Hacker News Reader

Comment by sneak | Hacker News Reader

If I download some open source free software, and modify it so it does something differently on my computer, simply running "systemctl start httpd" should not potentially bring down the machinery of state copyright enforcement against me for not publishing my private patches.

Freedom includes freedom to have privacy. Not distributing any software, my privacy should not be violated.

Running an ASP off a private fork is not "loophole", any more than, say, using free software to make missiles or killing machines.

I feel like the AGPL is just anticapitalist fist-shaking.

View on HN

> Freedom includes freedom to have privacy.

You have that. The AGPL provides rights to _users_ of your software; that's it, no one else. If _you don't provide_ the modified software to someone, they can't demand your private patches. No one can "bring down the machinery of state copyright enforcement" against you, unless you interact with them first and provide them your modified software and they use it.

And even when you do that — when you provide your software to someone — they still can't demand that you "publish" your private patches. Only that you give to _them_ the modified software under the same rights that you received the original software. Only to _them_, not the public. No publishing required. _They_ are free to publish the software they received, of course, as were you when you first received the original software; but you aren't obligated to publish it.

----

The only difference between AGPL and GPL is that the definition of what constitutes "distribution" of software is extended. The AGPL changes only "distribution" and nothing else in the GPL.

Yeah, and running a business on my own computer by providing API services to someone is not distribution of software. Running an API business shouldn't force me to distribute anything to anyone.

Consider "Service as a Software Substitute": https://www.gnu.org/philosophy/who-does-that-server-really-s...

Do you consider it a problem? If not, why not? If so, what other than the AGPL do you propose to fix it?

No, I don't consider it a problem at all. Nothing is being used improperly or against the spirit of free software when software freedom is exercised (by a service provider) - that's the whole point.

I really think the whole AGPL is simply sour grapes, because most GPL-using businesses have not figured out how to become profitable. ("open source is not a business model.") The anti-corporate, anti-business types see people exercising their software freedoms and using free software to make money, and think it's a problem that needs to be stopped.

It's interesting that TPTB have ruled such "ethical source" licenses as nonfree - you're not allowed to restrict Freedom 0 to say that users aren't allowed to, say, use the software to produce bombs. That's not a free software license.

Using it to generate revenue however, is seen as a "loophole" to be "closed".

I don't see a license that forbids the generation of revenue by selling access to a service API using a private fork as any less nonfree than one that forbids the production of bombs.

Consider an extreme example -- someone takes LibreOffice and many other GPL-licensed programs and creates a business where you can only access them through the internet. They make massive (useful changes) to LibreOffice to the point that a vast majority of users switch to the online version because it is objectively better.

However, because you can only access their fork of a GPL project over the internet, there is no requirement for them to provide users the source code of software they're using (which is based on software developed by other people under the social contract of the GPL). Thus users are using software which is technically free software but they have no mechanism by which to excerise any of their freedoms nor even see the source code of a program they use purely because the protocol used to display the interface is HTTP rather than X (yes, it's also not running on the same computer, but from a user's perspective it doesn't matter if it runs on your computer or not -- they are using and depend on the program, even if it happens to be running on a different computer).

Do you agree that this scenario is a problem, and the GPL is not helping to solve it? If so, then you now understand the reason behind the AGPL and how it is clearly in line with the spirit of free software. If not, then I'm not sure you fully buy into the concept of user freedom. User freedom is a holistic thing, it isn't a technical definition that cares about specific implementation details.

I would argue this is a bigger issue than tivoisation, because at least with tivoisation you can at least get the source code (even though you cannot use your freedoms on the hardware you bought). In this SaaS scenario, you can't even see the source code of software you are using.

Well, where the software is running changes the whole fact of the matter.

Something entirely different is happening when I'm running software on my computer, using it to provide i/o services to you, and when I provide software to you to run on your own computer.

One is a service, the other is a product. The hypothetical LibreOffice fork, with their private modifications on their own private computer, is entirely within the bounds of reason to keep those modifications private and generate revenue with it, if people want to pay them for the services they provide with it.

It's no different than me using LibreOffice to produce private documents, which I then use to generate revenue for my business. My customers have no right to access my private documents that I use to provide that service: source code is no different.

> The hypothetical LibreOffice fork, with their private modifications on their own private computer, is entirely within the bounds of reason to keep those modifications private and generate revenue with it, if people want to pay them for the services they provide with it.

I think you're getting caught up in the "on their own private computer" part. There is a clear distinction between using a piece of software and providing a service by which other users make use of the software by proxy. In the first case, you are not acting as a proxy for other users to run the software.

> It's no different than me using LibreOffice to produce private documents, which I then use to generate revenue for my business. My customers have no right to access my private documents that I use to provide that service:

It is incredibly different, so much so that I'm not sure you've understood my hypothetical.

> source code is no different.

If you were using it purely for yourself, yes. But in the hypothetical the business is providing the ability for other users to use the software by proxy. They aren't using the software themselves and then

As a final point, consider that these days a regular user might not know whether the software they run is actually locally running on their computer or is a SaaS application where the code happens to reside on a different machine. How they use the software is no different in either case -- so why should they have different concepts of what freedoms they have? For an ordinary user there is no practical distinction between software they use on their computer versus software which is provided over the internet -- hence why I said that the only real difference is that the "display protocol" for the application is HTTP not X.

Wow, this is a fascinating answer. I really like your thought experiment with LibreOffice. Imagine something even more nefarious: The whole LibreOffice team "quits" to start a company that does exactly the above. After building a large user base on their web-only version, they begin to charge for premium features. All while never distributing the GPL code ever again. To be clear to all readers: This is only a thought experiment!

Further: If we think about cloud-based AGPL apps: For the most part we are talking about web-apps, which, in most cases, will always include JavaScript running on the user's host. Does FSF or AGPL have anything to say about this source? I ask because I am thinking deeper about your idea: What if the not-so-LibreOffice was nothing more than compiled into WASM (WebAssembly) and run in your browser... so the "server" (SaaS) was doing nothing except serving a huge binary that you run locally in your JavaScript VM. Plus, the compile from C/C++ into WASM could reasonably obfuscate the original source. I do imagine a future where lots of commercial apps are nothing more than C/C++ compiled into WASM then run through a browser. This would provide some source code privacy (that vanilla JavaScript cannot provide today) and reduce the burden of installation issues.

The source for compiled JavaScript or WASM needs to be provided even with just the GPL rather than the AGPL. The loophole in the GPL only applies if the code is actually running on someone else's server and not the user's client.

Great point. To travel deeper down this rabbit hole: We might need something like "Citrix Remote Desktop" in a browser. Basically: Only sent graphical diffs over the wire. Then, browser is only painting pixels, not running the app. Everything else is computed remotely. Horrible scenario, but sadly might pass muster vis-a-vis A/GPL!

There is absolutely no problem with that. If you want to host it then do it yourself, nothing is stopping you with commercially permissive licenses.

I never knew how much I can't stand "free" software types until today.

You cannot host it yourself because you don't have a copy of the source code -- all of their changes are private because the are not distributing the software to anyone.

> I don't see a license that forbids the generation of revenue ...

The AGPL does not "forbid the generation of revenue". There exist revenue-generating services powered by AGPL software.

> Nothing is being used improperly or against the spirit of free software when software freedom is exercised (by a service provider)

If that exercise of software freedom hampers an end-user from exercising their software freedom, then that's pretty clearly "against the spirit of free software".

I wrote:

> forbids the generation of revenue by selling access to a service API using a private fork

That's the thing - "software freedom" is being applied to software that you have no reasonable expectation of having access to:

1) you didn't write it

2) it hasn't been provided to you

3) it's running on someone else's computer

There is no reasonable basis for claiming that you have the "freedom" to access information in someone else's computer that you have nothing to do with. That's actually a privacy violation.

I disagree that "it hasn't been provided to you". Imagine a regular desktop program that you can only use through RDP or VNC. Is that not provided to the user either?

No, only the outputs of the software are provided. The software remains wholly within the confines of the computer executing it.

There's a clear distinction between sending someone a file that represents computer software (source or object code) (a product) and sending someone the output of a calculation you have been requested to perform (a service).

> There's a clear distinction between ...

The distinction is meaningless to the user in the example your parent cites.

You forgot a point in your numbered list:

4) You're using it.

----

> access information in someone else's computer that you have nothing to do with.

1. "nothing to do with" is an absolute claim. Your line of argumentation has been heavily reliant on absolute statements, refusing to understand nuance.

2. If the user truly had "nothing to do with" some information on some computer, the AGPL places no requirement for them to be provided access to that information.

3. Interacting with a service provided by a software != having "nothing to do with" said software.

----

> ... claiming that you have the "freedom" to access information ...

For the last time, that is not how the AGPL works. I strongly urge you to go and actually read it, or even https://writing.kemitchell.com/2021/01/24/Reading-AGPL.html

Now, on to the specific rebuttal: The AGPL does not _force_ a user upon you, the service provider. It does not grant the user any "freedom" to access any information, let alone arbitrary information. It cannot even be used by a user to force themselves on you.

----

> That's actually a privacy violation.

By your line of reasoning, you have violated my privacy by way of your writing showing up on my computer. Do you see the absurdity in that?

> Yeah, and running a business on my own computer by providing API services to someone is not distribution of software.

Depending on the software, according to the author of said software, it can be. I'm not saying this is the case for all software, but for some kinds of software it makes sense.

> Running an API business shouldn't force me to distribute anything to anyone.

"Running an API business" does not "force" you to "distribute anything to anyone". Using software that was clearly meant, by its author, for the provision of a service and licensed as such to you is what requires you to do anything. And the AGPL is very tame at that:

1. you don't have to distribute non-AGPL3 and non-GPL3 code;

2. you don't have to distribute to just about anyone, only your users; and

3. you don't have to distribute anything _you haven't modified_.

----

If you were given the freedom to modify a software, then not providing users of this modified software the same freedoms you received is loss of software freedom, don't you see?

What's the difference to the user? Any kind of selling software is "providing API services", if I'm invoking an API over the network then I'd like access to the source that's behind that API for the same reasons (fixing bugs, making improvements) that I'd like access to the source for an API I'm invoking on my local machine.

Reply on news.ycombinator.com