AGPL is very controversial. I'm clearly on the "won't touch it with a 10 meter pole" side.
There are people with other opinions, but even they agree that this is not tested in court, and it's more expensive to be sued, even if you win, than to just buy (or write from scratch) ANY alternative to the AGPL software in question.
AGPL is a legal landmine. You can't plug it into anything else, even for your own purposes.
Let's say you use these to create a guest wifi network. According to AGPL it looks like you must now opensource any and all scripts that you use to manage this environment.
In other words that one-off script you used to loop over all your access points during setup must be opensourced. Oh, it has details about your internal asset tracking system? Well, they now have to be public. Oh, it relies on your internal database? I guess that's opensource now too.
Did you even keep that one-off script? AGPL demands that others must be able to run what you run, essentially. It says that everything you do operationally to your service must now be documented and published.
You want to connect your internal SSO to the AP? Sorry, you better instead change it so that your internal SSO takes whatever protocol the AGPL software already takes. Oh, that's not feasible? Ok, give up then.
1 year later… oh shit oh shit oh shit, someone added internal SSO to the AGPL software! Now we have to opensource that, but we can't because it includes code we licensed from a third party only for nondistribution!
AGPL only makes sense for organizations that fundamentally ONLY will EVER run open source software (like FSF and that's it), and usually not even then.
Also ideologically it's a huge violation of freedom. What I do in my own home is absolutely none of your business. What executes on my hardware is my business.
For those who disagree about my examples: Yeah… I'm personally not a lawyer (but HAVE consulted with lawyers about this). You may be right. In the end a court will decide. But do you want to take this poison pill in order to find out in court if you die?
So GPL doesn’t have this character? Like the GPLv2 taken by Linux kernel. I have an impression that AGPL only add “A” to GPL to adapt itself to the cloud era. Because a cloud/service deployment is not treated as redistribution in GPL, considering there wasn’t cloud at the time GPL was made. So some big cloud company can deploy GPL software on cloud without open source action because they are not actually “distribute” software, instead only distribute a service. AGPL fix only this hole created by cloud.
You say it "fixes" GPL, but as I described it makes AGPL completely unusable for basically any purpose, and it creates a HUGE risk that's in my opinion completely unacceptable, as described.
The only way it seems to work is:
1) it's extremely unpopular by number of projects
2) most private citizens who use it violate the license
3) most potential corporate users have it vetoed by their legal department, which means they plain don't use it
That's not a great situation. It only seems to work (in the rare cases that it's used) because so few people accept it, and the ones that do violate it.
AGPL removes freedom zero, in my opinion.
> The freedom to run the program as you wish, for any purpose (freedom 0).
I think my examples illustrate this, but I'm sure I could elaborate more.
The way I read it you cannot write an automation script for managing the MongoDB databases for your Etsy store without opensourcing those scripts.
In fact I disagree that "cloud didn't exist when GPL was created". This also applies to services like banks, and banks certainly existed before GPL, and provided a service.
So that was never a "hole" in GPL.
AGPL is poison because every time you touch it, even operationally, your work belongs to someone else. To call that "Freedom" is Orwellian.
But in the MongoDB case (when it was still using AGPLv3), those companies who violated AGPLv3 did have a solution: pay a fee for a commercial license of MongoDB instead of AGPLv3 which is free. In this way, those companies don't need to open source their code built based on MongoDB. MongoDB get money to go further, because I guess MongoDB people need to raise their family.
Sure. But if anyone who seriously uses some software (even on a hobby project) is either violating the license or buying a commercial license, in what sense is it free/libre software or even open source?
That's saying that AGPL is only useful to the extent that it doesn't exist.
But it's not just software "based on" MongoDB. It's your backup scripts. It's your cluster scheduling config for the jobs. It's your provisioning script, etc…
And it implies it being non-free software. It's only one (small) step removed from a licenes that disallows "commercial use".
A license disallowing commercial use is fine. But it's absolutely not "free software". Freedom zero was so obviously a freedom that it was initially just implied, and only added later to be explicit.
If you are saying AGPL's virus like behavior is much more severe than the GPL's virus like behavior, I am not professional on this aspect. Not sure.
If I understand correctly, the open source action is only required when you "re-distribute" it. So, if you play it only by yourself and never give your modified software to anyone else, it is OK for you to keep all code close. If you work on it together with other people in your organization, it is fair enough that you open the source code to those people for them to work together easily. But all the code are still kept inside your organization.
Only in a step that you want to re-distribute the software (or the service) to people (like external user or other company) who you don't want to show source code, you are facing violating the AGPLv3. But generally speaking, in this step you already have a plan to make money out of external people (like user or other company), so fair enough to pay a fee for commercial license.
"free software" or freedom zero is good, but how engineers/companies who develop free software make survival? Donations? If I am already a billionaire, I totally support your point.
> If you are saying AGPL's virus like behavior is much more severe than the GPL's virus like behavior
Well, it is, since it extends GPLs coverage to not just "linking" (a hard to define term) but also explicitly even to automation scripts.
But I'm also saying it's not just a difference in degree, but in kind.
> If I understand correctly, the open source action is only required when you "re-distribute" it. So, if you play it only by yourself and never give your modified software to anyone else, it is OK for you to keep all code close.
For GPL this is true. For AGPL it appears to apply to any artefacts or other public interactions too.
> Only in a step that you want to re-distribute the software (or the service) to people (like external user or other company) who you don't want to show source code, you are facing violating the AGPLv3.
Maybe. It's untested in courts. A very reasonable interpretation (that I subscribe to) if your BooksOnlineExample.com uses AGPL for backend storage, then that is covered by AGPL (but not GPL).
But even worse. If you use some AGPL software to compress some data as you transfer it to your backup tapes, then you are using this AGPL software in order to run BooksOnlineExample.com (after all, without backups you don't really have a service), and thus your backup script could very well be in scope for AGPL and may have to be published.
> But generally speaking, in this step you already have a plan to make money out of external people (like user or other company), so fair enough to pay a fee for commercial license.
Ah, but AGPL is not about covering the "making money hole". It's about the "cloud hole". I would argue that GPL never had any intention of preventing people from making money.
Do you think Linus is upset that maybe tens of thousands of companies have their own patches to Linux to run their service? Do you think he's upset that even the ones that don't patch the kernel don't publish their kernel config. (I don't know if you've ever built the kernel, like "make menuconfig", but this is definitely not just "settings", but actually a vital step in order to "reproduce the same binaries as run on your production servers")
GPL was extreme when it was created. Compare it to the BSD license. Then AGPL came along and just went absolutely off the wall by having your interactions with the software bind you to publish.
> "free software" or freedom zero is good, but how engineers/companies who develop free software make survival?
To be clear, are you saying that the main goal of AGPL is to have people NOT use it? Because people who do accept and abide by the terms of the AGPL license do NOT pay for it.
AGPL only prevents use. You're assuming all AGPL software is dual-licensed, which is very much not the case. Luckily very little software is AGPL.
If it's about money, then why use AGPL at all? Why not just have a commercial license? Because you're not giving anyone even the most basic freedom with AGPL.
If the goal of choosing AGPL is to get paid or not use it, then that's just commercial software. Which is fine, but don't call it free software, since it's anything but.
Ok. Actually I never (and don’t know who) call AGPL software a free software. Let’s just call it AGPL software! Problem solved.
Just curious, if AGPL is so evil, who made it for what kind of purpose from the beginning? You give me an impression that AGPL is totally wrong and shouldn’t be born.
I am not saying that AGPL is born to prevent people to use AGPL software. Instead, AGPL definitely encourages people to use for free under the license, or use it after purchase commercial license. Why you have impression that AGPL was born to let people not use the software?
Like MongoDB, it selected AGPL from the beginning, and many people were using it (so you can’t say AGPL stop people to use MongoDB), until some big commercial companies began to deploy it in cloud and violate AGPL (refuse to open source). This hurt the protocol and MongoDB, so MongoDB decided to change the license to a more explicit and strict license written by themselves to rule explicitly that if you deploy the MongoDB in cloud you should be open source. Otherwise you need to purchase a commercial license. From this point of view AGPL or the more strict MongoDB protocol find a good balance between open source and commercial usage. Please tell me if MongoDB uses more free software style license, like GPL, Apache, MIT, I guess many companies will use it in non open source style without violating the protocol, then how MongoDB can survive? If MongoDB can not live a good life, who will contribute to it, maintain it, help user continuously? MongoDB dies and the world gets nothing. Happy ending?
I am glad that google doesn’t like AGPL. To me this implies that the thing, that is not liked by big company, could be interesting. Google has become a gigantic monster. AGPL just prevents the big companies , like google, amazon, to use open source software for free.
> if AGPL is so evil, who made it for what kind of purpose from the beginning? You give me an impression that AGPL is totally wrong and shouldn’t be born.
Then I have succeeded in conveying my opinion. :-)
I think it was made with good intentions, but without thinking through the repercussions. It's made for a world where everything is opensource, and everyone has incentives to keep it that way.
But it's a fantasy world that doesn't exist. If all open source OSs were AGPL, then that would not force Google to start publishing their internal drivers. It would force Google to write their own Unix-like OS. It's a lot of work, yes, but especially if it's only for your own purposes it's not that hard. And they've done it before.
> Why you have impression that AGPL was born to let people not use the software?
Like I said any serious (I don't mean commercial) use of software requires automation and other surrounding stuff to make it work in a given environment. Yes, you can run MongoDB for fun at home, but considering that I've written scripts for my Ubiquity access points to collect some data, I'm glad that their software isn't AGPL. Even in my home use I would be forced to publish those scripts. Because it's not just me the legal entity that uses my access points. It's also my friends and family. So I'm in scope
So like I said and tried to give as much proof as possible for, there is only two ways to use AGPL software:
1) Violate the license. (by not publishing everything that touches the software)
2) Purchase another license.
(2) is usually not possible. Most software is not dual licensed.
(1) is not really using the license. If you don't agree to the license then you have no right to it. It's essentially software piracy.
So neither (1) nor (2) is actually using AGPL.
To the extent the software in question is used, it's not used under AGPL.
But I was mostly responding to "so everyone can just buy a commercial license" (but see (2)), which just means AGPL is only useful insofar as it doesn't exist.
> Like MongoDB, it selected AGPL from the beginning, and many people were using it (so you can’t say AGPL stop people to use MongoDB)
MongoDB is probably the most popular, yeah. Note that OpenBSD still uses POVRay 3.6, because 3.7 changed to AGPL.
I still maintain that most people who use MongoDB are violating the license, so they're not really "using" the AGPL.
> until some big commercial companies began to deploy it in cloud and violate AGPL (refuse to open source). This hurt the protocol and MongoDB, so MongoDB decided to change the license to a more explicit and strict license written by themselves to rule explicitly that if you deploy the MongoDB in cloud you should be open source
I was not aware of this. So you're saying AGPL failed at the one thing it attempted to do, which is to plug the so-called "hole" of cloud?
> From this point of view AGPL or the more strict MongoDB protocol find a good balance between open source and commercial usage.
"Open source" in the sense that the source is available for viewing? Yes. But most of the time that's not what that means.
From wikipedia:
> Open-source software is a type of computer software in which source code is released under a license in which the copyright holder grants users the rights to use, study, change, and distribute the software to anyone and for any purpose.
"For any purpose". That's freedom zero, which AGPL doesn't have.
Same with these recent licenses I've seen where the author has said "GPL but can not be used by the police", due to the author's political views. That's not what "open source" or "free software" means.
> Please tell me if MongoDB uses more free software style license, like GPL, Apache, MIT, I guess many companies will use it in non open source style without violating the protocol
Probably yes. I know at least one FAANG company that has purchased a non-AGPL license of MongoDB. But like I said that's not always possible. And my initial comment of "nope nope nope" is the legal stance frow actual tech lawyers I've discussed this with.
But curcially: This is intentional! Open source explicitly allows use for any purpose, even if that purpose is to interact with non-opensource. That's not a bug!
> If MongoDB can not live a good life, who will contribute to it, maintain it, help user continuously?
But this is two different questions. As I see it AGPL is about politics, not money. Most AGPL is not dual licensed.
As for maintaining. If you're a company (say Google) that runs GPL software (say the Linux kernel), then it's better to upstream your patches, when they are not specific to your proprietary internal systems, than to fork the code and have to manually apply upstream's patches.
Hell, the BSDs are still alive, and they even allow redistributing the binaries without providing source code!
The money question is a real one since free software began, but AGPL doesn't solve it, nor did it ever even attempt to solve it.
> I am glad that google doesn’t like AGPL. To me this implies that the thing, that is not liked by big company, could be interesting.
This is a terrible argument. I'm sure Trump also doesn't like it. The enemy of your enemy is not necessarily your friend. You should look at why they don't like it, and see if those reasons apply to you.
Google also doesn't like global warming or covid-19, but I don't see you out there releasing freon or licking ventilators.
Also note that this means none of the, what, 100'000 engineers working for Google are allowed to touch your software. No, not even contribute to it on their own time (with one exception: https://opensource.google/docs/iarc/).
Your community will shrink just because of that.
> AGPL just prevents the big companies , like google, amazon, to use open source software for free.
No, it prevents everyone from using it, as described.
Also: Using software for free (in both senses of the word) is literally what opensource is for.
"free software", "for any purpose", beautiful target. But maybe it can not be achieved in one step.
People select a license for purpose. No matter what is the purpose, the developer is free to choose, the user is free to accept or deny. If the license really brings some big hurt, people might change later.
Yup. There's nothing illegal about this private contract. I'm just saying it's a lose-lose license for both parties.
For authors:
AGPL is counterproductive to its stated purpose, and will only drive away users and contributors. AGPL is not "open source" or "free software". If dual-licensed then you are essentially releasing commercial software. And that's fine. But own up to that. If not dual-licensed then pretty much every user will violate your license. So what was the license good for?
For users:
There is no practical way to use AGPL software without violating the license. Everything you do with AGPL software incurs a huge legal liability. It is not open source or free software. If it's dual licensed, then pretend only the other license exists. If it's not, then pretend this software doesn't exist, and move along.
Actually, there is one way for authors to derive value from AGPL. It's not ethical, but it exists. Release your AGPL software, and wait for reports of a company using it. Then sue them. Because they are pretty much guaranteed to be in violation.
