5 ms·

Actually as long as they don't distribute the code, even under GPL they don't have to share it.

by zobzu 13y ago

dontmakemelaugh 13y ago
You mean the application? They need to distribute the code if they provide applications based on the code.
midas007 13y ago
Yup. It's pretty common for open source to be used, abused, modified in house and not shared. Just look at Sergey Aleynikov and Goldman Sachs. [0] Further I've seen a shop deploy hundreds of thousands of CentOS nodes to avoid RHEL license fees. Doesn't even begin to scratch the surface of shops not funding FOSS they exploit like OpenSSH, etc. Most of them are stingy, demanding, greedy bastards. [0] http://blog.garrytan.com/goldman-sachs-sent-a-brilliant-computer-scientist-to-jail-over-8mb-of-open-source-code-uploaded-to-an-svn-repo http://blog.garrytan.com/goldman-sachs-sent-a-brilliant-comp...
- aspensmonster 13y ago
  >Most of them are stingy, demanding, greedy bastards. I'd go so far as to say "nearly all of them."
  - midas007 13y ago
    There's a few counterexamples, which is a good thing: iXSystems does a lot of cool community work via FreeNAS, PC-BSD and FreeBSD. Github (Ruby), thoughtbot (Ruby), Google (Go, Python), Dropbox (Python), AT&T (C++, Ruby), Zurb (Ruby, Foundation), Twitter (Ruby, Scala), ... missing a bunch and some platforms too.
  - midas007 13y ago
    Also part of the reason I grabbed the eject handles on enterprise devops consulting. Although I did manage to fight and win open sourcing changes to net-ldap so that it worked with A-D.
- personZ 13y ago
  Further I've seen a shop deploy hundreds of thousands of CentOS nodes to avoid RHEL license fees Such decisions often happen at the engineer level, and it isn't for money management reasons, but rather "avoid purchasing and requisition BS, followed by licensing compliant BS" reasons.
jpalomaki 13y ago
GNU Affero license changes that: https://www.gnu.org/licenses/why-affero-gpl.html https://www.gnu.org/licenses/why-affero-gpl.html "It [Affero GPL License] has one added requirement: if you run the program on a server and let other users communicate with it there, your server must also allow them to download the source code corresponding to the program that it's running."
- orik 13y ago
  And if OpenSSL had been licensed with a GNU Affero license, we'd all be running something else.
- muyuu 13y ago
  AGPL is not the same as plain GPL. The vast majority of the code with a licence from the GPL family is not AGPL, but GPLv2, GPLv3 or LGPL. I understand the reasoning behind AGPL and on the surface it seems like a good idea, to stop the parasitic behaviour many have towards FOSS. But there are many situations where you have very legit reasons to avoid it. Even in this case, AGPL would put you in a delicate position where you need to immediately disclose the changes you made without respecting the non-disclosure period for mitigation. It's a licence that tries to solve the problem of the GPL going obsolete when many companies no longer distribute software, but rather services based on the software (like Google or Facebook) and they can basically get away with not giving anything back at all to the community work they built upon. But this is very hard to regulate and as a result AGPL is often so cumbersome that AGPL-licensed code is strongly avoided, and it's also extremely hard to enforce when the service simply doesn't release any code or software.
  - judk 13y ago
    It is not true that AGPL is incompatible with responsible disclosure. Responsible disclosure timelines mean that the source code would be published long before anyone had time to complain about the source not being available. Enforcement is hard, but AGPL is strictly stronger than GPL which doesn't evenninvitr enforcement on sharing server code. Yes, many companies avoid AGPL software. That isn't a problem for AGPL-leaning authors, that's the point.
okasaki 13y ago
But it's still GPL and anyone who works at the company is free to share it. Whereas with Apache they can just make the entire thing proprietary and forbid sharing. Granged, we don't know that that's what happened here. Maybe their version was still Apache licenced and nobody bothered to share it at any point.
- jre 13y ago
  IANAL, but I don't think that's how it works. The GPL allows the licensee to redistribute the code and so on. But if you're working for a company, you are not the licensee, the company is (in the same way the company owns the copyright on your work, not you). Otherwise, the AGPL would never have seen the light of day.
- axiak 13y ago
  No, this is incorrect. Just because the original code is GPL, doesn't automatically make it legal for any modifications to be released to the public as GPL without the copyright owner's consent. (In this case, the company owns the copyright.)
- computer 13y ago
  Modifications made to non-distributed GPL code are not automatically GPL. Only distribution of code derived from GPL-licensed code requires a GPL license for that derivative. But even on publication a modification/derivation of GPL-licensed code is not automatically GPL. It can also just be copyrighted code published in violation of the GPL. So, it's also not true that "any employee of the company can publish the modications to the GPL-licensed code".

Actually as long as they don't distribute the code, even under GPL they don't have to share it.

by zobzu 13y ago

Actually as long as they don't distribute the code, even under GPL they don't have to share it.

dontmakemelaugh 13y ago

You mean the application? They need to distribute the code if they provide applications based on the code.

midas007 13y ago

Yup. It's pretty common for open source to be used, abused, modified in house and not shared. Just look at Sergey Aleynikov and Goldman Sachs. [0] Further I've seen a shop deploy hundreds of thousands of CentOS nodes to avoid RHEL license fees. Doesn't even begin to scratch the surface of shops not funding FOSS they exploit like OpenSSH, etc. Most of them are stingy, demanding, greedy bastards. [0] http://blog.garrytan.com/goldman-sachs-sent-a-brilliant-computer-scientist-to-jail-over-8mb-of-open-source-code-uploaded-to-an-svn-repo http://blog.garrytan.com/goldman-sachs-sent-a-brilliant-comp...

aspensmonster 13y ago
>Most of them are stingy, demanding, greedy bastards. I'd go so far as to say "nearly all of them."
- midas007 13y ago
  There's a few counterexamples, which is a good thing: iXSystems does a lot of cool community work via FreeNAS, PC-BSD and FreeBSD. Github (Ruby), thoughtbot (Ruby), Google (Go, Python), Dropbox (Python), AT&T (C++, Ruby), Zurb (Ruby, Foundation), Twitter (Ruby, Scala), ... missing a bunch and some platforms too.
- midas007 13y ago
  Also part of the reason I grabbed the eject handles on enterprise devops consulting. Although I did manage to fight and win open sourcing changes to net-ldap so that it worked with A-D.
personZ 13y ago
Further I've seen a shop deploy hundreds of thousands of CentOS nodes to avoid RHEL license fees Such decisions often happen at the engineer level, and it isn't for money management reasons, but rather "avoid purchasing and requisition BS, followed by licensing compliant BS" reasons.

jpalomaki 13y ago

GNU Affero license changes that: https://www.gnu.org/licenses/why-affero-gpl.html https://www.gnu.org/licenses/why-affero-gpl.html "It [Affero GPL License] has one added requirement: if you run the program on a server and let other users communicate with it there, your server must also allow them to download the source code corresponding to the program that it's running."

orik 13y ago
And if OpenSSL had been licensed with a GNU Affero license, we'd all be running something else.
muyuu 13y ago
AGPL is not the same as plain GPL. The vast majority of the code with a licence from the GPL family is not AGPL, but GPLv2, GPLv3 or LGPL. I understand the reasoning behind AGPL and on the surface it seems like a good idea, to stop the parasitic behaviour many have towards FOSS. But there are many situations where you have very legit reasons to avoid it. Even in this case, AGPL would put you in a delicate position where you need to immediately disclose the changes you made without respecting the non-disclosure period for mitigation. It's a licence that tries to solve the problem of the GPL going obsolete when many companies no longer distribute software, but rather services based on the software (like Google or Facebook) and they can basically get away with not giving anything back at all to the community work they built upon. But this is very hard to regulate and as a result AGPL is often so cumbersome that AGPL-licensed code is strongly avoided, and it's also extremely hard to enforce when the service simply doesn't release any code or software.
- judk 13y ago
  It is not true that AGPL is incompatible with responsible disclosure. Responsible disclosure timelines mean that the source code would be published long before anyone had time to complain about the source not being available. Enforcement is hard, but AGPL is strictly stronger than GPL which doesn't evenninvitr enforcement on sharing server code. Yes, many companies avoid AGPL software. That isn't a problem for AGPL-leaning authors, that's the point.

okasaki 13y ago

But it's still GPL and anyone who works at the company is free to share it. Whereas with Apache they can just make the entire thing proprietary and forbid sharing. Granged, we don't know that that's what happened here. Maybe their version was still Apache licenced and nobody bothered to share it at any point.

jre 13y ago
IANAL, but I don't think that's how it works. The GPL allows the licensee to redistribute the code and so on. But if you're working for a company, you are not the licensee, the company is (in the same way the company owns the copyright on your work, not you). Otherwise, the AGPL would never have seen the light of day.
axiak 13y ago
No, this is incorrect. Just because the original code is GPL, doesn't automatically make it legal for any modifications to be released to the public as GPL without the copyright owner's consent. (In this case, the company owns the copyright.)
computer 13y ago
Modifications made to non-distributed GPL code are not automatically GPL. Only distribution of code derived from GPL-licensed code requires a GPL license for that derivative. But even on publication a modification/derivation of GPL-licensed code is not automatically GPL. It can also just be copyrighted code published in violation of the GPL. So, it's also not true that "any employee of the company can publish the modications to the GPL-licensed code".