A beta release and a new license for Mailpile

Posted Jul 23, 2015 17:42 UTC (Thu) by Cyberax (✭ supporter ✭, #52523)
In reply to: A beta release and a new license for Mailpile by Seegras
Parent article: A beta release and a new license for Mailpile

Even that is way too dangerous. For example, you integrate Mailpipe with your auditing and logging system. And BAM! you need to open your whole backend. It's just too risky.

In _all_ software companies I've worked so far, AGPL was explicitly Verbotten with no way of even getting lawyer-reviewed exemptions (even MongoDB required commercial licensing).

to post comments

A beta release and a new license for Mailpile

Posted Jul 23, 2015 19:37 UTC (Thu) by jnareb (subscriber, #46500) [Link] (14 responses)

> Even that is way too dangerous. For example, you integrate Mailpipe with your auditing and logging system. And BAM! you need to open your whole backend. It's just too risky.

Bulls*it. First, for a project to fall under (A)GPL it must be in strict definition combined work - mere aggregation doesn't trigger. Second, for license to matter at all you need to distribute combined work - mere in-house use doesn't trigger.

A beta release and a new license for Mailpile

Posted Jul 23, 2015 19:45 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link] (13 responses)

> Bulls*it. First, for a project to fall under (A)GPL it must be in strict definition combined work
Linking-in an in-house auditing/logging module makes it a combined work.

> Second, for license to matter at all you need to distribute combined work - mere in-house use doesn't trigger.
Simply giving an off-site contractor an account in the mail system is enough to trigger the 'distribution' clause in this case ( https://www.gnu.org/licenses/old-licenses/gpl-2.0-faq.en.... ).

I've spent quite a bit of time discussing these points with our lawyers...

A beta release and a new license for Mailpile

Posted Jul 23, 2015 19:56 UTC (Thu) by rahulsundaram (subscriber, #21946) [Link] (12 responses)

>Simply giving an off-site contractor an account in the mail system is enough to trigger the 'distribution' clause in this case

The FAQ is for GPLv2 and doesn't validate what you are claiming here.

" In particular, providing copies to contractors for use off-site is distribution."

> I've spent quite a bit of time discussing these points with our lawyers...

Your lawyers only represent the legal position within your organization.

A beta release and a new license for Mailpile

Posted Jul 23, 2015 20:11 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link] (11 responses)

> The FAQ is for GPLv2 and doesn't validate what you are claiming here.
I grabbed the first one. It's still there in the GPLv3 FAQ: http://www.gnu.org/licenses/gpl-faq.en.html#InternalDistr...

Uhm, excuse me, but I'll just quote the FAQ:
> "However, when the organization transfers copies to other organizations or individuals, that is distribution. *In particular, providing copies to contractors for use off-site is distribution.*"

For the AGPLv3 it's enough to simply give a link to the account (Article 13 of the AGPLv3): "Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version"

This is WAY too scary for companies.

> Your lawyers only represent the legal position within your organization.
If lawyers in several large organizations give me the same opinion, I tend to believe them.

A beta release and a new license for Mailpile

Posted Jul 23, 2015 20:40 UTC (Thu) by rahulsundaram (subscriber, #21946) [Link] (10 responses)

I have a different take on what you just quoted but if you have a legal opinion otherwise, you should probably rely on that but the following is more important:

>If lawyers in several large organizations give me the same opinion, I tend to believe them.

How do you know the opinions of lawyers in several large organizations on AGPL and does it confirm with your reading on it? This is a genuine question.

A beta release and a new license for Mailpile

Posted Jul 23, 2015 20:43 UTC (Thu) by dlang (guest, #313) [Link]

besides the opinions of lawyers from several large companies

when the people who are likely to file lawsuits to enforce the license state in the license FAQ that they consider giving a contractor access to something "distribution" that triggers the source availablilty clause of the license you would be smart to treat that as being the case.

Even if they are wrong and that isn't really "distribution", until they either change their mind, or loose a case in court, you will be in the position of paying to defend a lawsuit on the issue.

A beta release and a new license for Mailpile

Posted Jul 23, 2015 21:32 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link]

> I have a different take on what you just quoted
Which probably will carry much less weight in court than the FSF's opinion

It's been a consensus for quite some time that distribution clause is VERY easy to hit. I've explicitly asked lawyers this question many times.

> How do you know the opinions of lawyers in several large organizations on AGPL and does it confirm with your reading on it? This is a genuine question.
Yes. AGPL was a topic of conversation several times and lawyers in multiple companies were quite adamant about that.

A beta release and a new license for Mailpile

Posted Jul 23, 2015 22:20 UTC (Thu) by bronson (guest, #4806) [Link] (7 responses)

You have a different interpretation of language in the GPLv3 FAQ? I'd like to hear more. To me the language seems clear and agrees with Cyberax's statements.

Last I talked with lawyers about the AGPL, it was only a few years old, but they came to the same conclusion as Cyberax's: if you have AGPL and private code inside your organization, you need to tread VERY carefully and keep excellent records. For us, the showstopper was integrating single sign-on. The project was dropped. Frustrating, but I understand everybody's viewpoints.

A beta release and a new license for Mailpile

Posted Jul 23, 2015 23:10 UTC (Thu) by rahulsundaram (subscriber, #21946) [Link] (6 responses)

>You have a different interpretation of language in the GPLv3 FAQ?

Like I said, if you have legal opinion that suggests otherwise, rely on that. Here is what I have experience with:

This is partially based on a project where public deployment was going to use some AGPL'ed code with related modifications (not direct code changes but authentication provided by third party code snippets) and contractors involved. The organization decided against that for other reasons but the initial consultation from a lawyer was that a contractor involvement wouldn't count as distribution. Now I understand lawyers being risk averse about this and all that but I was wondering whether this was just a abundance of caution of whether the language in the license was interpreted consistently in a particular way.

A beta release and a new license for Mailpile

Posted Jul 24, 2015 4:07 UTC (Fri) by bronson (guest, #4806) [Link] (5 responses)

Man, that's gutsy. If I receive a legal opinion that directly contradicts what the FSF is saying about their own license, I'd go back to the lawyer and ask, "are you sure??" (and pay the additional $$$ of course) I'd be very curious to hear your lawyer's answer.

Even if the license's language leaves doubt, interpretation or estoppel would likely encourage the court to take the FSF's side.

A beta release and a new license for Mailpile

Posted Jul 24, 2015 4:41 UTC (Fri) by rahulsundaram (subscriber, #21946) [Link] (4 responses)

> If I receive a legal opinion that directly contradicts what the FSF is saying about their own license, I'd go back to the lawyer and ask, "are you sure??" (and pay the additional $$$ of course)

That additional expense would be pretty unjustifiable after one picks a different solution. It amounts to nothing more than idle curiosity at that point.

A beta release and a new license for Mailpile

Posted Jul 24, 2015 6:00 UTC (Fri) by bronson (guest, #4806) [Link] (3 responses)

Agreed. I meant, if you ever find yourself in this position again, I hope you'll report back. I'd love to hear any reasoning behind disagreeing with the FSF about the interpretation of their own license.

A beta release and a new license for Mailpile

Posted Jul 27, 2015 13:15 UTC (Mon) by drag (guest, #31333) [Link] (2 responses)

When you use legal terms like 'Derived Work' you are no longer the ones in charge of interpreting the license. These things are defined by courts, not by the license writers.

So it's very easy to be wrong about your own license.

A beta release and a new license for Mailpile

Posted Jul 27, 2015 18:33 UTC (Mon) by dlang (guest, #313) [Link] (1 responses)

However, if you end up having to go to court to defend your reading of the license as being different from what the authors of the license very publicly state, it can cost you quite a bit of money, even if you win.

Not to mention the bad PR.

There needs to be a VERY big upside to using that particular software instead of some other choice to make the risk worthwhile.

A beta release and a new license for Mailpile

Posted Jul 27, 2015 19:23 UTC (Mon) by rahulsundaram (subscriber, #21946) [Link]

There is also the question of how the developers interpret the license when it is different from the interpretation of the license authors themselves. My understanding is that the copyright holders view is the more relevant one.