7 ms·

The AGPL is an underrated licence. It solves the problem of $bigCorp taking free software, making significant improvements and then renting network access to th

by YPPH 4y ago

The AGPL is an underrated licence. It solves the problem of $bigCorp taking free software, making significant improvements and then renting network access to that improved version without providing their changes to anyone. That's unfair.

heywoodlh 4y ago
Doesn't the normal GPL solve this problem as well? I don't have strong opinions for or against AGPL, I'm just not really too sure why the GPL doesn't solve this as well.
- YPPH 4y ago
  Making software available over a network for interaction does not seem to constitute distributing the software. So, no, it does not cover this situation. https://en.m.wikipedia.org/wiki/Affero_General_Public_License https://en.m.wikipedia.org/wiki/Affero_General_Public_Licens...
  - EMIRELADERO 4y ago
    There could be an argument that the JS frontend that gets sent to the client over the network is part of the software, depending on the project's structure
    - deleted 4y ago
      [deleted]
    - Macha 4y ago
      Yes, but that would only apply to the frontend and derivative works thereof
- Am4TIfIsER0ppos 4y ago
  If I give you a webpage like this comment box in which you give a command line to run a GPL tool (e.g. ffmpeg built with --enable-gpl) I do not need to give you any source code because I am not distributing that tool. That applies to more complicated interfaces and even if I were to link libavcodec into the web server because I am not distributing the tool.
- ilyt 4y ago
  It's basically "I don't want people to sell my app as SaaS without disclosing source code" license It solves the "Amazon issue" where company can take open source software, change it, then offer as a service without giving sources. Under GPL you don't get binary if you access a service provided by open source software so you are not entitled to source code of the application Under AGPL just interacting with the software is enough for company to have to provide the source code.
aliqot 4y ago
counterpoint: At the end of the day, I just want people to use my stuff. Right now, 99% of what I write ends up MIT because I just want the shortest and most permissive license for others to use what I create without bothering me. Not to discount the feelings of others, but in a sense I only wish I could have these problems.
- YPPH 4y ago
  It possibly depends on your project. If you're running a password manager business, it makes little sense to provide all your source code to a competitor to enable them to build upon your project, make money, and not provide any of the code changes in return.
- krageon 4y ago
  You will feel different when some giant enterprise takes your shit, locks it up and never contributes any improvements back. Or maybe you would not. I definitely would :)
  - bombolo 4y ago
    Besides not contributing, they will start opening bug reports and ask you to fix them ASAP.
    - Aeolun 4y ago
      So they’re contributing bug reports. That’s a win!
      - bombolo 4y ago
        Feature requests aren't "contributions". Also bugs due to "I didn't bother to read the documentation". Also legitimate bugs with the attitude of "my production env is down because of this, so fix it at once". The entitlement is strong.
    - Spivak 4y ago
      And then use your lack of not wanting to prioritize free work for corporate daddy as evidence that the project has stalled and a "community" fork is necessary.
frant-hartm 4y ago
No it doesn't, at least not for e.g. a database which the big corp provides a vanilla version of. Say elastic search was AGPL. Any fixes to the engine would need to be made available to the users. But management console and most of the infrastructure wouldn't. AGPL is not viral across network.
- bayindirh 4y ago
  > But management console and most of the infrastructure wouldn't. AGPL is not viral across network. Yes. That part is covered by GPL. So, you have to share these changes anyway.
AstixAndBelix 4y ago
The AGPL is a stupid licence. If you use anything over a network you are using someone else's computer. Of course the code that runs on your end should be open source, but having the server's source code is useless since you cannot verify they are truly running what they claim they do.
- bayindirh 4y ago
  These licenses are legal documents and binding.
  - AstixAndBelix 4y ago
    Do you have a right over someone else's computer? Maybe we are talking about government servers and you could argue they are public property so AGPL could be needed, but private companies?
    - tpxl 4y ago
      Wat. You don't have a right to run _my_ code on your server. If you won't abide by the license terms, you can't run my code.
      - AstixAndBelix 4y ago
        The GPL tells me I have the freedom to run your code however I please, and I should release my modifications only if they run on someone else's computer and they request the source code. Since the code only runs on my server then no user has the right to request the source code. This is why AGPL is a dangerous extension to the GPL
        bombolo 4y ago
        It's not an "extension". It's a different license that doesn't give you the right to run the code on your server, unless you share the sources with the users. You are free to implement it yourself instead of using someone else's AGPL code.
_cenw 4y ago
I like the AGPL in theory, but the confusion about how immediately you have to convey a copy of the source is not great. I find the requirement some people read from it that any running piece of code must be able to spit out its source code from the same network service very annoying (as I find the people opening issues for your supposed noncompliance with this asinine requirement - even if you are the sole copyright holder - are very annoying)
Macha 4y ago
I'd argue that the GPLv3 is even obsolete. If you don't care about third parties using it in proprietary software, use LGPLv3 or Apache 2.0. If you do care, then a license that fails to apply that restriction to the dominant form of software today seems pretty underwhelming and you should go straight to AGPLv3 instead.
- CuriousCosmic 4y ago
  GPL is perfectly useful. It's just less useful for projects operating over the network. Are you writing a library that you want to be kept open when used in a project? GPL will do what you need. Are you writing an application where communicating over the network isn't a meaningful part of its operation? GPL will work fine. Are you writing a library or application where communicating over the network is a significant part of its operation? Yeah you probably want to use the AGPL instead. Even then, depending on where it is running, GPL might still be fine. JS on a client? GPL will be fine. JS on a server? You need AGPL. Really it comes down to: Does the user interact with this software with a network between them (i.e. user <--> ??? <--internet--> software)? If yes AGPL, if no GPL.
  - tpush 4y ago
    Well, the point is that you can make almost every library a network service if your want to. Anytime a vendor sees a GPL3 library, all they have to do is make a network service out of it and the GPL3 license is powerless. So AGPL3 as the default for strong copyleft software seems reasonable.
    - CuriousCosmic 4y ago
      Sure but for a lot of libraries that just doesn't make sense. Like I get that you can give any library an RPC and call it a day but with 90% of the libraries I work with on a daily basis, requiring that you call it over the network just adds unnecessary complexity, kills ergonomics of use, and adds latency. As an engineer I'm not going to use an RPC to do an FFT, populate a native UI, access some device, or manipulate a datastructure. Instead I'll just use a tool/library that does what I need while staying in the application's address space. The disconnect I think is that I work on a lot of embedded software and native applications. In the world I am in, the hoops needed to allow a library to bypass the GPL just mean that I'm not going to use that library and that I'll do everything in my power to keep leadership from using projects with that kind of pointless failure mode. The same goes for web apps though. If it's delivered to the client and executed by the client, it can just be GPL. They have a copy of the code and are running it. They already have to have access to a copy of the source. AGPL provides no additional protections here. AGPL has it's place and that place is server side software. If you are writing software that the user directly interacts with and that is running on hardware the user can physically touch, the AGPL provides you no added benefit. If that's not the case, you should certainly feel free to step the license up to AGPL but there's no reason to artificially complicate license compatibility when you already know that it wouldn't be feasible for a user/developer to use your software without complying with the GPL.
simiones 4y ago
This has generally turned out to be a problem very few people have. In practice, $bigCorp is happy to publicize all of the changes they make to this software. They can then focus on out-competing anyone by offering a cheaper and/or better integrated managed version then the original creators can. This is explicitly why Mongo moved from the AGPL to a custom non-FOSS license; Elastic followed suite and skipped the AGPL altogether for a similar license. Overall, $bigCorp love having any changes they make in upstream: less maintenance burden on them for the parts that are not in their direct business, more time spent on working on their value-adds.

by YPPH 4y ago

heywoodlh 4y ago

Doesn't the normal GPL solve this problem as well? I don't have strong opinions for or against AGPL, I'm just not really too sure why the GPL doesn't solve this as well.

YPPH 4y ago
Making software available over a network for interaction does not seem to constitute distributing the software. So, no, it does not cover this situation. https://en.m.wikipedia.org/wiki/Affero_General_Public_License https://en.m.wikipedia.org/wiki/Affero_General_Public_Licens...
- EMIRELADERO 4y ago
  There could be an argument that the JS frontend that gets sent to the client over the network is part of the software, depending on the project's structure
  - deleted 4y ago
    [deleted]
  - Macha 4y ago
    Yes, but that would only apply to the frontend and derivative works thereof
Am4TIfIsER0ppos 4y ago
If I give you a webpage like this comment box in which you give a command line to run a GPL tool (e.g. ffmpeg built with --enable-gpl) I do not need to give you any source code because I am not distributing that tool. That applies to more complicated interfaces and even if I were to link libavcodec into the web server because I am not distributing the tool.
ilyt 4y ago
It's basically "I don't want people to sell my app as SaaS without disclosing source code" license It solves the "Amazon issue" where company can take open source software, change it, then offer as a service without giving sources. Under GPL you don't get binary if you access a service provided by open source software so you are not entitled to source code of the application Under AGPL just interacting with the software is enough for company to have to provide the source code.

aliqot 4y ago

counterpoint: At the end of the day, I just want people to use my stuff. Right now, 99% of what I write ends up MIT because I just want the shortest and most permissive license for others to use what I create without bothering me. Not to discount the feelings of others, but in a sense I only wish I could have these problems.

YPPH 4y ago
It possibly depends on your project. If you're running a password manager business, it makes little sense to provide all your source code to a competitor to enable them to build upon your project, make money, and not provide any of the code changes in return.
krageon 4y ago
You will feel different when some giant enterprise takes your shit, locks it up and never contributes any improvements back. Or maybe you would not. I definitely would :)
- bombolo 4y ago
  Besides not contributing, they will start opening bug reports and ask you to fix them ASAP.
  - Aeolun 4y ago
    So they’re contributing bug reports. That’s a win!
    - bombolo 4y ago
      Feature requests aren't "contributions". Also bugs due to "I didn't bother to read the documentation". Also legitimate bugs with the attitude of "my production env is down because of this, so fix it at once". The entitlement is strong.
  - Spivak 4y ago
    And then use your lack of not wanting to prioritize free work for corporate daddy as evidence that the project has stalled and a "community" fork is necessary.

frant-hartm 4y ago

No it doesn't, at least not for e.g. a database which the big corp provides a vanilla version of. Say elastic search was AGPL. Any fixes to the engine would need to be made available to the users. But management console and most of the infrastructure wouldn't. AGPL is not viral across network.

bayindirh 4y ago
> But management console and most of the infrastructure wouldn't. AGPL is not viral across network. Yes. That part is covered by GPL. So, you have to share these changes anyway.

AstixAndBelix 4y ago

The AGPL is a stupid licence. If you use anything over a network you are using someone else's computer. Of course the code that runs on your end should be open source, but having the server's source code is useless since you cannot verify they are truly running what they claim they do.

bayindirh 4y ago
These licenses are legal documents and binding.
- AstixAndBelix 4y ago
  Do you have a right over someone else's computer? Maybe we are talking about government servers and you could argue they are public property so AGPL could be needed, but private companies?
  - tpxl 4y ago
    Wat. You don't have a right to run _my_ code on your server. If you won't abide by the license terms, you can't run my code.
    - AstixAndBelix 4y ago
      The GPL tells me I have the freedom to run your code however I please, and I should release my modifications only if they run on someone else's computer and they request the source code. Since the code only runs on my server then no user has the right to request the source code. This is why AGPL is a dangerous extension to the GPL
      - bombolo 4y ago
        It's not an "extension". It's a different license that doesn't give you the right to run the code on your server, unless you share the sources with the users. You are free to implement it yourself instead of using someone else's AGPL code.

_cenw 4y ago

I like the AGPL in theory, but the confusion about how immediately you have to convey a copy of the source is not great. I find the requirement some people read from it that any running piece of code must be able to spit out its source code from the same network service very annoying (as I find the people opening issues for your supposed noncompliance with this asinine requirement - even if you are the sole copyright holder - are very annoying)

Macha 4y ago

I'd argue that the GPLv3 is even obsolete. If you don't care about third parties using it in proprietary software, use LGPLv3 or Apache 2.0. If you do care, then a license that fails to apply that restriction to the dominant form of software today seems pretty underwhelming and you should go straight to AGPLv3 instead.

CuriousCosmic 4y ago
GPL is perfectly useful. It's just less useful for projects operating over the network. Are you writing a library that you want to be kept open when used in a project? GPL will do what you need. Are you writing an application where communicating over the network isn't a meaningful part of its operation? GPL will work fine. Are you writing a library or application where communicating over the network is a significant part of its operation? Yeah you probably want to use the AGPL instead. Even then, depending on where it is running, GPL might still be fine. JS on a client? GPL will be fine. JS on a server? You need AGPL. Really it comes down to: Does the user interact with this software with a network between them (i.e. user <--> ??? <--internet--> software)? If yes AGPL, if no GPL.
- tpush 4y ago
  Well, the point is that you can make almost every library a network service if your want to. Anytime a vendor sees a GPL3 library, all they have to do is make a network service out of it and the GPL3 license is powerless. So AGPL3 as the default for strong copyleft software seems reasonable.
  - CuriousCosmic 4y ago
    Sure but for a lot of libraries that just doesn't make sense. Like I get that you can give any library an RPC and call it a day but with 90% of the libraries I work with on a daily basis, requiring that you call it over the network just adds unnecessary complexity, kills ergonomics of use, and adds latency. As an engineer I'm not going to use an RPC to do an FFT, populate a native UI, access some device, or manipulate a datastructure. Instead I'll just use a tool/library that does what I need while staying in the application's address space. The disconnect I think is that I work on a lot of embedded software and native applications. In the world I am in, the hoops needed to allow a library to bypass the GPL just mean that I'm not going to use that library and that I'll do everything in my power to keep leadership from using projects with that kind of pointless failure mode. The same goes for web apps though. If it's delivered to the client and executed by the client, it can just be GPL. They have a copy of the code and are running it. They already have to have access to a copy of the source. AGPL provides no additional protections here. AGPL has it's place and that place is server side software. If you are writing software that the user directly interacts with and that is running on hardware the user can physically touch, the AGPL provides you no added benefit. If that's not the case, you should certainly feel free to step the license up to AGPL but there's no reason to artificially complicate license compatibility when you already know that it wouldn't be feasible for a user/developer to use your software without complying with the GPL.

simiones 4y ago

This has generally turned out to be a problem very few people have. In practice, $bigCorp is happy to publicize all of the changes they make to this software. They can then focus on out-competing anyone by offering a cheaper and/or better integrated managed version then the original creators can. This is explicitly why Mongo moved from the AGPL to a custom non-FOSS license; Elastic followed suite and skipped the AGPL altogether for a similar license. Overall, $bigCorp love having any changes they make in upstream: less maintenance burden on them for the parts that are not in their direct business, more time spent on working on their value-adds.