5 ms·

Counterpoint: Drew DeVault's essay, "The falsehoods of anti-AGPL propaganda": https://drewdevault.com/2020/07/27/Anti-AGPL-propaganda.html https://drewdevault.

Counterpoint: Drew DeVault's essay, "The falsehoods of anti-AGPL propaganda": https://drewdevault.com/2020/07/27/Anti-AGPL-propaganda.html https://drewdevault.com/2020/07/27/Anti-AGPL-propaganda.html

lolinder 3y ago
Drew misses a huge cause of misunderstandings about the AGPL, which is that some of the companies that use AGPL would love for AGPL to be more complicated than Drew's simple version. For example, iText PDF's entire business relies on interpreting the AGPL as being as viral as possible [0]: > You may not deploy it on a network without disclosing the full source code of your own applications under the AGPL license. You must distribute all source code, including your own product and web-based applications. > It’s a legal violation to use iText Core/Community and our open source add-ons in a non-AGPL environment. Rather than interpret Google's page[1] as some sort of psy-op, a simpler explanation is that there are many companies who use the AGPL license and want it to be totally viral even over network calls, and since the license has yet to be tested in court it's safest to just assume it has the strongest virality possible. [0] https://itextpdf.com/how-buy/AGPLv3-license https://itextpdf.com/how-buy/AGPLv3-license [1] https://opensource.google/documentation/reference/using/agpl-policy https://opensource.google/documentation/reference/using/agpl...
- AshamedCaptain 3y ago
  > Text PDF's entire business relies on interpreting the AGPL as being as viral as possible [0]: This page is just even more nonsensical than TFA. This is not "an interpretation of the AGPL that is as viral as possible", this is just a custom license that tries to masquerade itself as the AGPL. For example, the following term is batshit insane: > When using iText Core/Community under AGPL, you must prominently mention iText and include the iText copyright and AGPL license in output file metadata, and also retain the producer line in every PDF that is created or manipulated using iText. Yeah, no. If it was really AGPL, no one would forbid me from just removing all the watermarking code AND THEN publishing the non-watermark version to whoemever I wanted to. There's a friggin reason 4-clause BSD is considered incompatible with the GPL. The advertising clause doesn't fit into any of the additional requirements that the GPL allows you to exceptionally introduce. A watermark is even a stronger requirement.
  - lolinder 3y ago
    I'm inclined to agree that iText's position is bogus, but the point is that Google isn't inventing the idea of AGPL's virality out of whole cloth, they're using a definition that major vendors of AGPL software espouse. Interpreting it in the way that the vendors do is not a psy-op, it's just reasonable caution.
    - AshamedCaptain 3y ago
      Major vendors of what? I had never heard of iText before (unless it is related to the 90s PalmOS software of the same name ? ) . But in any case this is like trying to find problems in the GPL from a careful reading of the MS Public License. Sure the Ms-PL is a viral license from one of the "major software vendors of all history", but it is NOT the GPL.
- cratermoon 3y ago
  It sounds like iText wants a license that requires other developers to credit iText. Free advertising. But that's not the AGPL. Maybe the BSD license?
- josephcsible 3y ago
  Just because iText lies about what the AGPL requires doesn't mean that the AGPL is bad. If one company falsely claimed that their MIT-licensed product needed a different license for commercial use, would everyone start fearing the MIT license too?
  - lolinder 3y ago
    I'm not arguing that the AGPL is bad, I'm just arguing that Google isn't responsible for the false narratives surrounding it. The vendors of AGPL software have a clear and immediate motivation to exaggerate its effects (more commercial contracts), whereas the motivation that Drew posits for Google is a much more elaborate long con. Occam's razor suggests that the vendors are at fault.
- whartung 3y ago
  The “viral” part of AGPL comes from the GPL itself. If I write, say, a Java servlet that relies on an AGPL library, then by the same mechanics as effect GPL software, my servlet must now also be AGPL. Now I host my service and the servlet runs, sending content to whoever made the request. Whoever made that request to the servlet over the network is now entitled to the source code of the servlet. This is what the AGPL does. That whole effect stems from the original GPL, the AGPL just mucks with the new concept of network access being akin to the GPLs original use of distribution. If the library was just a GPL library, now even though the servlet is, now too, GPLd, there’s no obligation for source code release because the servlet was not “distributed”. Simply used on site of the servlet developer. Now if the original request is routed through a proxy, does the AGPL apply? Does the AGPL somehow “infect” the proxy? If not then a proxy is a simple AGPL firewall. If it does, let’s host some AGPL services and start make requests of AWS and Cloudflare for some of their source code. Which sounds pretty silly.
- paulmd 3y ago
  In iText's case this is not a misrepresentation - itext core is not a product like elastic or something that you interact with over the network, it's a library that you build into your program. And yes, in this case you would be bound by the license to release the programs you build it into, to the clients who interact with it over the network. The handwavey part is - what is "the application"? And they are not going into specifics there - it is, of course, only the application that you build it into. It doesn't virally extend to other things that interface with it over the network, and they're not going to say that part. You naturally can thus build a minimal "wrapper app" that just provides this library-as-a-service according to some interface, so that you didn't have to release your whole program, but, it is not a misrepresentation that if you use iText core then at least this program will be bound by AGPL and must be distributed.
somethingwitty1 3y ago
That starts off with "I'm not a lawyer". So as much as people think they understand it, lawyers have to read the actual text of the entire license and interpret what could happen in a court case. With the vagueness of the license, it isn't unreasonable for lawyers to read it and say "there is risk here. if this goes in front of the wrong judge, we could be in trouble"
- chx 3y ago
  > there is risk here. if this goes in front of the wrong judge, we could be in trouble This is it. I find it a compelling argument there is tremendous risk to AGPL if Google says so. They not only talk the talk but walk the walk: Google just indemnified AI (C) without limits putting 1.7 trillion dollars behind that statement. The same company said "nah, we are afraid of AGPL".
  - josephcsible 3y ago
    The AGPL is risky for Google because Google is in the business of making and hosting proprietary software.
    - chx 3y ago
      I wonder truly, is there any company above say 300 employees which does not have custom software.
      - josephcsible 3y ago
        The issue isn't that they have custom software. The issue is that their business model relies on their custom software being proprietary, and that's true of way fewer companies.
- AshamedCaptain 3y ago
  There's something much worse than "I'm not a lawyer" and that is "I'm not YOUR lawyer" -- you can practically assume that if you are reading a document produced by a lawyer you're not paying for, it is because it's trying to influence/scare you to act against your best interests (and into the lawyer's employers'). And FUD is a technique which is well defined in the handbook.
kccqzy 3y ago
The essay is wrong. I'm at least glad that the essay contains a disclaimer that the author isn't a lawyer. Because actual lawyers I've talked to disagree with the essay.
- Modified3019 3y ago
  What did they disagree about?
  - kube-system 3y ago
    As I understand, what exactly constitutes linking under GPL/AGPL hasn't been thoroughly tested in court in a way that is not up for some degree of interpretation.
giantrobot 3y ago
The AGPL is designed to infect code that isn't strictly "distributed" in the traditional sense. It considers deployment on internal infrastructure to be the same as distribution and requires code release. The core issue is what a court would consider derivative work. I would not consider a DB schema or SQL running on a server to be derivative of the AGPL DB server's code. A judge/jury might however. Then all of my SQL and any wrappers calling it become infected. This same question doesn't come up in a DB server licensed under the GPL, even v3. It's unlikely anyone could successfully argue that client node never publicly distributed could ever be considered distribution and therefore not derivative of the GPL code. Because there's not much if any legal precedent it's not really propaganda to be concerned by AGPL projects. It doesn't matter what is technically true. It only matters what a judge or jury can be convinced of to ruin a business. The AGPL opens more uncertainty than the GPLv3 which opens more uncertainty than GPLv2 or less viral licenses.
- pritambaral 3y ago
  I don't see how this is any different from how Java has to deal with what is considered "derivative work" under the GPL for code that uses the JRE. Similarly, I see no reason the solution employed by Java wouldn't work for your example AGPL db. I'm talking, of course, about the Class path exceptions.
gemstones 3y ago
Any derivative works of AGPL-licensed software must also use the AGPL. How a court interprets "derivative" here makes a big difference, that Drew doesn't seem to effectively counter. I'm not sure why his take on what it means will make a difference to what a judge may think it means. Until AGPL is tested over and over in court, and all interpretations converge on Drew's interpretation here, it's not safe to have anywhere in your commercial stack.
f33d5173 3y ago
> This is not true. They would be required to release their PostGIS patches in this situation. There's a license that actually works this way, namely the eupl. If drew is especially interested in having a license that works this way, perhaps he should consider adopting that license instead?

Counterpoint: Drew DeVault's essay, "The falsehoods of anti-AGPL propaganda": https://drewdevault.com/2020/07/27/Anti-AGPL-propaganda.html https://drewdevault.com/2020/07/27/Anti-AGPL-propaganda.html

lolinder 3y ago

Drew misses a huge cause of misunderstandings about the AGPL, which is that some of the companies that use AGPL would love for AGPL to be more complicated than Drew's simple version. For example, iText PDF's entire business relies on interpreting the AGPL as being as viral as possible [0]: > You may not deploy it on a network without disclosing the full source code of your own applications under the AGPL license. You must distribute all source code, including your own product and web-based applications. > It’s a legal violation to use iText Core/Community and our open source add-ons in a non-AGPL environment. Rather than interpret Google's page[1] as some sort of psy-op, a simpler explanation is that there are many companies who use the AGPL license and want it to be totally viral even over network calls, and since the license has yet to be tested in court it's safest to just assume it has the strongest virality possible. [0] https://itextpdf.com/how-buy/AGPLv3-license https://itextpdf.com/how-buy/AGPLv3-license [1] https://opensource.google/documentation/reference/using/agpl-policy https://opensource.google/documentation/reference/using/agpl...

AshamedCaptain 3y ago
> Text PDF's entire business relies on interpreting the AGPL as being as viral as possible [0]: This page is just even more nonsensical than TFA. This is not "an interpretation of the AGPL that is as viral as possible", this is just a custom license that tries to masquerade itself as the AGPL. For example, the following term is batshit insane: > When using iText Core/Community under AGPL, you must prominently mention iText and include the iText copyright and AGPL license in output file metadata, and also retain the producer line in every PDF that is created or manipulated using iText. Yeah, no. If it was really AGPL, no one would forbid me from just removing all the watermarking code AND THEN publishing the non-watermark version to whoemever I wanted to. There's a friggin reason 4-clause BSD is considered incompatible with the GPL. The advertising clause doesn't fit into any of the additional requirements that the GPL allows you to exceptionally introduce. A watermark is even a stronger requirement.
- lolinder 3y ago
  I'm inclined to agree that iText's position is bogus, but the point is that Google isn't inventing the idea of AGPL's virality out of whole cloth, they're using a definition that major vendors of AGPL software espouse. Interpreting it in the way that the vendors do is not a psy-op, it's just reasonable caution.
  - AshamedCaptain 3y ago
    Major vendors of what? I had never heard of iText before (unless it is related to the 90s PalmOS software of the same name ? ) . But in any case this is like trying to find problems in the GPL from a careful reading of the MS Public License. Sure the Ms-PL is a viral license from one of the "major software vendors of all history", but it is NOT the GPL.
cratermoon 3y ago
It sounds like iText wants a license that requires other developers to credit iText. Free advertising. But that's not the AGPL. Maybe the BSD license?
josephcsible 3y ago
Just because iText lies about what the AGPL requires doesn't mean that the AGPL is bad. If one company falsely claimed that their MIT-licensed product needed a different license for commercial use, would everyone start fearing the MIT license too?
- lolinder 3y ago
  I'm not arguing that the AGPL is bad, I'm just arguing that Google isn't responsible for the false narratives surrounding it. The vendors of AGPL software have a clear and immediate motivation to exaggerate its effects (more commercial contracts), whereas the motivation that Drew posits for Google is a much more elaborate long con. Occam's razor suggests that the vendors are at fault.
whartung 3y ago
The “viral” part of AGPL comes from the GPL itself. If I write, say, a Java servlet that relies on an AGPL library, then by the same mechanics as effect GPL software, my servlet must now also be AGPL. Now I host my service and the servlet runs, sending content to whoever made the request. Whoever made that request to the servlet over the network is now entitled to the source code of the servlet. This is what the AGPL does. That whole effect stems from the original GPL, the AGPL just mucks with the new concept of network access being akin to the GPLs original use of distribution. If the library was just a GPL library, now even though the servlet is, now too, GPLd, there’s no obligation for source code release because the servlet was not “distributed”. Simply used on site of the servlet developer. Now if the original request is routed through a proxy, does the AGPL apply? Does the AGPL somehow “infect” the proxy? If not then a proxy is a simple AGPL firewall. If it does, let’s host some AGPL services and start make requests of AWS and Cloudflare for some of their source code. Which sounds pretty silly.
paulmd 3y ago
In iText's case this is not a misrepresentation - itext core is not a product like elastic or something that you interact with over the network, it's a library that you build into your program. And yes, in this case you would be bound by the license to release the programs you build it into, to the clients who interact with it over the network. The handwavey part is - what is "the application"? And they are not going into specifics there - it is, of course, only the application that you build it into. It doesn't virally extend to other things that interface with it over the network, and they're not going to say that part. You naturally can thus build a minimal "wrapper app" that just provides this library-as-a-service according to some interface, so that you didn't have to release your whole program, but, it is not a misrepresentation that if you use iText core then at least this program will be bound by AGPL and must be distributed.

somethingwitty1 3y ago

That starts off with "I'm not a lawyer". So as much as people think they understand it, lawyers have to read the actual text of the entire license and interpret what could happen in a court case. With the vagueness of the license, it isn't unreasonable for lawyers to read it and say "there is risk here. if this goes in front of the wrong judge, we could be in trouble"

chx 3y ago
> there is risk here. if this goes in front of the wrong judge, we could be in trouble This is it. I find it a compelling argument there is tremendous risk to AGPL if Google says so. They not only talk the talk but walk the walk: Google just indemnified AI (C) without limits putting 1.7 trillion dollars behind that statement. The same company said "nah, we are afraid of AGPL".
- josephcsible 3y ago
  The AGPL is risky for Google because Google is in the business of making and hosting proprietary software.
  - chx 3y ago
    I wonder truly, is there any company above say 300 employees which does not have custom software.
    - josephcsible 3y ago
      The issue isn't that they have custom software. The issue is that their business model relies on their custom software being proprietary, and that's true of way fewer companies.
AshamedCaptain 3y ago
There's something much worse than "I'm not a lawyer" and that is "I'm not YOUR lawyer" -- you can practically assume that if you are reading a document produced by a lawyer you're not paying for, it is because it's trying to influence/scare you to act against your best interests (and into the lawyer's employers'). And FUD is a technique which is well defined in the handbook.

kccqzy 3y ago

The essay is wrong. I'm at least glad that the essay contains a disclaimer that the author isn't a lawyer. Because actual lawyers I've talked to disagree with the essay.

Modified3019 3y ago
What did they disagree about?
- kube-system 3y ago
  As I understand, what exactly constitutes linking under GPL/AGPL hasn't been thoroughly tested in court in a way that is not up for some degree of interpretation.

giantrobot 3y ago

The AGPL is designed to infect code that isn't strictly "distributed" in the traditional sense. It considers deployment on internal infrastructure to be the same as distribution and requires code release. The core issue is what a court would consider derivative work. I would not consider a DB schema or SQL running on a server to be derivative of the AGPL DB server's code. A judge/jury might however. Then all of my SQL and any wrappers calling it become infected. This same question doesn't come up in a DB server licensed under the GPL, even v3. It's unlikely anyone could successfully argue that client node never publicly distributed could ever be considered distribution and therefore not derivative of the GPL code. Because there's not much if any legal precedent it's not really propaganda to be concerned by AGPL projects. It doesn't matter what is technically true. It only matters what a judge or jury can be convinced of to ruin a business. The AGPL opens more uncertainty than the GPLv3 which opens more uncertainty than GPLv2 or less viral licenses.

pritambaral 3y ago
I don't see how this is any different from how Java has to deal with what is considered "derivative work" under the GPL for code that uses the JRE. Similarly, I see no reason the solution employed by Java wouldn't work for your example AGPL db. I'm talking, of course, about the Class path exceptions.

gemstones 3y ago

Any derivative works of AGPL-licensed software must also use the AGPL. How a court interprets "derivative" here makes a big difference, that Drew doesn't seem to effectively counter. I'm not sure why his take on what it means will make a difference to what a judge may think it means. Until AGPL is tested over and over in court, and all interpretations converge on Drew's interpretation here, it's not safe to have anywhere in your commercial stack.

f33d5173 3y ago

> This is not true. They would be required to release their PostGIS patches in this situation. There's a license that actually works this way, namely the eupl. If drew is especially interested in having a license that works this way, perhaps he should consider adopting that license instead?