First draft of the Affero GPL version 3 [LWN.net]

First draft of the Affero GPL version 3

Posted Jun 6, 2007 21:13 UTC (Wed) by Ed_L. (guest, #24287) [Link]

I dunno. I can see where someone might want to license their code this way, but this "network distribution" restriction could have some unintended consequences. Suppose I write a program that is intended to run on a corporate LAN. Usually not a big LAN, but a LAN nonetheless. My preferred distribution method is "sell the customer my product as a tarball or rpm on a CD." Oh, but there are some GPL'd subprograms my product relies on, and I want to make certain the customer has a specific version that I know works with my app. Maybe even I fixed a minor bug that hasn't yet been incorporated by the maintainer. Whatever. So I include executables and source code for my modified GPL subprograms, like the GPL requires, at no inconvenience whatsoever as part of my tarball.

Now, my particular application will never see the light of day outside corporate networks. Its not a secure app, and it will only be run behind firewalls. But behind a firefile it most certainly is networked. If one of the modified GPL'd subprograms has the Affero clause, am I then required to set up and maintain a public http or ftp server on my own personal or corporate machine to provide access to a mod that whill have zero outside interest whatsoever? I don't currently have or need such a public server, so there would be an added burden.

I realise that providing such public net access to source modifications is one way to satisfy GNU GPL, but it is not the only way, and it is not always the most convenient way. Again, if someone wants to affix the Affero provision to their license, that is their business and I'll certainly respect it. And sure, someone must have thought they had a good reason to require it. And I don't know, perhaps they really did: Goggle might be an example. Google has a huge internal network that serves the entire rest of the world. Their apps most certainly *are* exposed to the public light of day.

I'd just hate to see this thing added willy-nilly to all sorts of utilities to which it will make no positive difference, and ask anyone considering the Affero clause to ask themselves whether, for their particular code, if it is really necessary. Just give it careful thought, is all.

Meantime, I'll give some careful thought to the cost of maintaining my own ftp server vs. the benefit of having access to Google's modifications. I think there is room for discussion here. Thanks!

First draft of the Affero GPL version 3

Posted Jun 6, 2007 21:47 UTC (Wed) by tyhik (subscriber, #14747) [Link]

"... your modified version must give ALL USERS INTERACTING WITH IT remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source ..."

If your 'version' cannot be interacted with from outside of your private LAN then you don't have to provide the source outside your LAN either.

Interacts with

Posted Jun 6, 2007 22:07 UTC (Wed) by ncm (subscriber, #165) [Link]

If it only interacts with people behind a firewall, then those are the only people who need to be provided source code. If, as you say, you have already provided source code to them, what's the problem?

Interacts with

Posted Jun 6, 2007 22:13 UTC (Wed) by Los__D (subscriber, #15263) [Link]

The problem is that the Affero version ONLY accepts network distribution of the source, nothing else... At least that's how I read it.

Interacts with

Posted Jun 6, 2007 23:07 UTC (Wed) by pizza (subscriber, #46) [Link]

Yes, this is indeed a problem. Back when the GPL3 draft directly included an optional "Affero-like" clause, I remarked on this as well.

I'd presonally like to see the clause "from a network server at no charge" supplemented with "or any of the applicable methods from section 6" (granted, not all of them apply, but I think the written offer to have source sent to you at a reasonable fee should be an option, and in the case where you haven't modified the source at all I think pointing to an upstream distributor should suffice...)

Note that it's "a network server" not "the same network server" or "the same network session" as mentioned in earlier drafts -- so the source can be hosted elsewhere.

The other wrinkle I see with this is the case of configuration files. In many cases (think PHP) these config files are technically part of the source, but might contain things like database credentials that you'd want to keep private. There should be an explicit exemption to allow this sort of thing to be excluded from the "full corresponding source".

Once the FSF gets the comment system up and running, I'll be letting them know this directly. :)

Interacts with

Posted Jun 6, 2007 23:36 UTC (Wed) by allesfresser (subscriber, #216) [Link]

In the case of config files, I would think that making them part of the source code is a bad idea in the first place. (In PHP, there is a function called parse_ini_file that works quite well, if you want to go that way.) But, that being said, I'm sure if one is packaging up a PHP application to distribute the source to satisfy this requirement, placeholders would be a very acceptable idea:

$DBNAME = ""; // enter your database name here
$DBUSER = ""; // enter your database username here
$DBPASS = ""; // enter your database password here

Or, have an installer, as many applications do, that asks for the parameters and writes them into the files when installing.

In other words, there's no requirement to provide the *actual data* such as database usernames, passwords, etc. that are specific to a given installation. They're not really part of the source code; they're site-specific application data that happens to be stored in a place that makes them secure from prying eyes (hopefully!) as well as quick to access. Packages do this all the time, so I'm not seeing what the problem is here in regard to the source requirement vs. config files. This sort of concern is (in my mind) akin to people being concerned that they'd have to provide all their accounting data to outside parties if they used a GPL-licensed accounting application; it just doesn't work like that.

First draft of the Affero GPL version 3

Posted Jun 6, 2007 22:21 UTC (Wed) by i3839 (subscriber, #31386) [Link]

The key word here is "remote".

> users interacting with it remotely

I think it's safe to consider all LAN users to be local.
They can walk to you and ask for it.

But yeah, they might want to add a clause saying that the
server download option is only needed if the modified source
isn't already distributed to the users in some other way.

First draft of the Affero GPL version 3

Posted Jun 7, 2007 3:41 UTC (Thu) by dirtyepic (subscriber, #30178) [Link]

one could just as correctly argue that any machine other than the one they're actually sitting at is a remote machine, and connecting to it over the LAN is still "interacting [...] through a computer network". the terms will have to be defined more clearly in order to prevent abuse.

First draft of the Affero GPL version 3

Posted Jun 7, 2007 12:45 UTC (Thu) by zotz (guest, #26117) [Link]

I am just guessing here, but I would imagine that a company's own employees using the code on a lan or even a vpn would not trigger the clause just like giving copies to someone in IT to install on company machines does not trigger the distribution clause in the current GPL.

I welcome opposing views for discussions.

I would think that when an employee is doing something job related, he "is" the business. He is not some third party.

all the best,

drew

First draft of the Affero GPL version 3

Posted Jun 7, 2007 13:36 UTC (Thu) by dirtyepic (subscriber, #30178) [Link]

i suppose in practice if your own employees are suing you for not providing source for modifications of an internal application you may have bigger problems than licensing violations afoot.

First draft of the Affero GPL version 3

Posted Jun 7, 2007 14:34 UTC (Thu) by i3839 (subscriber, #31386) [Link]

If that would be the case the word "remote" would be superfluous. That, combined with the actual meaning of the word, convinces me that they indeed mean "remote" computers when saying so.

Though you're right there's at least enough room for different interpretations, so clarification is needed to avoid confusion (which not only gives room for abuse, but can also stop people from using the license because they're not sure what they'll get into).

First draft of the Affero GPL version 3

Posted Jun 7, 2007 8:46 UTC (Thu) by copsewood (subscriber, #199) [Link]

As I see it, the requirement to provide source to users accessing a server product is likely to be most easily supported by giving the Affero licensed server program a source download option as part of the server program to which this license is attached. If config files are part of the Affero licensed server, the data from these could be stripped prior to download as part of the source download functionality.

As to whether a user interacting with it and therefore licensed to obtain source code should include someone who just sees a login/password prompt to the Affero licensed server but has no credentials to interact with it further should I think be clarified.