9 ms·

Code licensed under the AGPL must not be used at Google

61 points by assttoasstmgr 4y ago

riedel 4y ago
See also https://news.ycombinator.com/item?id=23966778 https://news.ycombinator.com/item?id=23966778
Proven 4y ago
[dead]
ternaryoperator 4y ago
This post lacks historical context. Google is the company that initiated the whole movement against the GPL and the AGPL. I was in touch with their OSS guru, Chris diBona at the time. Also, Bruno Lowagie's book "Entreprenerd" gives some more details about this initiative. In short, Google were caught in violation of the GPL's copyleft terms and decided that they could not be caught in violation again on any of their principal technologies. So they started a very public campaign to strip the GPL from the company and because they are so reliant on OSS, to dissuade OSS developers from using the GPL (and by extension the AGPL). At the time, the GPL was, depending on survey the #1 or #2 license in OSS. However, contrary to their public position, Google still uses GPL products widely inside the company. Linux and Java, for example, are both licensed under the GPL and used extensively at Google. And the parts of Android that are based on Linux are licensed under the GPL [0]. Note that all major companies that sell licenses to their OSS use the GPL or AGPL licenses. This is because the copyleft provision provides OSS developers with leverage ("Either open-source your app if you use our product for free or buy a license.") This is what Google does not want to do. None of the more permissive licenses give developers this leverage: under MIT, Apache, and the other licenses, the developer gives up the GPL's copyleft leverage. Some companies have followed Google's lead and used scanning tools to eliminate GPL/AGPL code from their codebases. This is in part due to the copyleft provision and also to the so-called "viral clause" (if any part of the software is GPL/AGPL, the rest of the software it's part of must also be GPL/AGPL). This makes a lot of sense. However, for developers of stand-alone tools, the GPL is a good option and much less disfavored in corporate contexts (as evidenced by the widespread use of Linux, Java, MySQL, etc. in corporations) and the GPL license provides OSS developers a possible monetary stream from companies that want to modify the tool without disclosing the source code. Personal note: all of my OSS projects are released under permissive, non-GPL licenses because I'm not looking to make a business out of them and I want the widest possible distribution. Here, I simply want to provide context to the OP and clarify that it should be seen in the context of a long campaign by Google to dissuade OSS developers from the GPL/AGPL and to point out that those licenses have benefits for projects looking to pursue a business model based on licensing. [0] https://source.android.com/setup/start/licenses https://source.android.com/setup/start/licenses
- deleted 4y ago
  [deleted]
- jmillikin 4y ago
  Do you have a source for any of that? I worked at Google from 2011 to 2017, and the licensing policy was always pretty clear that the GPL was broadly OK for server-side but the AGPL was not. They're one of the few corporate entities I know of that are willing to use GPLv3 code, and when I went through their process for open-sourcing personal projects they had no problem with my use of the GPL. You might be confusing Google with Apple, which was historically willing to use GPLv2 code but is strongly opposed to GPLv3. > the so-called "viral clause" (if any part of the software is GPL/AGPL, > the rest of the software it's part of must also be GPL/AGPL) This is not an accurate summary of the GPL, or of software licensing in general. There is no requirement that all parts of some piece of software use the same license. As one famous example, the Linux kernel (largely GPLv2) also contains code covered by the MIT and BSD licenses. I'm also bothered by how you use "GPL/AGPL" repeatedly. The GPL is a standard copyright license, the AGPL is a EULA, and there's good reasons to distinguish them.
  - fmajid 4y ago
    It may not be an accurate summary, but GPLv3 makes extensive claims and none of that has been tested in court, so it is not unreasonable of them to be wary and not take any risks. They abandoned plans to incorporate ZFS in macOS and implemented the inferior APFS instead simply because of a patent troll lawsuit by NetApp against Sun.
  - ternaryoperator 4y ago
    > I'm also bothered by how you use "GPL/AGPL" repeatedly. The GPL is a standard copyright license, the AGPL is a EULA, and there's good reasons to distinguish them. I'm not sure what distinction you're trying to make. The very first line of the AGPL reads: "The GNU Affero General Public License is a free, copyleft license". And from the FSF's own site: "The GNU Affero General Public License is a modified version of the ordinary GNU GPL version 3. It has one added requirement..." [0] [0] https://www.gnu.org/licenses/why-affero-gpl.html https://www.gnu.org/licenses/why-affero-gpl.html
buildbot 4y ago
I would assume at googles scale that this has to be violated pretty often, how could you possibly police this well?
- Hamuko 4y ago
  I assume they do license scanning at the very least.
  - deleted 4y ago
    [deleted]
- Fiahil 4y ago
  we're not Google scale, but this works very well with precommit hooks and automatic CI checks that inspect dependencies for know vulnerabilities and incompatible licenses (you know, sonarqube and the likes). I would assume this is pretty well policed for all existing projects and by default for all new projects.
- fnbr 4y ago
  You are only allowed to use imports that are in the monorepo, and each time a library is added to the monorepo, the license is checked.
  - surajrmal 4y ago
    A lot of Google operates outside the monorepo these days.
- deleted 4y ago
  [deleted]
- klabb3 4y ago
  Every single 3p library that's imported into Google's monorepo gets vetted for license. If it's one of the standard licenses, it gets approved somewhat fast, but it's still time time consuming.
riffraff 4y ago
Seems reasonable, the restriction on installing AGPL stuff on your devices seems odd (how would that influence publicly deployed services?) but it mentions there's an approval process which makes it possible, so... Good enough?
- jabl 4y ago
  I'd guess it's for making really sure that AGPL code doesn't end up in a published service by accident.
  - danamit 4y ago
    Probably for making sure they won't give up work for free. Say you used an AGPL software that you had to make 10x times faster, being forced to giveaway something like that for Google is not good. At least they'd wanna have the option.
    - enneff 4y ago
      As a google employee I think by far the most likely outcome of that scenario (where a google engineer modifies a piece of OSS to make it significantly better) would be that engineer using a lightweight process to get permission to contribute to that project (if it’s not already white listed for contributions) and then sending the improvements to be merged upstream. There are many, many open source contributors at google and there is an entire group of people staffed to work on open source, among their responsibilities is to make it easy for google engineers to contribute to open source projects (both in their spare time and also as part of their daily work).
    - seoaeu 4y ago
      Presumably the bigger fear is that some AGPL program gets linked into their monorepo and the entire multi-billion line codebase is considered a "derivative work"
- kccqzy 4y ago
  What if you use some kind of Remote Desktop to access your own device? Then you'd violate the AGPL.
nnx 4y ago
Is there any uptake in AGPL use? Besides perhaps the initial spike near AGPL creation, any popular opensource library using AGPL since?
- wmf 4y ago
  Since it's in the news today... Mastodon.
- sauruk 4y ago
  Mold (the linker) uses it
- crb 4y ago
  There is a recent uptake in companies who want to make sure that their software isn't 'resold' by hosting companies (or book shops). They license the software under AGPL, so it's still "free", and can be used by individuals (or carefully by companies), but also have a commercial license available. You can't make "Hosted $THING" without a partnership. Grafana is the biggest example that comes to mind: https://grafana.com/blog/2021/04/20/grafana-loki-tempo-relicensing-to-agplv3/ https://grafana.com/blog/2021/04/20/grafana-loki-tempo-relic...
  - boris 4y ago
    This is inaccurate: you can definitely make "Hosted $THING" under AGPL. What you cannot do is modify said THING, host that (more precisely, make it publicly available as a service; if it's private, it's still ok), and keep the changes private.
  - josephcsible 4y ago
    > They license the software under AGPL, so it's still "free" What's with the scare quotes?
- SllX 4y ago
  https://en.wikipedia.org/wiki/List_of_software_under_the_GNU_AGPL https://en.wikipedia.org/wiki/List_of_software_under_the_GNU... Some of the ones on that list I didn’t know used AGPL: Anki, Bitwarden, Ghostscript, EdX, Diaspora, Mastodon, Searx, Signal’s server code. So a fair few from different time periods. Obviously doesn’t have the adoption rate of more popular open source licenses.
chungy 4y ago
I understand that AGPL is an attempt to combat software-as-a-service otherwise hiding open source behind a network interface (and yes I know, the FSF's preference against that term). It's still rather heavy-handed to a point that I would even avoid using AGPL software even for myself. It goes far beyond what the standard GPL demands and might even violate the freedoms to run a program as I wish, and to redistribute the software as I wish. The standard GPL already puts "restrictions" on the latter, but at least said restrictions only apply if I choose to distribute binaries. In the case of SaaS, I am more comfortable with running a service and making the choice to distribute my source or not. Personally, I probably would publish substantial changes to software regardless, but if the only thing I do is change a line of CSS, I also don't think it's right to force me to have to set up infrastructure to publish my modified source.
- devman0 4y ago
  AGPL is basically a clickwrap EULA instead of a distribution license, it also arguably violates freedom 0 of the free software definition.
  - lifthrasiir 4y ago
    With that logic virtually every free (and non-free) software violates the freedom 0 because there is no warranty that the software is fit for any particular purpose. The freedom 0 is simply about being able to run the software and doesn't talk about the consequence thereafter.
- hedora 4y ago
  What infrastructure are you talking about? You could literally just publish the source tarball from upstream and a .patch file. Alternatively, you could put in on github/gitlab for free. This is a particularly low bar, given that you'll need a server to serve the app anyway.
- svnpenn 4y ago
  > running a service and making the choice to distribute my source or not. This right here is exactly why AGPL (and OSL that I use) exists. It counters your sentence with "no, you can't do that". The fact that it removes your choice is a feature, not a bug. These licences don't give companies an escape hatch from sharing the source code, and I support that.
prvc 4y ago
This is, at least, an improvement compared to orgs which just use the code anyway in violation of its license.
laserbeam 4y ago
"This is triggered if the product or service can be accessed over a remote network interface, so it does not even require that the product or service is actually distributed." Huh? Does that mean that if you do an HTTP request to an AGPL server, your client code must be AGPL compliant? That does not make sense...
- _ikke_ 4y ago
  No, it means that you as a client are allowed to request and should be given the source code for that server.
- mormegil 4y ago
  No, it just explains that whenever you make an HTTP request to an AGPL server, you are entitled to the source code of the server (under AGPL). Obviously, Google does not want to give you the source code to any of its services (which are generally accessible via HTTP), so it needs to be very careful not to get any of those under AGPL (which could happen by linking (not just HTTP-connecting) to AGPL libraries/software).
- hedora 4y ago
  Doubtful, "can be accessed" is unlikely to be interpreted as "can be used to access" by any reasonable court.
todd3834 4y ago
When I was at Apple they were very cautious about this too. It wasn't banned but it was definitely something you had to get approval for.
- fmajid 4y ago
  Apple hates the GPL more generally, not just the GPL, and purged a number of packages from macOS (e.g. terminal-mode Emacs, which has been included since the days of NeXTsteo).
  - nojito 4y ago
    Has nothing to do with hate. The viral nature of the license makes it a nonstarter.
  - itsdrewmiller 4y ago
    GPL has the same virality as AGPL other than it isn't implicated by access over a network. Apple has plenty of software that isn't accessed over a network, so it makes sense that they would care about both. (So does Google, but that code is largely open source already - Android, Chrome/ChromeOS, etc.)
syshum 4y ago
Google like most tech companies may support "open source" but they do so only in the context of dev tools. This is a real problem for modern open source. Free software it seems is trending away from software products that are open source, instead Open source is being limited to developer tools, libraries and framework. Great for devs. Bad for end users and software in general
miraculixx 4y ago
So MongoDB is out
- bkuehl 4y ago
  I think MongoDB gets an unfair shake when it comes their updated license terms. They tried to be good OSS participants while still trying to run a business. They put it out there under a permissive license but tried to make some money of it (which is a tough already). And then they got popular and AWS basically just resold their tech because of the license. They had to change their terms and regular users freaked out. If you don't resell Mongo "as-a-service" you're fine. A lot of developers didn't see it that way and it hurt them.
hardwaresofton 4y ago
Welp this is a bit of a chip in my near-term analysis of the situation[0], but I still think the future of F/OSS is AGPL. Also since I'm bit biased I think that there's an entire group of people who see this as a welcome to build their next google-beating startup attempt on AGPL since they know Google won't touch it (not that google was the undifferentiated-hoster type anyway). [0]: https://vadosware.io/post/the-future-of-free-and-open-source-is-agpl/ https://vadosware.io/post/the-future-of-free-and-open-source...
- jupp0r 4y ago
  Google will just buy a non-AGPL license from the license holders if they really want to use a particular piece of software.
  - rapnie 4y ago
    I presume that then they may attempt to buy on a different license. And that you may say "No" to that.
    - Hamuko 4y ago
      I presume that if the software is non-trivial, Google's chequebook can convince most open-source maintainers.
      - rapnie 4y ago
        That is likely true. But I also know FOSS developers who outright rejected very large sums of money being offered for their work. From a combination of principles, values, not needing the money, or not willing to take responsibilities that come from such sale and/or restrictions of freedom that would mean. The "they just buy it" is the cynical assumption that everything always revolves around money. It often does, but not 100% of the time.
        deleted 4y ago
        [deleted]
franciscop 4y ago
I've made two npm utilities to check for licenses like this: `npx check-licenses`: lean library, requires npm+package-lock.json `npx legally`: checks the filesystem under node_modules, might overfetch license files that are unused Example output: ┌────────────────────────────────────────────────────────────────────────┐ │ │ │ Licenses (1326) │ │ │ ├──────────────────────────────────────────┬──────────────┬──────────────┤ │ License │ Number │ % │ ├──────────────────────────────────────────┼──────────────┼──────────────┤ │ MIT │ 1069 │ 80 │ │ ISC │ 65 │ 4 │ │ BSD 2 Clause │ 44 │ 3 │ │ CC0 │ 40 │ 3 │ │ Apache 2.0 │ 37 │ 2 │ │ BSD 3 Clause │ 36 │ 2 │ │ W3C │ 19 │ 1 │ │ Unlicense │ 3 │ 0 │ │ 0BSD │ 2 │ 0 │ │ GPL 2.0 │ 2 │ 0 │ │ AFL 2.1 │ 1 │ 0 │ │ CC BY 4.0 │ 1 │ 0 │ │ CC-BY │ 1 │ 0 │ │ MPL 1.1 │ 1 │ 0 │ │ MPL 2.0 │ 1 │ 0 │ │ ODC By 1.0 │ 1 │ 0 │ │ Python 2.0 │ 1 │ 0 │ │ Ruby │ 1 │ 0 │ │ WTFPL │ 1 │ 0 │ └──────────────────────────────────────────┴──────────────┴──────────────┘
- hardwaresofton 4y ago
  For the lazy: - https://www.npmjs.com/package/check-licenses https://www.npmjs.com/package/check-licenses - https://www.npmjs.com/package/legally https://www.npmjs.com/package/legally This feels like the kind of thing that might make for a good (paid?) app on the github marketplace francisco :)
josephcsible 4y ago
As usual, whenever anyone is against the AGPL, it's because they want to commit the exact bad behavior that the AGPL is designed to protect people against.
- aaronbrethorst 4y ago
  The AGPL cannot fail you—you can only fail the AGPL.
- sascha_sl 4y ago
  If you're picking a license to reveal who is up to no good, I'd also recommend the hippocratic license. Even more hilarious if used in a dual license setup with a commercial paid second license. It's like the spiritial successor to the old jslint license. Not using it or using the second license is like an implicit admission of maybe wanting to do evil.
  - seoaeu 4y ago
    That license is wild. It bans all sorts of activities and I can't imagine any company's lawyer signing off on it. Some examples of things that terminate your license... * Serve in the military: "Be an entity or a representative, agent, affiliate, successor, attorney, or assign of an entity which conducts military activities;" * Sell anything to a police department: "Be an individual or entity, or a or a [sic] representative, agent, affiliate, successor, attorney, or assign of an individual or entity, that provides good or services to, or otherwise enters into any commercial contracts with, any local, state, or federal law enforcement agency;" * Distribute violent media: "Be an individual or entity, or a or a [sic] representative, agent, affiliate, successor, attorney, or assign of an individual or entity, that broadcasts messages promoting killing, torture, or other forms of extreme violence;" * Have a corporate charter that doesn't reserve enough board seats for low-pay workers: "Ensure that if the Licensee has a Board of Directors, 30% of Licensee's board seats are held by Workers paid no more than 200% of the compensation of the lowest paid Worker of the Licensee;" * Discriminate (even unintentionally) based on a protected class: "Discriminate on the basis of sex, gender, sexual orientation, race, ethnicity, nationality, religion, caste, age, medical disability or impairment, and/or any other like circumstances"
heavyset_go 4y ago
Good, I license much of my open source software under the AGPL because of how easily bad actors are able to scare themselves with FUD about the license. I want companies who don't understand the licens to be afraid of simply taking without giving back. That said, most of fear around the AGPL is nonsense, and there are plenty of companies and contributors who understand the license and adhere to the terms AGPL software ships under. If Google wants to limit their options, while smaller competitors get a leg up by understanding and using their AGPL options, that's good for the market.
- vander_elst 4y ago
  IANAL so I don't have much experience here, but I am not sure this hits the spot. I think that an organization like Google can afford the brain power needed to understand many of the the implications of using such a license. There are probably other legal, compliance and liability reasons behind this rather than just lack of understanding.
  - voakbasda 4y ago
    I agree. I think they understand that they do not want to comply with the license terms.
    - ithkuil 4y ago
      Yes, and they clearly state why: > The primary risk presented by AGPL is that any product or service that depends on AGPL-licensed code, or includes anything copied or derived from AGPL-licensed code, may be subject to the virality of the AGPL license. This viral effect requires that the complete corresponding source code of the product or service be released to the world under the AGPL license. It's not that they want to fork a opensource component and they don't want to release their changes. It's because they are afraid that accidentally one part of an AGPL code gets linked into some of their production software which would force them to disclose the sources of their own IP. And it's hard to quantify the blast radius of that, since they are linking a shit-ton of stuff in every binary (think of thick clients for their colossus storage system). It's not that they want to pull an Amazon on OSS components they then sell as a service.
darthrupert 4y ago
Even though companies overreact a bit, isn't this a clear signal that AGPL is working as intended?
- fxtentacle 4y ago
  Yes. AGPL was designed to avoid issues like Amazon offering a hosted cloud service based on an open source project, but then never giving back to the project. E.g. what they did with PostgreSQL. Microsoft & Google at least donated, Amazon did not.
  - wizwit999 4y ago
    Does it really work, if they really want they'll implement it themselves like DocumentDB. Just makes everyone else's life hard.
hdjjhhvvhga 4y ago
The world "viral" immediately made me think about the Microsoft era[0]: In 2001 Microsoft vice-president Craig Mundie remarked "This viral aspect of the GPL poses a threat to the intellectual property of any organization making use of it." [0] https://www.nytimes.com/2001/05/03/business/technology-microsoft-is-set-to-be-top-foe-of-free-code.html https://www.nytimes.com/2001/05/03/business/technology-micro... The title of this NYT piece is "Microsoft Is Set To Be Top Foe Of Free Code." It's a peculiar feeling for all of us who saw the birth of Google and actually felt this particular company is very different from others - and especially from Microsoft.
Danielle69 4y ago
[dead]
fmajid 4y ago
Use of AGPL is generally considered a big red flag when a startup is undergoing due diligence to be acquired.

61 points by assttoasstmgr 4y ago

riedel 4y ago

See also https://news.ycombinator.com/item?id=23966778 https://news.ycombinator.com/item?id=23966778

Proven 4y ago

[dead]

ternaryoperator 4y ago

This post lacks historical context. Google is the company that initiated the whole movement against the GPL and the AGPL. I was in touch with their OSS guru, Chris diBona at the time. Also, Bruno Lowagie's book "Entreprenerd" gives some more details about this initiative. In short, Google were caught in violation of the GPL's copyleft terms and decided that they could not be caught in violation again on any of their principal technologies. So they started a very public campaign to strip the GPL from the company and because they are so reliant on OSS, to dissuade OSS developers from using the GPL (and by extension the AGPL). At the time, the GPL was, depending on survey the #1 or #2 license in OSS. However, contrary to their public position, Google still uses GPL products widely inside the company. Linux and Java, for example, are both licensed under the GPL and used extensively at Google. And the parts of Android that are based on Linux are licensed under the GPL [0]. Note that all major companies that sell licenses to their OSS use the GPL or AGPL licenses. This is because the copyleft provision provides OSS developers with leverage ("Either open-source your app if you use our product for free or buy a license.") This is what Google does not want to do. None of the more permissive licenses give developers this leverage: under MIT, Apache, and the other licenses, the developer gives up the GPL's copyleft leverage. Some companies have followed Google's lead and used scanning tools to eliminate GPL/AGPL code from their codebases. This is in part due to the copyleft provision and also to the so-called "viral clause" (if any part of the software is GPL/AGPL, the rest of the software it's part of must also be GPL/AGPL). This makes a lot of sense. However, for developers of stand-alone tools, the GPL is a good option and much less disfavored in corporate contexts (as evidenced by the widespread use of Linux, Java, MySQL, etc. in corporations) and the GPL license provides OSS developers a possible monetary stream from companies that want to modify the tool without disclosing the source code. Personal note: all of my OSS projects are released under permissive, non-GPL licenses because I'm not looking to make a business out of them and I want the widest possible distribution. Here, I simply want to provide context to the OP and clarify that it should be seen in the context of a long campaign by Google to dissuade OSS developers from the GPL/AGPL and to point out that those licenses have benefits for projects looking to pursue a business model based on licensing. [0] https://source.android.com/setup/start/licenses https://source.android.com/setup/start/licenses

deleted 4y ago
[deleted]
jmillikin 4y ago
Do you have a source for any of that? I worked at Google from 2011 to 2017, and the licensing policy was always pretty clear that the GPL was broadly OK for server-side but the AGPL was not. They're one of the few corporate entities I know of that are willing to use GPLv3 code, and when I went through their process for open-sourcing personal projects they had no problem with my use of the GPL. You might be confusing Google with Apple, which was historically willing to use GPLv2 code but is strongly opposed to GPLv3. > the so-called "viral clause" (if any part of the software is GPL/AGPL, > the rest of the software it's part of must also be GPL/AGPL) This is not an accurate summary of the GPL, or of software licensing in general. There is no requirement that all parts of some piece of software use the same license. As one famous example, the Linux kernel (largely GPLv2) also contains code covered by the MIT and BSD licenses. I'm also bothered by how you use "GPL/AGPL" repeatedly. The GPL is a standard copyright license, the AGPL is a EULA, and there's good reasons to distinguish them.
- fmajid 4y ago
  It may not be an accurate summary, but GPLv3 makes extensive claims and none of that has been tested in court, so it is not unreasonable of them to be wary and not take any risks. They abandoned plans to incorporate ZFS in macOS and implemented the inferior APFS instead simply because of a patent troll lawsuit by NetApp against Sun.
- ternaryoperator 4y ago
  > I'm also bothered by how you use "GPL/AGPL" repeatedly. The GPL is a standard copyright license, the AGPL is a EULA, and there's good reasons to distinguish them. I'm not sure what distinction you're trying to make. The very first line of the AGPL reads: "The GNU Affero General Public License is a free, copyleft license". And from the FSF's own site: "The GNU Affero General Public License is a modified version of the ordinary GNU GPL version 3. It has one added requirement..." [0] [0] https://www.gnu.org/licenses/why-affero-gpl.html https://www.gnu.org/licenses/why-affero-gpl.html

buildbot 4y ago

I would assume at googles scale that this has to be violated pretty often, how could you possibly police this well?

Hamuko 4y ago
I assume they do license scanning at the very least.
- deleted 4y ago
  [deleted]
Fiahil 4y ago
we're not Google scale, but this works very well with precommit hooks and automatic CI checks that inspect dependencies for know vulnerabilities and incompatible licenses (you know, sonarqube and the likes). I would assume this is pretty well policed for all existing projects and by default for all new projects.
fnbr 4y ago
You are only allowed to use imports that are in the monorepo, and each time a library is added to the monorepo, the license is checked.
- surajrmal 4y ago
  A lot of Google operates outside the monorepo these days.
deleted 4y ago
[deleted]
klabb3 4y ago
Every single 3p library that's imported into Google's monorepo gets vetted for license. If it's one of the standard licenses, it gets approved somewhat fast, but it's still time time consuming.

riffraff 4y ago

Seems reasonable, the restriction on installing AGPL stuff on your devices seems odd (how would that influence publicly deployed services?) but it mentions there's an approval process which makes it possible, so... Good enough?

jabl 4y ago
I'd guess it's for making really sure that AGPL code doesn't end up in a published service by accident.
- danamit 4y ago
  Probably for making sure they won't give up work for free. Say you used an AGPL software that you had to make 10x times faster, being forced to giveaway something like that for Google is not good. At least they'd wanna have the option.
  - enneff 4y ago
    As a google employee I think by far the most likely outcome of that scenario (where a google engineer modifies a piece of OSS to make it significantly better) would be that engineer using a lightweight process to get permission to contribute to that project (if it’s not already white listed for contributions) and then sending the improvements to be merged upstream. There are many, many open source contributors at google and there is an entire group of people staffed to work on open source, among their responsibilities is to make it easy for google engineers to contribute to open source projects (both in their spare time and also as part of their daily work).
  - seoaeu 4y ago
    Presumably the bigger fear is that some AGPL program gets linked into their monorepo and the entire multi-billion line codebase is considered a "derivative work"
kccqzy 4y ago
What if you use some kind of Remote Desktop to access your own device? Then you'd violate the AGPL.

nnx 4y ago

Is there any uptake in AGPL use? Besides perhaps the initial spike near AGPL creation, any popular opensource library using AGPL since?

wmf 4y ago
Since it's in the news today... Mastodon.
sauruk 4y ago
Mold (the linker) uses it
crb 4y ago
There is a recent uptake in companies who want to make sure that their software isn't 'resold' by hosting companies (or book shops). They license the software under AGPL, so it's still "free", and can be used by individuals (or carefully by companies), but also have a commercial license available. You can't make "Hosted $THING" without a partnership. Grafana is the biggest example that comes to mind: https://grafana.com/blog/2021/04/20/grafana-loki-tempo-relicensing-to-agplv3/ https://grafana.com/blog/2021/04/20/grafana-loki-tempo-relic...
- boris 4y ago
  This is inaccurate: you can definitely make "Hosted $THING" under AGPL. What you cannot do is modify said THING, host that (more precisely, make it publicly available as a service; if it's private, it's still ok), and keep the changes private.
- josephcsible 4y ago
  > They license the software under AGPL, so it's still "free" What's with the scare quotes?
SllX 4y ago
https://en.wikipedia.org/wiki/List_of_software_under_the_GNU_AGPL https://en.wikipedia.org/wiki/List_of_software_under_the_GNU... Some of the ones on that list I didn’t know used AGPL: Anki, Bitwarden, Ghostscript, EdX, Diaspora, Mastodon, Searx, Signal’s server code. So a fair few from different time periods. Obviously doesn’t have the adoption rate of more popular open source licenses.

chungy 4y ago

I understand that AGPL is an attempt to combat software-as-a-service otherwise hiding open source behind a network interface (and yes I know, the FSF's preference against that term). It's still rather heavy-handed to a point that I would even avoid using AGPL software even for myself. It goes far beyond what the standard GPL demands and might even violate the freedoms to run a program as I wish, and to redistribute the software as I wish. The standard GPL already puts "restrictions" on the latter, but at least said restrictions only apply if I choose to distribute binaries. In the case of SaaS, I am more comfortable with running a service and making the choice to distribute my source or not. Personally, I probably would publish substantial changes to software regardless, but if the only thing I do is change a line of CSS, I also don't think it's right to force me to have to set up infrastructure to publish my modified source.

devman0 4y ago
AGPL is basically a clickwrap EULA instead of a distribution license, it also arguably violates freedom 0 of the free software definition.
- lifthrasiir 4y ago
  With that logic virtually every free (and non-free) software violates the freedom 0 because there is no warranty that the software is fit for any particular purpose. The freedom 0 is simply about being able to run the software and doesn't talk about the consequence thereafter.
hedora 4y ago
What infrastructure are you talking about? You could literally just publish the source tarball from upstream and a .patch file. Alternatively, you could put in on github/gitlab for free. This is a particularly low bar, given that you'll need a server to serve the app anyway.
svnpenn 4y ago
> running a service and making the choice to distribute my source or not. This right here is exactly why AGPL (and OSL that I use) exists. It counters your sentence with "no, you can't do that". The fact that it removes your choice is a feature, not a bug. These licences don't give companies an escape hatch from sharing the source code, and I support that.

prvc 4y ago

This is, at least, an improvement compared to orgs which just use the code anyway in violation of its license.

laserbeam 4y ago

"This is triggered if the product or service can be accessed over a remote network interface, so it does not even require that the product or service is actually distributed." Huh? Does that mean that if you do an HTTP request to an AGPL server, your client code must be AGPL compliant? That does not make sense...

_ikke_ 4y ago
No, it means that you as a client are allowed to request and should be given the source code for that server.
mormegil 4y ago
No, it just explains that whenever you make an HTTP request to an AGPL server, you are entitled to the source code of the server (under AGPL). Obviously, Google does not want to give you the source code to any of its services (which are generally accessible via HTTP), so it needs to be very careful not to get any of those under AGPL (which could happen by linking (not just HTTP-connecting) to AGPL libraries/software).
hedora 4y ago
Doubtful, "can be accessed" is unlikely to be interpreted as "can be used to access" by any reasonable court.

todd3834 4y ago

When I was at Apple they were very cautious about this too. It wasn't banned but it was definitely something you had to get approval for.

fmajid 4y ago
Apple hates the GPL more generally, not just the GPL, and purged a number of packages from macOS (e.g. terminal-mode Emacs, which has been included since the days of NeXTsteo).
- nojito 4y ago
  Has nothing to do with hate. The viral nature of the license makes it a nonstarter.
- itsdrewmiller 4y ago
  GPL has the same virality as AGPL other than it isn't implicated by access over a network. Apple has plenty of software that isn't accessed over a network, so it makes sense that they would care about both. (So does Google, but that code is largely open source already - Android, Chrome/ChromeOS, etc.)

syshum 4y ago

Google like most tech companies may support "open source" but they do so only in the context of dev tools. This is a real problem for modern open source. Free software it seems is trending away from software products that are open source, instead Open source is being limited to developer tools, libraries and framework. Great for devs. Bad for end users and software in general

miraculixx 4y ago

So MongoDB is out

bkuehl 4y ago
I think MongoDB gets an unfair shake when it comes their updated license terms. They tried to be good OSS participants while still trying to run a business. They put it out there under a permissive license but tried to make some money of it (which is a tough already). And then they got popular and AWS basically just resold their tech because of the license. They had to change their terms and regular users freaked out. If you don't resell Mongo "as-a-service" you're fine. A lot of developers didn't see it that way and it hurt them.

hardwaresofton 4y ago

Welp this is a bit of a chip in my near-term analysis of the situation[0], but I still think the future of F/OSS is AGPL. Also since I'm bit biased I think that there's an entire group of people who see this as a welcome to build their next google-beating startup attempt on AGPL since they know Google won't touch it (not that google was the undifferentiated-hoster type anyway). [0]: https://vadosware.io/post/the-future-of-free-and-open-source-is-agpl/ https://vadosware.io/post/the-future-of-free-and-open-source...

jupp0r 4y ago
Google will just buy a non-AGPL license from the license holders if they really want to use a particular piece of software.
- rapnie 4y ago
  I presume that then they may attempt to buy on a different license. And that you may say "No" to that.
  - Hamuko 4y ago
    I presume that if the software is non-trivial, Google's chequebook can convince most open-source maintainers.
    - rapnie 4y ago
      That is likely true. But I also know FOSS developers who outright rejected very large sums of money being offered for their work. From a combination of principles, values, not needing the money, or not willing to take responsibilities that come from such sale and/or restrictions of freedom that would mean. The "they just buy it" is the cynical assumption that everything always revolves around money. It often does, but not 100% of the time.
      - deleted 4y ago
        [deleted]

franciscop 4y ago

I've made two npm utilities to check for licenses like this: `npx check-licenses`: lean library, requires npm+package-lock.json `npx legally`: checks the filesystem under node_modules, might overfetch license files that are unused Example output: ┌────────────────────────────────────────────────────────────────────────┐ │ │ │ Licenses (1326) │ │ │ ├──────────────────────────────────────────┬──────────────┬──────────────┤ │ License │ Number │ % │ ├──────────────────────────────────────────┼──────────────┼──────────────┤ │ MIT │ 1069 │ 80 │ │ ISC │ 65 │ 4 │ │ BSD 2 Clause │ 44 │ 3 │ │ CC0 │ 40 │ 3 │ │ Apache 2.0 │ 37 │ 2 │ │ BSD 3 Clause │ 36 │ 2 │ │ W3C │ 19 │ 1 │ │ Unlicense │ 3 │ 0 │ │ 0BSD │ 2 │ 0 │ │ GPL 2.0 │ 2 │ 0 │ │ AFL 2.1 │ 1 │ 0 │ │ CC BY 4.0 │ 1 │ 0 │ │ CC-BY │ 1 │ 0 │ │ MPL 1.1 │ 1 │ 0 │ │ MPL 2.0 │ 1 │ 0 │ │ ODC By 1.0 │ 1 │ 0 │ │ Python 2.0 │ 1 │ 0 │ │ Ruby │ 1 │ 0 │ │ WTFPL │ 1 │ 0 │ └──────────────────────────────────────────┴──────────────┴──────────────┘

hardwaresofton 4y ago
For the lazy: - https://www.npmjs.com/package/check-licenses https://www.npmjs.com/package/check-licenses - https://www.npmjs.com/package/legally https://www.npmjs.com/package/legally This feels like the kind of thing that might make for a good (paid?) app on the github marketplace francisco :)

josephcsible 4y ago

As usual, whenever anyone is against the AGPL, it's because they want to commit the exact bad behavior that the AGPL is designed to protect people against.

aaronbrethorst 4y ago
The AGPL cannot fail you—you can only fail the AGPL.
sascha_sl 4y ago
If you're picking a license to reveal who is up to no good, I'd also recommend the hippocratic license. Even more hilarious if used in a dual license setup with a commercial paid second license. It's like the spiritial successor to the old jslint license. Not using it or using the second license is like an implicit admission of maybe wanting to do evil.
- seoaeu 4y ago
  That license is wild. It bans all sorts of activities and I can't imagine any company's lawyer signing off on it. Some examples of things that terminate your license... * Serve in the military: "Be an entity or a representative, agent, affiliate, successor, attorney, or assign of an entity which conducts military activities;" * Sell anything to a police department: "Be an individual or entity, or a or a [sic] representative, agent, affiliate, successor, attorney, or assign of an individual or entity, that provides good or services to, or otherwise enters into any commercial contracts with, any local, state, or federal law enforcement agency;" * Distribute violent media: "Be an individual or entity, or a or a [sic] representative, agent, affiliate, successor, attorney, or assign of an individual or entity, that broadcasts messages promoting killing, torture, or other forms of extreme violence;" * Have a corporate charter that doesn't reserve enough board seats for low-pay workers: "Ensure that if the Licensee has a Board of Directors, 30% of Licensee's board seats are held by Workers paid no more than 200% of the compensation of the lowest paid Worker of the Licensee;" * Discriminate (even unintentionally) based on a protected class: "Discriminate on the basis of sex, gender, sexual orientation, race, ethnicity, nationality, religion, caste, age, medical disability or impairment, and/or any other like circumstances"

heavyset_go 4y ago

Good, I license much of my open source software under the AGPL because of how easily bad actors are able to scare themselves with FUD about the license. I want companies who don't understand the licens to be afraid of simply taking without giving back. That said, most of fear around the AGPL is nonsense, and there are plenty of companies and contributors who understand the license and adhere to the terms AGPL software ships under. If Google wants to limit their options, while smaller competitors get a leg up by understanding and using their AGPL options, that's good for the market.

vander_elst 4y ago
IANAL so I don't have much experience here, but I am not sure this hits the spot. I think that an organization like Google can afford the brain power needed to understand many of the the implications of using such a license. There are probably other legal, compliance and liability reasons behind this rather than just lack of understanding.
- voakbasda 4y ago
  I agree. I think they understand that they do not want to comply with the license terms.
  - ithkuil 4y ago
    Yes, and they clearly state why: > The primary risk presented by AGPL is that any product or service that depends on AGPL-licensed code, or includes anything copied or derived from AGPL-licensed code, may be subject to the virality of the AGPL license. This viral effect requires that the complete corresponding source code of the product or service be released to the world under the AGPL license. It's not that they want to fork a opensource component and they don't want to release their changes. It's because they are afraid that accidentally one part of an AGPL code gets linked into some of their production software which would force them to disclose the sources of their own IP. And it's hard to quantify the blast radius of that, since they are linking a shit-ton of stuff in every binary (think of thick clients for their colossus storage system). It's not that they want to pull an Amazon on OSS components they then sell as a service.

darthrupert 4y ago

Even though companies overreact a bit, isn't this a clear signal that AGPL is working as intended?

fxtentacle 4y ago
Yes. AGPL was designed to avoid issues like Amazon offering a hosted cloud service based on an open source project, but then never giving back to the project. E.g. what they did with PostgreSQL. Microsoft & Google at least donated, Amazon did not.
- wizwit999 4y ago
  Does it really work, if they really want they'll implement it themselves like DocumentDB. Just makes everyone else's life hard.

hdjjhhvvhga 4y ago

The world "viral" immediately made me think about the Microsoft era[0]: In 2001 Microsoft vice-president Craig Mundie remarked "This viral aspect of the GPL poses a threat to the intellectual property of any organization making use of it." [0] https://www.nytimes.com/2001/05/03/business/technology-microsoft-is-set-to-be-top-foe-of-free-code.html https://www.nytimes.com/2001/05/03/business/technology-micro... The title of this NYT piece is "Microsoft Is Set To Be Top Foe Of Free Code." It's a peculiar feeling for all of us who saw the birth of Google and actually felt this particular company is very different from others - and especially from Microsoft.

Danielle69 4y ago

[dead]

fmajid 4y ago

Use of AGPL is generally considered a big red flag when a startup is undergoing due diligence to be acquired.