3 ms·

> if I use Minio in my stack without modifications (as a file server that my other services interact with via an API), do I have to AGPL all the stuff the touch

> if I use Minio in my stack without modifications (as a file server that my other services interact with via an API), do I have to AGPL all the stuff the touches Minio or not No and it's spelled out very clearly in the license.

zadokshi 2y ago
No it is not clearly spelled out. So I am wondering why you think it is clear. Perhaps you are misunderstanding the problem that is being raised? I’m not sure.
haytamoptika 2y ago
https://www.gnu.org/licenses/gpl-faq.en.html https://www.gnu.org/licenses/gpl-faq.en.html "However, in many cases you can distribute the GPL-covered software alongside your proprietary system. To do this validly, you must make sure that the free and nonfree programs communicate at arms length, that they are not combined in a way that would make them effectively a single program." I think you can interact with GPL/AGPL and retain your code propietary by: - Don't modify the AGPL program. - Run separatly, using docker container, vm etc - Interact with CLI, REST API, filesystem, database etc - Keep the AGPL interaction only to your program, non public consumption, minimum the surface of distirbution the code. - Keep your code non directly interact, such as avoid use node npm dependencies directly, avoid library linking, use api gateway, use thirdparty module.
- demurgos 2y ago
  You linked a more general FAQ for the GPL. Would you have a more specific quote or link for interactions with AGPL code?
  - misterio7 2y ago
    AFAIK, the difference between AGPL is GPL is on what constitutes "distribution"; what constitutes a "derivative" is still the same. https://drewdevault.com/2020/07/27/Anti-AGPL-propaganda.html https://drewdevault.com/2020/07/27/Anti-AGPL-propaganda.html
    - demurgos 2y ago
      Thank you!
  - camgunz 2y ago
    "In AGPLv3, what counts as 'interacting with [the software] remotely through a computer network?'" "If the program is expressly designed to accept user requests and send responses over a network, then it meets these criteria. Common examples of programs that would fall into this category include web and mail servers, interactive web-based applications, and servers for games that are played online." "If a program is not expressly designed to interact with a user through a network, but is being run in an environment where it happens to do so, then it does not fall into this category. For example, an application is not required to provide source merely because the user is running it over SSH, or a remote X session." [0]: https://www.gnu.org/licenses/gpl-faq.html#AGPLv3InteractingRemotely https://www.gnu.org/licenses/gpl-faq.html#AGPLv3InteractingR...
    - demurgos 2y ago
      Thank you!
- ashkankiani 2y ago
  "This License explicitly affirms your unlimited permission to run the unmodified Program." In the Basic permissions of the actual content of the license https://github.com/minio/minio/blob/master/LICENSE https://github.com/minio/minio/blob/master/LICENSE It's not that difficult to parse if you actually read it top to bottom instead of skimming.
- afro88 2y ago
  Github may have it wrong then? Their summary says: > Permissions of this strongest copyleft license are conditioned on making available complete source code of licensed works and modifications, which include larger works using a licensed work, under the same license. Note the last part: "which include licensed works using a licensed work"
  - xyzzy_plugh 2y ago
    No, GitHub has it exactly right. Ultimately this sort of thing has to be settled in court.
    - camgunz 2y ago
      At least in the EU there's some precedent where AGPLv3+ won out, though it was through settlement and not judgement (and it's not super clear how contentious the parties were anyway) [0] [0]: https://archive.fosdem.org/2021/schedule/event/agplcompliance/ https://archive.fosdem.org/2021/schedule/event/agplcomplianc...
  - camgunz 2y ago
    Yeah I wouldn't rely on their editorializing. It's best to just refer to the FAQ [0], which covers these questions. [0]: https://www.gnu.org/licenses/gpl-faq.html https://www.gnu.org/licenses/gpl-faq.html
mrbluecoat 2y ago
I think the length of this HN discussion is evidence enough that AGPL isn't clear. In my experience, organizations that use AGPL do so to 1) ward off an active non-paying community with its associated support cost, 2) claim open source to help convince you to buy their software/service, 3) hire skill-vetted programmers, 4) allow third-party security audits, and/or 5) avoid being jaded by someone that can market or host their solution better than they can.
- camgunz 2y ago
  It can also be evidence that HN posters have a poor understanding of GPL licenses. Pretty much all these questions are answered in the FAQ [0]. Your guess is as good as mine as to why people continually post random, uninformed, needlessly conservative takes on them instead of just doing a small amount of reading. [0]: https://www.gnu.org/licenses/gpl-faq.html https://www.gnu.org/licenses/gpl-faq.html
  - SpicyLemonZest 2y ago
    The FAQ is not at all clear about this question. #GPLInProprietarySystem says that you unconditionally cannot "incorporate GPL-covered software in a proprietary system", although it might be OK to ship a proprietary system that integrates with and depends on GPL software so long as "the two programs remain well separated". How do I know whether a particular API usage qualifies as well separated or not? The only standard described is "like the compiler and the kernel, or like an editor and a shell".
    - camgunz 2y ago
      > How do I know whether a particular API usage qualifies as well separated or not? The two paragraphs above what you quoted are: "However, in many cases you can distribute the GPL-covered software alongside your proprietary system. To do this validly, you must make sure that the free and nonfree programs communicate at arms length, that they are not combined in a way that would make them effectively a single program." "The difference between this and 'incorporating' the GPL-covered software is partly a matter of substance and partly form. The substantive part is this: if the two programs are combined so that they become effectively two parts of one program, then you can't treat them as two separate programs. So the GPL has to cover the whole thing." Two programs communicating over a socket aren't incorporated. They're two programs.
afro88 2y ago
Is it? Doesn't it depend on whether your stack depends on it to function, or if it is standalone that your stack can connect to but doesn't rely on?
yencabulator 2y ago
Only after people badgered them to remove their claim that anything communicating with Minio gets infected by AGPL immediately. Their compliance page used to claim: > Combining MinIO software as part of a larger software stack triggers your GNU AGPL v3 obligations. The method of combining does not matter. When MinIO is linked to a larger software stack in any form, including statically, dynamically, pipes, or containerized and invoked remotely, the AGPL v3 applies to your use. What triggers the AGPL v3 obligations is the exchanging data between the larger stack and MinIO. That version has, unfortunately, not been archived at web.archive.org or such. Some remnants of the old compliance text are still mentioned: https://github.com/minio/operator/issues/2030 https://github.com/minio/operator/issues/2030

zadokshi 2y ago

No it is not clearly spelled out. So I am wondering why you think it is clear. Perhaps you are misunderstanding the problem that is being raised? I’m not sure.

haytamoptika 2y ago

https://www.gnu.org/licenses/gpl-faq.en.html https://www.gnu.org/licenses/gpl-faq.en.html "However, in many cases you can distribute the GPL-covered software alongside your proprietary system. To do this validly, you must make sure that the free and nonfree programs communicate at arms length, that they are not combined in a way that would make them effectively a single program." I think you can interact with GPL/AGPL and retain your code propietary by: - Don't modify the AGPL program. - Run separatly, using docker container, vm etc - Interact with CLI, REST API, filesystem, database etc - Keep the AGPL interaction only to your program, non public consumption, minimum the surface of distirbution the code. - Keep your code non directly interact, such as avoid use node npm dependencies directly, avoid library linking, use api gateway, use thirdparty module.

demurgos 2y ago
You linked a more general FAQ for the GPL. Would you have a more specific quote or link for interactions with AGPL code?
- misterio7 2y ago
  AFAIK, the difference between AGPL is GPL is on what constitutes "distribution"; what constitutes a "derivative" is still the same. https://drewdevault.com/2020/07/27/Anti-AGPL-propaganda.html https://drewdevault.com/2020/07/27/Anti-AGPL-propaganda.html
  - demurgos 2y ago
    Thank you!
- camgunz 2y ago
  "In AGPLv3, what counts as 'interacting with [the software] remotely through a computer network?'" "If the program is expressly designed to accept user requests and send responses over a network, then it meets these criteria. Common examples of programs that would fall into this category include web and mail servers, interactive web-based applications, and servers for games that are played online." "If a program is not expressly designed to interact with a user through a network, but is being run in an environment where it happens to do so, then it does not fall into this category. For example, an application is not required to provide source merely because the user is running it over SSH, or a remote X session." [0]: https://www.gnu.org/licenses/gpl-faq.html#AGPLv3InteractingRemotely https://www.gnu.org/licenses/gpl-faq.html#AGPLv3InteractingR...
  - demurgos 2y ago
    Thank you!
ashkankiani 2y ago
"This License explicitly affirms your unlimited permission to run the unmodified Program." In the Basic permissions of the actual content of the license https://github.com/minio/minio/blob/master/LICENSE https://github.com/minio/minio/blob/master/LICENSE It's not that difficult to parse if you actually read it top to bottom instead of skimming.
afro88 2y ago
Github may have it wrong then? Their summary says: > Permissions of this strongest copyleft license are conditioned on making available complete source code of licensed works and modifications, which include larger works using a licensed work, under the same license. Note the last part: "which include licensed works using a licensed work"
- xyzzy_plugh 2y ago
  No, GitHub has it exactly right. Ultimately this sort of thing has to be settled in court.
  - camgunz 2y ago
    At least in the EU there's some precedent where AGPLv3+ won out, though it was through settlement and not judgement (and it's not super clear how contentious the parties were anyway) [0] [0]: https://archive.fosdem.org/2021/schedule/event/agplcompliance/ https://archive.fosdem.org/2021/schedule/event/agplcomplianc...
- camgunz 2y ago
  Yeah I wouldn't rely on their editorializing. It's best to just refer to the FAQ [0], which covers these questions. [0]: https://www.gnu.org/licenses/gpl-faq.html https://www.gnu.org/licenses/gpl-faq.html

mrbluecoat 2y ago

I think the length of this HN discussion is evidence enough that AGPL isn't clear. In my experience, organizations that use AGPL do so to 1) ward off an active non-paying community with its associated support cost, 2) claim open source to help convince you to buy their software/service, 3) hire skill-vetted programmers, 4) allow third-party security audits, and/or 5) avoid being jaded by someone that can market or host their solution better than they can.

camgunz 2y ago
It can also be evidence that HN posters have a poor understanding of GPL licenses. Pretty much all these questions are answered in the FAQ [0]. Your guess is as good as mine as to why people continually post random, uninformed, needlessly conservative takes on them instead of just doing a small amount of reading. [0]: https://www.gnu.org/licenses/gpl-faq.html https://www.gnu.org/licenses/gpl-faq.html
- SpicyLemonZest 2y ago
  The FAQ is not at all clear about this question. #GPLInProprietarySystem says that you unconditionally cannot "incorporate GPL-covered software in a proprietary system", although it might be OK to ship a proprietary system that integrates with and depends on GPL software so long as "the two programs remain well separated". How do I know whether a particular API usage qualifies as well separated or not? The only standard described is "like the compiler and the kernel, or like an editor and a shell".
  - camgunz 2y ago
    > How do I know whether a particular API usage qualifies as well separated or not? The two paragraphs above what you quoted are: "However, in many cases you can distribute the GPL-covered software alongside your proprietary system. To do this validly, you must make sure that the free and nonfree programs communicate at arms length, that they are not combined in a way that would make them effectively a single program." "The difference between this and 'incorporating' the GPL-covered software is partly a matter of substance and partly form. The substantive part is this: if the two programs are combined so that they become effectively two parts of one program, then you can't treat them as two separate programs. So the GPL has to cover the whole thing." Two programs communicating over a socket aren't incorporated. They're two programs.

afro88 2y ago

Is it? Doesn't it depend on whether your stack depends on it to function, or if it is standalone that your stack can connect to but doesn't rely on?

yencabulator 2y ago

Only after people badgered them to remove their claim that anything communicating with Minio gets infected by AGPL immediately. Their compliance page used to claim: > Combining MinIO software as part of a larger software stack triggers your GNU AGPL v3 obligations. The method of combining does not matter. When MinIO is linked to a larger software stack in any form, including statically, dynamically, pipes, or containerized and invoked remotely, the AGPL v3 applies to your use. What triggers the AGPL v3 obligations is the exchanging data between the larger stack and MinIO. That version has, unfortunately, not been archived at web.archive.org or such. Some remnants of the old compliance text are still mentioned: https://github.com/minio/operator/issues/2030 https://github.com/minio/operator/issues/2030