FSF Releases AGPL License For Web Services

mako writes "The Free Software Foundation has released the Affero General Public license version 3. The license is essentially the GPLv3 with an added clause that requires that source code be distributed to users that interact with the application over a network. The license effectively extends copyright to Web applications. The new AGPL will have important effects for companies that, under the GPL, have no obligation to distribute changes to users on the Web. This release adds the license to the stable of official FSF licenses and is compatible with the GPLv3."

Comments

really?

[rucs_hack]

The new AGPL will have important effects for companies that, under the GPL, have no obligation to distribute changes to users on the Web

Only if they use it. No-one's under an obligation to use a new version of a licence, and if they don't like the terms, they may steer clear of it to start with.

Re:really?

[DirtyHerring]

You write ReallyCoolWebTool and license it under the AGPL. GreedyBastardCompany wants to use and change it. Now they have the choice between releasing their source code, or not using it at all. That was different with the GPL.

Re:really?

[nahdude812]

Your argument basically disagrees with the core values of open source. "I don't want to have to share my changes to an application which was shared freely with me." You do still have a choice, and that is: build it yourself from the ground up or buy a commercial off the shelf solution.

This license has been needed for a long time. Authors of open source web applications could not use the GPL or almost any other open source license, which only grants access to modified source code if the modder distributes it as a compiled binary. Web applications don't work that way, so people unwitting enough to release an open source web app under GPL could discover that GreedyEvilCompany took their hard work, made some changes and started using it for-profit online, without contributing back to the community that created it, and without having any obligation to.

Those of us who were burned by this (I am one) have since switched to other licenses which are not as tailored toward software, such as Creative Commons ones. I use By-NC-SA, which is attribution, non-commercial, share-alike, and I describe in my license preamble that I consider using the site on a publicly accessible server to be "performance" of the work under the Creative Commons. You have to preserve my copyright, you cannot resell my software, and you have to contribute your changes back to the community. Basically the terms are the same which I abide by when I distribute it. I'm not asking anyone to do anything which I don't myself already do, and I think that anyone who has a problem with that system can choose to find another project to play with.

If you're the original author and you're not intending for it to be full open source, then you shouldn't use this license. If you're inheriting this license by using code from another project, then you should respect their wishes and contribute back to them, or else not use their work.

Ug

[pat mcguire]

I've been against this clause ever since I heard GPLv3 was adding compatibility. One of the important parts of the GPL is that it allows private development if the changes weren't distributed - this is an important thing, as there's no user to protect if it's made for self consumption. The four freedoms that RMS always speak of aren't threatened by this, as the user is the same as the writer - there's no oppression that needs to be stopped here. The addition is a corruption of the GPL, changing it's purpose from one of freedom for all users to the coercive obtainment of the source code at any cost.

Re:Ug

[sayfawa]

Okay, imagine the following scenario: you code some software that allows people to do some horrendously complicated and hard mathematical problems. You release it under the GPL and give it to the Gnu Scientific Library. Some commercial company, like Maple or Mathematica, takes it and installs it on their computers. Then they start charging people large amounts of money to go to a web site, enter in their math problem and have the website spit out the answer after their in-house computers have crunched out the solution using your code. At first it's fine, because anybody could have got the answer from GSL tools as well.

But then the company makes some changes that allow it to solve an even greater range of problems. Now people have to go to them for this extra functionality, that they built off of your code. Even you have to pay them money to use this extension of your code. That's ok with you? It's a violation of the GPL in every sense except the technical one.

Re:Ug

[pat mcguire]

My problem is that the clause is too broad. I'll quote it here to point out what I mean:

"Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software. This Corresponding Source shall include the Corresponding Source for any work covered by version 3 of the GNU General Public License that is incorporated pursuant to the following paragraph."

It covers anything that the user has any contact with on the server. I don't have a problem with the producers using a tweaked kernel version to support the server that it's running on or them adding a module to mySQL to support whatever they're doing without necessarily being forced to give that away for their competitors. As for the objects that the user directly interfaces with, yes, I think you are correct on that account.

I suppose therefore that the license has it's place as long as it's chosen carefully - I know the kernel won't be leaving GPLv2 , but there's lots of system level software that would take away from the freedom of the producer to use it as they wished if they were forced to give it away. I suppose that the compatibility clause in GPLv3 is the best middle ground for code that doesn't need the protection of AGPLv3, as I would think most user-oriented applications would. COngratulations, you've converted me.

Re:Ug

[Just Some Guy]

If your "private development" in use on a public website, then it isn't really private.

That's just bizarrely wrong. By your logic, Coca Cola's formula isn't really a trade secret because regular people can buy it. I'll happily give our customers the output of our internal algorithms, but my boss wouldn't be too keen on giving them the algorithms themselves considering they're how we stay in business.

Re:Ug

[Just Some Guy]

You seem to be overlooking the fact that your so called internal algorithms are actually derivative works.

Umm, no, they're not. I'm not talking about taking a CMS and adding a new module to it. I'm talking about using an application server to display the output of a 20-year-old internally-developed application we've written. It's no more a derived work than if running it as a GUI exported over Citrix would make it a derived work of Citrix.

Fortunately, Zope is licensed under the GPL-compatible ZPL so we don't have to deal with any of this anti-Free Software stupidity.

Use and copyright

[Anonymous Coward]

As much as I welcome this license, and as important as I think it is that web services aren't used to deny people the basic freedoms that every software user should enjoy (especially if that software IS free software to begin with)...

Can someone explain to me just how this license can actually be legally binding? We were always told that merely *using* a piece of software did not require accepting its license, and - furthermore - that this was not due to a special clause in the GPL, either (in fact, that would've been impossible, since you'd have to accept the license for that clause to have any effect). This made sense: after all, copyright is about copying/distributing/conveying things (like software), not about regulating use of copyrighted works. You can read a book without needing a license from the publisher; you can use software without requiring a license as well (copying it to your own computer may be another matter, though).

So how can the Affero GPL stipulate that you need to convey the source code of the software you're using to power your web services when you're not actually distributing that software? What would keep $EvilCorporation from simply saying "we do not accept the terms of this license; therefore, we have no right to distribute $UsefulSoftware written by $PhilanthropicHacker, but we still have the right to *use* it, which is all we do when we use it to power our web service"?

No you troll

[SmallFurryCreature]

This guy is trolling, he purposefully misreads the license and tries to introduce the old troll that GPL software means that what is produced with that software must be GPL'ed as well. This is offcourse complete and utter nonsense, but it is a regular troll that usually gets modded down pretty quickly.

He just tries a new angle with the AGPL. To make it clear for those who don't understand the license. Slashdot is run on custom code, lets say that it is released under the GPL, you can now take that code, install it on your own server (scream a bit as you release what you have just done) and run your own site with it (although it never will be quite like slashdot unless you hire a finite number of monkeys as your editors). So far so good. Now you modify this code. To hide your shame you don't actually distribute the code in question, just run it on your own server. A GPL license in this case would NOT force you to release these modifications, the GPL only triggers when you distribute the code/program to others. Google for instance uses a modified GPL code, but because they don't distribute are under no obligation to distribute the modified code (they do distribute some of it although they don't have too).

IF however the slash code was released under the AGPL you would be forced to distribute your modifications.

BUT at no point would the END result of the code/program fall under any license other then that which you choose. In this case, the HTML pages created would OFFCOURSE not fall under the AGPL or GPL or ANY license unless you choose one yourselve. (does machine created content fall under basic copyright?)

This is very clear from the license text and only a deliberate misreading by someone wishing to troll could result in any other explenation.

The GPL/AGPL are about the program/code, NOT about the results of the program/code. Anyone who tries to claim something else is an idiot.

It says a lot about slashdot moderation that this tired old troll was modded up. He tries to disguise himself by saying that he is happy to be corrected but before without trying to link Stallman to communism (the gpl is far closer to the true idea of a free market) and without having spouted a lot of outright crap first.

Now if you excuse me, I have to use windows for an hour as punishement for feeding the troll.

Almost correct, but...

[SamP2]

This guy is trolling, he purposefully misreads the reply in question and tries to introduce the old troll that anyone questioning any aspect of GPL must be Windoze fanboy. This is offcourse complete and utter nonsense, but it is a regular troll that usually gets modded up by other fanboyz pretty quickly. ...

This is very unclear from the license text and only a deliberate misreading of the parent post by someone wishing to troll could result in any other explenation for a complete bs of a reply.

All debate about GPL on /. must be of admiration and awe, with not a single word of criticism or questioning. Anyone who tries to claim something else is an idiot.

It says a lot about slashdot moderation that this tired old troll was never modded up in the first place, but he's too kneejercked to actually check that before posting a flame He tries to disguise himself by saying that he is a defender against the defamation of free software but before without trying to link questioning of GPL to heresy (the gpl is far closer to God than Jesus is and without having spouted a lot of outright crap first.

Now if you excuse me, I have to use windows which (gasp) is not released under GPL for an hour as punishement for being the troll.

There, fixed it for you.

and now why this won't work..

[LingNoi]

Maybe I am wrong here but if your code is..

<?php
echo 'blah';
?>

and then you see that I have done all this awesome stuff with your AGPL code and demand the changes, could I just give you..

<?php
include 'mycode.php';
echo 'blah';
?>

Since you have to redistribute changes not your own files it doesn't seem like this license would be much use, just like how GPL2 isn't much use stopping DRM'd linux kernels.

If however I am wrong and you have to redistribute mycode.php I can see this being a real nightmare for programmers who have incorporated all sorts of code into their project.

Re:and now why this won't work..

[jellomizer]

Hence part of the problem with GPL and AGPL. Is that FSF assumes that everyone is thinking on the same wave they are which is untrue. Most people/companies would be OK to honor the use of GPL Code but as it keeps on getting stricter and removing loop holes it is just turning people and companies off towards it. I know you bring up Big Face Less corporation steeling as much code as possible and making a system that will make million of dollars off the work of some poor GPL developer who put his heart and sole into it. But the flip side is some Mom and Pop software development company uses a small portion of GPL Code (Not being lawyers or feeling very strongly toward IT Politics) they make a really great service and in order to stay competitive with the other big corporations Google, Microsoft, Yahoo... They kinda need to the unique part of their service closed source. But because they may be using some small GPL software that was developed by say Red Hat or Novel, say a function that handles with the Linux Kernel at a lower level for faster performance... they are now forced to release their code, even the bits that has nothing to do with it. There is a flip side, FSF has a tendency assuming that all corporations are evil and all uses of closed source are used for greed. Sometime people need to keep things closed source to survive.

Re:and now why this won't work..

[sumdumass]

I think your reading too much into things. The FSF seems to want to shoot themselves in the foot whenever possible. They got their fame and fortune being the underdog and claiming that everyone was out to get them.

Whenever there is a certain level of success in the free software/GPL front, they pull some stunt and take it backwards. It seems that their goal is more to perpetuate their notoriety then to help mom and pop shops. Just look at some of their actions recently, they attacked novell for something that only existed in their mind in order to push a license not many people were interested in and they done this at a time when nobody liked Vista and the switch to vista could have been just as dramatic as the switch to linux. So instead of embracing Vista's rejection, they created an unneeded controversy to keep the masses at bay. Then more recently, even though that their biggest enemies claim they are a bunch of thieves trying to steal your IP with the viral nature of the GPL, they go and take the moneys you donated to them and set up a defense fund for people accused of stealing copyright protected material.

I know the Viral part of the GPL is mostly FUD. But more interestingly, they knew the claim is being made and went ahead and publicly aligned themselves with accused thieves.

Re:Now for a contrarian view...

[petermgreen]

I don't consider a software as a service operator to be an "end user", they are a middleman providing users with the ability to use software that runs on thier servers. Software as a service was being used to essentially do an end run arround the GPLs requirement to provide the source code.

You missed his point

[Anonymous Coward]

If you build a web service with software that OTHER PEOPLE wrote (or more specifically, own the copyrights to), and those COPYRIGHT HOLDERS licensed it under the AGPL, then:

- YES you have to release your modifications, or you are in breach of the AGPL. (Unless you obtain some other license directly from the copyright holders. If the only license you have from them is the AGPL, you have to follow its terms or you can't modify or distribute the software, or make derivative works of it ("propagate" it in GPLv3 parlance)).

- NO you can't relicense the original software that you used -- only its copyright holders can do that.

- You can license your *derived work* however you want, with the exception that it must be compatible with the AGPL licensing terms that the original software carries (otherwise no one will be able to use your licensed code, and your own AGPL rights to the original code it is based on may be terminated due to your breach of its terms).

IANAL.

I thought viruses were illegal?

[anthm]

It's bad enough that a 2 million line program written from scratch would suddenly be infected by the GPL by including a 1 line file, but now we are supposed to propagate the virus with our web servers? I am perfectly happy to allow the GPL and its descendants to exist but I am reluctant see its roots dig deeper into the minds of ill-informed developers who do not realize the only goal of this license is to see how far it can spread. Before anyone tries to flame me be aware I am simply expressing my opinion, if you disagree, disagree with objectivity. I myself am an open source developer and I practice what I preach http://www.freeswitch.org/ I release my code under the MPL and BSD licenses which are actually much more liberal licenses than GPL but all the propaganda would have you believe otherwise. If you are going to write free code and give it away, then stop worrying about how other people are going to use it. When someone takes your code and makes a service out of it, don't you think they put any of their own work into it building an infrastructure etc?

Re:Depends a bit on what you do

[sumdumass]

The parent also got a few other things wrong with it too. He said

"BUT because you never distribute that modified code (you only run it on your own server) you don't have to honor the GPL and disclose your modifications."

A user never had to honor the GPL and the GPL never required a User to give changes or anything back.

Something that is disturbing here, if your company uses AGPLed software and components inside the company, how does the give out source apply? The people working there are agents of the same company but if an outside person get access to a computer does that mean they now are obligated to give him the source to your companies internal accounting app?

I can see this as a big show stopper in a lot of ways. Mostly the misunderstanding ways. I will be avoiding it like the plague and I suspect most others not drinking the cool aid would too. I guess I'm going to have to read this again. But I hope it turns into one of those things that always sit in the shadows and never comes into general population.

Re:Depends a bit on what you do

[Anonymous Coward]

What could happen is that you'll have a license violation. You can choose how you want to solve this violation:
1. Relicense your application under a compatible license. Again: this is completely up to you! Nobody can force you to relicense your software.
2. Remove any dependencies on the library in question, by rewriting (parts of) your code.
3. Ask the copyright holders of the library in question whether they'll grant you a commercial license, possibly for a fee.

And this set of options is EXACTLY why many companies have a "no way, no how, no Open Source anywhere near this company" policy.

All three options are out of the question for many (most?) companies*. The easiest way for them to deal with open source is to avoid it like the plague.

Your point about GPL not being viral is technically correct, but that doesn't make open source any less dangerous.

* #3 would be acceptable IF there was a single copyright holder who was interested in cutting a deal, but this is not the case for most open source projects, so again, the easiest and smartest thing to do is to treat open source like a disease.

an administrators nightmare?

[kandresen]

Is it just me, or does this seem to be an administrators nightmare?

Lets say I run a modified version of PHPwebsites under AGPL; I would then need to maintain a copy of the source code available for the rest of the world on my site(?). This would of course mean that the source code directory would indicate what version of the software I ran, as well as the patches I did to it. This in turn would not only open for easy detection of programming errors in the small local patches on my server, but as I could not apply the changes to the latest version without also announcing that I updated the software, which in turn would announce quite immediately to the world that my currently running version is out of date with vulnerabilities, as well as how much time I would usually take from a new version of the software is released, to I as admin have cleared it/activated the changes on my site.

So not only will I be more likely need to daily monitor every software used under this license to always run the latest version to avoid hostile takeovers of my server, but the attacker would be even one more step ahead of me, knowing when I would typically get things fixed - can only imagine how it would be to run a few applications on a server under a license such as this...

A major problem with this plan

[kc8jhs]

I can think of a number of reasons why many projects won't go with this. Imagine this scenario

I start contributing to an open source project, such as a web app. My contributions are released under...say... GPLv2.

I am also a consultant or run my own business. As a service, I modify and setup the application to meet my clients needs. I'm really good at this 'cause I know the software well. My clients get a good product that meets their needs of reasonable privacy, and they can choose what portions of the modifications they wish to release under GPLv2.

With AGPL, the same process breaks down. My client is not happy when I tell them I have to release the entirety of their customized web app, back to the public under AGPL. Their competitor copies it, and my client goes out of business and doesn't hire me anymore. Not good.

Some web apps are in favor of the GPLv2 model as they already have plenty of contributions, and get more meaningful enhancements committed, if they know that the people doing the work are going to go a modify it later, for private use. Case in point, Drupal.