Item — HN Reader

I'm not an expert in licenses, could someone weight in and explain how the AGPLv3 was being abused? Did the mentioned companies follow the spirit of the license and were getting away with something the company didn't like or were they just improperly distributing the software, regardless of licensing terms? Also: "So while the SSPL isn’t all that different from the GNU GPLv3,(...) [it] explicitly states that anybody who wants to offer MongoDB as a service (..) needs to either get a commercial license or open source the service to give back the community."

Doesn't AGPLv3 already require open sourcing server side implementations?

Thanks in advance

2 comments

Speaking as a lawyer:

There was no abuse, there was only mongo not being able to make money in all cases they wanted to. That's what they see as abuse. It isn't.

While they complain of bad actors, bad actors always act bad. This will not disincentivize them (they are also often in a lot of interesting jurisdictions that would make it hard anyway).

Instead, this is really about making it completely unpalatable for normal actors to not pay mongo in every single case.

Otherwise, one has to believe that mongo is going to go off and sue a bunch of people now, which would be a horribly stupid business model.

> While they complain of bad actors, bad actors always act bad. This will not disincentivize them (they are also often in a lot of interesting jurisdictions that would make it hard anyway).

Yes this is not going to stop the Asian cloud providers they talk about. It is truly aimed at AWS et al. If they came out and said that it would not sound as nice. Mongo just made a big move in the cloud space by buying mLab. They are looking to contain the competition.

Speaking as not a lawyer: there is lots of abuse of OSS infrastructure from big tech corps — because the AGPL isn't equipped for everything-as-a-service eating software licensing. If "abuse" were license violations, they wouldn't have to use a new license.

Abuse is often legal.

What is your definition of "abuse"?

This feels a lot like when i hear about "GPL" abuse when it was specifically not designed for what people think is abuse (and that's not my view but stallman's).

Similarly, AGPL was not designed to require every piece of software around a piece of AGPL software to be open sourced.

Deliberately so. Not doing so is not "abuse".

You may have different goals, and that's actually fine! But it doesn't make following the license and what it was meant for abuse.

I'll also point out: In the history of my work on open source, by far the largest legal abusers of open source are startups. By many orders of magnitude. This is real abuse in the sense of clear license non-compliance. I worked on M&A at a variety of companies that acquired all sorts of different kind/stages of startups.

They rarely are compliant with even simple notice licenses (IE don't bother to post notices), let alone any of the more restrictive licenses.

Large corps often have legal departments that try to understand and consider and figure out what to do, even if they do it wrong.

So to me, every time i hear "large company open source abusers" i kind of laugh, because IMHO getting the startups to stop abusing open source would have a much more significant difference on OSS than getting 2 or 3 large companies to stop "abusing" it.

Abuse is taking all the free candy at a doctor's office. It might just violate a norm without breaking a law, but it's still abuse.

It's situational, but if you define abuse as "breaking a contract or law" we're not going to agree on anything about this.

MongoDB has _always_ wanted to make money when other people make money reselling their work. The AGPL doesn't really do what they needed, but their intent has been clear since day one.

Let's be real concrete here with no analogies: I asked you to define what you see as abuse?

Give me concrete examples.

I explicitly pointed out to you a social norm, not a violation of contract. I did not define it as breaking a contract or law. I defined it in terms of the social norm that was set by the creator of the license, or the "spirit" of the license.

I want to understand what you see as "violation of that spirit", not the legal definition. As mentioned, most definitions i've seen here are explicitly not what the creator of the license intended (again, not what they wrote down, but what they intended). It's hard to see something that doesn't violate the spirit of the license as abuse.

For example, i often hear about "not contributing back" to GPL projects. RMS explicitly was okay with "not contributing back" in the broader sense, as long as they released their source code. He had no expectation he would get anything other than a pile of source that he would have to deal with. He just wanted to be able to hack it, so as long as it had the right stuff, he didn't expect others to care. He thought it would be nice for sure, but it's not "abuse".

(A great concrete example of abuse is usually binary kernel blobs that have deliberate shim interfaces. This clearly violates the spirit of the license even if the license says it may be okay.)

So far i haven't seen what you have defined as abuse especially by "large companies".

Additionally, I pointed out to you the notion that large corporations are the ones doing the abusing is wrong under almost all definitions of abuse, spirit, legal, aspirational, you name it.

Who are you to decide what is the norm being violated? What I mean by that was the entire point of open source and free software licensing is to codify the 'norms' that the authors found important.

Companies like Google, MS, Amazon are not violating norms but complying with them. When companies like MongoDB abandon these licenses its because they're incompatible with their business model.

Open Source is fine for them while they're making a market and developing a programmer user base, becoming popular with people who will not bother with a new proprietary database, mind you, but once they're 'popular' and need to increase revenue, the license gets replaced with a familiar , proprietary, one.

> Abuse is taking all the free candy at a doctor's office.

This is a bad analogy for software, since software is not a finite resource. Anyone can make a near infinite number of copies.

Don't blame 3rd parties when you realized that an open source license is the wrong license for your product.

It's bad analogy, but the candy bowl in this particular example is "revenue available to companies selling this stuff". The cost to duplicate these things is 0, but the available income is fixed.

I'm assuming you're not being sarcastic. Is there a monopoly on SAAS for Mongo?

I don't think this takes away from MongoDB picking the wrong license and business model.

> Abuse is taking all the free candy at a doctor's office. It might just violate a norm without breaking a law, but it's still abuse.

Using your analogy, MongoDB is taking all of the free community that is around open source and changing the license after they have a community so they can extract/shakedown money from people. If anyone is abusive, it's people like MongoDB changing the license after they got lots of free contributors adding to mongodb.

> because the AGPL isn't equipped for everything-as-a-service eating software licensing

The AGPL is just generally a ridiculously badly written license.

Abuse isn't a legal concept here. It's condemnation of specific business conduct, specifically a kind of free riding. That's for businessfolk to debate. Lawyers read the licenses, but business managers decide how to use them, to what ends, and why.

The cloud competitors MongoDB professes concern about have sophisticated software license counsel. They're very good at reading licenses. That is part of the claimed problem: They were good enough to see and exploit loopholes in a dense, oddly drafted license like AGPLv3, which most others read as "free for free software only", rather than as written. They also have deep pockets, US legal nexus, and significant ongoing commercial use to enjoin. The latter make a wide target. But the former makes them too strong to sue on anything but firm ground.

I don't know what you mean by normal actors, but if there are a lot of them, and they're relatively small, and also potential Mongo customers, suing them en mass to make examples, RIAA/MPAA-style, isn't nearly as appealing as cutting big cloud providers offering MongoDB off from updates with a license change. Everything about these changes and the materials accompanying points to the latter.

I don't see Mongo announcing any litigation campaign for going beyond AGPLv3 permission. I do see Mongo drawing a new line in the sand, via a new license for new releases, that will be easier to defend against the specific competitors they see pushing the limits of the old line.

The article is missing the specifics of what Mongo are saying that others are doing that they won't be able to do under this new licence.

The license is very clear, you'd have to ship the entire system around it.

AGPL: 'if you run a modified program on a server and let other users communicate with it there, your server must also allow them to download the source code corresponding to the modified version running there.'

Some companies are illegally running a modified version of MongoDB while keeping their changes closed source.

As I understand, the new licence will allow them to do that if they pay a commercial licence (contributing to the project by financing instead of coding).

AGPL does not require the copyright-holder to license the work exclusively under the AGPL, only those that received the work under the AGPL. People and companies are free to receive from copyright-holders their works under different — even commercial — licenses, irrespective of which (and how many) (non-exclusive) licenses the copyright-holders have used in the past for the same works.

In the matter of allowing commercial licensing by the copyright-holder, the AGPL and this new license do not differ.

> Instead, this is really about making it completely unpalatable for normal actors to not pay mongo in every single case.

Or they might just release their entire stack, which is probably 90% open source stuff with 10% glue code anyway.

There’s more to running a business than just cloning a software stack. Any idiot can fire up an OpenStack based ‘cloud’, but that won’t make them the next AWS.

https://webassets.mongodb.com/_com_assets/legal/SSPL-compare...

“Service Source Code” means the Corresponding Source for the Program or the modified version, and the Corresponding Source for all programs that you use to make the Program or modified version available as a service, including, without limitation, management software, user interfaces, application program interfaces, automation software, monitoring software, backup software, storage software and hosting software, all such that a user could run an instance of the service using the Service Source Code you make available.”

^ not the same.

That... is an impressive load of shit. So because I want to host MongoDB, I have to offer up the source for the Linux distro used to host the Jenkins server that I use to test it, huh.

Last week I was debating whether MongoDB is now completely obsoleted by PostgreSQL’s JSON datatype. As of now, I consider that no longer a debate.

Couldn't you just say "I run Jenkins available from https://blah.com and Ubuntu from https://blah.com"? Doesn't sound too strenuous

If you've never had to enumerate every piece of software you've installed, you might not think so. In practice, it's a major PITA. And what if you're using a closed-source CI/CD or monitoring system, so that you can't comply with their bizarre terms?

No, I think the real goal here is to make it effectively impossible to use this in a business setting without buying a commercial license. I'm glad Linus and RMS didn't see it that way.

The "all programs you use" clause seems to make it extremely viral, perhaps unprecedentedly so. It seems to me that anyone not willing to comply with AGPL would be even less likely to comply with this. Not sure how that's supposed to be a good outcome, even for Mongo.

This sounds like a violation of provision 9 of the Open Source Definition and the DFSG.

It's going to backfire hard when distros start removing Mongo from their main repos.

Why would they? They don't make a Mongo service available. Neither do most users who install Mongo from a Linux distribution repository.

(Thanks for the explanation, "DFSG" passed over me the first time I read this. "Debian Free Software Guidelines".)

Distributions like Debian, Fedora, Ubuntu, etc. require that all software in their core repos be FOSS. It's not about their legal obligations but about their own policies forbidding proprietary software in their core repos.

Since the new Mongo license violates rule 9 of the DFSG, it is considered proprietary software by Debian's definition, and that means Debian's FOSS policy will require Mongo to be moved out of the core repos and into the non-free repo. Fedora and Ubuntu have their own policies which will have the same effect.

Mongo already provides their own repos, and recommends using that for install and updates. I don't think they care or anyone seriously wanting to develop something on/around Mongo does either.

The same can be said for docker?

Yes, though I think their enterprise efforts are truly different offerings, and Kubernetes probably surprised them a bit there.

Why is it viral? It doesn't require those other stuff to also be available under this license, just as source-available. Which means this is basically AGPL++.

Also from the license, w.r.t. "Corresponding Source" definition:

===

However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work.

===

Not that this makes the issue any more clear or enforceable...

Original: your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software.