Hacker News Reader

Comment by shadowgovt | Hacker News Reader

It's a complicated question, but I think the real decline of true free software commons was probably around the time cloud services proved so valuable. Cloud provides huge leverage to some end-users for getting to the goal of doing the thing they want to do with the software, and it utterly side-steps the Four Freedoms via the simple expedient of "You don't own the hardware the software runs on."

GNU hasn't had an answer to this besides "boycott it," which feels an awful lot like horse-riders suggesting we deal with the problems with cars by never owning or supporting ownership of them.

View on HN

I think the GNU response is more subtle than "boycott it". In particular, I do not get the impression that GNU opposes someone using software that runs on someone else's server machine in general. One obvious example would be an HTTP server with PHP scripts, or whatever.

The software running on the remote server could even be proprietary software! For the sake of the person running the server, they should not use proprietary software, but if it is running on their machine and not yours, then it is not your responsibility, and (as I understand the GNU position) not wrong for you to access that software.

Now, if the software is actually a combination of server-side software and client-side software, such as servers that deliver Javascript code to be run locally, then that Javascript software should be Free Software.

But moreover, the GNU concern about running software on remote servers (i.e., "in the cloud"), is not just about the software itself, but about what the server maintainers can and do do with user data. Who owns the data? Can you get a copy of it? Can you get a copy of _all_ of it? How about the implications of the data? For example, you could tell Facebook ten things about yourself, and they could extrapolate a hundred more. Is "your data" the ten things only, and not the additional hundred extrapolations? And, if you ask them to delete "your data", will they? If they do, what exactly do they delete?

So it's really more of a privacy issue, I think, than a pure "free software" issue, but important nevertheless.

> The software running on the remote server could even be proprietary software! For the sake of the person running the server, they should not use proprietary software, but if it is running on their machine and not yours, then it is not your responsibility, and (as I understand the GNU position) not wrong for you to access that software.

I'd expect them to prefer you to use free software on the server, licensed under the AGPL.

I thought I had read something along those lines in a GNU document, but I believe I found what I was thinking of on Stallman's personal web site:

I firmly refuse to install non-free software or tolerate its installed presence on my computer or on computers set up for me.

However, if I am visiting somewhere and the machines available nearby happen to contain non-free software, through no doing of mine, I don't refuse to touch them. I will use them briefly for tasks such as browsing. This limited usage doesn't give my assent to the software's license, or make me responsible its being present in the computer, or make me the possessor of a copy of it, so I don't see an ethical obligation to refrain from this. Of course, I explain to the local people why they should migrate the machines to free software, but I don't push them hard, because annoying them is not the way to convince them.

Likewise, I don't need to worry about what software is in a kiosk, pay phone, or ATM that I am using. I hope their owners migrate them to free software, for their sake, but there's no need for me to refuse to touch them until then. (I do consider what those machines and their owners might do with my personal data, but that's a different issue, which would arise just the same even if they did use free software. My response to that issue is to minimize those activities which give them any data about me.)

https://stallman.org/stallman-computing.html

A kiosk, pay phone, ATM, or someone else's personal computer is indeed not a "cloud" server; I might reasonably extrapolate that Stallman would have the same opinion about software installed on someone else's server, but whether if that is true or not, this may in fact not be an official "GNU" position, as such.

> I do not get the impression that GNU opposes someone using software that runs on someone else's server machine in general.

That's my impression as well, but to me that is an area where the FSF/GNU/RMS is fundamentally wrong. Not having control over the software and, even more important, the data that is on the server is the main reason why everything is going to shit. Yet the FSF doesn't seem to care, specifically this reply from RMS on the topic:

https://lists.gnu.org/archive/html/repo-criteria-discuss/201...

All the privacy, censorship and other problems with Facebook, Youtube, smartphones and so on are rooted in somebody else controlling the server, and in turn the software and the data.

If the Javascript is GPL or not is essentially irrelevant, yet that is the main problem the FSF focuses on. I can understand how the FSF would came to that conclusion (by following their philosophy that has been outdated for decades), but it completely misses all the problems people have day to day on the Internet.

How data is managed and controlled on the server should be the main concern of the FSF today, but there has been shockingly little effort in that area. I am not even talking in terms of actual software solutions, but just general philosophy discussions. The few bits of effort we have seen, such as the AGPL, not only don't go anywhere far enough, it wasn't even originally created by the FSF. And their repo-criteria completely miss the point.

Ironically, even the slow moving field of politics went to overtake the FSF here. The GDPR goes far and beyond anything I have ever seen by the FSF when it comes to data freedom.

I really wish the FSF would put more effort into solving and discussing todays problem, instead of solving RMS's printer driver problems from the 80s, since really, that problem has been essentially solved. We have today completely Free Software OSs that everybody can use. The problems that remain are outside the realms of the classic four software freedoms.

Cloud services are actually still very fragile and vulnerable to being replaced.

(Granted, it will be annoying and painful to find new ways to do things like search the web, manage files/emails, or stream videos, but I think those can all be solved from the technical side.)

About the time the proprietary OS was finally declared dead, new competitors arose with convenient, cheap solutions that made money exactly because "you don't own the hardware the software runs on."

So we have another proprietary "open" operating system and it can capitalize on free software but still be proprietary.

When it becomes inconvenient (or painful) to use the proprietary solutions, there's a flood of new users to the free software world. I plan to just keep polishing the free software offering. That deprives the proprietary versions of oxygen, because it raises the bar for what is Free.

The significant difference between free vs. proprietary OS and free vs. proprietary cloud are around responsibility and cost.

A person can hack away on a free version of an OS for cost of labor and electricity, and making a mistake on one's personal OS build tends to have a "blast radius" limited to the individual user (or perhaps an enterprise relying on whatever software that OS was running).

Running a free (as in speech) cloud service? Much trickier as one deals with cost to run the servers on behalf of other people and administrative costs of users of one's cloud offering abusing one's resources. It shifts responsibility and cost models in a way that doesn't map cleanly to pre-cloud models.

I'm not sure I disagree with you, but I can't visualize the model of replacement that would actually work (everything I've seen so far has significant gaps in security, reliability, and division-of-responsibility in the design itself).

I don't think a Free Software version of what we now call the cloud has to slice the responsibilities the same way.

(Reductio ad absurdium) GNU hackers creating an AWS clone? Not gonna happen.

I have paid close attention to conversations that Ed Snowden brought up around his attempts to convince Glen Greenwald to use and trust PGP.

The Free Software movement will someday have an improvement on PGP. When average ordinary people such as Glen Greenwald can use it, that part is done. Part of what?

And... let's argue about what to call it!

Free Cloud? Nah, too conformist.

GNU's Non-Cloud? The acronym GNC is already taken and besides, it's unpronounceable.

Shout out to https://plausible.io/ even though they use the MIT license.

> Granted, it will be annoying and painful to find new ways to do things like search the web, manage files/emails

The best thing I did to reduce annoyance and pain in managing files and emails was to move off of hosted garbage like Gmail and Dropbox to offlineimap/mu4e and Unison/git/rsync.

> GNU hasn't had an answer to this besides "boycott it," which feels an awful lot like horse-riders suggesting we deal with the problems with cars by never owning or supporting ownership of them.

That is a really unfair way to describe things:

https://www.gnu.org/software/librejs/ https://www.gnu.org/licenses/agpl-3.0.en.html

The real problem is corporate propaganda to discourage people from licensing their work under the GPLv3+ or AGPLv3+

https://www.youtube.com/watch?v=XGa_TlRdtG8

Their "answer" misses the problem. A cloud solution running AGPL is not any more free than one that doesn't. The issue is Tivoization 2.0. The AGPL allows you to get the source, but since you don't own the server, you can't really do much with it.

Same with the Javascript, sure, you get the source in a non-obscured fashion, but that doesn't buy you anything, the data is still on the server and how much or how little you are allowed to access it is controlled by the owner of the server, not that bit of Javascript.

To bring Free Software into the cloud age you would need licenses that go beyond the source code and regulate how the data on the server is stored, manipulated and distributed. The European GDPR does that and there are a tiny few licenses like the Open Data Commons Open Database License that do that. But from the FSF there has been pretty much nothing.

Well, AGPL was the answer to that issue, but it hasn't really done much. I think part of the impact was things like GitHub recommending the MIT license.

Also you can ask 20 honest developers what they think AGPL means and get 3 or more wildly different explanations, at least if you include "I've no idea except it also works lver the network".

Or you can stop spreading the FUD and point people to: https://www.gnu.org/licenses/why-affero-gpl.html

It might very well be that this is more of an education and explanation problem.

My point still stands: I don't personally know a single person who is able to explain AGPL.

Is it not "if you take AGPL code and run it on your server and make it available to other people, you need to give them the code to whatever you're running"?

It's the "whatever you're running" that gets complicated if you're using the AGPL code in conjunction with a bunch of other code to deliver some service to customers. What are the rules around how that other code is allowed to interact with the AGPL code before it has to be made available as well?

Ok, two slightly different already, in addition to a number of people who have no idea at all.

I think this proved what I said.

(That said there was a thread on the n8n project where a couple of persons had serious problems understanding the basics of open source, its relation to free software, why commons clause isn't open source etc etc so guess we will have to explain what is and isn't "open source" for the foreseeable future :-/

The meaning seems pretty clear. It's like the GPL but distribution now also encompasses offering the software over the network in the form of a service.

What's less clear is what defines the boundaries between AGPL-licensed software and the rest of your stuff making up whatever you're offering. This isn't always 100% clear with the GPL either but the GPL meaning of distribution is pretty tightly tied to traditional Unix methods of combining code which are mostly unambiguous.

> The meaning seems pretty clear. It's like the GPL but distribution now also encompasses offering the software over the network in the form of a service.

Agree.

> What's less clear is what defines the boundaries between AGPL-licensed software and the rest of your stuff making up whatever you're offering. This isn't always 100% clear with the GPL either but the GPL meaning of distribution is pretty tightly tied to traditional Unix methods of combining code which are mostly unambiguous.

Agree again.

See my point? I don't say AGPL is bad only that it has a tendency to confuse developers in all directions.

People tend to spread a lot of FUD about AGPL. We have recently released a server product under GNU AGPLv3, and very next moment someone says: "Agpl makes it basically worthless except as a toy" :-\

Source: https://twitter.com/binarytemple/status/1172884198912331776

My understanding is that the AGPL is an answer to an older problem and didn't see the cloud coming. It addressed those running web-hosted GPL licensed applications who were side-stepping the viral aspect of the GPL by claiming that they were not "technically" distributing a binary by making the application available on the internet as an executing web app.

The AGPL requires those who create web applications derived from the AGPL (whether they're distributed as binaries or not) to make the code for their web applications available.

The AGPL does not address the cloud-hosting conundrum at all. This conundrum is where a cloud hosting company (e.g. Amazon AWS) can replicate the original author's service offering using the unmodified open source tool (wrapping it and interacting via API at most), and undercut the original author's business model. I.e., you can imagine a power user of some AGPL software competitively putting the software author's company out of business.

This is the reason for the recent licensing restrictions around ElasticSearch and MongoDB. The originating companies have had their hosted service revenue models undercut by Amazon AWS offerings that simply repackaged the software as part of their cloud offering.

Making the AGPL even stronger by adding in a viral API clause would pigeon hole AGPL software to only the most fringe ideological use-cases as everyone would be afraid to run AGPL software in a business context.

The AGPL covers the cloud use case insofar as, if a cloud provider takes the AGPL-licensed code, adds additional features, and offers it as a service it would have to add those additional features. (And, potentially, other code that interacts with the AGPL-licensed code; the boundaries are a bit unclear.)

Of course, the desire is to keep AWS from offering even just a fully-compatible competing service. But that would 1.) require APIs to be copyrightable and 2.) would, as you suggest, make that software pretty much unusable for most cases.

You're right that the AGPL largely pre-dated the cloud providers although the direction things were going in was reasonably clear.

I don't think the AGPL actually cares about being able to undercut the original author's business model, as long as you're not just taking open source software, adding minimal value-add, then keeping that as a closed service.

The AGPL was really driven by the increasing prevalence of software being delivered in the form of a service. I don't recall much discussion of business models at the time but there was at least a school of thought that the GPL's protections of software freedom were being eroded because of service providers exploiting this "ASP loophole."

There are licenses to address that, though they're even more expansive or "viral", making the proposition less attractive. What I've seen instead is software project owners, tired of being profited upon by cloud services without contribution, switching to more restrictive licenses or attaching the Commons Clause. Then, commercial use is pay to play.

It's a small tragedy.

Reply on news.ycombinator.com