Hacker News Reader

Comment by dekhn | Hacker News Reader

The AGPL is different from the GPL. The AGPL prevents use at my Bigco (Google) for a number of good reasons.

That's company policy and not the fault of the license. EDIT: Unless you're making modifications to the software, the AGPL does not apply.

EDIT2: http://www.affero.org/oagf.html#How_does_this_license_treat_...

Specifically, the question, "How does this license treat commercial enterprise use over intranets and internal networks?"

Is that true? My understanding of the AGPL was that any software product which uses it as a component becomes subject to the AGPL - it has the linking semantics of the GPL, not the LGPL. If that's not the case, please do disabuse me of my misconception!

Yes, it is like the GPL. But in this case, where the product is a standalone application, that distinction shouldn't matter unless you're actually planning on bundling it into your own product somehow.

I think your understanding of the AGPL (specfically) is in error.

See EDIT2 on my post.

>That's company policy

Yes.

I was just pointing out that regardless of modification/distribution/whatever, bigco policy is to not allow ANY AGPL code within a 10 mile radius of any computer owned by said company.

The author(s) are free to use AGPL, but there are significant downsides if they care about adoption.

They care about the freedom of software users, not weird corporate policies.

Non-adoption by non-respecters of freedom isn't a downside.

It's a downside if it leads to general non-adoption, either directly or because a competitor with a different license gets the market share.

I'm all for the moral stance, but moral purity in a vacuum is essentially irrelevant. Effective morality is about impact on the world. A morality that's only about the good feelings of the purist is sterile self-indulgence.

Precisely. And even RMS has been known to agree with that principle.

http://lwn.net/2001/0301/a/rms-ov-license.php3

These aren't "weird corporate policies", they're very sensible. If they wish to use such software they need to be very careful in how, and track its use, and they just don't think having such a framework is worth it.

See https://news.ycombinator.com/item?id=13342657 , https://news.ycombinator.com/item?id=13342804

> bigco policy is to not allow ANY AGPL code within a 10 mile radius of any computer owned by said company."

Wait, that seems extremely paranoid, even if only meant figuratively... Can you explain the thinking on restricting the use of AGPL'd licensed applications?

You can still make modifications so long as it isn't distributed outside the company.

The problem is that "outside of the company" can be murky. What if the company outsources? What if the company hires contractors? What if the company employs an intern - does the intern now have the right to distribute the software?

These are the legal landmines that BigCos want to avoid, mainly because they're questions that have not really been decided.

It is not as murky as you think. Are you referring to any particular precedent?

There are pretty simple As to these Q's. c

It's a very common company policy, because it's 'never use GPL' is a much easier rule to follow than 'only use GPL when it doesnt expose the company to risk'. Programmers aren't lawyers.

No, GPL is fine. AGPL is not.

Why?

You might be thinking of Lesser GPL? It should be immediately obvious why any Bigco would treat the AGPL like an exploding canister of infected blood and sharps.

The AGPL treats web publishing as the same as binary distribution. If a bigco (e.g. Google) used AGPL code as part of a web service (e.g a web-based email client) there is a risk that they'd be required to comply with requests for source code. It's a pretty scary license. I wouldn't touch it... and I run a teeny tiny little speck of a website by comparison.

https://en.wikipedia.org/wiki/Affero_General_Public_License

Why would you use notty's code inside a web service?

This is the mindset that lead to people not realizing the impact of shellshock. If your webservice shells out to use any other tools (imagemagick for instance) the shell is now part of your app.

A shell could conceivably be used in a webapp's backend, but a terminal emulator is a lot less likely.

Which then begs the question why the author chose AGPL over regular GPL, if it's unlikely to ever apply in practice. What was the author worried about?

Meanwhile, it's much easier for a BigCo to have a blanket policy for a license which has incredibly high theoretical dangers and little clarity around its scope. And I don't blame them.

That only addresses part of the reason for the policy. Please, you have to be aware the legal world and companies is very complicated, and smart people spend a lot of time analyzing this.

While licenses are not simple, AGPL is specifically meant to "counter" closed source services based on AGPL code.

So unless you want to offer Alacritty-as-a-Service, you should be just fine with the license.

There's a big difference between "should be fine" and "will be fine". When the stakes are small, the former can be enough. But as the stakes get larger, people favor the latter.

At a large company, the stakes get large in two ways. One is that all the numbers are just larger. But more important is that an individual decision maker's career success can become dependent on a relatively small number of things. E.g., if a lawyer approves a license that should be fine but actually isn't, that could substantially harm career prospects. It still may be a small problem overall for a major company, but if it means somebody gets fired, those are pretty big stakes.

Use or integration into your products?

"Integration into your products" is too narrow. For example, AGPL may mean that contractors who use company internal web services must be given access to the source code of those services. That's a frightening prospect for companies.

I meant use more in "install and use, maybe fix a few bugs", which is what I'd primarily expect for a terminal emulator. It's not the kind of software you're likely going to specially interface with your systems, unless you ship it with your own OS.

Software can be "shipped" to users in ways you may not anticipate. Even a lowly terminal emulator might find its way into a POS system, factory line, etc. (These interfaces are often shockingly primitive).

And even if not, developers might use internal code search, find what they want, and then copy and paste. The pushback on AGPL code (and GPL code even) comes from the difficulty of establishing internal policies to keep the code segregated. Much easier to have simple-to-undersatnd policies enforced at the boundaries, e.g. "no AGPL, period", instead of "AGPL code is OK for software that won't interface with our systems, as determined by either biased engineers or technically-shaky lawyers."

Reply on news.ycombinator.com