Hot take, don't @ me: AGPL should never have been an OSI approved license.

The license is basically a compliance trap, and I would posit that > 99% of modified AGPL software violates the license.

This leads to a world where license enforcement is entirely up to arbitrary decisions by the copyright owner. Any contributor to an AGPL software package (without CLA) can go and mass-send C&Ds and/or request $$$, kind of like the Creative Commons copyright trolls have been doing for CC-BY violations.

That's without even getting into the fact that really, the AGPL is GPL + a "usage restriction" clause camouflaging as not being one (because that would be against the FSF's principles).

I suspect most of the AGPL users would be better served with some of the more permissive source-available licenses. Unfortunately, people seem to have allergic reactions to non-OSI approved licenses, and AGPL being OSI approved even though it sucks means it gets regarded more highly than better alternatives.

@delroth If something is AGPL I won’t touch it. Not even for personal use.
I’d sooner buy a commercial product than interact with someone who believes their “open source” code copyright claims reach over a network at runtime.
@marshray @delroth I have bad news for you about Mastodon.
@nasado @delroth Oh great. I guess I won’t be running an instance.

@marshray @delroth I don’t mind using an unmodified version for personal use, but I will not, under any circumstances modify it. If my change isn’t accepted upstream then I have a potentially growing liability and that just isn’t worth the effort. I may grumble on issue trackers, but if you release your code under AGPL then you will never see a single one-line bug fix from me.

If it’s under a permissive license, I’ll happily add new features, test them, and upstream them if I think anyone else might care. Doing so comes with no legal liability and gives me almost the same rights over the resulting project as I have over my contributions.

@marshray @delroth man lucky you sadly all the good apub software is agpl #krokodili
@delroth even bigger hot take: none of this matters because nobody ever enforces this shit, and people should generally stop paying attention to what's "officially" open source and just make stuff with licenses that let people get on with their lives. enforcing license violation against a company as an individual is prohibitively expensive and only something people with more free time and money than sense can take on. and enforcing it against individuals just trying to get shit done is silly.
@delroth open source software licensing is lawyer larping for nerds and nobody will ever, in a million years, convince me otherwise
@gsuberland @delroth I'm involved in a community where the AGPL license is a hot topic (because some forks "switched" to it) god damn "lawyer larping for nerds" is definitely most perfect way to put it possible, holy shit.

@PJB @gsuberland @delroth This is why i went with 3-clause BSD for most of my projects.

It lowers the chance of some big corp from successfully suing me over bugs and gives me a chance of getting credit for my work, but stays out of the way for most actual users.

@gsuberland @delroth with this one weird licence we'll finally destroy the dastardly corpos!

@gsuberland @delroth Indeed. Watching said larpers try and "re-license" a project without a CLA or near-unanimous contributor consent generally makes me go "you do know that's not how this works, right?"

Then there's people that try to attach additional clauses to the GPL, which unless they're exceptions to the license (such as "things using this defined boundary should not be considered derivative works for the purposes of this license") are utterly unenforceable given the license contains an implied right to "revert" to the unmodified version when distributing derivatives...

@gsuberland I kinda disagree because most companies will actually comply with the terms of your license of choice, or rather "will make a decision to use or not use your software based on the costs of complying with the terms". There's a set of actors that will just not care (hi China), but they're usually not what people care about.
@gsuberland (so yes, I agree, enforcement is futile, but that doesn't mean the license isn't useful preventively)

@delroth my general view on the matter is that since the three options are:

1. they will just not use your code
2. they will use your code in violation of the license and you can't do anything about it
3. they will comply with the license by putting your license text in the installer somewhere (where nobody will read it) and then zip up your code and put it on their website for download, which is functionally no different than getting it off git

... it really makes no odds either way.

@delroth like yay they complied with the license by doing absolutely nothing that materially matters, whoop de doo, feel that freedom!
@gsuberland @delroth That is a false dichotomy. There have been plenty of successful, non-onerous individual license enforcement actions that have affected mega corps through their use and underfunding of open source projects (e.g. mimemagick) and there have been plenty of enforcement actions led by organizations like the FSF against mega corps leading to incredibly large technical dividend to the community (e.g. Linksys/Cisco).

@delroth @sleevi
What's the usage restriction in the AGPL? Doesn't it basically say that users of the software have the right to modify it whether it's delivered to a computer in their possession or offered over a network connection?

There are criticisms to be made of the AGPL, but I don't see how to characterize it as a "usage restriction".

@ian @delroth @sleevi I mandates that you provide the source not only to the people that got binaries from you, but also to people who interact with it remotely.

So a link to the repo with your modified source.

@waldi @delroth @sleevi
It imposes obligations on distribution, not restrictions on use.
@delroth if you really want this restriction, use the European Public License (EUPL). It covers this, but fixes the compliance problem and was written by actual lawyers. And they knew about how to deal e.g different jurisdictions etc.
@delroth Worst of the AGPL for me is that effectively it's a online-services-only license. For example I don't think think "your modified version must prominently offer all users […]" can be done with a library.

EUPL-1.2 looks like a much better kind of license if you really want the network+viral-copyleft annoyances.
Which is why from a pragmatic point of view I heavily lean towards MPL-1.2, protect your code files, leave the others alone.

@delroth

"I suspect most of the AGPL users would be better served with some of the more permissive source-available licenses."

I'm curious what you mean here. By users presumably you mean of the license rather than users of the software. Is that right? If so, what are you thinking of as the goals of AGPL licensors that would be furthered by source available licenses?

@delroth OSI approved the OpenWatcom license and it does what AGPL is trying to do more explicitly.

Ok, it still has some severe problems, but it's a lot more legally ironclad to say "you must publish private forks" than "you must implement a view source URL that may or may not get stripped out by a proxy".

Bonus points: You get to be Open Source but NOT Free Software! Perfect for running on GNU-less Linux distros like Alpine Linux.

@delroth no, yeah, by coincidence we had a discussion about it yesterday which led us to the same conclusion for a different reason.
Intentionally Permissive Licensing

I decided to write down my personal views on licensing and why most of my projects are licensed…

Flameeyes's Weblog
@flameeyes @delroth that was a rabbit hole to dive into

takeaways:

FSFE sucks about as much as FSF

AGPL is a clusterfuck

Apache-2.0 is a clusterfuck too

@delroth
I get that perspective, but respectfully I think it has a place in the OSI. The GPL limits some individual freedoms in order to support grander community freedom; a noble but sometimes questionable goal. I think the AGPL has the same spirit.

It is definitely a compliance trap for the unaware.

@delroth cant you just provide your modified source code on request? i don’t think there’s a responsibility to be specifically hosting it?
@bagel no, that's not how the AGPL works, you should go read the license and the associated FAQ
@delroth oh apologies, i see

“…an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software.”

@bagel and the previous part of the sentence is even more key imo:

"if you modify the Program, your modified version **must** prominently offer all users interacting with it remotely through a computer network [...]"

(emphasis mine)

@delroth Some people are hell bent at misunderstanding the AGPL. There is little point in engaging with them (e.g. marcan)
@delroth if i took every pet peeve i'd have about the agpl and fixed it... the eupl would be pretty close to that.

(no @ here, just FYI for anyone coming to this thread)

EUPL is a thing and OSI-approved, although it's more comparable to the MPL than AGPL. At least in the EU, the EUPL is definitely enforceable, and all 22 languages are considered official, legally binding versions of the EUPL.

https://commission.europa.eu/content/european-union-public-licence_en

European Union Public Licence

Privacy Observatory of the Advanced Training Course in Data Protection and Privacy Officer of the Univ. of Bologna

European Commission

@delroth I'm particularly frustrated at the way the unclear nature of the license is used as a mechanism to filter out users. Don't do that! Just clearly write what you actually care about and let people make an informed decision.

Contracts (and thus licenses) aren't arcane incantations: there should be mutual understanding at their heart!

@delroth
IMO not being OSI compliant is a badge of honor for an open source license.