Hacker News Reader

Comment by cfallin | Hacker News Reader

That's the difference between GPL and AGPL. GPL only requires source distribution if you distribute binaries, not if you run your binaries on your own server responding to requests from users. AGPL requires source distribution for any network-accessible service.

(Unsurprisingly, there was a very very strict rule against using, coming within 100 meters of, looking funnily at, or even thinking in a passing way of any AGPL source internally when I was at a particular large internet company that was otherwise pretty open-source-friendly...)

View on HN

This is an imprecise description of the AGPL that may feed common misconceptions.

* If you don't modify the AGPL program, you don't have to offer source.

* The AGPL is viral in exactly the same way as the GPL. Programs don't become subject transitively to the AGPL just because they communicate over a network.

If busybox was AGPL, you wouldn't have to distribute source code unless you modified busybox and it communicated over a network with users. Even then, you would only have to distribute the modified code for busybox, not other services that it might communicate with.

Precisely that.

A more relevant example might be something like my web-facing software, `bitcoin-top`, which I release under the AGPL.

https://bitcoin.esotericnonsense.com

You are free to copy the source code and run it on your website, as a part of your website (e.g. link to it on a subdomain), etc.

In that case the matter of whether you have to offer the source is kind of immaterial - it's the same source I'm offering and have mirrored at least 4 times, and in this year 2019 we don't need to be shipping CDROMs about.

I don't believe that your statement: * If you don't modify the AGPL program, you don't have to offer source. is strictly correct, rather that it's simply the case that if you don't modify it, you're already offering source, you can just point people to my github or whatever.

If you modify it and serve a different version, say a litecoin node monitor or you tweak and improve it or whatever, you must release the source code because our software would be licenced under the AGPL.

> I don't believe that your statement: * If you don't modify the AGPL program, you don't have to offer source. is strictly correct, rather that it's simply the case that if you don't modify it, you're already offering source, you can just point people to my github or whatever.

Clause 13 of the AGPL specifies that you must offer the Corresponding Source via "a network server at no charge". It doesn't say it has to be your network server. But if upstream shut down for some reason, you'd have to come up with some other method to offer users the source.

Right.

It's right in section 13:

> Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network [the source code]

This is simpler than the rules for distributing the binary.

That is exactly the case at my current gig. It doesn't matter how many hours you put into a project. If any of the code is AGPL, our legal team will squash the project.

Sounds like a very narrow minded legal team, AGPLv3 code is the core of many modern businesses.

Quite a few people here agree with you.

I'm far from the only one rinning a business atop AGPLv3 software :P

Amazon was the pioneer of SaaSifying AGPLv3 software.

Actually, I think they're being cautious. You may be fine for now, using AGPL code, but if it's modified at some point in the future, then the viral issues kick in. That's probably what the lawyers are worried about. You can't assume that everything will stay the same.

The AGPL requires you to provide source to "all users interacting with it remotely through a computer network."

If I have a factory, and my line workers use terminals that talks to my central server, do I have to provide them with a copy of my source code?

If I own a store that has price scanners that check a central database, do I have to make source code available to all customers?

If I have an airline that contains in-flight entertainment units, do I have to provide source code to every passenger?

If the code in question were licensed under the AGPL, yes to all three, I would think.

If you modify AGPL code and redistribute it or offer its services over a network, you've created a derived work which is not solely 'your source code'. What you need to provide is the collective including the modifications.

You can avoid this by not using AGPL licensed code.

> If I have a factory, and my line workers use terminals that talks to my central server, do I have to provide them with a copy of my source code?

No, and the FAQ for AGPL (http://www.affero.org/oagf.html) explains that AGPL and GPL works identical in this matter. Organization that just makes the copies for itself is not distributing, and as such not bound by the conditions for distributing (https://www.gnu.org/licenses/gpl-faq.en.html#InternalDistrib...).

> If I own a store that has price scanners that check a central database

> If I have an airline that contains in-flight entertainment units

Grey zones. It depend on copyright law. All interaction with copyrighted material is not distribution. I can look at a building without the architect being owned money. I should be able to sleep in a hotel without the architect having a copyright claim. Can I take a photo? That is debated. Can I buy and sell the building? maybe.

I would personally think that a price scanner is not conveying the work of internal workings of the store, but a agpl game in an in-flight entertainment units is conveying copies of the art to passengers just like a movie.

Ask a lawyer and the answer should be "it depend", just like any other legal area which does not have clear bright lines.

> I package my software with my business logic

The implication here is that OP is not simply providing a web service.

> a particular large internet company

https://opensource.google/docs/using/agpl-policy/ ?

Reply on news.ycombinator.com