[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Is AGPLv3 DFSG-free?



"Arc Riley" <arcriley@gmail.com> wrote:
> Given the thread thus far to paste AGPL section 13, the only section which
> differs from the GPLv3 beyond name changes:
>
>   13. Remote Network Interaction; Use with the GNU General Public License.
>
>   Notwithstanding any other provision of this License, if you modify the
> Program, your modified version must prominently offer all users
> interacting with it remotely through a computer network (if your version
> supports such interaction) an opportunity to receive the Corresponding
> Source of your version by providing access to the Corresponding Source
> from a network server at no charge, through some standard or customary
> means of facilitating copying of software.  This Corresponding Source
> shall include the Corresponding Source for any work covered by version 3
> of the GNU General Public License that is incorporated pursuant to the
> following paragraph.
>
>   Notwithstanding any other provision of this License, you have
> permission to link or combine any covered work with a work licensed
> under version 3 of the GNU General Public License into a single
> combined work, and to convey the resulting work.  The terms of this
> License will continue to apply to the part which is the covered work,
> but the work with which it is combined will remain governed by version
> 3 of the GNU General Public License.

What I'm concerned about is that software under the above licence:
+ acceptably protects integrity of the author's source (DFSG 4),
+ allows distribution of licence (DFSG 7),
+ is not specific to debian (DFSG 8),
but
- DOES NOT have free redistribution (DFSG 1),
and
* MIGHT include source code (DFSG 2),
* MIGHT permit derived works (DFSG 3),
* MIGHT discriminate against people (DFSG 5),
* MIGHT discriminate against fields of endeavour (DFSG 6), and
* MIGHT contaminate other software (DFSG 9).

> I'm going to break this down into pieces, as I understand it from numerous
> conversations with people at the FSF, SFLC, etc:
>
>
> *your modified version must prominently offer all users interacting with it
> remotely through a computer network*
>
> The terms of client/server/peer do not appear in the license text.  A "user"
> is thus

Wait a moment: how is a "user" *thus* anything?  That doesn't follow
from the non-definition of client, server and peer.

> any person operating software which interacts with the software
> you're running, regardless of the network role your software is running in.
> If you're running a 3d IM client connected to GTalk, and that client has
> modified code, you're thus required to allow Google sysadmins to receive a
> copy of your changes.

I'm not sure that that's the case, but that seems like a pretty clear
contamination of unrelated software, which would break DFSG 9.

It seems like Google's sysadmins aren't interacting with your client,
but rather your client is interacting with the GTalk server.  It's not
clear to me precisely what the difference is between interacting and
merely answering requests and I'm not convinced that Google's
sysadmins are the users in this case.  If anything, Google the
organisation is the server-side user.

Is the introduction of the added cost of the distribution requirement
an unaccepable discrimination against the field of network use?
(Network use seemed to be accepted as a field of endeavour in the
March 2001 discussion of FilterProxy.)

> Also note that the first paragraph of section 13 only applies when you're
> able to connect to the Internet, thus, the license passes the desert island
> test just the same as the GPLv3 does.

It applies on any interactive computer network, not only the Internet,
but the lack of interactivity on a desert island makes this mostly
harmless.  (I wouldn't get too hung up on the tests.)  However, it was
suggested (April 2004 Message-id:
<Pine.LNX.4.44.0404221428520.10248-100000@violet.rahul.net>) that the
underlying aim is that "you must be allowed to use the software even
if you can't distribute" which is less clear here.

> *an opportunity to receive the Corresponding Source of your version by
> providing access to the Corresponding Source** from a network server at no
> charge, through some standard or customary means of facilitating copying of
> software.*
>
> Note that this does *not* read that the user of the software must,
> themselves and through their local Internet connection, send a copy of the
> modified software.  It also does not specify that the user must host it on
> their own server.

How can the user be sure to satisfy both this and section 6 without
hosting it on their own server?  6a requires the source to be sent at
the same time, 6b needs the licensee to host a copy (else they cannot
rely on it being there when they need it), 6c discriminates against
commercial activity, 6d requires hosting and 6e requires hosting a
seed copy.  This seems like a significant cost, breaking DFSG 1.

This isn't a problem for GPLv3 because that doesn't require all users
to become distributors like AGPL does.

Do we care about users who are forbidden from this software distribution?
That's my concern about DFSG 5.  (I'm trying other channels to see
whether such users really exist, or whether someone made them up.)

> It is standard and customary that software patches be made available through
> a VCS.  Many VCS's allow numerous options in how this can be done.  There
> are numerous free code hosting services available to anybody with a network
> connection.

Free (as in cost) code hosting services do not offer guarantees of
availability or longevity, so the user must still host their own copy
too, else the C.Source may not be available when it is requested.

> In many cases only the modifications to the Corresponding
> Source on which it's based (ie, VCS patches) need be uploaded, and only
> once, by the modifier themselves.

Why?  Don't all users of the modified version also have to keep a copy
to be able to satisfy section 6, as outlined above?  They can share
the cost by using 6e, but they don't reliably avoid it.

> Thus, the source sending requirement does not violate DFSG's guidelines 3 or
> 5, as nobody who is able to run software on the network is burdened
> (financially or otherwise) with offering their changes to the people
> operating software that their modified software is interacting with.

I agree about *this aspect* not breaking DFSG 3, but I'm unsure about
DFSG 5 and I think the necessary cost means it breaks DFSG 1.

> *but the work with which it is combined will remain governed by version 3 of
> the GNU General Public License.*
> [...] AGPLv3 does not "contaminate" other software as in DFSG guideline 9.

At least, not in this way.

> The only potentially tricky spot I see is the dissident test.  I believe the
> AGPLv3 could pass as it does not require that the software, when on a
> network, interact with anybody.  That is to say, if avoiding an evil
> government's prying eyes was desired, the software could only interact with
> trusted agents, and thus keep even it's presence secret.

So why is this tricky?

I'm more concerned that this defence against evil agents gives rise to
a loophole that Anthony Towns explained, where you try to filter out
those "undesirable" users who are about to request the C.Source.

Puzzled,
-- 
MJR/slef
My Opinion Only: see http://people.debian.org/~mjr/
Please follow http://www.uk.debian.org/MailingLists/#codeofconduct


Reply to: