4 ms·

Big companies don’t touch AGPL stuff with a ten foot pole.

by swiley 5y ago

ttiurani 5y ago
This is good to know and precisely the reason I use AGPLv3 whenever I can. IMO open source developers writing code on their free time for the common good or just for fun should make sure with a licence like AGPLv3 that their work isn't appropriated by fundamentally immoral corps to increase profits. It isn't a badge of honor that a FAANG uses your library, it's just exploitation.
LinuxBender 5y ago
I witnessed this. There was a process to submit licenses to legal. People didn't follow the process and their projects were killed off just prior to completion as audits would surface licenses. This happened multiple times. People tried to argue with legal, but they wouldn't even entertain the conversation.
pabs3 5y ago
Its not exactly hard to comply with the AGPL. Just choose either to not modify the software, or if you do then link to the git repo you store the changes in.
- swiley 5y ago
  It doesn't matter though. The GPL was easy to comply with, AGPL completely freaks them out.
  - pabs3 5y ago
    Why? Is it that they haven't read the AGPL yet?
- rstuart4133 5y ago
  > Its not exactly hard to comply with the AGPL. Just choose either to not modify the software Unfortunately, the GPL and AGPL suffer from the same flaw: they don't rigorously define what a derivative work is. The way the licences are written they make the definition seem self evident, but it's self evident the way porn is self evident - everyone knows it when they see it. For example, from the way the GPL is written, dynamic linking to something makes it a derivative work, but invoking services from a http server is not. So how about I circumvent your GPL licence by putting an RPC shim layer than talks over http? Some projects have solved the problem by drawing their strict demarcation lines. For example, Linus has publicly stated on numerous occasions that using the kernel user user space API does not make a user space program a derivative work of the Linux kernel. Somewhat more dubiously, they seem to tolerate kernel modules that use GPL kernel symbols only. I've convinced myself that strong, clear demarcation is fundamental to Linux being accepted everywhere. The reason this is important is when you say "choose to not modify the software", the software in question is the original software or any derivative work. The problem is there is no clear definition of when your code becomes a derivative work. If you give a lawyer that much wriggle room and put enough money up as the prize, and you end up spending 10's of millions defending lawsuits from Oracle's lawyers trying to wriggle through an "API is copyrightable" loophole. A GPLv4 that insisted the licence holder clearly define what they consider to be a derivative work would IMO be a big step forward in copyleft licences. Oh and get rid of the "Installation Information" requirement, or at least make it compatible with code signing. A device defending itself by insisting any binary it runs is signed by a trusted source is not compatible with defining the private keys securing the signature are "Installation Information".
  - pabs3 5y ago
    The phrase "derivative work" comes from copyright law, so it isn't up to any one software author or license author to decide what "derivative work" means, that is for the law and the courts to decide. A GPLv4 without the installation requirement would not be a license that advances the goals of the FSF and the wider Free Software movement, which is to empower software users and users who can't install software are not empowered. Its definitely possible to use signing with GPLv3, just do it like UEFI Secure Boot devices do and allow users to enroll new signing keys.
    - rstuart4133 5y ago
      > The phrase "derivative work" comes from copyright law, so it isn't up to any one software author or license author to decide what "derivative work" means, that is for the law and the courts to decide. Yes, I've seen that same statement rolled out on LWN. Who knows, it in principle it might even be correct. In practice at best it's plain misleading. Neither the Law nor the courts get to have any input if the copyright holder doesn't bring the matter to their attention by suing. The choice about whether to enforce it or not is entirely up to the copyright holder. Further, the GPL isn't claiming additional rights that might be dubious under copyright law. If the copyriht holder chose to enforce those right in a court of law they almost certainly be challenged. Instead, it's giving away rights. You have _always_ been allowed to give away rights. That's what you do when you sell something - you allow someone to take a copy in exchange for money. The GPL is actually an agreement to not enforce copyright under some circumstances. In fact it's not too different to the backup clause in Microsoft's standard agreement. The standard agreement explicitly you may not take copies of Microsoft's software - but backups are an exception. Now I'm not lawyer, so I'm merely guessing that if Microsoft decided to sue you anyway for taking backups they would lose. Part of the problem arises in my use of the "derivative work". I'm copying the wording in the GPL, but really I assuming whatever the GPL is claiming is a derivative work really is a derivative work under copyright law. What I'm really saying, is that I won't sue you for copyright if you only use the derivative work in way I specify, such as only using it via a well documented API. There is nothing new about this. Arguably the GPL, AGPL, and LGPL only differ in how they say you can use the software in question. All I am saying is that's turned out to be too ambiguous. I'd much prefer the licence define allowed usage in a way a machine check. For example, if you only call symbols defined in this .h file, you don't have to make copies available. Or (and the GNU compilers do this), you can use the compiled output of the compiler even though they are derivative works (because they contain statically linked parts of crt.o). This argument about you can't do that because copyright law defines what a derivative work is, is a complete red hearing. > A GPLv4 without the installation requirement would not be a license that advances the goals of the FSF and the wider Free Software movement, which is to empower software users and users who can't install software are not empowered. The entire thing was about TvIO. It was never about preventing you from installing software in general. It could not be - the software was open source. The whole point of open source is I can modify it and install it on any device that let me do so. It was a particular _device_ that was locked down - not the software. You may be right is saying the FSF wanted to leverage their control of software licences into controlling the devices as well, which they did by demanding you provide private keys. I'm not the FSF - I can't say. What I am saying is that IMO, it was an overreach that hurt GPLv3 adoption. Without that clause I suspect the GPLv3 would have been adopted far more widely, and I think that would have been a good thing. > Its definitely possible to use signing with GPLv3, just do it like UEFI Secure Boot devices do and allow users to enroll new signing keys. We get back to the point above - what the copyright holder allows is not determined by a court of law. They can allow whatever they please, because if they don't bring it before a court the courts, the lawyers and the law don't get to have a say. The courts do determine what they can enforce - but that's not what's going on here. What is going on is no one has brought a law suit against Microsoft for signing Debian's secure boot loader with a key they won't reveal. And it seems very unlikely that will ever happen. But if someone did bring such a suite - well whether it was enforceable would be determined by a court of law. My guess from how the GPLv3 is written is it would be enforceable. My opinion irrelevant of course - but the big app stores also apparently believe it would be enforceable, so they ban the GPLv3 from their stores. And if I were them, I would too - the risk is far too great.

Big companies don’t touch AGPL stuff with a ten foot pole.

by swiley 5y ago

Big companies don’t touch AGPL stuff with a ten foot pole.

This is good to know and precisely the reason I use AGPLv3 whenever I can. IMO open source developers writing code on their free time for the common good or just for fun should make sure with a licence like AGPLv3 that their work isn't appropriated by fundamentally immoral corps to increase profits. It isn't a badge of honor that a FAANG uses your library, it's just exploitation.

LinuxBender 5y ago

I witnessed this. There was a process to submit licenses to legal. People didn't follow the process and their projects were killed off just prior to completion as audits would surface licenses. This happened multiple times. People tried to argue with legal, but they wouldn't even entertain the conversation.

pabs3 5y ago

Its not exactly hard to comply with the AGPL. Just choose either to not modify the software, or if you do then link to the git repo you store the changes in.

swiley 5y ago
It doesn't matter though. The GPL was easy to comply with, AGPL completely freaks them out.
- pabs3 5y ago
  Why? Is it that they haven't read the AGPL yet?
rstuart4133 5y ago
> Its not exactly hard to comply with the AGPL. Just choose either to not modify the software Unfortunately, the GPL and AGPL suffer from the same flaw: they don't rigorously define what a derivative work is. The way the licences are written they make the definition seem self evident, but it's self evident the way porn is self evident - everyone knows it when they see it. For example, from the way the GPL is written, dynamic linking to something makes it a derivative work, but invoking services from a http server is not. So how about I circumvent your GPL licence by putting an RPC shim layer than talks over http? Some projects have solved the problem by drawing their strict demarcation lines. For example, Linus has publicly stated on numerous occasions that using the kernel user user space API does not make a user space program a derivative work of the Linux kernel. Somewhat more dubiously, they seem to tolerate kernel modules that use GPL kernel symbols only. I've convinced myself that strong, clear demarcation is fundamental to Linux being accepted everywhere. The reason this is important is when you say "choose to not modify the software", the software in question is the original software or any derivative work. The problem is there is no clear definition of when your code becomes a derivative work. If you give a lawyer that much wriggle room and put enough money up as the prize, and you end up spending 10's of millions defending lawsuits from Oracle's lawyers trying to wriggle through an "API is copyrightable" loophole. A GPLv4 that insisted the licence holder clearly define what they consider to be a derivative work would IMO be a big step forward in copyleft licences. Oh and get rid of the "Installation Information" requirement, or at least make it compatible with code signing. A device defending itself by insisting any binary it runs is signed by a trusted source is not compatible with defining the private keys securing the signature are "Installation Information".
- pabs3 5y ago
  The phrase "derivative work" comes from copyright law, so it isn't up to any one software author or license author to decide what "derivative work" means, that is for the law and the courts to decide. A GPLv4 without the installation requirement would not be a license that advances the goals of the FSF and the wider Free Software movement, which is to empower software users and users who can't install software are not empowered. Its definitely possible to use signing with GPLv3, just do it like UEFI Secure Boot devices do and allow users to enroll new signing keys.
  - rstuart4133 5y ago
    > The phrase "derivative work" comes from copyright law, so it isn't up to any one software author or license author to decide what "derivative work" means, that is for the law and the courts to decide. Yes, I've seen that same statement rolled out on LWN. Who knows, it in principle it might even be correct. In practice at best it's plain misleading. Neither the Law nor the courts get to have any input if the copyright holder doesn't bring the matter to their attention by suing. The choice about whether to enforce it or not is entirely up to the copyright holder. Further, the GPL isn't claiming additional rights that might be dubious under copyright law. If the copyriht holder chose to enforce those right in a court of law they almost certainly be challenged. Instead, it's giving away rights. You have _always_ been allowed to give away rights. That's what you do when you sell something - you allow someone to take a copy in exchange for money. The GPL is actually an agreement to not enforce copyright under some circumstances. In fact it's not too different to the backup clause in Microsoft's standard agreement. The standard agreement explicitly you may not take copies of Microsoft's software - but backups are an exception. Now I'm not lawyer, so I'm merely guessing that if Microsoft decided to sue you anyway for taking backups they would lose. Part of the problem arises in my use of the "derivative work". I'm copying the wording in the GPL, but really I assuming whatever the GPL is claiming is a derivative work really is a derivative work under copyright law. What I'm really saying, is that I won't sue you for copyright if you only use the derivative work in way I specify, such as only using it via a well documented API. There is nothing new about this. Arguably the GPL, AGPL, and LGPL only differ in how they say you can use the software in question. All I am saying is that's turned out to be too ambiguous. I'd much prefer the licence define allowed usage in a way a machine check. For example, if you only call symbols defined in this .h file, you don't have to make copies available. Or (and the GNU compilers do this), you can use the compiled output of the compiler even though they are derivative works (because they contain statically linked parts of crt.o). This argument about you can't do that because copyright law defines what a derivative work is, is a complete red hearing. > A GPLv4 without the installation requirement would not be a license that advances the goals of the FSF and the wider Free Software movement, which is to empower software users and users who can't install software are not empowered. The entire thing was about TvIO. It was never about preventing you from installing software in general. It could not be - the software was open source. The whole point of open source is I can modify it and install it on any device that let me do so. It was a particular _device_ that was locked down - not the software. You may be right is saying the FSF wanted to leverage their control of software licences into controlling the devices as well, which they did by demanding you provide private keys. I'm not the FSF - I can't say. What I am saying is that IMO, it was an overreach that hurt GPLv3 adoption. Without that clause I suspect the GPLv3 would have been adopted far more widely, and I think that would have been a good thing. > Its definitely possible to use signing with GPLv3, just do it like UEFI Secure Boot devices do and allow users to enroll new signing keys. We get back to the point above - what the copyright holder allows is not determined by a court of law. They can allow whatever they please, because if they don't bring it before a court the courts, the lawyers and the law don't get to have a say. The courts do determine what they can enforce - but that's not what's going on here. What is going on is no one has brought a law suit against Microsoft for signing Debian's secure boot loader with a key they won't reveal. And it seems very unlikely that will ever happen. But if someone did bring such a suite - well whether it was enforceable would be determined by a court of law. My guess from how the GPLv3 is written is it would be enforceable. My opinion irrelevant of course - but the big app stores also apparently believe it would be enforceable, so they ban the GPLv3 from their stores. And if I were them, I would too - the risk is far too great.