5 ms·

AGPLv3 can be a bad idea for software that will be hosted internally only, particularly if you are modifying it. The remote network interaction clause makes no

AGPLv3 can be a bad idea for software that will be hosted internally only, particularly if you are modifying it. The remote network interaction clause makes no differentiation between internal and external users. They are all just users[1] As such, you owe all them all source to modified versions. Why does this matter? A lot of companies have internal systems, and temps, vendors, and contractors who access those systems. If those systems are (or are linked to) modified AGPL software (no matter how small the modification), they owe the temps, vendors, and contractors access to the source code to those systems. That seems ... bad :) [1] "if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network ... an opportunity to receive the Corresponding Source of your version ... at no charge ..."

wmf 11y ago
So just don't make any modification that you aren't willing to give to the public. If you're really concerned, just don't make any modifications period.
mikekchar 11y ago
Your quote is misleading. The "at no charge" refers only to providing access to a server at no charge. If you wish you can provide the source and charge what it costs to physically perform the copy. The intent is to provide access to the source code for no more than what you charged for access to the service itself. It doesn't mean that you necessarily will be out of pocket. Putting your changes on GitHub or the equivalent and providing a link would satisfy the requirement completely. This is not exactly an onerous requirement unless your intent is to keep your changes secret. The "That seems ... bad" part, really depends on your point of view, I guess. Letting all my temps, vendors, and contractors have access to this code means that any of them can inspect it for problems, learn from it, fix bugs, improve it for themselves and help others improve it. That seems ... good ... to me, anyway. At worst, they'll do nothing and I won't be any worse off. Of course, if I'm relying on secret source code to obfuscate my security holes, then perhaps I'll be in trouble, but I'm not about to do that. At best, I've turned my users into collaborators. Perhaps you can enlighten me as to why you think this is bad.
- anon1385 11y ago
  >Perhaps you can enlighten me as to why you think this is bad. You can't see why a Google lawyer would think it 'bad' for a temporary member of staff to be able to receive the full source (with licence to use and redistribute) for Google search, adwords, gmail etc etc?
TazeTSchnitzel 11y ago
> That seems ... bad :) Why would it be? Employees having access to modifications to open-source software the company made surely wouldn't materially affect any aspect of the business. It doesn't mean they can change the code running on your servers, or peer into other people's accounts. Sounds like a non-issue.
- tommorris 11y ago
  Said people might find a bug in your software and send you a bug fix. That's how open source is meant to work, no?
zmmmmm 11y ago
Bad seems a little strong. But I think your point is valid, if rephrased as "potentially problematic". If you consider the common kind of scenario where a company wants or needs to integrate back end systems with one another, and the viral nature of copyleft licenses, you could quickly end up with your external contractor having the right to ask for code to completely unrelated internal systems that have nothing to do with Mailpile. I am sure that is not the intent of Mailpile authors, and I wonder if they fully understand that this might well put Mailpile straight onto a blacklist for a lot of companies.
bcg1 11y ago
You could have your temps and employees waive their rights under the AGPLv3 as a condition of their employment, contract, etc. Most legit AGPL projects I've seen by the way don't really try to trap you like that anyhow... for instance, you can re-theme mediagoblin etc. And if you're going to hack on the core... would it really be so bad to upstream the code?
- detaro 11y ago
  > for instance, you can re-theme mediagoblin etc. Is that tested in court? Because that was one of the scenarios described as potentially problematic before to me by a lawyer (Applying a corporate theme to an AGPL system, breaching the contract with the designer of the theme that doesn't allow you to re-license the design, only to use it)
  - belorn 11y ago
    There doesn't seem to be a court case that defined if images should count as part of the work or not when talking about licenses. Many AGPL projects clarify their intention and exclude css, images and styling regarding agpl compliance. At this point it could almost be said to be a industry practice. Outside software, there doesn't seem to be a clear legal precedence either. I commonly see news paper include CC-share-alike images in articles without adding the CC license to the article, website or the news paper itself. The question about copyright almost exclusively end up being about distribution rights of the work in isolation, or the right of the author to have the work associated in a specific context.
sukilot 11y ago
GPLv3 handles contractors just fine, does AGPL not? http://gcn.com/Articles/2007/07/23/GNU-version-of-GPL-gives-feds-a-break.aspx?m=1 http://gcn.com/Articles/2007/07/23/GNU-version-of-GPL-gives-...
riquito 11y ago
> If those systems are (or are linked to) modified AGPL software (no matter how small the modification), they owe the temps, vendors, and contractors access to the source code to those systems. Which is exactly the point. Don't modify the source code or use a different product if you don't want to accept the license.
belorn 11y ago
You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you. Seems rather clear cut to me how contractors are handled. Since we are talking about legal risk and risk is measured in likeliness of an event happening, and as a lawyer you were expected during training to find and provide legal precedence as proof for legal reasoning, how high risk is there that this would not cover internal systems, temps, vendors, and contractors who access those systems? Has there been any cases involving that kind of employee status, having access to source code with similar licensed agreement, and the court finding a decision which support your conclusion? If you worked for a insurance company, how much money per month would you advice them to charge for this "risk", and would you then in good-faith advice companies that it is a good deal rather than shouldering the risk themselves?
- makomk 11y ago
  Unfortunately, that exemption doesn't apply to clause 13, which is the one that requires you to give copies of the source to anyone that can access the software remotely through a network server. This is a fairly nasty difference from the standard GPLv3 that I don't think enough people appreciate. As you point out, companies that modify GPL code for internal use don't have to release the source code and aren't affected by most of its provisions, and this is intentionally one of the freedoms it gives users. This isn't true of the AGPLv3.
  - belorn 11y ago
    The clause 2 permits you to add terms that prohibit the contractors from making any copies. While technically, a contractor could request the source code by clause 13, it do not conflict with the contractually term that they have which says they are not allowed to make copies. DannyBee said the word "access", and technically that would then be "read only" access. While I could conceive a situation in which a disgruntled contractor plus the original author could in theory make a case, read-only access is a odd thing to create a court case around and a judge decision could really go anywhere. I don't think anyone would be willing to test it or feel that the court costs would be worth paying for the privilege.

wmf 11y ago

So just don't make any modification that you aren't willing to give to the public. If you're really concerned, just don't make any modifications period.

mikekchar 11y ago

Your quote is misleading. The "at no charge" refers only to providing access to a server at no charge. If you wish you can provide the source and charge what it costs to physically perform the copy. The intent is to provide access to the source code for no more than what you charged for access to the service itself. It doesn't mean that you necessarily will be out of pocket. Putting your changes on GitHub or the equivalent and providing a link would satisfy the requirement completely. This is not exactly an onerous requirement unless your intent is to keep your changes secret. The "That seems ... bad" part, really depends on your point of view, I guess. Letting all my temps, vendors, and contractors have access to this code means that any of them can inspect it for problems, learn from it, fix bugs, improve it for themselves and help others improve it. That seems ... good ... to me, anyway. At worst, they'll do nothing and I won't be any worse off. Of course, if I'm relying on secret source code to obfuscate my security holes, then perhaps I'll be in trouble, but I'm not about to do that. At best, I've turned my users into collaborators. Perhaps you can enlighten me as to why you think this is bad.

anon1385 11y ago
>Perhaps you can enlighten me as to why you think this is bad. You can't see why a Google lawyer would think it 'bad' for a temporary member of staff to be able to receive the full source (with licence to use and redistribute) for Google search, adwords, gmail etc etc?

TazeTSchnitzel 11y ago

> That seems ... bad :) Why would it be? Employees having access to modifications to open-source software the company made surely wouldn't materially affect any aspect of the business. It doesn't mean they can change the code running on your servers, or peer into other people's accounts. Sounds like a non-issue.

tommorris 11y ago
Said people might find a bug in your software and send you a bug fix. That's how open source is meant to work, no?

zmmmmm 11y ago

Bad seems a little strong. But I think your point is valid, if rephrased as "potentially problematic". If you consider the common kind of scenario where a company wants or needs to integrate back end systems with one another, and the viral nature of copyleft licenses, you could quickly end up with your external contractor having the right to ask for code to completely unrelated internal systems that have nothing to do with Mailpile. I am sure that is not the intent of Mailpile authors, and I wonder if they fully understand that this might well put Mailpile straight onto a blacklist for a lot of companies.

bcg1 11y ago

You could have your temps and employees waive their rights under the AGPLv3 as a condition of their employment, contract, etc. Most legit AGPL projects I've seen by the way don't really try to trap you like that anyhow... for instance, you can re-theme mediagoblin etc. And if you're going to hack on the core... would it really be so bad to upstream the code?

detaro 11y ago
> for instance, you can re-theme mediagoblin etc. Is that tested in court? Because that was one of the scenarios described as potentially problematic before to me by a lawyer (Applying a corporate theme to an AGPL system, breaching the contract with the designer of the theme that doesn't allow you to re-license the design, only to use it)
- belorn 11y ago
  There doesn't seem to be a court case that defined if images should count as part of the work or not when talking about licenses. Many AGPL projects clarify their intention and exclude css, images and styling regarding agpl compliance. At this point it could almost be said to be a industry practice. Outside software, there doesn't seem to be a clear legal precedence either. I commonly see news paper include CC-share-alike images in articles without adding the CC license to the article, website or the news paper itself. The question about copyright almost exclusively end up being about distribution rights of the work in isolation, or the right of the author to have the work associated in a specific context.

sukilot 11y ago

GPLv3 handles contractors just fine, does AGPL not? http://gcn.com/Articles/2007/07/23/GNU-version-of-GPL-gives-feds-a-break.aspx?m=1 http://gcn.com/Articles/2007/07/23/GNU-version-of-GPL-gives-...

riquito 11y ago

> If those systems are (or are linked to) modified AGPL software (no matter how small the modification), they owe the temps, vendors, and contractors access to the source code to those systems. Which is exactly the point. Don't modify the source code or use a different product if you don't want to accept the license.

belorn 11y ago

You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you. Seems rather clear cut to me how contractors are handled. Since we are talking about legal risk and risk is measured in likeliness of an event happening, and as a lawyer you were expected during training to find and provide legal precedence as proof for legal reasoning, how high risk is there that this would not cover internal systems, temps, vendors, and contractors who access those systems? Has there been any cases involving that kind of employee status, having access to source code with similar licensed agreement, and the court finding a decision which support your conclusion? If you worked for a insurance company, how much money per month would you advice them to charge for this "risk", and would you then in good-faith advice companies that it is a good deal rather than shouldering the risk themselves?

makomk 11y ago
Unfortunately, that exemption doesn't apply to clause 13, which is the one that requires you to give copies of the source to anyone that can access the software remotely through a network server. This is a fairly nasty difference from the standard GPLv3 that I don't think enough people appreciate. As you point out, companies that modify GPL code for internal use don't have to release the source code and aren't affected by most of its provisions, and this is intentionally one of the freedoms it gives users. This isn't true of the AGPLv3.
- belorn 11y ago
  The clause 2 permits you to add terms that prohibit the contractors from making any copies. While technically, a contractor could request the source code by clause 13, it do not conflict with the contractually term that they have which says they are not allowed to make copies. DannyBee said the word "access", and technically that would then be "read only" access. While I could conceive a situation in which a disgruntled contractor plus the original author could in theory make a case, read-only access is a odd thing to create a court case around and a judge decision could really go anywhere. I don't think anyone would be willing to test it or feel that the court costs would be worth paying for the privilege.