LWN: Comments on "Videos from the 2020 Copyleft Conference"

Videos from the 2020 Copyleft Conference

Seirdy — Tue, 26 May 2020 07:01:25 +0000

Some significant software released under the AGPL:

- SecureDrop, used by whistleblowers to submit documents to the press.
- libraries.io, which is integrated into a number of platforms (inc. PYPI)
- F-Droid, the FOSS Android repository serving as an alternative to Google Plaay
- Pretty much the entire ActivityPub landscape
- Pelican, a very popular static-site-generator
- edX: MOOCs
- OctoPrint, the biggest FOSS for 3D-printer management

Videos from the 2020 Copyleft Conference

anselm — Fri, 08 May 2020 00:07:06 +0000

My employer's product – an MFA integration server – is under the AGPL (paid licenses with support are also available).

Videos from the 2020 Copyleft Conference

flussence — Thu, 07 May 2020 22:42:35 +0000

All that's demonstrated here is that AGPL is nonexistent in desktop-installed software, which spectacularly misses the point.

Videos from the 2020 Copyleft Conference

Cyberax — Tue, 05 May 2020 18:09:41 +0000

It's an internal software developed by Linaro employees for their own needs: https://git.lavasoftware.org/lava/lava/-/graphs/master

Linaro is also a trade group dedicated to promotion of ARM CPUs, so they don't particularly care about an income stream.

Videos from the 2020 Copyleft Conference

stevem — Tue, 05 May 2020 17:19:42 +0000

LAVA (https://www.lavasoftware.org/) has much of its code under AGPL, and it's definitely not a piece of proprietary software otherwise...

Videos from the 2020 Copyleft Conference

Wol — Tue, 05 May 2020 09:37:49 +0000

> Where is the problem ?

Finding enough people prepared to pay rather than freeload ...

Oh - and the potential liability, and all that sort of stuff.

People write software for all sorts of reasons, get paid in all sorts of ways, but sometimes cash is a necessity :-(

Cheers,
Wol

Videos from the 2020 Copyleft Conference

Lennie — Tue, 05 May 2020 08:57:58 +0000

Well, you get paid to write the code, if you do a good enough job, people will pay you to add more code.

So going with your example: the tax code changes, so the program has to change with it: people pay you to write the new code.

Where is the problem ?

Videos from the 2020 Copyleft Conference

Wol — Mon, 04 May 2020 21:26:13 +0000

> Sorry, I'm not really interested helping people make nonfree software

Unfortunately, software devs need to eat like everyone else. And if your software REQUIRES you to work on it full-time (things like tax software for example) how are you going to pay for your food if most people freeload off you?

Yes, I would like to write awesome free software. But most people can't afford to do it for free.

Cheers,
Wol

Videos from the 2020 Copyleft Conference

pizza — Mon, 04 May 2020 18:20:53 +0000

> So far Mastodon has is basically a large hobbyist project for bored coders, if it disappears almost nobody would notice this.

While what you say is probably true, I doubt their choice of software license will have anything to do with it.

> But OK, whatever. Let's say that there are two large AGPL-only projects: Mastodon and nextCloud. I guess it's "Mission Accomplished" for AGPL?

Many years ago, I deliberately chose to _not_ use AGPL for one of my projects, for many of the reasons mentioned in this thread. I share the opinion that the AGPL is only really useful as a poison pill.

Videos from the 2020 Copyleft Conference

Cyberax — Mon, 04 May 2020 18:06:01 +0000

A successful project is something that has an impact, not necessarily with the raw number of users. I guess it needs to be at least noticeable in the area it serves. Example: Blender - it's now widely used in animation industry.

So far Mastodon has is basically a large hobbyist project for bored coders, if it disappears almost nobody would notice this.

But OK, whatever. Let's say that there are two large AGPL-only projects: Mastodon and nextCloud. I guess it's "Mission Accomplished" for AGPL?

Videos from the 2020 Copyleft Conference

pizza — Mon, 04 May 2020 17:58:10 +0000

Way to move the goalposts there.

...Mastadon (and the rest of the activitypub ecosystem) may not be your cup of tea, but it is decidedly non-trivial.

(Or do you only consider something "successful" or "serious" when its userbase is hits nine digits?)

Videos from the 2020 Copyleft Conference

Cyberax — Mon, 04 May 2020 17:19:21 +0000

Sorry, but I don't consider Mastodon to be a serious app.

Videos from the 2020 Copyleft Conference

federico3 — Mon, 04 May 2020 17:15:37 +0000

AGPL is widely used across the ActivityPub/Mastodon ecosystem and it's being adopted very quickly.

Videos from the 2020 Copyleft Conference

jra — Mon, 04 May 2020 00:01:47 +0000

A fellow Samba Team member and Red Hat engineer has just pointed out to
me that it's unfair to call out Red Hat specifically for this, and in retrospect
I agree with him and would like to apologize to Red Hat.

Many others including my own employer Google also signed on to this statement as well.

Sorry Red Hat. Hats off to you for all your sterling Open Source work :-).

Videos from the 2020 Copyleft Conference

jra — Sun, 03 May 2020 03:15:18 +0000

Sorry, links in the previous comment were broken (note to self, don't cut-n-paste truncated web-page representations of links as text :-) :

Richard Fontana's retrospective:

https://opensource.com/article/18/6/gplv3-anniversary

Richard Fontana's blog post:

https://www.redhat.com/en/blog/gpl-cooperation-commitment...

Videos from the 2020 Copyleft Conference

Cyberax — Sun, 03 May 2020 03:11:29 +0000

This is a related but different problem: the lack of license enforcement for the kernel. I think that Canonical is clearly in the wrong, but nobody cares enough to sue them.

Videos from the 2020 Copyleft Conference

jra — Sun, 03 May 2020 03:07:37 +0000

I just realized something interesting about GPLv3 adoption that I'd actually forgotten about for my talk. If I give this talk again (how about it, LinuxFoundation ? :-) I'd include this perspective that I'm copying here from my own comment on the slashdot (yes, some of us still read it :-) version of this article:

---------------------------------------------------------------------------------------------------------------------------
Here is a great retrospective on GPLv3 from a good friend of mine, Richard Fontana at Red Hat:

https://opensource.com/article... [opensource.com]

One of the things he notes (that to be honest I'd forgotten about for my talk) is that Red Hat and others have lead the charge to adopt the "forgiveness" provisions of GPLv3 (which as I recall was one of the primary concerns of corporate lawyers taking part in the GPLv3 drafting process) into GPLv2.

To quote from the linked article:

> "This in turn was followed by a Red Hat-led series of corporate commitments to extend the GPLv3 cure provisions to GPLv2 and LGPLv2.x noncompliance, a
> campaign to get individual open source developers to extend the same commitment, and an announcement by Red Hat that henceforth GPLv2 and LGPLv2.x
> projects it leads will use the commitment language directly in project repositories."

From Richard's blog post:

https://www.redhat.com/en/blog... [redhat.com]

> "As of today, all new Red Hat-initiated open source projects that opt to use GPLv2 or LGPLv2.1 will be expected to supplement the license with the cure
> commitment language of GPLv3."

A cynic would read that as an attempt by Red Hat to neuter possible adoption of GPLv3 with it's "problematic" (for corporations) anti-DRM provisions. In the words of one of my favorite fictional characters - "You might think that, I couldn't possibly comment" :-).
--------------------------------------------------------------------------------------------------------------------------

Videos from the 2020 Copyleft Conference

jra — Sun, 03 May 2020 02:06:51 +0000

Sorry to reply to myself but: "the FSF refused point blank to re-license glibc under LGPLv3, due to a fear of competition". I know this because I asked them to do so (I was tired of Samba getting arrows in our back for GPLv3 relicensing - that is the common fate of pioneers). A flat refusal due to a fear of competition for glibc was the response I got.

You can tell, I'm still rather annoyed by that :-).

Videos from the 2020 Copyleft Conference

jra — Sun, 03 May 2020 02:03:49 +0000

Well the FSF can claim what they like. But the proof of the pudding is in the eating. And the FSF refused point blank to re-license glibc under LGPLv3, due to a fear of competition. That to me does not engender confidence in their stewardship of licensing.

Videos from the 2020 Copyleft Conference

IanKelling — Sat, 02 May 2020 18:52:45 +0000

There might be more, I haven't surveyed the licenses of all GNU programs.

Videos from the 2020 Copyleft Conference

IanKelling — Sat, 02 May 2020 18:51:57 +0000

There's also GNU Social that is Agpl. The thing with GNU is that FSF recommends agpl "If it is likely that others will make improved versions of your program to run on servers and not distribute their versions to anyone else, and you're concerned that this will put your released version at a disadvantage" https://www.gnu.org/licenses/license-recommendations.en.html, and GNU doesn't have many of those programs.

Videos from the 2020 Copyleft Conference

Cyberax — Fri, 01 May 2020 19:33:39 +0000

nextCloud is a "hostile" fork of ownCloud, so they only have the AGPLv3 option. But so far it looks like they are actually managing to pull that off. I'm honestly amazed that it worked.

Videos from the 2020 Copyleft Conference

joib — Fri, 01 May 2020 19:18:45 +0000

Ouch. From the poll I linked to which they used to guide the decision, the results were about 50/50 split between Apache and AGPL. Somewhat damning that of all those in favour of the stricter choice, nobody was prepared to step up and help after they got the license they wanted. (Of course, we can't rewind history to check whether the results would have been different had Apache won).

As for nextcloud, IIUIC it's a fork of owncloud, which has precisely the "poison pill" AGPL/proprietary license.

Videos from the 2020 Copyleft Conference

Cyberax — Fri, 01 May 2020 17:41:57 +0000

AGPL absolutely was related to stagnation. The number of contributors cratered and it became a one-man show: https://github.com/mailpile/Mailpile/graphs/contributors . Then that one man burned out.

The _only_ non-trivial AGPL-only project I know of that avoided this fate is nextCloud.

Videos from the 2020 Copyleft Conference

Cyberax — Fri, 01 May 2020 15:50:37 +0000

Pithos is actually GPLv3, not AGPL: https://github.com/pithos/pithos/blob/master/license

> I've just demonstrated that on my computer, there are several useful agpl programs that i've been using for years.
Sure, there are exceptions. I think the _only_ non-trivial software I've seen so far under pure AGPL is nextCloud. Almost everything else is either simple or dual-licensed.

So AGPL is basically a dead license.

Videos from the 2020 Copyleft Conference

IanKelling — Fri, 01 May 2020 15:12:54 +0000

pithos is not dual-licence afaik. I've just demonstrated that on my computer, there are several useful agpl programs that i've been using for years. Just a single anecdata to counter the "i've never seen agpl be useful." And the fact that some program has proprietary dual licencing doesn't invalidate it. In fact, I'd rather a program have a proprietary dual license than get used as part of a nonfree program or os, which is much more prevalent. Agpl is having small and important successes and we need more of it.

Videos from the 2020 Copyleft Conference

pizza — Fri, 01 May 2020 12:53:51 +0000

> But how do we do that in practice? What ultimately caused Microsoft to open up and document the SMB protocol suite? Can that same approach be successful in other areas?

The short version -- it took nine years and an anti-trust lawsuit by the EU commission.

(If they hadn't been so dominant in the market, the EU wouldn't have had grounds to step in. But at the same time, if they hadn't been so dominant, the odds are they'd have been more open in an attempt to gain more market share..)

So, no, I don't think that approach is scalable.

Videos from the 2020 Copyleft Conference

joib — Fri, 01 May 2020 11:38:48 +0000

I have to say I'm feeling sympathetic towards Landley's, and now jra's, arguments.

Though jra goes a bit further and argues for focusing on "documented, interoperable protocols", as an approach more in line with what's relevant today and more likely to be successful than expanding and enforcing copyleft.

But how do we do that in practice? What ultimately caused Microsoft to open up and document the SMB protocol suite? Can that same approach be successful in other areas?

Videos from the 2020 Copyleft Conference

joib — Fri, 01 May 2020 11:19:11 +0000

There's mailpile, an email client. They switched to AGPL: https://www.mailpile.is/blog/2015-07-02_Licensing_Decisio...

The project set off quite promising (focus on security and making encryption easy), but seems to have stagnated (not saying the stagnation is related to AGPL).

Videos from the 2020 Copyleft Conference

NYKevin — Thu, 30 Apr 2020 22:09:43 +0000

On https://en.wikipedia.org/wiki/List_of_software_under_the_... I found GNUnet, which is apparently a peer-to-peer networking client under the aegis of the GNU project. I can't say I've ever used it, however.

Videos from the 2020 Copyleft Conference

NYKevin — Thu, 30 Apr 2020 21:15:56 +0000

> There are also no problems with GPL dynamic libraries, it's widely accepted that linking them in results in a derived work.

This is mostly but not universally true. For example, Canonical has, for quite some time, distributed ZFS-on-Linux as a binary module with Ubuntu, which the Conservancy says violates the GPL. As you might imagine, Canonical disagrees with them. The heart of the dispute is dynamic linking between ZFS and Linux.

Videos from the 2020 Copyleft Conference

Cyberax — Thu, 30 Apr 2020 21:02:54 +0000

> You might still object to those formalities, but in this case, your beef is with copyleft in general, not AGPL in particular.
I have no problems with copyleft when it's clearly defined. For example, Linux is perfect in that regard because there's a clear and concise description of where the GPL stops.

There are also no problems with GPL dynamic libraries, it's widely accepted that linking them in results in a derived work. So proprietary programmers just avoid them altogether.

But there ARE problems with uncertainty around AGPL's scope. And FSF at least can provide clear guidance here. It won't be legally binding per se, but it will be taken into account by courts.

With all the uncertainty companies just have to ban it entirely (like Amazon and Google do internally). And this in turn ensures that there is close to zero useful AGPL-only code.

Videos from the 2020 Copyleft Conference

NYKevin — Thu, 30 Apr 2020 20:47:53 +0000

> It's also not at all fair, there's no way our code is a derivative work of a webmail app.

The FSF takes the position that any sort of linking constitutes a derivative work, but this is a question of law for a court to resolve. The FSF does not have the power to override the plain language of either the local copyright statute or their own licenses. The {,A,L}GPL are all very explicit about this. Consider for example this line from GPLv3:

> To “modify” a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a “modified version” of the earlier work or a work “based on” the earlier work.

So, if whatever you did does not "require copyright permission" according to your local jurisdiction, then section 5 of GPLv3 ("Conveying Modified Source Versions") does not attach and copyleft is not applicable to your product. AGPLv3 has an identical definition, and LGPLv3 incorporates GPLv3's definition by reference. A prudent lawyer would probably advise you to assume that permission is required, but to the best of my knowledge, the claim that dynamic linking constitutes a derivative work has not been seriously tested in a court of law and might not actually be correct. Even if a court were to rule it correct, it might vary by jurisdiction or by circumstances.

(Whether it is wise to actually litigate this out is another question, of course. Lawsuits are expensive and may have uncertain outcomes. Most businesses will likely prefer to just avoid AGPL-licensed software altogether. This is probably why we don't have many clear court rulings on this point.)

Finally, I feel obligated to quote the actual part of the AGPL that gives most people pause (section 13, "Remote Network Interaction; Use with the GNU General Public License"):

> Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software. This Corresponding Source shall include the Corresponding Source for any work covered by version 3 of the GNU General Public License that is incorporated pursuant to the following paragraph.
>
> [snip GPL compatibility paragraph]

It is important to bear in mind *which program* is the "modified version" and how it is interacting with the end user. For example, if you made a plugin to a traditional email client rather than a webmail service, then the user would not be interacting with your plugin "remotely through a computer network" but locally on their own machine, so the AGPL would not impose any additional requirements on top of regular GPL formalities. You might still object to those formalities, but in this case, your beef is with copyleft in general, not AGPL in particular.

Videos from the 2020 Copyleft Conference

Cyberax — Thu, 30 Apr 2020 20:31:48 +0000

This still is not quite right.

Pulseaudio removed an AGPL plugin in 2017: https://lists.freedesktop.org/archives/pulseaudio-discuss...

Without pulseaudio spam, the final is: anki, debug-me, monit, mupdf, pithos. Out of these four mupdf, pithos are "poisoned pill" software with a proprietary dual-license.

So we have only: anki (last version in 2006), debug-me (a small hobby project) and monit as a result. Sorry, but you've just demonstrated that that AGPL is basically non-existent.

Videos from the 2020 Copyleft Conference

IanKelling — Thu, 30 Apr 2020 20:21:31 +0000

$ grep -l 'Remote Network Interaction; Use with the GNU General Public License' /usr/share/doc/*/copyright
/usr/share/doc/anki/copyright
/usr/share/doc/debian-goodies/copyright
/usr/share/doc/debug-me/copyright
/usr/share/doc/libpulse0/copyright
/usr/share/doc/libpulsedsp/copyright
/usr/share/doc/libpulse-mainloop-glib0/copyright
/usr/share/doc/monit/copyright
/usr/share/doc/mupdf/copyright
/usr/share/doc/pithos/copyright
/usr/share/doc/pulseaudio/copyright
/usr/share/doc/pulseaudio-module-gconf/copyright
/usr/share/doc/pulseaudio-module-zeroconf/copyright
/usr/share/doc/pulseaudio-utils/copyright

Videos from the 2020 Copyleft Conference

jra — Thu, 30 Apr 2020 19:38:49 +0000

OK - mastodon, I'll give you mastodon. I forgot about that :-).

Videos from the 2020 Copyleft Conference

jra — Thu, 30 Apr 2020 18:57:10 +0000

Just did it on my work laptop and got a shorter list. Which is why I know that isn't a good way to accurately track licensing of packages, as AGPL is explicitly prohibited here at Google.

If you want to claim AGPL is widely used, please tell me which of the FSF's projects for which they own copyright are under AGPL ? They won't even move glibc to LGPLv3 as Richard was frightened it would encourage creation of glibc alternatives.

The FSF is frightened of its own licenses.

Videos from the 2020 Copyleft Conference

Cyberax — Thu, 30 Apr 2020 18:42:27 +0000

You can try to look for "Remote Network Interaction; Use with the GNU General Public License".

Videos from the 2020 Copyleft Conference

IanKelling — Thu, 30 Apr 2020 18:37:07 +0000

Fair enough. Want to make a proper grep command for us to run?

Videos from the 2020 Copyleft Conference

IanKelling — Thu, 30 Apr 2020 18:35:05 +0000

> The only real use I've seen of AGPL is as a "poison-pill" license designed to get users to purchase the proprietary licensed version.

I've never seen it, thus it doesn't exist! https://old.reddit.com/r/Giraffesdontexist/ it was a bit entertaining of a talk, but that part was clearly wrong. Here's another example for you: Civicrm, used by thousands of nonprofits.