Debian Bug report logs - #495721
ftp.debian.org: Is AGPLv3 DFSG-free?

Package: ftp.debian.org; Maintainer for ftp.debian.org is Debian FTP Master <ftpmaster@ftp-master.debian.org>;

Reported by: Miriam Ruiz <little_miry@yahoo.es>

Date: Wed, 20 Aug 2008 00:21:01 UTC

Severity: wishlist

Done: Joerg Jaspert <joerg@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Debian FTP Master <ftpmaster@ftp-master.debian.org>:
Bug#495721; Package ftp.debian.org. Full text and rfc822 format available.

Acknowledgement sent to Miriam Ruiz <little_miry@yahoo.es>:
New Bug report received and forwarded. Copy sent to Debian FTP Master <ftpmaster@ftp-master.debian.org>. Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Miriam Ruiz <little_miry@yahoo.es>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: ftp.debian.org: Is AGPLv3 DFSG-free?
Date: Wed, 20 Aug 2008 00:19:09 +0000
Package: ftp.debian.org
Severity: wishlist

GNU Affero General Public License v3 (AGPLv3) [1] is a license
published by the Free Software Foundation targeted towards
web and server network applications. It is almost equal to the
GPLv3 license except for this clause:


13. Remote Network Interaction; Use with the GNU General Public License.

  Notwithstanding any other provision of this License, if you modify the
Program, your modified version must prominently offer all users
interacting with it remotely through a computer network (if your version
supports such interaction) an opportunity to receive the Corresponding
Source of your version by providing access to the Corresponding Source
from a network server at no charge, through some standard or customary
means of facilitating copying of software.  This Corresponding Source
shall include the Corresponding Source for any work covered by version 3
of the GNU General Public License that is incorporated pursuant to the
following paragraph.

  Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU General Public License into a single
combined work, and to convey the resulting work.  The terms of this
License will continue to apply to the part which is the covered work,
but the work with which it is combined will remain governed by version
3 of the GNU General Public License.


This clause has important implications, the most important ones -in my
opinion- being:

1) It can might add a cost to the usage of the software that restricts
its usage.
2) It might forbid private usage of software that uses any kind of
network.
3) It might contaminate unrelated software.

The most relevant messages about this topic in debian-devel up to now
have been:

http://lists.debian.org/debian-legal/2008/08/msg00045.html
http://lists.debian.org/debian-legal/2007/09/msg00032.html
http://lists.debian.org/debian-legal/2003/03/msg00380.html
http://lists.debian.org/debian-legal/2008/08/msg00053.html
http://lists.debian.org/debian-legal/2008/08/msg00056.html
http://lists.debian.org/debian-legal/2008/08/msg00057.html
http://lists.debian.org/debian-legal/2008/08/msg00060.html
http://lists.debian.org/debian-legal/2008/08/msg00063.html


Thanks and greetings,
Miry




Blocking bugs of 404942 added: 495721 Request was from David Bremner <bremner@unb.ca> to control@bugs.debian.org. (Sat, 13 Sep 2008 19:09:10 GMT) Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Debian FTP Master <ftpmaster@ftp-master.debian.org>:
Bug#495721; Package ftp.debian.org. (Mon, 24 Nov 2008 14:18:03 GMT) Full text and rfc822 format available.

Acknowledgement sent to MJ Ray <mjr@phonecoop.coop>:
Extra info received and forwarded to list. Copy sent to Debian FTP Master <ftpmaster@ftp-master.debian.org>. (Mon, 24 Nov 2008 14:18:04 GMT) Full text and rfc822 format available.

Message #12 received at 495721@bugs.debian.org (full text, mbox):

From: MJ Ray <mjr@phonecoop.coop>
To: 495721@bugs.debian.org
Subject: Progress on AGPLv3 concerns
Date: Mon, 24 Nov 2008 14:16:27 +0000
There have been some changes in this.  Firstly, the relevant FAQ has
clarified some problems about whether servers must have the opportunity
to download client source code; see
http://permalink.gmane.org/gmane.comp.mobile.funambol.user/1391

Secondly, ftpmasters have a "working opinion" that AGPL meets the DFSG
and a rationale will apparently be added to this report; see
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506042

I think all the remaining concerns which need addressing in that
rationale are around the vague/ambiguous terms, use cost and its
background. Out of the list of 8 URLs, only 2 remain relevant:-
http://lists.debian.org/debian-legal/2007/09/msg00032.html
http://lists.debian.org/debian-legal/2003/03/msg00380.html

I think there may be some third-party circumvention loopholes, but the
DFSG don't require copyleft that actually works, so they're irrelevant.

Hope that helps,
-- 
MJR/slef
My Opinion Only: see http://people.debian.org/~mjr/
Please follow http://www.uk.debian.org/MailingLists/#codeofconduct





Reply sent to Joerg Jaspert <joerg@debian.org>:
You have taken responsibility. (Fri, 28 Nov 2008 11:45:05 GMT) Full text and rfc822 format available.

Notification sent to Miriam Ruiz <little_miry@yahoo.es>:
Bug acknowledged by developer. (Fri, 28 Nov 2008 11:45:07 GMT) Full text and rfc822 format available.

Message #17 received at 495721-done@bugs.debian.org (full text, mbox):

From: Joerg Jaspert <joerg@debian.org>
To: 495721-done@bugs.debian.org
Cc: 506402-done@bugs.debian.org, debian-legal@lists.debian.org
Subject: AGPL and Debian
Date: Fri, 28 Nov 2008 12:42:09 +0100
[Message part 1 (text/plain, inline)]
Hi,

recently we, your mostly friendly Ftpmaster and -team, have been asked
about an opinion about the AGPL in Debian.

The short summary is: We think that works licensed under the AGPL can
go into main. (Provided they don't have any other problems).

Reason:
The concerns people have expressed with regard to this license relate to
the only ยง in it which is different to the GPL:

|| 13. Remote Network Interaction; Use with the GNU General Public License.

Citing the three main concerns from Bug #495721:

> 1) It can might add a cost to the usage of the software that restricts
>    its usage.
[this is also raised in #506042]

We do not think that this is a severe enough problem to restrict the
freeness of a work licensed using the AGPL.
 - Offering a publically accessible network service already comes with a
   cost that might be hard to calculate. Think about DDOS attacks for
   example.

 - For practical matters the distribution costs via the internet are
   close to zero for free software. While bandwidth does cost money, and
   having a (say) 20MB app downloaded a million times would create a
   large cost, the license text reads "from a network server at no
   charge". This means it is not required to be your own server, so you
   can use any of the free services, like Alioth, Savannah, SourceForge,
   Launchpad or Google Code. While those are only there for Free
   Software - that is the case for AGPL applications.

Considering those points, the requirement to make the source available
does not seem to be one which restricts the usage of the software in any
way related to us and the DFSG.

> 2) It might forbid private usage of software that uses any kind of
>    network.

We do not see that it would forbid the private usage of the software. If
you use the software privately, the users of that software are a pretty
limited group. And as soon as they can reach your system to use the
software that means they are able to either download the source from your
private server or get a link to a download location on a machine
accessible to them.

Why might it forbid the private usage of software? Section 13 only
requires to offer the source to the users of your service. As such you
only need to give it to the limited user set your private usage has.

Also, we tend to agree with the FSFs opinion that a client does not need
to provide you access to the source of the servers it interacts with, see
http://www.fsf.org/licensing/licenses/gpl-faq.html#AGPLv3ServerAsUser

> 3) It might contaminate unrelated software.

We aren't sure that this is much different to the "normal" GPL. It is a
copyleft license after all. So unless someone declares the GPL non-free
thanks to that, we disagree with applying it to the AGPL.


In conclusion we will continue to access AGPL works into main subject to
the rest of the checks that we also normally perform.

-- 
bye, Joerg
Could you please add me to the mirrors@debian.org alias. I'm not receiving
enough spam.
  -- Andrew Pollock
[Message part 2 (application/pgp-signature, inline)]

Message #18 received at 495721-done@bugs.debian.org (full text, mbox):

From: Joerg Jaspert <joerg@debian.org>
To: 495721-done@bugs.debian.org
Cc: debian-legal@lists.debian.org
Subject: Re: AGPL and Debian
Date: Sat, 29 Nov 2008 10:26:23 +0100
[Message part 1 (text/plain, inline)]
On 11583 March 1977, Joerg Jaspert wrote:

> recently we, your mostly friendly Ftpmaster and -team, have been asked
> about an opinion about the AGPL in Debian.

> The short summary is: We think that works licensed under the AGPL can
> go into main. (Provided they don't have any other problems).

Steve had a point there, we should have mentioned the version we talk
about.

It is, as bug #495721 asked us, AGPLv3.

-- 
bye, Joerg
Some NM:
>A developer contacts you and asks you to met for a keysign. What is
>your response and why?
Do you like beer? When do we meet? [...]
[Message part 2 (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Debian FTP Master <ftpmaster@ftp-master.debian.org>:
Bug#495721; Package ftp.debian.org. (Tue, 02 Dec 2008 23:21:02 GMT) Full text and rfc822 format available.

Acknowledgement sent to MJ Ray <mjr@phonecoop.coop>:
Extra info received and forwarded to list. Copy sent to Debian FTP Master <ftpmaster@ftp-master.debian.org>. (Tue, 02 Dec 2008 23:21:02 GMT) Full text and rfc822 format available.

Message #23 received at 495721@bugs.debian.org (full text, mbox):

From: MJ Ray <mjr@phonecoop.coop>
To: debian-legal@lists.debian.org, 495721@bugs.debian.org
Subject: Re: AGPL and Debian
Date: Tue, 02 Dec 2008 23:18:26 +0000
I'll only comment on point 1, the use fee, because I think others have
answered the other questions and found solutions for the problem.

Joerg Jaspert <joerg@debian.org> wrote:
> We do not think that this is a severe enough problem to restrict the
> freeness of a work licensed using the AGPL.
>  - Offering a publically accessible network service already comes with a
>    cost that might be hard to calculate. Think about DDOS attacks for
>    example.

Thinking about DDOS attacks, we can try to filter out the requests
that we believe to be abusive.  Do ftpmasters consider that debian
users are allowed to filter out requests for the Corresponding Source
that we believe to be abusive?

>  - For practical matters the distribution costs via the internet are
>    close to zero for free software. While bandwidth does cost money, and
>    having a (say) 20MB app downloaded a million times would create a
>    large cost, the license text reads "from a network server at no
>    charge". This means it is not required to be your own server, so you
>    can use any of the free services, like Alioth, Savannah, SourceForge,
>    Launchpad or Google Code. While those are only there for Free
>    Software - that is the case for AGPL applications.

As an aside, last I checked, Savannah does not allow free software
documention under GPL, while SourceForge and LaunchPad are non-free
and hard to control, and Google Code has age restrictions and other
problems, but there are more hosting services not mentioned above, so
the general point still stands.

> Considering those points, the requirement to make the source available
> does not seem to be one which restricts the usage of the software in any
> way related to us and the DFSG.

The concern here is that the application has to refuse to serve users
if it can't verify that the source code hosting service is capable of
serving.  A few licensors have happily stated that hosting on one and
linking to it is sufficient, but I'm not sure if that's generally
accepted, or whether the auto-kill-switch is necessary.  Do you
believe it's generally accepted that uploading+linking to a public
service is fine, or is it not related to the DFSG if the software is
required to take itself offline if (for example) Alioth is down, or is
there some other reason this is irrelevant?

[...loose end...]
> Why might it forbid the private usage of software? Section 13 only
> requires to offer the source to the users of your service. As such you
> only need to give it to the limited user set your private usage has.

I think the argument was that if your web application just serves a
"permission denied" page, are they a user?  But, that is probably
dealt with along similar lines to this:-

> Also, we tend to agree with the FSFs opinion that a client does not need
> to provide you access to the source of the servers it interacts with, see
> http://www.fsf.org/licensing/licenses/gpl-faq.html#AGPLv3ServerAsUser


Hope you don't mind clarifying how you think public hosting services
should be used to avoid the AGPLv3 use fee.

Thanks,
-- 
MJR/slef
My Opinion Only: see http://people.debian.org/~mjr/
Please follow http://www.uk.debian.org/MailingLists/#codeofconduct





Information forwarded to debian-bugs-dist@lists.debian.org, Debian FTP Master <ftpmaster@ftp-master.debian.org>:
Bug#495721; Package ftp.debian.org. (Sat, 06 Dec 2008 14:27:02 GMT) Full text and rfc822 format available.

Acknowledgement sent to Francesco Poli <frx@firenze.linux.it>:
Extra info received and forwarded to list. Copy sent to Debian FTP Master <ftpmaster@ftp-master.debian.org>. (Sat, 06 Dec 2008 14:27:02 GMT) Full text and rfc822 format available.

Message #28 received at 495721@bugs.debian.org (full text, mbox):

From: Francesco Poli <frx@firenze.linux.it>
To: debian-legal@lists.debian.org
Cc: 495721@bugs.debian.org
Subject: Re: AGPL and Debian
Date: Sat, 6 Dec 2008 15:23:46 +0100
[Message part 1 (text/plain, inline)]
On Fri, 28 Nov 2008 12:42:09 +0100 Joerg Jaspert wrote:

> Hi,
> 
> recently we, your mostly friendly Ftpmaster and -team, have been asked
> about an opinion about the AGPL in Debian.
> 
> The short summary is: We think that works licensed under the AGPL can
> go into main. (Provided they don't have any other problems).

First off, thank you for explaining the rationale of your decision.
I wish Ftpmasters did so more often...

However, I disagree with your conclusion, and I would like to respond
to your points as a (disappointed) Debian user.
Just to be clear: IANAL, TINLA, IANADD, TINASOTODP (...it's a *response*
to a statement of the official Debian position).

> 
> Reason:
[...]
> Citing the three main concerns from Bug #495721:
> 
> > 1) It can might add a cost to the usage of the software that restricts
> >    its usage.
> [this is also raised in #506042]
> 
> We do not think that this is a severe enough problem to restrict the
> freeness of a work licensed using the AGPL.
>  - Offering a publically accessible network service already comes with a
>    cost that might be hard to calculate. Think about DDOS attacks for
>    example.

I am not convinced that the fact that a use cost might exist anyway
justifies adding other costly requirements.
I don't remember seeing use restrictions accepted as suitable for
main, before.

> 
>  - For practical matters the distribution costs via the internet are
>    close to zero for free software.

A cost which is negligible for some people, might be significant for
other, less lucky, people...

>    While bandwidth does cost money, and
>    having a (say) 20MB app downloaded a million times would create a
>    large cost, the license text reads "from a network server at no
>    charge". This means it is not required to be your own server, so you
>    can use any of the free services, like Alioth, Savannah, SourceForge,
>    Launchpad or Google Code. While those are only there for Free
>    Software - that is the case for AGPL applications.

As already pointed out by other people, there's no guarantee that
running a modified AGPLv3'ed application, while the third-party hosting
service is off-line, will not be considered a breach of the license
conditions.
Hence, I think there's no guarantee that using a third-party hosting
service like Alioth is an acceptable way to comply with Section 13
requirements.

This leaves us with two options: setting up our own source distribution
server (which may be a significant cost) or put source on the same
server/device which runs the AGPLv3'ed application (which may be
unfeasible due to resource constraints, think about a small embedded
system which talks a limited network protocol).

[...]
> > 2) It might forbid private usage of software that uses any kind of
> >    network.
> 
> We do not see that it would forbid the private usage of the software. If
> you use the software privately, the users of that software are a pretty
> limited group. And as soon as they can reach your system to use the
> software that means they are able to either download the source from your
> private server or get a link to a download location on a machine
> accessible to them.
> 
> Why might it forbid the private usage of software? Section 13 only
> requires to offer the source to the users of your service. As such you
> only need to give it to the limited user set your private usage has.

The term "user" is not clearly defined.  If I get an "access denied"
error page through a browser, am I a user of the web application?
This ambiguity is really problematic, since it implies that there's no
clear way to tell who I am compelled to make source available to.

[...]
> In conclusion we will continue to access AGPL works into main subject to
> the rest of the checks that we also normally perform.

Sadly, another bunch of non-free software will be accepted in main.  :-(
As a Debian user, I am disappointed by the decreasing strictness with
which the SC and the DFSG are applied.


-- 
 On some search engines, searching for my nickname AND
 "nano-documents" may lead you to my website...  
..................................................... Francesco Poli .
 GnuPG key fpr == C979 F34B 27CE 5CD8 DC12  31B5 78F4 279B DD6D FCF4
[Message part 2 (application/pgp-signature, inline)]

Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Sun, 04 Jan 2009 07:27:03 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Fri Apr 18 09:06:49 2014; Machine Name: beach.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.