25

I'm trying to understand the difference between the SSPL and the GNU AGPL license, after reading the terms of SSPL.

The 13th clause of the license states the following:

If you make the functionality of the Program or a modified version available to third parties as a service, you must make the Service Source Code available via network download to everyone at no charge, under the terms of this License. Making the functionality of the Program or modified version available to third parties as a service includes, without limitation, enabling third parties to interact with the functionality of the Program or modified version remotely through a computer network, offering a service the value of which entirely or primarily derives from the value of the Program or modified version, or offering a service that accomplishes for users the primary purpose of the Program or modified version.

“Service Source Code” means the Corresponding Source for the Program or the modified version, and the Corresponding Source for all programs that you use to make the Program or modified version available as a service, including, without limitation, management software, user interfaces, application program interfaces, automation software, monitoring software, backup software, storage software and hosting software, all such that a user could run an instance of the service using the Service Source Code you make available.

I'm not sure if I understand correctly the point, but this what I'm thinking:

  1. Under the GNU AGPL:

    • It is legal to create a proprietary program B that uses AGPL-licensed program A over a local network N1.
    • It is legal that program B provides a service S to an end-user over network N2.
    • It is legal to modify the program A without sharing changes, since A is connected to N1 and the end-user is provided with the service S under different network N2.
  2. The new SSPL license fixes the gaps above, in order to grant a pure open-source service implementation without any proprietary counterpart.

Is my analogy correct? Is there other differences?

user6039980
  • 388
  • 4
  • 9

2 Answers2

21

The AGPL requires that the people interacting with program A over a network have the right (and possibility) to obtain a copy of the source code of A. The AGPL does not strictly define what interaction over a network means and if it includes indirect interaction via program B.

It can be argued that interaction with a program means that your actions as a user cause a reaction in that program, even if the action was initially done on another program. This would mean that if program B just forwards the user interactions to program A, then it can be argued that the user is actually interacting with program A. On the other hand, if the requests from B to A can not be directly related to user actions, then the user probably not interacting with A.

The SSPL license indeed tries to close the gap that a copyleft program can be used in the background without giving out the sources.
If that is actually successful remains to be seen, because the SSPL license seems to step outside the realm of copyright. The SSPL license puts requirements on programs that are completely unrelated in terms of copyrights and it remains to be seen if that clause will actually be upheld in a court of law.
For example, if you have a web-application that offers data-storage services using MongoDB and runs on Microsoft's IIS as webserver, then clause 13 of the SSPL requires that you provide the source code of IIS even though IIS is in no way derived from code that is copyrighted by the authors of MongoDB.

Bart van Ingen Schenau
  • 29,549
  • 3
  • 46
  • 83
  • 1
    "SSPL license seems to step outside the realm of copyright" Why do you think so? – user6039980 Mar 02 '19 at 22:17
  • 3
    @kais Because the SSPL requires distribution of source code for applications that are unrelated in terms of copyright – Bart van Ingen Schenau Mar 03 '19 at 09:49
  • Unrelated to what? I really don't understand, because these applications should be subject to these licensing terms since they make use of the copyrighted open-source code. – user6039980 Mar 03 '19 at 13:23
  • 4
    @Kais If you provide a web-application that uses MongoDB under the SSPL and runs on Microsoft's IIS, then clause 13 of the SSPL requires that you provide the source code of IIS. Even though IIS is not in any way derived from code that is copyrighted by the authors of MongoDB. – Bart van Ingen Schenau Mar 03 '19 at 15:39
  • 1
    @BartvanIngenSchenau this specific example would suit the answer well. – Tim Mar 03 '19 at 16:46
  • 1
    I see. But IMHO, this requirement is good in the sense it will push the service providers to be based on 100% open-source code, which will drive them more in open-source software rather than proprietary. – user6039980 Mar 03 '19 at 16:50
  • 1
    @BartvanIngenSchenau So despite this restriction you pointed above, am I correct in the question about the gaps that SSPL is trying to fix? – user6039980 Mar 03 '19 at 16:54
  • 1
    @Kais: You are correct that SSPL tries to fix the gap you identified. – Bart van Ingen Schenau Mar 03 '19 at 17:22
  • @BartvanIngenSchenau OK, thanks a lot for the clarifications. – user6039980 Mar 03 '19 at 17:26
  • @BartvanIngenSchenau could you give your opinion on this please? https://opensource.stackexchange.com/questions/10703/mongodb-community-license-usage – Ewoks Nov 12 '20 at 13:34
  • 3
    Ok, no, this is not how clause 13 works. IANAL, but it very plainly says here and elsewhere that license only applies to building a public service of the covered software and not situations where the software in simply a component of another application or system. It excludes major components of the OS as well as system libraries. The license restriction just says that you aren't allowed to create a closed-source service offering of the covered software. What we have in this accepted answer is a very common misreading of the SSPL promoted by its detractors. – Ryan Egesdahl Jan 14 '21 at 21:46
  • 1
    @deriamis, I have updated my answer to indicate only a certain kind of application is affected by clause 13. IMHO, the webserver falls under the term "hosting software", for which you are required to provide the Corresponding Source. – Bart van Ingen Schenau Jan 15 '21 at 12:40
  • 2
    @bart-van-ingen-schenau - No, it really doesn't. Section 13 only applies to the functionality of the licensed software provided as a service, or any modifications you make to that end. You can get the info directly from MongoDB on this one: https://www.mongodb.com/licensing/server-side-public-license/faq

    "The copyleft condition of Section 13 of the SSPL applies only when you are offering the functionality of MongoDB, or modified versions of MongoDB, to third parties as a service. There is no copyleft condition for other SaaS applications that use MongoDB as a database."

     – Ryan Egesdahl Jan 15 '21 at 20:24
  • @deriamis, and what is the functionality of MongoDB if it isn't "data storage services"? – Bart van Ingen Schenau Jan 16 '21 at 06:35
  • @bart-van-ingen-schenau - The license says “the functionality of MongoDB” and not “data storage services.” I don’t know why you’re so dead-set on reading the license more broadly than it’s written. Unless you’re literally building a web application that provides MongoDB as a service, there’s no reason to believe that restriction applies. Besides, plenty of companies have built their closed-source products on top of SSPL MongoDB. I’m pretty sure their lawyers are smarter than we are. – Ryan Egesdahl Jan 17 '21 at 07:14
  • 1
    @deriamis Bart is not the only person to read the SSPL widely, and to eschew it as a result. The compliance expert at Facebook absolutely bans SSPL software, and he's not the only one. – MadHatter Jan 17 '21 at 08:08
  • @madhatter - And plenty of others don’t. There’s no reason to believe Facebook lawyers are correct simply because they work for Facebook. Smaller companies are, if anything, even more exposed to litigation than Facebook, and any software Facebook decides not to use for licensing reasons can be replaced in-house by their army of software engineers. Besides, my point is what the license actually says in plain language. If you want to say the plain-language reading is incorrect, please give details why and how you know. Otherwise, you’re spreading FUD. – Ryan Egesdahl Jan 18 '21 at 15:17
  • 2
    @deriamis that is his legal interpretation of what the licence actually says in plain language. And when it comes to professional axes to grind, I note you're not doing a great job pointing out your conflict of interest - which working for MongoDB definitely constitutes in this particular discussion. – MadHatter Jan 18 '21 at 15:17
  • @madhatter - Whoa, stop right there. I don’t hide where I work, and where I work has nothing at all to do with this discussion. I have no axe to grind here, either - I nearly worked for Facebook over MongoDB. The only reason I didn’t is because of my home situation and wanting a smaller company. Keep the conversation focused on the topic at hand, please. Show me how the plain language supports the interpretation you espouse, especially when the authors of the language explicitly state it doesn’t. Alternatively, tell me why anyone should be offering legal advice on this site to begin with. – Ryan Egesdahl Jan 19 '21 at 16:53
  • 3
    @deriamis you don't draw attention to it, either, which would only be courteous in this context. However, this is the comments field of Bart's answer, so I don't intend to continue the discussion here. If you think Bart's answer is wrong, you should have a(nother) go at writing your own answer, explaining the differences between the SSPL and the AGPL as you see them. – MadHatter Jan 19 '21 at 20:17
2

From my reading of this, the relationship of the SSPL to the AGPL is similar to that of the GPL to the LGPL.

Say I create a calculator with a really nice, sophisticated user interface that uses the GNU Multiple Precision Arithmetic Library (GMP library) and I distribute binaries of this. Because (since version 6) this is licensed under the LGPL, so long as I give you a copy of the GMP library source, along with any modifications I have made to this, everything's fine; I need not give you the source for my nice, sophisticated user interface.

However, if I'd done the same thing with the Class Library for Numbers (CLN), it would not be enough to give you the source code and any modifications I'd made to that; because it's licensed under the GPL, I would also need to give you the full source code (in a form suitable for modification and rebuilding) to my nice, sophisticated user interface.

A parallel to this would be if I created a nice, sophisticated user interface for something like Redis and sold access to this user interface as an on-line service. If Redis were distributed under the AGPL I would need to give you the source code for Redis and any changes I'd made to it, but not to the nice user interface I'm providing because I'm not linking my sophisticated user interface to Redit code, I'm merely accessing it over the network as part of my service, even though my service is basically a nicer version of Redis.

The intent of the slight change from the AGPL to the SSPL is that, because my nice, sophisticated user interface is basically still selling the Redis service itself, I must give you the source code for my nice UI, as well as the Redis source code, if I'm selling you network access to my system.

Now this might be (and, it seems, is) seen by some as "unfair" or "restricting freedom," especially if the nice, sophisticated user interface I created is a large work that's doing some fairly sophisticated and valuable stuff. And that's not an unreasonable opinion. But this is nothing new; the exact same thing is done with the GPL with libraries such as GMP before version 6 (when it was GPL), CLN, and even readline.

Arguably, the GPL is even less open than the SSPL in intent. The SSPL, though it may not be written to make this as well defined as it could, at least does declare that it's trying to address,

...offering a service the value of which entirely or primarily derives from the value of the Program or modified version, or offering a service that accomplishes for users the primary purpose of the Program or modified version.

With the GPL, on the other hand, it's been made clear by at least some of its users that it's directly designed to force release of source code even when the GPL code added to it is serving only a relatively trivial function unrelated to the core functionality of the full source code, such as adding readline to a large and sophisticated language system. Bruno Haible, (the original author of GMP), when discussing why he wanted GMP to remain under GPL instead of LGPL, said, "Building libgmp.a was just too hard work. Other people shouldn't get it for free."

cjs
  • 171
  • 4