5 ms·

Party 1 develops the software, and hosts it on an open endpoint that is not publicly advertised. Party 1 has met their obligations. Party 2 hosts the software,

Party 1 develops the software, and hosts it on an open endpoint that is not publicly advertised. Party 1 has met their obligations. Party 2 hosts the software, and does so behind a wrapper that does not forward the source code offer (this doesn't mean a wrapper that does s/source code offer//; it could be a protocol converter, WAF, or any other number of things that could lose non-protocol-relevant data like a source code offer). None of this demonstrates intent. In fact, I have ended up in the Party 2 scenario accidentally already (in my case I was both parties, but that was a a coincidence), as I ran an (accidentally) modified AGPL service behind another public server that used it as a backend. There was no source code offer at all to begin with, but even if there had been, the nature of the system involved would mean it would be pretty much impossible for that offer to percolate past the frontend and back to the external users, just the way the protocols involved worked, no explicit malice involved.

Nursie 5y ago
Party 2 in this case appears to be in violation, serving a service without the offer. Then there was no particular intent there, and I'm sure when you realised, you remedied it? Honestly we've wandered so far from "malicious actors can sidestep the license here that I'm not sure what your point is.
- marcan_42 5y ago
  > Party 2 in this case appears to be in violation, serving a service without the offer. If Party 2 has not made any changes to the source code, they have no obligation to make any offer under the license, since the requirement only applies to parties who modify the program. Party 1's obligations are not transferred to Party 2 when the program is. The license applies as written, there is no "carry-over" of state.
  - Nursie 5y ago
    The license applies as written and as interpreted in a court of law. When you were both parties, you were in violation. And as you say party 2 hosts the software that party 1 has altered, you appear to be relying on a contractual barrier between party 1 and 2 that makes them separate entities to 'shield' the party actually presenting the service from having any obligations. It's entirely possible that a judge could interpret the 'you' in clause 13 to include any parties who are providing the modified version to their networked users. Either way it's probably not really some sort of 'gotcha' that just allows you to circumvent with impunity.
    - marcan_42 5y ago
      I'm not relying on the contractual barrier, I'm relying on the interpretation of the clause as applying strictly to the behavior of the program as designed and embodied in the source code, and arguing that there is no moral requirement stated in the license for ensuring that that behavior is ultimately exposed to end users, and in fact, such a requirement would go against the spirit of the AGPL as a copyright license and it was explicitly written not to require that. Some people might disagree with that interpretation, which is okay because it's the kind of fine point nobody will ever agree on until it ends up in front of a judge. Which is why I bring up the two party example, to sidestep that question.
      - Nursie 5y ago
        But your two-party example is quite possibly fallacious, that's the point here, they may well be considered one party by a court, or equally responsible. Further, if the New York Times website can be considered a copyright work, and my proxy provides an altered version (say, one that credits me with writing all the articles), I've probably violated their copyright. I think your proxy could fall foul of this sort of thing too. You may have identified an area where a legal morass could be found if it comes up, but again I don't think it's "one simple trick that AGPL holders hate".
  - cxr 5y ago
    You are equivocating. You are making subtle changes to the qualifiers of the condition at issue (again[1]). Doubly odd for someone exhorting others to "read[...] very carefully". Whether someone has "made any changes to the source code" is not the applicable rubric. In this case you are constructing a stronger condition than the actual condition—which is much lower: to modify the Program. Your clever reverse proxy doesn't subvert this. (It's not so clever.) You're modifying the program whether you've touched any files containing plain text source code or not. (Even then, you probably have; cf IaC.) Aside from that, others' points about courts not being simple machines that exist to be hacked is very relevant to this discussion and many others that devolve into this sort of thing when hackers get involved[2]. Overall, this is astoundingly bad synthesis for something that has gotten so much traction. 1. https://news.ycombinator.com/item?id=30179334 https://news.ycombinator.com/item?id=30179334 2. https://news.ycombinator.com/item?id=25687897 https://news.ycombinator.com/item?id=25687897
    - marcan_42 5y ago
      Are you arguing that creating a program that interacts with another program is "modifying it"? Because then essentially all software is a derivative work of everything else and the entire industry is one giant copyright violation. Come on. You're grasping at straws here. That makes zero sense. It goes against everything we know about how software licensing works. It is extremely well established that interacting with software through stable, external interfaces does not constitute creating a derivative work of the software.
      - cxr 5y ago
        I am arguing, specifically, that your reverse proxy respects neither the spirit nor the letter of the AGPL and does not provide the kind of protections that you're claiming it would. (Separately, if ever the words "come on" make their way into your response, or you have to try to invent an argument for another person so that you can simultaneously take it down, then your own argument is probably junk. Here you've done both.)
        marcan_42 5y ago

Nursie 5y ago

Party 2 in this case appears to be in violation, serving a service without the offer. Then there was no particular intent there, and I'm sure when you realised, you remedied it? Honestly we've wandered so far from "malicious actors can sidestep the license here that I'm not sure what your point is.

marcan_42 5y ago
> Party 2 in this case appears to be in violation, serving a service without the offer. If Party 2 has not made any changes to the source code, they have no obligation to make any offer under the license, since the requirement only applies to parties who modify the program. Party 1's obligations are not transferred to Party 2 when the program is. The license applies as written, there is no "carry-over" of state.
- Nursie 5y ago
  The license applies as written and as interpreted in a court of law. When you were both parties, you were in violation. And as you say party 2 hosts the software that party 1 has altered, you appear to be relying on a contractual barrier between party 1 and 2 that makes them separate entities to 'shield' the party actually presenting the service from having any obligations. It's entirely possible that a judge could interpret the 'you' in clause 13 to include any parties who are providing the modified version to their networked users. Either way it's probably not really some sort of 'gotcha' that just allows you to circumvent with impunity.
  - marcan_42 5y ago
    I'm not relying on the contractual barrier, I'm relying on the interpretation of the clause as applying strictly to the behavior of the program as designed and embodied in the source code, and arguing that there is no moral requirement stated in the license for ensuring that that behavior is ultimately exposed to end users, and in fact, such a requirement would go against the spirit of the AGPL as a copyright license and it was explicitly written not to require that. Some people might disagree with that interpretation, which is okay because it's the kind of fine point nobody will ever agree on until it ends up in front of a judge. Which is why I bring up the two party example, to sidestep that question.
    - Nursie 5y ago
      But your two-party example is quite possibly fallacious, that's the point here, they may well be considered one party by a court, or equally responsible. Further, if the New York Times website can be considered a copyright work, and my proxy provides an altered version (say, one that credits me with writing all the articles), I've probably violated their copyright. I think your proxy could fall foul of this sort of thing too. You may have identified an area where a legal morass could be found if it comes up, but again I don't think it's "one simple trick that AGPL holders hate".
- cxr 5y ago
  You are equivocating. You are making subtle changes to the qualifiers of the condition at issue (again[1]). Doubly odd for someone exhorting others to "read[...] very carefully". Whether someone has "made any changes to the source code" is not the applicable rubric. In this case you are constructing a stronger condition than the actual condition—which is much lower: to modify the Program. Your clever reverse proxy doesn't subvert this. (It's not so clever.) You're modifying the program whether you've touched any files containing plain text source code or not. (Even then, you probably have; cf IaC.) Aside from that, others' points about courts not being simple machines that exist to be hacked is very relevant to this discussion and many others that devolve into this sort of thing when hackers get involved[2]. Overall, this is astoundingly bad synthesis for something that has gotten so much traction. 1. https://news.ycombinator.com/item?id=30179334 https://news.ycombinator.com/item?id=30179334 2. https://news.ycombinator.com/item?id=25687897 https://news.ycombinator.com/item?id=25687897
  - marcan_42 5y ago
    Are you arguing that creating a program that interacts with another program is "modifying it"? Because then essentially all software is a derivative work of everything else and the entire industry is one giant copyright violation. Come on. You're grasping at straws here. That makes zero sense. It goes against everything we know about how software licensing works. It is extremely well established that interacting with software through stable, external interfaces does not constitute creating a derivative work of the software.
    - cxr 5y ago
      I am arguing, specifically, that your reverse proxy respects neither the spirit nor the letter of the AGPL and does not provide the kind of protections that you're claiming it would. (Separately, if ever the words "come on" make their way into your response, or you have to try to invent an argument for another person so that you can simultaneously take it down, then your own argument is probably junk. Here you've done both.)
      - marcan_42 5y ago