Hacker News Reader

Comment by emptyparadise | Hacker News Reader

>This is the best way to future-proof the project against bad actors, including ourselves if we become evil at some point. By allowing open source forks and competitors to exist, we are opening ourselves up to healthy competition and accountability from the open source community.

Major respect for recognizing that and not doing anything like dual licensing or CLAs (at least as far as I can tell).

View on HN

thank you! the easy / "obvious" choice was to close source but this was not really something we wanted to consider. we're in the privacy first space and we want to stay fully open source. AGPL should hopefully protect us better from similar commercial threats in the future

Hello, can you confirm exactly what you are doing here? If it's AGPL with no CLA or anything, how are you doing "They can purchase a commercial license to remove the copyleft restrictions"?

EDIT: Asking because I'm genuinely interested in this issue and am currently making license choices myself - not trying to have a go!

For now we just changed to AGPL as a defensive move to avoid these threats. It was an unplanned move that we didn't even think about few days ago.

Next step is really to consider what we want to do in the future and if necessary add a CLA before we merge next contribution.

We never planned to do any commercial licenses (we're focused on our Cloud offering) but it seems like a valid option in case of these corporations who want to resell our product but not open source their modifications.

Hello markosaric, Have you thought on requiring contributions to be dual licensed MIT + AGPL? This would avoid you the need of a CLA because you can use MIT to incorporate the contribution to your cloud solution and/or to sell a license to a corporation that would like to keep their modifications closed. This would also lower the barrier to contributors due they don't need to sign the CLA.

This is an insightful comment about how to achieve certain uses without CLAs, nice to learn about this.

Do you have any examples of projects doing this? Thanks!

thanks! that's a good point and makes sense to do!

I see.

I would definitely urge you to consider this very soon: AFAIK you can't do any commercial licenses with AGPL without A) some form of dual license and CLA or B) just never accepting pull requests from anyone.

But also, does this also apply to your own cloud hosted offering? Without sorting this out, all the software in your cloud hosting product now has to be fully open-source. And I get that's your philosophy, but would there not be any tiny bit you want to keep closed - maybe the anti-fraud stuff around your billing system, for instance?

This seems a key point that I'm very interested in, so sorry for pushing!

AGPL doesn't work the way you think it does. An anti-fraud system service can easily communicate with Plausible over a network connection through an IPC interchange (HTTP, gRPC, etc.) without triggering that issue. The extension to Plausible to support that itself would be AGPL, but the anti-fraud service itself would not have to be.

Yes - I was thinking of internal code, not an external service. But yeah, knowledge of what would or would not be covered by AGPL seems crucial here.

You'd probably want to be able to communicate with multiple anti-fraud systems anyway, so I would expect it to be something plugged into Plausible and not part of Plausible itself.

> how are you doing "They can purchase a commercial license to remove the copyleft restrictions"?

This is incorrect. If you own copyright on something you can transfer those rights to other people in any way you want.

I can give you a copy of my software under AGPL and another copy under a completely different license and the two things are independent from each other.

There isn't a "remove the copyleft restrictions" mechanism.

You can simply give out a new copy with a closed license that allows, for example, execution as a service, static linking, dynamic linking but no copy.

Right, but if you accept outside contributions, and those contributors give you their changes under the AGPL as well, you cannot relicense their work under terms other than the AGPL.

You can get around this by requiring copyright assignment from all contributors, or by making contributors sign an agreement that allows you to do what you want to do.

The problem is contributions by others, of course.

> So how can a corporation commercialize a FOSS project without open sourcing their modified code? They can purchase a commercial license to remove the copyleft restrictions and in that way support the original project.

Looks like they are doing something like dual license? Can the company comment and clear this up?

It looks like they are doing one license, AGPL, without CLAs. They provide a hosted service.

Others can also provide hosted services, They can't get a competitive advantage with proprietary "value-adds." Usually, the authors have significant reputation and branding advantage, so unless they f- up, competitors are bottom-barrel low-cost providers.

AGPL without CLA is whom I tend to gravitate to.

Indeed. That would also require CLAs unless they aren't taking in outside contributions.

>Major respect for recognizing that and not doing anything like dual licensing or CLAs

It's nice, but in my opinion there is nothing wrong with doing it either. It might be even good thing if it ensures stability of the developer. If it turns out the original developer with dual licence/CLA is no longer good, community can continue from the AGPL version on its own and if the original developer wants to incorporate these new community changes, the AGPL will "infect" the dual licensed version.

My opinion is that we've been burned by this enough times that it ain't worth it. Most recently, Oracle rolled back Java.

If I'm buying into an open ecosystem, it's because I want an open ecosystem. I don't want a use-open-to-gain-market-dominance-and-than-milk-customers ecosystem.

AGPL is ideal for things I don't need to link proprietary code to.

What I most want is a plausible, paid, AGPL competitor to GSuite.

Reply on news.ycombinator.com