7 ms·

So in the end he didn't actually explain, why he chose AGPLv3. "Because I think it is the right license for this project". Of course he does: otherwise he would

by krick 11y ago

So in the end he didn't actually explain, why he chose AGPLv3. "Because I think it is the right license for this project". Of course he does: otherwise he wouldn't chose it. Essentially it translates to "I chose it because I chose it". But why? If I would participate in the voting I would probably skim both, look at Wikipedia and some of these "license explained" projects, but I doubt it would be enough to be sure my vote is the right one whatever election result will be in the end. What it actually means for the project to take this or that stand? I wonder, how many people who actually voted where thinking something like this? Maybe it would be better if anybody who knows for himself which decision is right would share his opinion explicitly. Who knows, maybe the voting result wouldn't look so "divided" after such a discussion.

nekopa 11y ago
But he did explain it :- The AGPLv3 on the other hand, is a political and ethical line in the sand. And so is Mailpile.
- insaneirish 11y ago
  > The AGPLv3 on the other hand, is a political and ethical line in the sand. And a good way to completely scare away a good subset of potential users.
  - rodgerd 11y ago
    Which ones? The ones who want to build services on the tool without contributing back to it? Perhaps the author feels like they are no-value users.
    - quadrangle 11y ago
      Or negative value users
    - Pyxl101 11y ago
      It's more complicated than that. Part of the problem is that it's difficult to predict how a variety of complex situations will turn out in court. With strongly opinionated licenses like AGPLv3, it's difficult to know if you're using the software "safely" in full compliance with the license without putting yourself at risk in unintended ways. Many of the complex situations that could come up in a protracted legal battle have not been tested in a court, so there is no precedent allowing one to determine for sure how technical issues will be viewed in terms of the license. Due to the risks and complexity around these issues, and the high cost of "getting it wrong" either in one's analysis or in making a mistake, many firms choose to stay away from projects licensed with AGPLv3 even if they are actually intending to use the software in a way completely compliant with the license. Using it even the right way, safely, is viewed as too much of a risk. The legal teams for many large companies recommend a company policy that prohibits using GPL and AGPL software outright - that's just using (running on company servers), not modifying, and not redistributing anything but the original version. Attaching a license like GPL or AGPL is a good way to kill enterprise use of a program even by companies that are conscientious about open source. See how Google views the AGPL, for example: http://www.theregister.co.uk/2011/03/31/google_on_open_source_licenses/ http://www.theregister.co.uk/2011/03/31/google_on_open_sourc... Perhaps it shouldn't be this way, and perhaps these legal teams are being overly cautious and someone should be push back, but that's how it is today at many companies. Attaching an AGPLv3 license means that I can't use it, while I can and do use Apache-licensed projects, and contribute improvements or fixes arising out of corporate usage.
      - mikekchar 11y ago
        Choosing a license is difficult. There is no question that choosing a more permissive license lowers the bar for participation. However consider what they are building here: a mail client that purports to securely send and store email. Imagine you are working for a company that uses Mailpile. You think that your email is secure and encrypted because you are using Mailpile. Instead, you management has hacked in a back door to spy on your communications. As you mentioned, perhaps someone should push back. I'm not involved in Mailpile, but it seems that this is exactly what they are doing. They are drawing a line in the sand and saying, "You must show your users any changes you have made to the system because otherwise how are they to trust it?" It's clearly a tradeoff and also clearly not an easy decision. Do you give up a little bit of your goal of protecting users at the benefit of having wider exposure? Or do you refuse to compromise and suffer from potentially having less adoption? It doesn't seem that they took the decision lightly.
  - oldmanjay 11y ago
    Why would that happen? I admit I'm not really an expert here but as I understand it, users have no obligation at all with this license.
  - rbanffy 11y ago
    Who would be scared? The only thing this would prevent would be to offer a modified version of the software on a SaaS model without opening the code for its modifications.
    - alextgordon 11y ago
      I can definitely see how AGPL would give legal departments a collective heart attack. It's quite onerous, if triggered, and who wants to risk their job for a stupid piece of software? Better to ban it from the organisation.
      - istvan__ 11y ago
        Yep, many organizations banned it already and few guys are learning it the hard way that they should have. Google requires special approvals to even use AGPL in their network. It is kind of funny that these guys who want AGPL showed down your throat happily use non-AGPL code.
    - makomk 11y ago
      If you modify the source, the AGPLv3 requires you to "prominently offer all users interacting with it remotely through a computer network" the ability to download the modified source. As far as I can tell, that includes anyone who can so much as view the login screen - there's no minimum level of interaction required - which means that even people who are only running Mailpile for their own personal use are affected. It definitely doesn't just affect SaaS providers even though they were the main target of the clause.
      - mikekchar 11y ago
        Simply running the software does not require me to accept the license. This is explicitly stated in section 9 of the licence. So it doesn't matter what it says in section 13, I don't have to comply with it. If you don't modify the software and don't "convey" it (for which usage is specifically not "conveyance" as per section 0), then there is no exposure to risk at all. What does trigger that (which you somehow elided from your quote) is modifying the source. I must accept the license in order to modify the code as stated in section 9. Having accepted the license I have a responsibility to offer the changes to all "users" interacting with it remotely. Very unfortunately, they don't provide a definition of "user". This may be intentional, though. There are legal definitions of the word "user" and it may not be possible/desirable to try to override the term in the license. IANAL but in my experience, people who gain unauthorized access to software are not defined as a "user". I can't enter into a contract with an entity of whom I am unaware. There is a crucial difference between inviting people (even random people) to use the software and having a system that just happens to be accessible. There is a huge amount of case law on the topic, so if you are really curious I'm sure any lawyer can give you good advice.
  - el33th4xx0r 11y ago
    Thats the point, to get rid of freedom-hating potential users.
    - rimantas 11y ago
      Calling anyone choosing MIT or BSD over AGPLv3 "freedom-hating" does not sound right.
  - istvan__ 11y ago
    Yep, these licenses are banned in Amazon for example. I am also refusing to use AGPL projects because I think free supposed to be free in the BSDL sense and not some weird awkward way that AGPL is trying to force on people.
    - bcg1 11y ago
      Trying to follow your logic... Freedom is important to you... so you measure a software license's merits by whether or not it is blessed by Amazon "We-delete-Orwells-1984-from-your-kindle" Inc. Amazon probably just hates RMS because he always calls them out in every speech he makes. And the licenses are 2 totally different animals anyhow... BSD license incidentally grants some freedom... but FSF's licenses are designed to protect it.
      - istvan__ 11y ago
        Not really. I just know that Amazon's lawyer team has more expertise in law than I do. They also run a relatively large business while I am working for a small company. If their legal team decided that protecting their IP is best done by not opening up the company to a lawsuit (have you seen what happened to VMware btw?) than I think it is a pretty safe policy to follow for us the smaller corporation with smaller legal team. I measure freedom in the license context by how much I have to do using a certain licensed software. MIT, BSDL, Apache, EPL -> nothing AGPL -> I need to open up every single thing that touches the service that uses AGPL Which one is more free? In my interpretation the former. Please convince me that AGPL is more free than the other licenses. On the top of all that jazz, I really dislike the GPL/Gnu agenda of defining freedom to me. Let me show you what is the definition of freedom: "the power or right to act, speak, or think as one wants without hindrance or restraint." Opening open source code that I have no intention to open up sounds pretty restraining to me and also it qualifies as hindrance...
        detaro 11y ago
        I also don't necessarily agree with them, but: As already pointed out in other places in this thread, (A) GPL isn't about your (the developer offering a service) freedom, but focuses on the users. If you don't subscribe to their definition of freedom, of course it doesn't appear more free to you, and really the only way to convince you otherwise would be to convince you that their definition of freedom is the more important one. And even then one can argue if the AGPL serves this best, because it also doesn't really help users if no-one offers services based on the software because they don't trust the legal situation.
  - tommorris 11y ago
    When your homeless soup kitchen scares away Donald Trump, you might be doing something right.
vog 11y ago
> he didn't actually explain, why he chose AGPLv3. He did. > "Because I think it is the right license for this project". That's the introduction sentence of that section. He then goes into more detail. Did you skip the last 3 paragraphs? --------------- Mailpile is a project about freedom. It is not a popularity contest or a startup, it's not "industry infrastructure", nor does it aim to be. Mailpile is a political project which aims to improve the privacy and digital independence of individuals everywhere. The Apache License is a wonderful thing, an open, generous, pragmatic, apolitical license. The AGPLv3 on the other hand, is a political and ethical line in the sand. And so is Mailpile. ---------------
- istvan__ 11y ago
  Yes, this is exactly right. If you want to write free software just use a nice license like MIT, BSD, Apache, Eclipse etc. Why would you want to force your views on people?
  - kijin 11y ago
    Nobody is forcing any views on anyone. If you don't like the license on a piece of code, don't use it.
    - deleted 11y ago
      [deleted]
    - istvan__ 11y ago
      As I said earlier I do not use AGPL code. Don't you need to opensource a service that works with the AGPL service?
      - kijin 11y ago
        You are right. The whole point of Mailpile is to take your data off the cloud and control it yourself. It is explicitly and deliberately anti-cloud. If the license makes it nearly impossible for others to use Mailpile as part of a cloud-based platform, the developers probably consider it a feature, not a bug. If there's any program for which AGPL is an appropriate license, Mailpile is it.
asabjorn 11y ago
The reasoning also does not make sense at all to me. Making secure email popular is hard enough without restrictive licensing. At this point almost no-one cares about this problem and even fewer about this solution. I donated money to the project and considering the goal behind the project is to make e-mail secure, allowing liberal reuse of components in commercial projects seems very desirable as a way to spread the concept. However, they just made this impossible by choosing AGPLv3.
- wtallis 11y ago
  Which of the license restrictions actually poses a challenge to anyone who is trying to further the goals of the mailpile project? The emphasis on security and not trusting the server or service providers already precludes integrating it into a closed-source product.
  - asabjorn 11y ago
    It hinders growth paths and stops reuse that would lower the bar for spreading secure e-mail support. AGPLv3 has license restrictions that are unacceptable to many or maybe even most companies, and secure company e-mail would be a great first growth application. Even for personal use easy 3rd-party deployment by hosting providers would be desirable, but AGPLv3 may be of concerns for these hosts for a fringe-application. AGPLv3 also prohibits code-reuse in most contexts, so it makes surprising reuse of sub-components less likely. Stopping this reuse is a shame since it could have reduced the bar for implementing secure email support in more e-mail clients.
    - zanny 11y ago
      In email clients with either more permissive or even proprietary licenses, where those Mailpile most wants not to use their source (evesdropper backend email services like gmail) can then use their work to enhance their user experience without providing their users the software freedoms they enjoyed when modifying mailpile or a permissive fork of a permissive piece of it.

by krick 11y ago

nekopa 11y ago

But he did explain it :- The AGPLv3 on the other hand, is a political and ethical line in the sand. And so is Mailpile.

insaneirish 11y ago
> The AGPLv3 on the other hand, is a political and ethical line in the sand. And a good way to completely scare away a good subset of potential users.
- rodgerd 11y ago
  Which ones? The ones who want to build services on the tool without contributing back to it? Perhaps the author feels like they are no-value users.
  - quadrangle 11y ago
    Or negative value users
  - Pyxl101 11y ago
    It's more complicated than that. Part of the problem is that it's difficult to predict how a variety of complex situations will turn out in court. With strongly opinionated licenses like AGPLv3, it's difficult to know if you're using the software "safely" in full compliance with the license without putting yourself at risk in unintended ways. Many of the complex situations that could come up in a protracted legal battle have not been tested in a court, so there is no precedent allowing one to determine for sure how technical issues will be viewed in terms of the license. Due to the risks and complexity around these issues, and the high cost of "getting it wrong" either in one's analysis or in making a mistake, many firms choose to stay away from projects licensed with AGPLv3 even if they are actually intending to use the software in a way completely compliant with the license. Using it even the right way, safely, is viewed as too much of a risk. The legal teams for many large companies recommend a company policy that prohibits using GPL and AGPL software outright - that's just using (running on company servers), not modifying, and not redistributing anything but the original version. Attaching a license like GPL or AGPL is a good way to kill enterprise use of a program even by companies that are conscientious about open source. See how Google views the AGPL, for example: http://www.theregister.co.uk/2011/03/31/google_on_open_source_licenses/ http://www.theregister.co.uk/2011/03/31/google_on_open_sourc... Perhaps it shouldn't be this way, and perhaps these legal teams are being overly cautious and someone should be push back, but that's how it is today at many companies. Attaching an AGPLv3 license means that I can't use it, while I can and do use Apache-licensed projects, and contribute improvements or fixes arising out of corporate usage.
    - mikekchar 11y ago
      Choosing a license is difficult. There is no question that choosing a more permissive license lowers the bar for participation. However consider what they are building here: a mail client that purports to securely send and store email. Imagine you are working for a company that uses Mailpile. You think that your email is secure and encrypted because you are using Mailpile. Instead, you management has hacked in a back door to spy on your communications. As you mentioned, perhaps someone should push back. I'm not involved in Mailpile, but it seems that this is exactly what they are doing. They are drawing a line in the sand and saying, "You must show your users any changes you have made to the system because otherwise how are they to trust it?" It's clearly a tradeoff and also clearly not an easy decision. Do you give up a little bit of your goal of protecting users at the benefit of having wider exposure? Or do you refuse to compromise and suffer from potentially having less adoption? It doesn't seem that they took the decision lightly.
- oldmanjay 11y ago
  Why would that happen? I admit I'm not really an expert here but as I understand it, users have no obligation at all with this license.
- rbanffy 11y ago
  Who would be scared? The only thing this would prevent would be to offer a modified version of the software on a SaaS model without opening the code for its modifications.
  - alextgordon 11y ago
    I can definitely see how AGPL would give legal departments a collective heart attack. It's quite onerous, if triggered, and who wants to risk their job for a stupid piece of software? Better to ban it from the organisation.
    - istvan__ 11y ago
      Yep, many organizations banned it already and few guys are learning it the hard way that they should have. Google requires special approvals to even use AGPL in their network. It is kind of funny that these guys who want AGPL showed down your throat happily use non-AGPL code.
  - makomk 11y ago
    If you modify the source, the AGPLv3 requires you to "prominently offer all users interacting with it remotely through a computer network" the ability to download the modified source. As far as I can tell, that includes anyone who can so much as view the login screen - there's no minimum level of interaction required - which means that even people who are only running Mailpile for their own personal use are affected. It definitely doesn't just affect SaaS providers even though they were the main target of the clause.
    - mikekchar 11y ago
      Simply running the software does not require me to accept the license. This is explicitly stated in section 9 of the licence. So it doesn't matter what it says in section 13, I don't have to comply with it. If you don't modify the software and don't "convey" it (for which usage is specifically not "conveyance" as per section 0), then there is no exposure to risk at all. What does trigger that (which you somehow elided from your quote) is modifying the source. I must accept the license in order to modify the code as stated in section 9. Having accepted the license I have a responsibility to offer the changes to all "users" interacting with it remotely. Very unfortunately, they don't provide a definition of "user". This may be intentional, though. There are legal definitions of the word "user" and it may not be possible/desirable to try to override the term in the license. IANAL but in my experience, people who gain unauthorized access to software are not defined as a "user". I can't enter into a contract with an entity of whom I am unaware. There is a crucial difference between inviting people (even random people) to use the software and having a system that just happens to be accessible. There is a huge amount of case law on the topic, so if you are really curious I'm sure any lawyer can give you good advice.
- el33th4xx0r 11y ago
  Thats the point, to get rid of freedom-hating potential users.
  - rimantas 11y ago
    Calling anyone choosing MIT or BSD over AGPLv3 "freedom-hating" does not sound right.
- istvan__ 11y ago
  Yep, these licenses are banned in Amazon for example. I am also refusing to use AGPL projects because I think free supposed to be free in the BSDL sense and not some weird awkward way that AGPL is trying to force on people.
  - bcg1 11y ago
    Trying to follow your logic... Freedom is important to you... so you measure a software license's merits by whether or not it is blessed by Amazon "We-delete-Orwells-1984-from-your-kindle" Inc. Amazon probably just hates RMS because he always calls them out in every speech he makes. And the licenses are 2 totally different animals anyhow... BSD license incidentally grants some freedom... but FSF's licenses are designed to protect it.
    - istvan__ 11y ago
      Not really. I just know that Amazon's lawyer team has more expertise in law than I do. They also run a relatively large business while I am working for a small company. If their legal team decided that protecting their IP is best done by not opening up the company to a lawsuit (have you seen what happened to VMware btw?) than I think it is a pretty safe policy to follow for us the smaller corporation with smaller legal team. I measure freedom in the license context by how much I have to do using a certain licensed software. MIT, BSDL, Apache, EPL -> nothing AGPL -> I need to open up every single thing that touches the service that uses AGPL Which one is more free? In my interpretation the former. Please convince me that AGPL is more free than the other licenses. On the top of all that jazz, I really dislike the GPL/Gnu agenda of defining freedom to me. Let me show you what is the definition of freedom: "the power or right to act, speak, or think as one wants without hindrance or restraint." Opening open source code that I have no intention to open up sounds pretty restraining to me and also it qualifies as hindrance...
      - detaro 11y ago
        I also don't necessarily agree with them, but: As already pointed out in other places in this thread, (A) GPL isn't about your (the developer offering a service) freedom, but focuses on the users. If you don't subscribe to their definition of freedom, of course it doesn't appear more free to you, and really the only way to convince you otherwise would be to convince you that their definition of freedom is the more important one. And even then one can argue if the AGPL serves this best, because it also doesn't really help users if no-one offers services based on the software because they don't trust the legal situation.
- tommorris 11y ago
  When your homeless soup kitchen scares away Donald Trump, you might be doing something right.

vog 11y ago

> he didn't actually explain, why he chose AGPLv3. He did. > "Because I think it is the right license for this project". That's the introduction sentence of that section. He then goes into more detail. Did you skip the last 3 paragraphs? --------------- Mailpile is a project about freedom. It is not a popularity contest or a startup, it's not "industry infrastructure", nor does it aim to be. Mailpile is a political project which aims to improve the privacy and digital independence of individuals everywhere. The Apache License is a wonderful thing, an open, generous, pragmatic, apolitical license. The AGPLv3 on the other hand, is a political and ethical line in the sand. And so is Mailpile. ---------------

istvan__ 11y ago
Yes, this is exactly right. If you want to write free software just use a nice license like MIT, BSD, Apache, Eclipse etc. Why would you want to force your views on people?
- kijin 11y ago
  Nobody is forcing any views on anyone. If you don't like the license on a piece of code, don't use it.
  - deleted 11y ago
    [deleted]
  - istvan__ 11y ago
    As I said earlier I do not use AGPL code. Don't you need to opensource a service that works with the AGPL service?
    - kijin 11y ago
      You are right. The whole point of Mailpile is to take your data off the cloud and control it yourself. It is explicitly and deliberately anti-cloud. If the license makes it nearly impossible for others to use Mailpile as part of a cloud-based platform, the developers probably consider it a feature, not a bug. If there's any program for which AGPL is an appropriate license, Mailpile is it.

asabjorn 11y ago

The reasoning also does not make sense at all to me. Making secure email popular is hard enough without restrictive licensing. At this point almost no-one cares about this problem and even fewer about this solution. I donated money to the project and considering the goal behind the project is to make e-mail secure, allowing liberal reuse of components in commercial projects seems very desirable as a way to spread the concept. However, they just made this impossible by choosing AGPLv3.

wtallis 11y ago
Which of the license restrictions actually poses a challenge to anyone who is trying to further the goals of the mailpile project? The emphasis on security and not trusting the server or service providers already precludes integrating it into a closed-source product.
- asabjorn 11y ago
  It hinders growth paths and stops reuse that would lower the bar for spreading secure e-mail support. AGPLv3 has license restrictions that are unacceptable to many or maybe even most companies, and secure company e-mail would be a great first growth application. Even for personal use easy 3rd-party deployment by hosting providers would be desirable, but AGPLv3 may be of concerns for these hosts for a fringe-application. AGPLv3 also prohibits code-reuse in most contexts, so it makes surprising reuse of sub-components less likely. Stopping this reuse is a shame since it could have reduced the bar for implementing secure email support in more e-mail clients.
  - zanny 11y ago
    In email clients with either more permissive or even proprietary licenses, where those Mailpile most wants not to use their source (evesdropper backend email services like gmail) can then use their work to enhance their user experience without providing their users the software freedoms they enjoyed when modifying mailpile or a permissive fork of a permissive piece of it.