Ask HN: AGPL - what do I have to give up, and to whom? | Hacker News Reader

Ask HN: AGPL - what do I have to give up, and to whom?

1 pointnsxwolf2 comments

I realize I should be asking a lawyer, but I'm trying to get a general understanding of the AGPL license.

If my enterprise server application links to a library that is made available under the AGPL, and I do not pay for a license, what source code am I responsible for making available, and to whom?

In my head I am seeing two extreme interpretations:

A. It covers literally every single line of source code my company owns - even if it never touches code that goes anywhere near the library.

B. Only the code actually calling the library needs to be released.

Option A seems arbitrary and extreme, and seems to exist only as a punitive measure to get me to buy a license. It also seems difficult to comply with, as it could potentially cover one-off database scripts that DBAs used to import or maintain some data, which I may not even be aware of the existence of, but may put us in violation of the AGPL.

Option B could be implemented in a way that would be totally unfair to the spirit of the license - i.e., write a simple utility class that does nothing but wrap the library calls and then claim we only need to release that utility class.

Also, to whom must the source be made available? If the company is a B2B operation, does it only need to be made available to the customers, or to their end-users as well?

The vague answer to the first part is: whatever code you would've been required to include if the library were GPL and you "distributed" an application using it, which is any portion of the software that can be considered a "derivative work" of the library. The AGPL only changes the definition of "distributed" to include running it as a hosted webapp, but doesn't meddle with the definition of "derivative work".

Some cases are easier than others, and I think A is definitely too strong; for example, if your company runs two clearly separate webapps, and one of them is a derivative work of AGPL code while the other isn't, you only need to AGPL the one of them. One possibility is to run your planned source release by the author of the AGPL code in question, and see if they feel your course of action satisfies their intent with the license.

Thanks.

Reading the license they seem to say the intent is to have to "give something back" for using the code. If we were to release just the portion of the code that uses it, I feel that it would serve as an excellent real-world example of the use of this library which would be helpful to many.

But honestly, if there's an alternative to this library with a different license I'm more inclined to do that out of fear of compliance failures.

Not against paying for software either, but this particular vendor doesn't advertise a price - they want to basically sit down and have a chat with you about how you use the library. That sounds like $$$$ to me, no doubt they will want to get into details about number of processors and threads and users and price accordingly.

Reply on news.ycombinator.com