Comment by NavinF | Hacker News Reader

Comment by NavinF | Hacker News Reader

Parent Full thread

> Step 5: Stick a reverse proxy in front that deletes the source code offer (No license implication, does not modify the AGPL software in any way, see Clause 9)

> Heck, this situation could easily happen semi-organically - a reverse proxy doesn't have to be designed to explicitly remove the source code offer, it could merely be a protocol translator/wrapper that has no support for that specific message/tag, which is something that happens all the time.

Hmm I would be unsurprised a judge interprets the writing/configuring of a reverse proxy that modifies the HTML output or blocks access to some pages to be the same thing as editing the AGPL code yourself.

Though if I’m right, this implies that anything (load balancer, templating engine, protocol conversion, auth, etc) that calls an AGPL app also has to be open sourced even if the AGPL app is unmodified and doesn’t call any of your code. I can see why pretty much every company bans the use (freedom 0) of AGPL even on dev laptops: https://opensource.google/documentation/reference/using/agpl...

> Hmm I would be unsurprised a judge interprets the writing/configuring of a reverse proxy that modifies the HTML output or blocks access to some pages to be the same thing as editing the AGPL code yourself.

That would mean anyone using an ad blocker (or any other userscript) on AGPLed websites is in violation of the license too.

This is actually a very complex legal issue, because HTML can be copyrighted, and so making changes to it can be subject to the license. It's why I mentioned that web apps can conceivably benefit from the AGPL in a somewhat reasonable way if they self-serve their own source code, to sidestep the AGPL's anti-developer aspect.

But for something like MongoDB, where the protocol does not convey copyrightable portions of the software? Doesn't work. The AGPL is out of the picture by the time the bytes flow out of the server.

It really wouldn't mean that, this is fallacious thinking, the law is not code and intent is important.

Indeed, which is why ad blockers are legal. And thus, it follows that my interpretation of the two-party scenario is also correct, because similarly to the user running an ad blocker, the person running a reverse proxy has nothing to do with the licensing requirements imposed on a different person who modified the code.

No, I'm afraid it does not follow at all. Your two-party scenario displays intent to interfere with contractual rights. It may be a difficult situation to deal with legally, but it's very different from a user running their own ad-blocker.

As others have said, your thinking here is very much "apply the contract as if it were code, and then think of exploits/bugs". I don't believe this maps to the real world legal system very well.

> Your two-party scenario displays intent to interfere with contractual rights.

Only if those two parties actually colluded with that intent, and you can prove it.

Personally, I don't want to be on the hook for proving this kind of nonsense in order to enforce my license. If I cared about SaaSification, I'd much rather use an outright EULA that forbids it and cut out all this nonsense of pretending you can solve the issue with a free software pure copyright license.

> Only if those two parties actually colluded with that intent, and you can prove it.

Let's think about it though -

Party 1 hosts the software, and does so on an open endpoint that is very hidden, most/all users access it through party 2's proxy - there's intent, right there. In civil cases in particular, the standard of proof is on preponderance of evidence and what's most likely, not 'beyond a reasonable doubt'.

Again, you're falling very much for "software guy interprets law as code" through all of this.

Party 1 develops the software, and hosts it on an open endpoint that is not publicly advertised. Party 1 has met their obligations.

Party 2 hosts the software, and does so behind a wrapper that does not forward the source code offer (this doesn't mean a wrapper that does s/source code offer//; it could be a protocol converter, WAF, or any other number of things that could lose non-protocol-relevant data like a source code offer).

None of this demonstrates intent. In fact, I have ended up in the Party 2 scenario accidentally already (in my case I was both parties, but that was a a coincidence), as I ran an (accidentally) modified AGPL service behind another public server that used it as a backend. There was no source code offer at all to begin with, but even if there had been, the nature of the system involved would mean it would be pretty much impossible for that offer to percolate past the frontend and back to the external users, just the way the protocols involved worked, no explicit malice involved.

Party 2 in this case appears to be in violation, serving a service without the offer.

Then there was no particular intent there, and I'm sure when you realised, you remedied it?

Honestly we've wandered so far from "malicious actors can sidestep the license here that I'm not sure what your point is.

> Party 2 in this case appears to be in violation, serving a service without the offer.

If Party 2 has not made any changes to the source code, they have no obligation to make any offer under the license, since the requirement only applies to parties who modify the program. Party 1's obligations are not transferred to Party 2 when the program is. The license applies as written, there is no "carry-over" of state.

The license applies as written and as interpreted in a court of law.

When you were both parties, you were in violation. And as you say party 2 hosts the software that party 1 has altered, you appear to be relying on a contractual barrier between party 1 and 2 that makes them separate entities to 'shield' the party actually presenting the service from having any obligations. It's entirely possible that a judge could interpret the 'you' in clause 13 to include any parties who are providing the modified version to their networked users.

Either way it's probably not really some sort of 'gotcha' that just allows you to circumvent with impunity.

I'm not relying on the contractual barrier, I'm relying on the interpretation of the clause as applying strictly to the behavior of the program as designed and embodied in the source code, and arguing that there is no moral requirement stated in the license for ensuring that that behavior is ultimately exposed to end users, and in fact, such a requirement would go against the spirit of the AGPL as a copyright license and it was explicitly written not to require that.

Some people might disagree with that interpretation, which is okay because it's the kind of fine point nobody will ever agree on until it ends up in front of a judge. Which is why I bring up the two party example, to sidestep that question.

But your two-party example is quite possibly fallacious, that's the point here, they may well be considered one party by a court, or equally responsible.

Further, if the New York Times website can be considered a copyright work, and my proxy provides an altered version (say, one that credits me with writing all the articles), I've probably violated their copyright. I think your proxy could fall foul of this sort of thing too.

You may have identified an area where a legal morass could be found if it comes up, but again I don't think it's "one simple trick that AGPL holders hate".

You are equivocating. You are making subtle changes to the qualifiers of the condition at issue (again[1]). Doubly odd for someone exhorting others to "read[...] very carefully".

Whether someone has "made any changes to the source code" is not the applicable rubric.

In this case you are constructing a stronger condition than the actual condition—which is much lower: to modify the Program. Your clever reverse proxy doesn't subvert this. (It's not so clever.) You're modifying the program whether you've touched any files containing plain text source code or not. (Even then, you probably have; cf IaC.)

Aside from that, others' points about courts not being simple machines that exist to be hacked is very relevant to this discussion and many others that devolve into this sort of thing when hackers get involved[2].

Overall, this is astoundingly bad synthesis for something that has gotten so much traction.

1. https://news.ycombinator.com/item?id=30179334

2. https://news.ycombinator.com/item?id=25687897

Are you arguing that creating a program that interacts with another program is "modifying it"? Because then essentially all software is a derivative work of everything else and the entire industry is one giant copyright violation.

Come on. You're grasping at straws here. That makes zero sense. It goes against everything we know about how software licensing works. It is extremely well established that interacting with software through stable, external interfaces does not constitute creating a derivative work of the software.

I am arguing, specifically, that your reverse proxy respects neither the spirit nor the letter of the AGPL and does not provide the kind of protections that you're claiming it would.

(Separately, if ever the words "come on" make their way into your response, or you have to try to invent an argument for another person so that you can simultaneously take it down, then your own argument is probably junk. Here you've done both.)

You argued, specifically, that,

> You're modifying the program whether you've touched any files containing plain text source code or not.

And that is just not how copyright works.

(Separately, if you ever find yourself linking to completely unrelated comments by the person you are replying to in order to construct an attack on them personally, then your own argument is probably nonsense, and you're probably not a fun person to have around.)

Do less Twitter.

Slightly off-topic:

I'm surprised by how many internal technical details Google is intentionally leaking with their documentation here. Stuff about //third_party and //experimental etc.

Oh all that is public knowledge. You’ll find references to the repo layout in just about every open sourced project that comes with Bazel BUILD files.

It's extremely intentional! I wouldn't even call it a leak...

Thanks.

I meant 'leak' in the sense of 'oil leak'. Not in the sense of 'unintentional disclosure'.

Reply on news.ycombinator.com