Slashdot Mirror
FSF Releases AGPL License For Web Services
mako writes "The Free Software Foundation has released the Affero General Public license version 3. The license is essentially the GPLv3 with an added clause that requires that source code be distributed to users that interact with the application over a network. The license effectively extends copyright to Web applications. The new AGPL will have important effects for companies that, under the GPL, have no obligation to distribute changes to users on the Web. This release adds the license to the stable of official FSF licenses and is compatible with the GPLv3."
Can someone explain exactly how a license can extend Copyright?
The owner of the copyright might extend terms in his license, not the other way round.
If you keep throwing chairs, one day you'll break windows....
The new AGPL will have important effects for companies that, under the GPL, have no obligation to distribute changes to users on the Web
Only if they use it. No-one's under an obligation to use a new version of a licence, and if they don't like the terms, they may steer clear of it to start with.
This might be useful for companies too. We have in example been thinking about releasing our software in open source to expand the usage of our software and to gain more knowledge in the markets about us. However as we are business and a rather small one, releasing the software in example in GPL would be more or less commercial suicide, as our software is purely web based, some bigger service company could just take it and give nothing back...
I really have to read more about AGPL. I think that by combining AGPL + MPL + strong attribution clauses, for us and maybe to many more small developers it could come more lucrative to open source our software, because we still would get changes back, we would have more freedom and we would get attribution for our work. Definitely very good for FSF to publish this license. I really think that in time as there comes more licenses that cover different things, it will come more and more easier and secure to publish software and other works in open source.
Survey research tool for commercial and scientific use
There's a special clause written into the GPLv3 which permits compatibility with exactly this one license. See http://gplv3.fsf.org/ for more info.
I've been against this clause ever since I heard GPLv3 was adding compatibility. One of the important parts of the GPL is that it allows private development if the changes weren't distributed - this is an important thing, as there's no user to protect if it's made for self consumption. The four freedoms that RMS always speak of aren't threatened by this, as the user is the same as the writer - there's no oppression that needs to be stopped here. The addition is a corruption of the GPL, changing it's purpose from one of freedom for all users to the coercive obtainment of the source code at any cost.
I write a web based application, say forum software, and publish that under the regular GPL.
That means you can take the source code for my software and modify it and use it. BUT because you never distribute that modified code (you only run it on your own server) you don't have to honor the GPL and disclose your modifications.
This is extremely common lots of websites use GPL software but never contribute back their own changes.
IF I write my forum software under the AGPL and you modify it for your own use, you now have to distribute those changes. Roughly the same as if you had modified a client program.
HOWEVER your question is slightly odd, if you release a web service under AGPL then you are the original author. As the original author (as long as no others contribute code to you) you can do what you please. Just because version 1 of your software was under X license doesn't mean version 2 has to be.
What I think you meant to ask was "If I build a webservice with software that is licensed under the AGPL, do I have to distribute changes I make to that software".
The answer to that is YES.
Although I presume they will allow you to modify the config file and keep it private, bit of a security nightmare if you have to distribute the bit that contains your passwords ^_^
Basically this is the GPL for software where the end-user only gets the end-result, not the actuall program.
It is an intresting idea, the GPL works because it en-forces users to be contributors as well. There is a reason MS and Apple love BSD and IBM loves the GPL. Why should software like forum software be different?
As a web developer I like the idea. When I release a web-app and you modify it, you now have to give that code back. Seems only fair, why should web-apps be different?
If you don't like the idea, well then don't use AGPL licensed software. Write your own or use software under a different license.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
This guy is trolling, he purposefully misreads the license and tries to introduce the old troll that GPL software means that what is produced with that software must be GPL'ed as well. This is offcourse complete and utter nonsense, but it is a regular troll that usually gets modded down pretty quickly.
He just tries a new angle with the AGPL. To make it clear for those who don't understand the license. Slashdot is run on custom code, lets say that it is released under the GPL, you can now take that code, install it on your own server (scream a bit as you release what you have just done) and run your own site with it (although it never will be quite like slashdot unless you hire a finite number of monkeys as your editors). So far so good. Now you modify this code. To hide your shame you don't actually distribute the code in question, just run it on your own server. A GPL license in this case would NOT force you to release these modifications, the GPL only triggers when you distribute the code/program to others. Google for instance uses a modified GPL code, but because they don't distribute are under no obligation to distribute the modified code (they do distribute some of it although they don't have too).
IF however the slash code was released under the AGPL you would be forced to distribute your modifications.
BUT at no point would the END result of the code/program fall under any license other then that which you choose. In this case, the HTML pages created would OFFCOURSE not fall under the AGPL or GPL or ANY license unless you choose one yourselve. (does machine created content fall under basic copyright?)
This is very clear from the license text and only a deliberate misreading by someone wishing to troll could result in any other explenation.
The GPL/AGPL are about the program/code, NOT about the results of the program/code. Anyone who tries to claim something else is an idiot.
It says a lot about slashdot moderation that this tired old troll was modded up. He tries to disguise himself by saying that he is happy to be corrected but before without trying to link Stallman to communism (the gpl is far closer to the true idea of a free market) and without having spouted a lot of outright crap first.
Now if you excuse me, I have to use windows for an hour as punishement for feeding the troll.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
I can see where this would be useful.
Say you've got forum software, like phpBB. Lots of people put modifications into it and lots of people release modifications. There are also lots of people who hack in large custom mods and gain from the phpBB base while not releasing anything because it is GPL. If phpBB was AGPLed then major changes like that would have to be released and so anyone modifying, for example, a forum script to turn it into a CMS would have to release their modification. That would then stop people having to re-implement the same CMS functionality just because no-one wanted to release it.
Okay, so it's not necessarily going to be a winner in all cases, and it may dissuade some people from using a script, but I can see where it might be useful.
The trouble with this is that the people purportedly bound by the license are users, not distributors. The GPL works because the people in question are distributing copies and thus need a license. People installing software on a server are not.
In the USA, you have the legal right to make copies of software for the purpose of using it. Copying it to your server is not copyright infringement. Running it is not copyright infringement. You don't need a license. So what compels AGPL users to accept this license and be bound by its terms? Where is the consideration?
Bogtha Bogtha Bogtha
No, no, no, you've completely misunderstood it.
The GPL, and all other licenses based in copyrights, only kick in when you perform the actual copying. Say, for example, that you modify MySQL somehow. If you acquired MySQL under the GPL, and you wish to DISTRIBUTE this modified version, you have to abide by the GPL, and give out the source-code for your modifications alongside. This is the only way the GPL can kick in currently, when someone wishes to distribute modifications of GPL software.
But say that instead of modifying MySQL and making a downloadable application that runs on the user's computer, I make a web application. I still use MySQL on my server, and I use my code for the actual web application, and this combined essentially forms a derived work of MySQL, and if I were to distribute this application, I would also have to give out the source-code for my web app for free. But I'm not distributing it, I'm only making it available through my website, and because GPL only kicks in during distribution, I'm free to use as much GPL software as I possibly want for my web application without ever releasing any source code.
This is what this AGPL wants to stop. If MySQL was distributed under it, then everyone who built a web app using MySQL, would also have to give away the source code for their web app, if they make it available to users.
Needless to say, this is not going to be very popular with companies. I can't imagine Google or Facebook or MySpace or similar websites ever wanting to give away their source-code, since it contains all the trade secrets, everything that gives them the edge over the competition. I work for a small company and we have our own web application that is backed by some GPL software, but we would never want to give away the code we made ourselves, that would be suicide for us as a company.
For the right to modify code to be useful there is an implicit assumption that the database under the program is available. What point is it for a web user, of any level of sophistication, to have the source for some web app, when he doesn't have access to the database it runs on? He can't reproduce his experience. He can only relaunch the same service on another URL with a different database on the backend.
This illustrates nicely that the purpose of the FSF is not to ensure users retain important capabilities, but to ensure that there is no copyright in any software work.
If however I am wrong and you have to redistribute mycode.php I can see this being a real nightmare for programmers who have incorporated all sorts of code into their project.
I posted this comment on the FSF's site during the commenting period for the AGPL and I will reproduce it here:
AGPL is not enforceable in the United States
Disclaimer: IANAL
I did some research on case law and I found that AGPL is not enforceable in the United States.
As I understand it, under US law there are four legal positions in which a party can find itself with respect to a copyrighted computer program it possesses:
1. Copyright owner
2. "Owner of a copy"
3. Governed by a contract such as an EULA
4. Unauthorized possessor
Dismissing 1 and 4 as irrelevant to the discussion, we find that a user of AGPL software will be in either position 2 or 3.
The AGPL is not an EULA.
Neither the AGPL, nor the GPL, nor the LGPL are EULAs. They are not contracts. So we conclude that a party which uses AGPL software is an "owner of a copy."
The AGPL purports to restrict one's right to modify software that runs on a public server. It bases this on copyright law, which restricts the right to make derivative works.
However, 17 U.S.C. 117 (a)(1) gives the "owner of a copy" of a copyrighted computer program the right to modify the program if "... such a new copy or adaptation is created as an essential step in the utilization of the computer program in conjunction with a machine and that it is used in no other manner"
Aymes v. Bonelli, 47 F.3d 23 (2d Cir. 1995) said that: [b]uyers should be able to adapt a purchased program for use on the buyers computer because without modifications, the program may work improperly, if at all. No buyer would pay for a program without such a right.6[The defendants], as rightful owners of a copy of the plaintiffs program, did not infringe upon the copyright, because the changes made to the program were necessary measures in their continuing use of the software in operating their business and the program was not marketed, manufactured, distributed, transferred, or used for any purpose other than the defendants own internal business needs. (as quoted in http://www.copyright.gov/1201/2006/comments/granick_wirelessalliance.pdf)
This right to modify was broadened in Krause v. Titleserv 03-9303 http://caselaw.lp.findlaw.com/data2/circs/2nd/039303p.pdf Discussion: http://www.techlawjournal.com/topstories/2005/20051107.asp
Krause is important to AGPL because it includes the use of software over a network. The court found that the "owner of a copy" of a computer program could add new features essential to its business -- including customer modem access to use the program -- without permission from the copyright owner.
Krause was sited recently in a similar case: Weitzman v. Microcomputer 06-60237-CIV, 2007 WL 744649 (S.D. Fla. March 6, 2007). http://www.thelen.com/tlu/StuartWeitzmanVMicroComputer.pdf The established law of the land in the United States is that the "owner of a copy" of a computer program has the right to modify that copy for its business needs. The AGPL cannot restrict this right without being an EULA and using contract law.
So, a SaaS provider that is the "owner of a copy" of an AGPL computer program has the right to modify its copy of that program to further its business needs, and it does not require the permission of the copyright holder to do so. This means that it does not have to provide the source publicly for any modifications that it makes. The only way to prevent this is to use an EULA and contract law.
The GPL is and has always been passed to DERIVIATIONS of an application
The GPL is about enforcing give and take in the "free software" community, you get to use and modify the communities code on condition that when you release an improved version your users get the source to those modifications under the GPL (and hence can feed the code back to the community if they wish which if there is more than a handfull of them one of them probablly will).
The problem has been that companies are making improvements to free software but getting arround the requirement to release the source to those improvements to thier users by operating on a service model and not giving the code to thier users in any form (either source or binary).
Afaict there is no requirement in the license to release your website data or the source to other apps on your site in the license (though things could get tricky for tightly integrated sites, the license doesn't seem to do a good job of handling them).
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
I don't consider a software as a service operator to be an "end user", they are a middleman providing users with the ability to use software that runs on thier servers. Software as a service was being used to essentially do an end run arround the GPLs requirement to provide the source code.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
This is another step down the path to the dark side.
First, the FSF extended their definition of derived work to include programs that were compatible with GPLed code but didn't actually contain any GPLed code, bringing the horrors of interface copyrights into the FSF's fold.
Now, they're invoking the madness that modifying but not redistributing software is against the license, which is a tool used to lock end-users in by denying them the right to modify commercial software.
These kinds of clauses and interpretations strengthen the dead grasp of Microsoft and other companies that want to use software patents, interface copyrights, and onerous and offensive non-modification clauses to keep users from modifying their own software. One day, I can see the LPF in court, attacking some onerous license, and their opposite number pointing out that the same clauses were right there in licenses drawn up by the same lawyers working for the FSF.
Don't fear one evil so much that you end up serving others just as great. Fear leads to hate, hate leads to anger, and anger leads to suffering.
It's bad enough that a 2 million line program written from scratch would suddenly be infected by the GPL by including a 1 line file, but now we are supposed to propagate the virus with our web servers? I am perfectly happy to allow the GPL and its descendants to exist but I am reluctant see its roots dig deeper into the minds of ill-informed developers who do not realize the only goal of this license is to see how far it can spread. Before anyone tries to flame me be aware I am simply expressing my opinion, if you disagree, disagree with objectivity. I myself am an open source developer and I practice what I preach http://www.freeswitch.org/ I release my code under the MPL and BSD licenses which are actually much more liberal licenses than GPL but all the propaganda would have you believe otherwise. If you are going to write free code and give it away, then stop worrying about how other people are going to use it. When someone takes your code and makes a service out of it, don't you think they put any of their own work into it building an infrastructure etc?
Is it just me, or does this seem to be an administrators nightmare?
Lets say I run a modified version of PHPwebsites under AGPL; I would then need to maintain a copy of the source code available for the rest of the world on my site(?). This would of course mean that the source code directory would indicate what version of the software I ran, as well as the patches I did to it. This in turn would not only open for easy detection of programming errors in the small local patches on my server, but as I could not apply the changes to the latest version without also announcing that I updated the software, which in turn would announce quite immediately to the world that my currently running version is out of date with vulnerabilities, as well as how much time I would usually take from a new version of the software is released, to I as admin have cleared it/activated the changes on my site.
So not only will I be more likely need to daily monitor every software used under this license to always run the latest version to avoid hostile takeovers of my server, but the attacker would be even one more step ahead of me, knowing when I would typically get things fixed - can only imagine how it would be to run a few applications on a server under a license such as this...
I can think of a number of reasons why many projects won't go with this. Imagine this scenario
I start contributing to an open source project, such as a web app. My contributions are released under...say... GPLv2.
I am also a consultant or run my own business. As a service, I modify and setup the application to meet my clients needs. I'm really good at this 'cause I know the software well. My clients get a good product that meets their needs of reasonable privacy, and they can choose what portions of the modifications they wish to release under GPLv2.
With AGPL, the same process breaks down. My client is not happy when I tell them I have to release the entirety of their customized web app, back to the public under AGPL. Their competitor copies it, and my client goes out of business and doesn't hire me anymore. Not good.
Some web apps are in favor of the GPLv2 model as they already have plenty of contributions, and get more meaningful enhancements committed, if they know that the people doing the work are going to go a modify it later, for private use. Case in point, Drupal.