Re: issues with the AGPL
On Mon, 23 Mar 2009 14:27:42 +0100
Bill Allombert <Bill.Allombert@math.u-bordeaux1.fr> wrote:
> Hello Debian legal,
>
> I'd like to share two issue I found with the AGPL, for the record.
>
> REFERENCES:
>
> The GNU Affero General Public License (AGPL) is essentially the GNU
> General Public License with the following additional clause
> reproduced below. See http://www.fsf.org/licensing/licenses/agpl.html
> for the full text of the license.
> ""
> 13. Remote Network Interaction; Use with the GNU General Public
> License.
>
> Notwithstanding any other provision of this License, if you modify
> the Program, your modified version must prominently offer all users
> interacting with it remotely through a computer network (if your
> version supports such interaction) an opportunity to receive the
> Corresponding Source of your version
> by providing access to the Corresponding Source from a network
> server at no charge, through some standard or customary means of
> facilitating copying of software. This Corresponding Source shall
> include the Corresponding Source for any work covered by version 3
> of the GNU General Public License that is incorporated pursuant to
> the following paragraph.
>
> Notwithstanding any other provision of this License, you have
> permission to link or combine any covered work with a work licensed
> under version 3 of the GNU General Public License into a single
> combined work, and to convey the resulting work. The terms of this
> License will continue to apply to the part which is the covered work,
> but the work with which it is combined will remain governed by
> version 3 of the GNU General Public License. ""
>
> ISSUES:
>
> 0) Conflict with the The Free Software Definition:
> <http://www.gnu.org/philosophy/free-sw.html>
>
> The AGPL is in direct conflicts with the two paragraphs below:
>
> You should also have the freedom to make modifications and use them
> privately in your own work or play, without even mentioning that
> they exist. If you do publish your changes, you should not be
> required to notify anyone in particular, or in any particular way.
>
> However, rules about how to package a modified version are
> acceptable, if they don't substantively limit your freedom to release
> modified versions, or your freedom to make and use modified versions
> privately. Rules that "if you make your version available in this
> way, you must make it available in that way also" can be acceptable
> too, on the same condition. (Note that such a rule still leaves you
> the choice of whether to publish your version at all.) Rules that
> require release of source code to the users for versions that you put
> into public use are also acceptable. It is also acceptable for the
> license to require that, if you have distributed a modified version
> and a previous developer asks for a copy of it, you must send one, or
> that you identify yourself on your modifications.
>
> The AGPL seriously restrict your ability to make public version.
>
> 1) Clause 13 creates obligations for the persons who has modified the
> software, even when they stopped using it and stopped to distribute
> it.
>
> Suppose Alice modifies the software and distributes it in source form
> to Bill. Alice stops to use the software. Bill starts using the
> software on a server. Since it is Alice which modified the software,
> it is Alice which has to satisfy clause 13, and thus to provide
> access to the Corresponding Source, as long as Bill is using Alice
> version.
>
> This is extremly onerous to Alice.
>
> 1 bis) it is Alice which is responsible for the runtime behaviour of
> the modified software run by Bill, even though Bill can run it
> unmodified in an environment which can cause it to perform
> differently than on Alice computer, and not display prominently an
> offer for the Corresponding Source.
>
> This is a risk to Alice.
>
> 2) The wording "your modified version must prominently offer " is
> very strange: a modified version is not a legal entity that can offer
> anything, let alone make good on an offer. So either the AGPL require
> the modified version to be raised to AI level, or that the offer does
> not need to be fulfilled.
>
> 3) The AGPL does not specify if the "computer network" and the
> "network server" must be part of the same network. If yes, you might
> be forced to provide the Corresponding Source on all non-internet
> connected networks someone use your software on. If not, you can
> provide it from a network server where noone has access to.
>
> 4) I find pretty alarming that the one situation where providing the
> Corresponding Source is easy (where the program is a perl CGI script
> and you just need to configure apache to allow users to download it
> from the /cgi-bin directory and having it displays a link) is not
> suitable for the AGPL because the program cannot force the webserver
> to allow such download.
>
> 5) Is recompiling a software modifying it for the AGPL ?
>
> (Full disclosure: there is a GR proposal pending on this topic, with a
> different rationale)
>
> Cheers,
The AGPL has been the topic of multiple extended and heated discussions
during my short time subscribed to this list. If you are interested in
actual comments, you may want to review the previous discussions. If
you are interested in renewed (and to my mind unproductive) bouts of
rehashing these questions, no doubt you will get that result as well.
From a purely personal perspective, I just don't see the problem.
Authors who choose to license their work under the AGPL have a desire
not to see derivative works locked up inside a walled garden under some
pretense that those derivative works are not "distributed" when they
are offered for public user interaction. There is nothing in that goal
that is in any way incompatible with the goals of the GPL. (As you
quote: "Rules that require release of source code to the users for
versions that you put into public use are also acceptable.")
With respect to your identified problems, Alice would have been under
an obligation to provide source code for her derived version to Bill.
When Bill distributes (and that, really, is what we are talking about
here) a modified derivative version to public users, Bill undertakes an
obligation to make available the source code to those users. I do not
see anywhere a basis to invent any ongoing obligation for Alice.
Similarly, if the AGPL does not specify that modified source code must
be made available from the same or a different network, that
emphatically is not a shortcoming. It can be either, or both, but not
none.
Your items (2) and (4) are, frankly, mystifying. If those are
intended to represent actual concerns, you have not explained them
in a way that I can understand. (Your fifth issue leads me to suspect
that none of them are concrete problems. Does a mere recompiling alter
the source code? How does this raise any issue concerning the AGPL that
does not also effect other licenses?)
I do not profess any expertise or experience with Debian policies other
than a general reading. Nor do I think of myself as a defender or
critic of any particular variation of a "free" license that an author
might choose. From the various objections I have read about the AGPL,
however, there seem to be a number of people who do not share its
goals. But I do not recall reading any statement of objections that
concluded it was not a "free" license or that set forth any realistic
example of impracticability. I could be persuaded; I just haven't seen
any substance so far. (I'm just a bystander, of course, so you need not
think you've won or lost anything by my opinion.)
Here's what I think needs to be addressed if anyone wants to make
actual progress on this subject:
- What exactly is it that someone wants to do that they are prevented
from doing by the terms of the AGPL?
- What other license would be required to allow them to implement a
derived work, offer it to public users, and refuse to share their
changes? (I'm aware that's a loaded phrasing, but that is the
hypothetical problem as seen by those who choose this license.)
- Is this discussion really about nothing more than what
"distribution" means in the context of a public-facing server-based
application?
Greg Harris
Reply to: