4 ms·

> No, there isn't. FOSS licenses makes devs complain because "cloud companies are vultures"; SSPL license (or similar) makes devs complain because it's not FOSS

> No, there isn't. FOSS licenses makes devs complain because "cloud companies are vultures"; SSPL license (or similar) makes devs complain because it's not FOSS (even if it doesn't affect them). Somehow this discussion never mentions AGPL, which is widely considered FOSS, and yet companies seem to hate it?

jsiepkes 3y ago
Companies (and their lawyers) hate it because the AGPL (and also the GPL and LGPL) contain a lot of fluffy wording which can be interpreted in a lot of ways. In contrast take for example the CDDL. It just says: This particular source file is CDDL licensed. If you modify and create a "result" (binary) from it which you distribute you have to share it if someone asks for it. In contrast licenses like the LGPL for example talk about having to supply the means to rebuild it and such. What that means exactly and where it begins and ends? That's for a judge to decide.
- darkwater 3y ago
  > In contrast licenses like the LGPL for example talk about having to supply the means to rebuild it and such. What that means exactly and where it begins and ends? That's for a judge to decide. That... makes sense? Otherwise you could release your Free Software and at the same time create a proprietary compiler that cannot be reverse engineered because it would break your IP, but hey, you can license it at a nice recurring fee and you are still producing Free Software!
  - robertlagrant 3y ago
    You're assuming malice, when really it's just impractical in most cases that object to this wording. What if my software build includes a Windows client, which needs some DLL from an install of Visual Studio? The licence wording as I understand it doesn't differentiate well enough between "large cloud company trying to use my work" and "everyone else".
    - wizzwizz4 3y ago
      In that particular case, simply distribute the DLL with the source code. Microsoft lets you: they even have "redistributable" in the name!
      - robertlagrant 3y ago
        Hah well, that's true. But there may be tougher cases than the one I came up with.
      - joseda-hg 3y ago
        You're arguing the example, not the concept What if it depends on something that's not created to be redistributable?
        wizzwizz4 3y ago
        We can ask "what if" forever. I've never seen an example, you've never seen an example: yeah, it's good to be prepared, but what if we're painting ourselves into corners over things that'll never occur?
- Zambyte 3y ago
  This argument cannot be made in favor of the SSPL, considering the SSPL is literally the AGPL (like, verbatim) with extra terms.
mvdtnz 3y ago
It's no mystery why companies hate AGPL. It's a hugely risky license that can, in some cases, endanger entire companies. https://opensource.google/documentation/reference/using/agpl-policy https://opensource.google/documentation/reference/using/agpl...
- graemep 3y ago
  It is a risk if you operate in a way that breaches copyright. > It's a hugely risky license that can, in some cases, endanger entire companies. it can no more endanger a company than any other breach of copyright. It is exactly the same as distributing software using GPL library. Google are fine with GPL because it is not a problem for their particulalr business mode.
- ebiester 3y ago
  Then Buy A License. Most code today with AGPL is dual-licensed.
pizza234 3y ago
The discussion needs to be split in two: the why of AGPL/SSPL, and the hate against them (and from who). Re:why - SSPL is intended to be an improvement of AGPL, because according to some, it's possible by a cloud provider to work it around. Re:hate by big companies - Google has an explicit policy, which says: The license places restrictions on software used over a network which are extremely difficult for Google to comply with. Using AGPL software requires that anything it links to must also be licensed under the AGPL. Even if you think you aren’t linking to anything important, it still presents a huge risk to Google because of how integrated much of our code is. The risks heavily outweigh the benefits. I think that there's no way for a license to be formally exact on preventing cloud services to appropriate a code base. AGPL was an attempt (presumably failed), and SSPL failed for the exactness reason (which is the reason why it was rejected).
- kevincox 3y ago
  I think there is a fundamental "proxy problem" with AGPL-like licenses. If I put a transparent proxy in front of the service and let users connect to that am I exposing it to them? Almost certainly yes. What about a proxy that provides a HTTP API for the database and then translates it to the native protocol? Probably also considered exposing. If I put stock data into the database and put up a website that displays a stock ticker am I exposing the database to them? Very likely not? But what if the user can also write stock values? What if they can sum the values of various stocks. Basically there is no clear line where you stop exposing the database to the user and you stop needing to provide the source of whatever intermediate services you are using. So lawyers will recommend erring on the side of caution and just not touching it.

jsiepkes 3y ago

Companies (and their lawyers) hate it because the AGPL (and also the GPL and LGPL) contain a lot of fluffy wording which can be interpreted in a lot of ways. In contrast take for example the CDDL. It just says: This particular source file is CDDL licensed. If you modify and create a "result" (binary) from it which you distribute you have to share it if someone asks for it. In contrast licenses like the LGPL for example talk about having to supply the means to rebuild it and such. What that means exactly and where it begins and ends? That's for a judge to decide.

darkwater 3y ago
> In contrast licenses like the LGPL for example talk about having to supply the means to rebuild it and such. What that means exactly and where it begins and ends? That's for a judge to decide. That... makes sense? Otherwise you could release your Free Software and at the same time create a proprietary compiler that cannot be reverse engineered because it would break your IP, but hey, you can license it at a nice recurring fee and you are still producing Free Software!
- robertlagrant 3y ago
  You're assuming malice, when really it's just impractical in most cases that object to this wording. What if my software build includes a Windows client, which needs some DLL from an install of Visual Studio? The licence wording as I understand it doesn't differentiate well enough between "large cloud company trying to use my work" and "everyone else".
  - wizzwizz4 3y ago
    In that particular case, simply distribute the DLL with the source code. Microsoft lets you: they even have "redistributable" in the name!
    - robertlagrant 3y ago
      Hah well, that's true. But there may be tougher cases than the one I came up with.
    - joseda-hg 3y ago
      You're arguing the example, not the concept What if it depends on something that's not created to be redistributable?
      - wizzwizz4 3y ago
        We can ask "what if" forever. I've never seen an example, you've never seen an example: yeah, it's good to be prepared, but what if we're painting ourselves into corners over things that'll never occur?
Zambyte 3y ago
This argument cannot be made in favor of the SSPL, considering the SSPL is literally the AGPL (like, verbatim) with extra terms.

mvdtnz 3y ago

It's no mystery why companies hate AGPL. It's a hugely risky license that can, in some cases, endanger entire companies. https://opensource.google/documentation/reference/using/agpl-policy https://opensource.google/documentation/reference/using/agpl...

graemep 3y ago
It is a risk if you operate in a way that breaches copyright. > It's a hugely risky license that can, in some cases, endanger entire companies. it can no more endanger a company than any other breach of copyright. It is exactly the same as distributing software using GPL library. Google are fine with GPL because it is not a problem for their particulalr business mode.
ebiester 3y ago
Then Buy A License. Most code today with AGPL is dual-licensed.

pizza234 3y ago

The discussion needs to be split in two: the why of AGPL/SSPL, and the hate against them (and from who). Re:why - SSPL is intended to be an improvement of AGPL, because according to some, it's possible by a cloud provider to work it around. Re:hate by big companies - Google has an explicit policy, which says: The license places restrictions on software used over a network which are extremely difficult for Google to comply with. Using AGPL software requires that anything it links to must also be licensed under the AGPL. Even if you think you aren’t linking to anything important, it still presents a huge risk to Google because of how integrated much of our code is. The risks heavily outweigh the benefits. I think that there's no way for a license to be formally exact on preventing cloud services to appropriate a code base. AGPL was an attempt (presumably failed), and SSPL failed for the exactness reason (which is the reason why it was rejected).

kevincox 3y ago
I think there is a fundamental "proxy problem" with AGPL-like licenses. If I put a transparent proxy in front of the service and let users connect to that am I exposing it to them? Almost certainly yes. What about a proxy that provides a HTTP API for the database and then translates it to the native protocol? Probably also considered exposing. If I put stock data into the database and put up a website that displays a stock ticker am I exposing the database to them? Very likely not? But what if the user can also write stock values? What if they can sum the values of various stocks. Basically there is no clear line where you stop exposing the database to the user and you stop needing to provide the source of whatever intermediate services you are using. So lawyers will recommend erring on the side of caution and just not touching it.