4 ms·

> If i take the license literally, why wouldn't my db password be considered part of the derrived work? Configuration is just a short artifact. It's not a crea

> If i take the license literally, why wouldn't my db password be considered part of the derrived work? Configuration is just a short artifact. It's not a creative work and is therefore not copyrightable at all, whether by AGPL or otherwise. > if there is a security issue and it has an emergency patch but there is some coordinated disclosure going on so its not public yet, is this an agpl violation? No because: - if you are coordinating with the developers, then you have their explicit permission to temporarily withhold those changes (AGPL copyright holders can still grant exceptions to the license) - AGPL does not mean you must provide up-to-date source code in an automated matter; you have to be able to provide the source code upon request, and there's nothing in the license preventing any forms of delays (much less so for ensuring security of users) > antispam stuff tends to benefit from security through obscurity. Can i embed antispam checks directly in the agpl source without revealing I'm not convinced obscurity helps against spam at all. DKIM and blocklists have done much more against email spam than any form of "security by obscurity" corporate scheme has. However, if the logic is separate from the configuration, you would have to publish the edited source code (the logic), but could retain the actual configuration (because once again, configuration is not copyrightable).

cylinder714 5y ago
>AGPL does not mean you must provide up-to-date source code in an automated matter; you have to be able to provide the source code upon request, and there's nothing in the license preventing any forms of delays (much less so for ensuring security of users) I think it does, if you modify the code. From section 13 of the AGPL: "Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software."
- southerntofu 5y ago
  I am not a lawyer, but i don't think anything would prevent you from waiting to update that source code. You could for example say "The source code provided here dates from XX/XX/XXXX and may be slightly out-of-date in regards to the latest security patches. Updates to this repository are pushed no later than 2 months after being applied on the server, and such delay is only incurred when dealing with security patches as part of a coordinated disclosure strategy with upstream project Y".
  - cylinder714 5y ago
    That sounds fine.
  - mbreese 5y ago
    I believe there is no such provision in the APGL for a reasonable period of time/delay. Unless there is an exception in the license, one would need to give remote users the source code for the exact version of a program they are interacting with. It is no different from the traditional GPL in this regard. Imagine getting a (binary) copy of GCC and the README said — this is version X.Y.Z. Please wait up to two months to download the source code. Until then, you can download the source code for X.Y.Z-2. IANAL either, but my interpretation was always that you had to treat AGPL code in the same way as GPL, except for the fact that access by remote/internet users was considered a distribution.
    - southerntofu 5y ago
      > Imagine getting a (binary) copy of GCC and the README said (...) Just like sibling commenter haukem pointed out, GPL does not mandate that you distribute the source code alongside the binary, as long as there is an official channel to request the source code. GPL license predates version control, and code often had to be snail-mailed at the time. This can lead to funny situations like famous hacker Naomi Wu dropping by hardware manufacturer offices to get the GPL source code. [0] So yes, you could distribute a binary version of FunnySoft v1.3, and it could take a few days/weeks/months to get a copy of the actual source code. [0] https://nitter.snopyta.org/RealSexyCyborg/status/1428706989274583049 https://nitter.snopyta.org/RealSexyCyborg/status/14287069892...
charcircuit 5y ago
>than any form of "security by obscurity" corporate scheme has. Companies wouldn't use security by obscurity if it didn't work. Obscurity definitely increases the time investment needed by attackers.
adrianN 5y ago
Antispam and fraud detection definitely benefit from security by obscurity. It is essentially an arms race between you and the spammers, with the goal of making spam and fraud too expensive to bother. Any extra work that your opponents have to do directly makes your work easier.
haukem 5y ago
I think this answer is wrong or very dangerous, but I am not a lawyer. The AGPL v3 says: >... your modified version must prominently offer all users interacting with it remotely through a computer network .... an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge..... > if there is a security issue and it has an emergency patch but there is some coordinated disclosure going on so its not public yet, is this an agpl violation? When you have the permission from all copyright holder to make an exception to the AGPL you do not have to publish the source code. Otherwise you have to publish it. If it is an open source project with many contributors and the copyright stays at the original authors getting such a permission is practically impossible.
bawolff 5y ago
> Configuration is just a short artifact. It's not a creative work and is therefore not copyrightable at all, whether by AGPL or otherwise. I'm doubtful. For example https://github.com/wikimedia/operations-mediawiki-config https://github.com/wikimedia/operations-mediawiki-config is wikipedia's config. It is not short, and much of it is complex enough i think it would be copyrightable (ianal) I agree though a very traditional list of key value pairs that are simple facts like where to find the db, might lack creativity to be copyrighted (ianal). But how many real deployed systems have that simple a config. More generally i would prefer that the license was less ambigious about this especially in an international context (e.g. rules are totally different in uk over what can be copyrighted) > I'm not convinced obscurity helps against spam at all. DKIM and blocklists have done much more against email spam than any form of "security by obscurity" corporate scheme has. Gmail et al use techniques beyond dkim that are secret. However i meant more like web spam where you can't just rely on source vouching for users. For example on wikipedia there is a feature where admins can write "code" that block patterns in edits. When used against persistent vandals, they are often secret lest they use the info to adjust behaviour. That's the type of thing i mean. > if you are coordinating with the developers, then you have their explicit permission to temporarily withhold those changes (AGPL copyright holders can still grant exceptions to the license) That only works if one entity holds all the copyright. Even then, does that mean forks cannot have coordinated disclosure?

cylinder714 5y ago

>AGPL does not mean you must provide up-to-date source code in an automated matter; you have to be able to provide the source code upon request, and there's nothing in the license preventing any forms of delays (much less so for ensuring security of users) I think it does, if you modify the code. From section 13 of the AGPL: "Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software."

southerntofu 5y ago
I am not a lawyer, but i don't think anything would prevent you from waiting to update that source code. You could for example say "The source code provided here dates from XX/XX/XXXX and may be slightly out-of-date in regards to the latest security patches. Updates to this repository are pushed no later than 2 months after being applied on the server, and such delay is only incurred when dealing with security patches as part of a coordinated disclosure strategy with upstream project Y".
- cylinder714 5y ago
  That sounds fine.
- mbreese 5y ago
  I believe there is no such provision in the APGL for a reasonable period of time/delay. Unless there is an exception in the license, one would need to give remote users the source code for the exact version of a program they are interacting with. It is no different from the traditional GPL in this regard. Imagine getting a (binary) copy of GCC and the README said — this is version X.Y.Z. Please wait up to two months to download the source code. Until then, you can download the source code for X.Y.Z-2. IANAL either, but my interpretation was always that you had to treat AGPL code in the same way as GPL, except for the fact that access by remote/internet users was considered a distribution.
  - southerntofu 5y ago
    > Imagine getting a (binary) copy of GCC and the README said (...) Just like sibling commenter haukem pointed out, GPL does not mandate that you distribute the source code alongside the binary, as long as there is an official channel to request the source code. GPL license predates version control, and code often had to be snail-mailed at the time. This can lead to funny situations like famous hacker Naomi Wu dropping by hardware manufacturer offices to get the GPL source code. [0] So yes, you could distribute a binary version of FunnySoft v1.3, and it could take a few days/weeks/months to get a copy of the actual source code. [0] https://nitter.snopyta.org/RealSexyCyborg/status/1428706989274583049 https://nitter.snopyta.org/RealSexyCyborg/status/14287069892...

charcircuit 5y ago

>than any form of "security by obscurity" corporate scheme has. Companies wouldn't use security by obscurity if it didn't work. Obscurity definitely increases the time investment needed by attackers.

adrianN 5y ago

Antispam and fraud detection definitely benefit from security by obscurity. It is essentially an arms race between you and the spammers, with the goal of making spam and fraud too expensive to bother. Any extra work that your opponents have to do directly makes your work easier.

haukem 5y ago

I think this answer is wrong or very dangerous, but I am not a lawyer. The AGPL v3 says: >... your modified version must prominently offer all users interacting with it remotely through a computer network .... an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge..... > if there is a security issue and it has an emergency patch but there is some coordinated disclosure going on so its not public yet, is this an agpl violation? When you have the permission from all copyright holder to make an exception to the AGPL you do not have to publish the source code. Otherwise you have to publish it. If it is an open source project with many contributors and the copyright stays at the original authors getting such a permission is practically impossible.

bawolff 5y ago

> Configuration is just a short artifact. It's not a creative work and is therefore not copyrightable at all, whether by AGPL or otherwise. I'm doubtful. For example https://github.com/wikimedia/operations-mediawiki-config https://github.com/wikimedia/operations-mediawiki-config is wikipedia's config. It is not short, and much of it is complex enough i think it would be copyrightable (ianal) I agree though a very traditional list of key value pairs that are simple facts like where to find the db, might lack creativity to be copyrighted (ianal). But how many real deployed systems have that simple a config. More generally i would prefer that the license was less ambigious about this especially in an international context (e.g. rules are totally different in uk over what can be copyrighted) > I'm not convinced obscurity helps against spam at all. DKIM and blocklists have done much more against email spam than any form of "security by obscurity" corporate scheme has. Gmail et al use techniques beyond dkim that are secret. However i meant more like web spam where you can't just rely on source vouching for users. For example on wikipedia there is a feature where admins can write "code" that block patterns in edits. When used against persistent vandals, they are often secret lest they use the info to adjust behaviour. That's the type of thing i mean. > if you are coordinating with the developers, then you have their explicit permission to temporarily withhold those changes (AGPL copyright holders can still grant exceptions to the license) That only works if one entity holds all the copyright. Even then, does that mean forks cannot have coordinated disclosure?