Comment by rectang | Hacker News Reader

Comment by rectang | Hacker News Reader

Parent Full thread

I can understand the trial court's rationale.

Preventing a licensor from adding clauses may have been intent of the authors of the AGPL, but they aren't in a position to enforce that.

The license in question is not being called "GNU Affero General Public License + Commons Clause", which could be fought on the grounds of trademark violation — it's being called the "Neo4j Sweden Software License".

There's the theoretical possibility of a copyright claim for the text of the AGPL, where the AGPL's copyright holders disallow derivative works, but I'm pretty sure that won't fly for lots of reasons: not clear who has the copyright and therefore has standing, not original enough, functional rather than creative, etc.

ETA:

There may actually be a trademark problem here.

https://sfconservancy.org/blog/2022/mar/30/neo4j-v-purethink...

> But Neo4j consciously chose not to do that. Instead, they license their software “subject to the terms of the GNU AFFERO GENERAL PUBLIC LICENSE Version 3, with the Commons Clause”. (The name “Neo4j Sweden Software License” only exists in the later Court papers, BTW, not with “The Program” in question.)

> There's the theoretical possibility of a copyright claim for the text of the AGPL, where the AGPL's copyright holders disallow derivative works

There's also a pretty clear case for promissory estoppel since their FAQ (which is "maintained by the Free Software Foundation's Licensing and Compliance Lab") says "we will not raise legal objections to your making a modified license": https://www.gnu.org/licenses/gpl-faq.en.html#ModifyGPL

But Neo4J didn't fulfill the conditions of that FAQ, particularly this:

> provided that you call your license by another name

Given that the AGPL itself uses qualifiers to be a different license from the GPL arguably adding the “with commons clause” is a different name.

That's the argument that the Commons Clause authors made — that they should be able to sponge off of the goodwill of FOSS community. It's outrageous, offensive, and I strongly suspect a losing legal argument so long as the original license name is a defensible trademark.

Consider the Apache Software License version 2.0. "Apache" is a registered trademark held by the Apache Software Foundation in the US and other jurisdictions. The Commons Clause is not additive, it is antithetical to the values of the ASF and directly undermines the ASF's mission. Calling something the "Apache License with the Commons Clause" damages the interests of the ASF by introducing a confusingly named product into the market.

What I have more questions about are other licenses where there's not necessarily an obvious trademark held by a willing defender. Can you call your deceptive fake FOSS license the "Common Development and Distribution License"? I'm not so sure about trademark defense there — the only option might be social pressure.

Greg’s Private License Very Three, or GPL v3 is my new license. Not at all sneaky.

I would reduce "the Commons Clause [...] is antithetical to the values of the ASF" to "_one_ of the values".

As an example of other values untouched by the Common Clause, the Apache License 2.0 includes: "(4.b) You must cause any modified files to carry prominent notices stating that You changed the files;". The values here are correct attribution of work, and protecting consumers by making changes easily spotable.

Please do not collapse all open source licenses into a single point value, it does them no favor. And if you really have to, then at least use the one about open access to the source code. The one in the name.

Yes, the Common Clause violates point 6 of the opensource.org/osd - but there are 10 points on that list. And the OSI is not the be-all-end-all of defining open source, even if it sues people for using the word, it not the one and only source of truth, not some religion of 10 commandments that wants its followers to harass heretics.

And this is important, because this whole discussion is as old as open source. Besides commercial use with negligible own contribution as seen in the Common Clause, there are other well known examples of restrictions people added to their works in spite of point 6, like a "no military use" clause that was quite popular for some time. That prevented good software from being distributed by Debian, because of Debians choice to only include software that complies with all of its ideals.

People first and foremost have the freedom to license their original work however they want. Some restrictions, such as trademarks, may apply. You have a point with trademarks and naming a modified license in a confusing way, but i think you are overreacting when you call the Common Clause "outrageous, offensive" and "to sponge off of the goodwill of FOSS". Yes, the license that is "AGPLv3 + Common Clause" may never become OSI approved, but for the consumer the modification is easy to spot and understand. And that actually does follow an important value of the FOSS community.

Ironically one that is not part of the 10 but included in the Apache License 2.0

I stand by my characterization of the Commons Clause initiative as sponging off the goodwill of the FOSS movement.

The language of the Commons Clause did not have to be attached to a derivative, trademark-abusing naming stratagem. They should have used novel, non-confusing names for their licenses from the start.

Perhaps limit your policing of others' phraseology to cases where it's clearly wrong or harmful?

The Apache Software License and the Apache Software Foundation are not the same thing. The latter is a human organisation and its values are determined by its members - some of these values are not even codified, so it may be hard for an outsider to determine them - but in this case I am inclined to agree with the GP.

The ASF promotes permissive software distribution - this includes the right to remove permissions when relicensing. However, distributing such a modified license under the Apache umbrella potentially harms that goal by muddying the meaning of "Apache licensed"

> However, distributing such a modified license under the Apache umbrella potentially harms that goal by muddying the meaning of "Apache licensed".

Exactly.

The ASF fosters a permissive ecosystem, characterized by low risk of litigation. If you attribute ALv2-licensed dependencies properly, you should feel confident that you are pretty much in the clear. If you screw up and fail to attribute, it's easy to achieve compliance — just add the attributions. You need not worry about publishing your proprietary code under a copyleft license, stripping out the ALv2 dependencies, or other more involved remedies.

This low risk environment is key to the participation of many users, especially risk-averse corporate contributors. It is a fundamental aspect of the ASF culture and mission.

The "Apache + Commons Clause" license radically undermines that, because if you are a commercial user, you may well get sued. The "Apache" name doesn't belong anywhere near a license which includes the Commons Clause.

I changed the first sentence from "please limit" to "i would reduce" as it is not my intent to "police phraseology" but to state my opinion in reaction to someone else opinion. Maybe there is some other phrase that would be even better to make the rhetoric non-violent.

I think you have still missed the important distinction between the ASF and the ASL.

Your opinion is based around your interpretation of the ASL, whereas the GP was referencing the ASF - an organisation of people, with their own shared values, that created the ASL. You have not referenced the ASF at all, only the ASL and some general concepts around FOSS, which are not particularly relevant to a discussion of the ASF's goals and values.

Either the ASL includes values the ASF does not hold, which would be very strange, or the example of a value enshrined in the ASL speaks for the values of the ASF as well.

Nowhere did the GP say that it was antithetical to all interests of the ASF.

> Given that the AGPL itself uses qualifiers to be a different license from the GPL arguably adding the “with commons clause” is a different name.

Copyright holders aren’t bound by license conditions they impose on others.

>> I can understand the trial court's rationale.

Agreed, there is no point or value in adding terms that can be immediately removed by the person receiving it.

IMHO the FSF also went a little too far trying to dictate how people go about handling violations in GPLv3, but it's still a good license.

I think we have to accept that people will reuse and modify the texts of various open source licenses in all sorts of ways which cause downstream confusion.

What the FOSS community needs to ensure is that users can always differentiate between a FOSS license and a modified version which has subtle but profound changes. Our best defenses there would seem to be trademarks and social pressure. "That's not actually the AGPL, and calling it the AGPL causes confusion in the marketplace."

All of these headaches stem from the OSI's refusal to address the problems posed by SaaS to the open source model. Their thinking is stuck in the 1980s and 1990s.

SaaS is effectively a loophole. You can use 100% open source software to create something that is actually far more proprietary and that offers less user freedom than old school closed source applications. Yes the user can theoretically get the code but it's painful to operate and meanwhile the SaaS application has all the user's data.

Open source is rapidly becoming free labor for closed SaaS and a tool to accelerate the lock-down of user data in the cloud rather than a tool to expand user freedom.

People are trying to roll their own licenses to deal with these problems since the OSI is providing no leadership.

> All of these headaches stem from the OSI's refusal to address the problems posed by SaaS to the open source model. Their thinking is stuck in the 1980s and 1990s

There are no such problems. The “problem“ supposedly raised by SaaS is, in fact, an issue widely recognized as inherent to FOSS licensing before the OSI existed.

> Open source is rapidly becoming free labor for closed SaaS

“Free Software commercially redounds to the benefit of whatever for has the most resources to build and sell non-licensing services around it“ is not a new thing with SaaS. It's been recognized widely since the early 1990s.

What's new is people feeling entitled to a viable business mod for VC-funded startups that can free ride on FOSS-centered goodwill, without actually being FOSS.

You realize that you're choosing a future here where nobody owns their data nor has the ability to actually run software on that data themselves... unless they have a lot of free time and the skills of a developer and IT professional, right?

People are letting the idea of open source as originally conceived eclipse the goal of providing freedom to the user.

It's a pretty common thing. When an idea doesn't turn out exactly as people wanted, it's very common for people to double down on the idea to the point of even turning against the original goals of the idea. This is what open source is doing. The license is more important than what the license was intended to achieve: freedom for the end user.

Wasn't the AGPL created to address exactly this loophole?

Isn't this a case of Neo4j trying to prevent a SaaS from making money selling a managed Neo4j offering?

It seems the OSI is siding against Neo4j and with the SaaS by saying Neo4j had no rights to remove the right to sell the software from the SaaS company who decided to remove the added clause preventing them from selling Neo4j.

The goal of the AGPL is that anyone can run a SaaS based on someone else’s code, as long as their own modifications are open as well.

Just like the GPL ensures that while Microsoft could take Linux and sell it, they’ll have to make their changes open again.

Yes, yes it was.

If you're talking about projects where people are following the letter and spirit of the license, and publishing their code, but it's a pain to use... that's not really something you can control with a copyright license. The correct answer in that case is to not use that code and treat projects that rely on it as technical debt.

If you mean that the SaaS provider has a private fork of someone else's code, and won't publish that fork... well, AGPL already exists for that. But here's the thing: in order for any license to close this loophole, you need to create a licensing term that obligates the user to publish private forks. These terms will inevitably either restrict the user's freedom to run the program, or the user's freedom to modify the program. I don't see why we should be calling restrictions on either freedom[0] to be Free Software or Open Source.

My personal feeling is that companies that are adopting "SaaS-loophole" copylefts are looking for the street cred of being source-available, while still being able to wield copyright in the way one would with proprietary software. Hence the Commons Clause that bans commercial endeavors on top of the already difficult-to-comply-with Affero clause. If you want to be paid, just... demand payment.[1] That's what proprietary licensing is for, and you are never going to close the "SaaS loophole" in FOSS while still remaining in the spirit and letter of FOSS.

The thing about SaaS is that it wasn't invented this decade. Even back in the 80s and 90s when FOSS was novel, you had massive IBM mainframes that could be partitioned, virtualized, and rented out exactly in the same way Amazon does today.

[0] GPL and weaker copylefts are tolerable because said licensing provisions only trip on distribution. Ordinary users do not need to worry about GPL compliance until they want to give someone else their code. This is a feature, not a bug.

[1] Are FOSS support contracts still a thing?

> in order for any license to close this loophole, you need to create a licensing term that obligates the user to publish private forks. These terms will inevitably either restrict the user's freedom to run the program

No. The end user is the one using the SaaS service, not the company providing the service. AGPL is there to give freedom all the way up to the end user. Also, there is no private fork in this scenario.

Uh, there is a private fork in this scenario. The whole point of AGPL is that you cannot legally modify the software and host it over a network to avoid having to publish your fork and comply with the GPL copyleft clause. Mere use does not trip the AGPL copyleft, because Freedom Zero is considered sacrosanct.

Furthermore, there are plenty of situations involving a network, other than SaaS, in which both the client and server could be considered end-users. For example, a WordPress site. The people who own the site and the people viewing it are two separate sets of end-users with their own freedoms to protect.

No, you are still conflating running something for internal use or for external users.

Under AGPL when a service is provided to the public it is not a private fork or private execution.

That's the whole point of the AGPL.

Seems a better solution would be a checksum on the license text no?

The most accurate license detector is ScanCode. I think it uses some sort of rolling checksum thing for detection.

https://github.com/nexB/scancode-toolkit/

Hey, pabs3! Actually this is not using a rolling checksum for detection but rather a combo of language model, checksums, automatons, bitvectors, inverted indexes and multiple sequences alignment (e.g. a specialized diff). I put some docs there to explain the approach at ahttps://github.com/nexB/scancode-toolkit/blob/develop/src/li...

You need a bit more than checksums for this. If anything the FSF published many different versions of the "official" GPL2 texts and this would defeat checksums. See https://github.com/pombredanne/gpl-history ... so in the general cases hashing a text does not work consistently and safely. Eventually you need a diff for a pairwise comparison, and the only difficulty is making diff fast or find ways to approximate it fast enough to avoid doing a full diff.

In fact, modifying and updating licenses falls under what I'd consider free speech. The answer to bad license edits is not to shut them down, it's just to write better ones and convince others to use them.

I may not agree with bad license edits, but I'll defend them under the right to the free speech of the developer who is shipping the code.

It's never been acceptable free speech to sell a fake Rolex watch or a fake Samsung TV and its not a violation of free speech to insist they call it something else. This is a really weird hill to die on.

What you're talking about falls under Fair Use. Free speech protections don't provide any such right.

Reply on news.ycombinator.com