what you said. (It's incredibly well written by the way, thanks for linking it.) Near the end it asks: > If you build a larger web service by combining network services that call each other over HTTP, rather than libraries or snippets of code linked or pasted together, does “Corresponding Source” include the source for those other services? What if each service is containerized, encapsulated in its own operating system? Do those operating systems count as “System Libraries” or “generally available programs” shield the application code they run? Note that the author is asking a question here. It's not entirely clear (AFAIK, IANAL, etc) what precisely constitutes "linking" when it comes to the (A)GPL. A thought experiment. Evil Corp takes a GPL licensed program and modifies it to communicate via file descriptors instead of linking with it at compile time and directly calling its functions. They proceed to distribute a separate proprietary product that makes use of the GPL program for many of its core functions. They claim that this isn't a violation of the GPL because they haven't "linked" with any GPL'd code. This is clearly a violation of the spirit of the GPL, but is it a violation of the letter?
    - rad_gruchalski 5y ago

jcadam 5y ago

If my layman's reading of the affero license is accurate (ha!), I think it only affects you if you run minio with (your) custom modifications, in which case you would have to make the source of your custom minio fork available. It shouldn't affect the source of other services on your system.

tapirl 5y ago
available to public? Or the end users?
chii 5y ago
it's unclear what counts as derivative work (which would "infect" your closed source program). I'd say only clarifiable by having case laws or precedents, which currently dont exist yet.

temp667 5y ago

Correct - you would need to open source your entire app (or at least a strong arguement can be made that you must do so). "The primary risk presented by AGPL is that any product or service that depends on AGPL-licensed code, or includes anything copied or derived from AGPL-licensed code, may be subject to the virality of the AGPL license. " Almost all larger places have very strict bans on evening touching AGPL - https://opensource.google/docs/using/agpl-policy/ https://opensource.google/docs/using/agpl-policy/ The contributors can of course license commercially, so this has made it a popular sort of "shared source" type license - you can look at the code, but can't use it in your own projects unless they are open source too or pay for the commercial license.

enriquto 5y ago
> you can look at the code, but can't use it in your own projects unless they are open source too or pay for the commercial license. Please, stop spreading ridiculous FUD. You can use copylefted code in your own projects without any restriction. It is only when you distribute this copylefted code (e.g., by letting users run it in your computer) that you need to publish your modifications to it. And then, this is only relevant when you have modified the copylefted code; otherwise you just need to distribute code that is public elsewhere, which is a non-issue.
- MaxBarraclough 5y ago
  > It is only when you distribute this copylefted code (e.g., by letting users run it in your computer) that you need to publish your modifications to it. I don't know if that was a typo, but letting users run the software on your computer, isn't 'distribution' in the usual sense. What you said sounds true of the GPL, but doesn't give a complete account of the AGPL. From the FSF: [0] > The GNU Affero General Public License is a modified version of the ordinary GNU GPL version 3. It has one added requirement: if you run a modified program on a server and let other users communicate with it there, your server must also allow them to download the source code corresponding to the modified version running there. [0] https://www.gnu.org/licenses/why-affero-gpl.html https://www.gnu.org/licenses/why-affero-gpl.html