The AGPL is Free Software

A debian developer recently argued on a mailing list that the Affero GPL does not meet the debian free software guidelines. He wants packages developed under that software license to not be allowed in Debian.

The author essentially says that modifying an AGPL program is too much extra work, because one has to think of the users and keep their ability to download the sourcecode intact, rendering it too difficult to develop using AGPL software in some cases. This basic premise is repeated through many bullet points in his email below:

http://lists.debian.org/debian-vote/2009/11/msg00000.html

It is interesting to note that the author does not link to the Debian Free Software Guidelines, so I will do so here. They are a good read, and this work helped bridge the gaps between the permissive and copyleft licenses in the late 1990's, and it still the definitive work on the subject in my mind:

http://www.debian.org/social_contract

In my opinion to remove the AGPL from debian would hinder software authors' ability to protect the freedom of users who interact with their software over a network. Authors want to give their software to all users, not give their software to companies trying to lock users into a service. Companies are not prevented from locking users in by siloing their data away, but at the very least they have to give them the source code of the applications they are interacting with. When you accept code from these authors, you are agreeing to taking whatever steps are necessary to providing those same rights + your modifications to your network users.

Let's go through the points that folks are complaining about.

2.1 & 2.2 .. yes, you may have to take some effort or cost to preserve your users' freedom. The GPL also requires you to go to the effort or cost of including the source code to recipients or distributing the source code afterward via various mediums. In fact, interacting with GPL software over a network is kind of a loophole that the AGPL is closing. It's a 21st century version of the GPL. Can you imagine shipping source code on tape? Allowing download is not inconvenient.

Presumably the AGPL software you are using will already have a code delivery mechanism built in (as it itself probably complies with the license originally). You shouldn't take this mechanism out, and if you use the code in a way that breaks the original mechanism no longer works, yes, you have to port and repair that mechanism for your new version -- or else hope you have no users whose freedom you are not respecting.

2.2(I think he means 2.3) Yes, people downstream from you may misconfigure the software either out of malice or stupidity. Having malicious or stupid downstream community members does not put you in violation of the AGPL, it puts THEM in violation, so this is not an issue at all for developers. If you work for these "downstream" malicious people, however, and they are asking you to do malicious things like removing offer of source... find some other software to build your service on.

3.1 Yeah if you are using a headless, low bandwidth machine with no interface, it might be a bit harder to offer sourcecode to your users. The AGPL understands that in some cases the offer of source is not appropriate. For instance if your machine has no networking (no network users) then you don't need to give out your modifications (no one to give them too.) However, your case above doesn't cut it. If this machine is so crippled that it has no functionality, and no interface, what use is it? Microcontrollers and DNS servers maybe? But surely those have interfaces, just not a standard web or desktop interface.

Get creative! Nothing says that you have to deliver AGPL software from the same machine that provides the service, just that it has to be the same source code that the service is running. You could put a minified download url in your commandline telnet client, or stuff one into an obsolete data field in your DNS reponses. Have the server at the end of that url do the data serving. Give the patches back to the original author and ask if they can be upstreamed so you can just point people to him/her. I don't know, but your software absolutely has an interface if I has network interaction. Yes, if you are using AGPL'ed software that is this low level, then you will have to have to get creative to give a prominent offer.

It can be hard to offer source over an API only interface. In this case I would recommend exploring offering source for the buried software that communicates over an API in the interface of a related program that humans do interact with. I.E. you can't get source from my router software in the TCP/IP packets themselves, but you can get it from the router's web interface just fine.

Side note: I would like to see some innovation for those API only cases where machines could request source from other machines. They would share it, faster and faster, patching and compiling it down to new bytecode DNA, running it and taking over the world (just kidding). But some soft of API level "offer of source" would solve your problem. Maybe an offer of source protocol to serve the same purpose as the machine readable creative commons license badges? You don't have to write one, but it might be a nice tool for someone to develop.

I know you think it is burdensome to keep having to keep offering source as long as you have network users for an AGPL'd service, but them's the breaks. If you have a network server, you are responsible for having a network server capable of offering source, sorry.

Anyway, I think debian should allow authors to require those downstream to share even when it requires a bit more work and creativity. This is free software in the classic copyleft sense, free for users and developers in any field of endeavor as long as they are passing freedom along to the next link in the chain.

Debian should cite its Social Contract (scroll up from DFSG) on point 4 where they say "Our priorities are our users and free software".

In the 21st century our users are the people interacting with the services we build on free software. We should take debian's advice and include them.