Seems GPL2 or GPL3 already requires this

Posted Nov 28, 2024 0:47 UTC (Thu) by rra (subscriber, #99804)
In reply to: Seems GPL2 or GPL3 already requires this by pizza
Parent article: Arch Linux finally starts licensing PKGBUILDs

It's almost like the GPL is an arcane and absurdly complicated legal document that almost no one fully understands, whose meaning is socially and in places legally disputed, and that many people in the free software community fail to follow correctly without ever realizing it.

I'm not going to argue with people about the merits of the GPL when applied to some large and complex piece of software that is meaningfully affected by the copyleft principles, but I wish people would think twice before slapping it on their 500 line Python library. Following the GPL correctly is nontrivial and controversial, and even people who have worked on free software for decades regularly fail to follow it correctly according to at least some people. I wish people would ask themselves whether it's really worth paying the mental tax for each specific piece of software before they blindly use it.

Seems GPL2 or GPL3 already requires this

Posted Nov 29, 2024 16:15 UTC (Fri) by NYKevin (subscriber, #129325) [Link] (1 responses)

If you think the GPL is bad, try reading the AGPL section 13 very carefully, and then think about which of the following scenarios might or might not violate it:

* The FooBar application, licensed under AGPL 3, has some networking functionality (which is elaborate enough that users can interact with it remotely), and is freely available (with source, full attribution, a copy of the AGPL, etc.) on GitHub. It does not have any feature that allows remote users to directly request a copy of its source code.
* You fix a typo or other minor bug in the FooBar source, commit the changes to a local Git repository, and send a pull request to the FooBar maintainers. You only fix the typo, and do not add a feature allowing remote users to request source from the application.
* The FooBar developers add a "request source" function to the FooBar application. It is implemented using mDNS, which relies on broadcast packets to work. You don't like broadcast packets on your home network, so you patch this functionality out in your own private copy of FooBar. This patch is never redistributed to anyone, and the binary is only ever used on your own private LAN that nobody else can access. For good measure, you hide the FooBar application behind some kind of client-authenticating reverse proxy, so that you can be absolutely sure that it has no remote users other than yourself.
* Alternatively, you stick your copy of FooBar behind a router or switch that is configured to drop broadcast packets.
* You make a FooBar instance accessible over the public internet, after making some minor modifications to it (all of which are contributed upstream via GitHub pull requests, so your copy of FooBar is identical to the public source code). But broadcast packets are not going to be routed over the public internet, so the source offer presents an unusable mDNS domain (your changes never touched the source offer part of the code).
* You change the link to point to the public GitHub, but upstream refuses your pull request (arguing that FooBar should serve its own source code without relying on GitHub or any other third party, and claiming that mDNS is "good enough" for their intended use case on a private LAN), so now you are presenting a source link that does not exactly correspond to the binary you are running.

Seems GPL2 or GPL3 already requires this

Posted Nov 29, 2024 17:34 UTC (Fri) by rra (subscriber, #99804) [Link]

Oh, yeah, I absolutely refuse to use the AGPL for any software I write. If I'm going to have to invest that much time and mental energy into understanding a complex legal document, I'd better be getting a house out of it.