Re: Web application licenses

[Brian Thomas Sniffen <bts@alum.mit.edu>]

Josh Triplett <josh.trip@verizon.net> writes:

> Brian Thomas Sniffen wrote:
>> Josh Triplett <josh.trip@verizon.net> writes:
>>>How about something vaguely like:
>>>
>>>"""
>>>If you make the software or a work based on the software available for
>>>direct use by another party, without actually distributing the software
>>>to that party, you must either:
>>>
>>>a) Distribute the complete corresponding machine-readable source code
>>>publically under this license, or
>>>b) Make the source code available to that party, under the all the same
>>>conditions you would need to meet in GPL section 3 if you were
>>>distributing a binary to that party.
>>>"""
>> 
>> So if I use software under such a license in a network switch, to whom
>> am I obliged to distribute source?  How about a web proxy?
>
> My _intent_ with the phrase "direct use" was to avoid such issues.  I'm
> aiming only for the case where a user directly _interacts_ with the
> software, so perhaps I should have said "direct interaction" instead of
> "direct use".
>
> Really, the main cases I'm thinking of here are:
> * Using the software to power a website or web service.

But I don't directly use your CGI scripts.  They aren't even
network-aware.  I'm talking to Apache, which you probably haven't
modified.

In fact, I'm not even talking to Apache.  I'm talking to your kernel
-- or the network switches between you and me.  I'm not even sure I
*am* talking to you, what with dynamic routing tables and all.

And in fact, I'm not talking to the network at all.  I'm just using
this unmodified Mozilla Firefox, and it renders various results of RPC
calls for me.

> * Using the software in a kiosk that others can directly interact
>   with.

OK, *that* I'll agree is reasonably direct.  There, you have a work --
the kiosk -- which has components GUI, OS, application, etc.

But if I put up a bronze plaque, should I be obliged to provide the
source, complete with build tools, to anyone who can see it?  I
continue to have trouble seeing how that promotes freedom: even if you
have the source, you don't have my kiosk, and you can't just run
whatever you want there.

For example, even if Debian Airlines gave out the source to its
fast-checkin kiosks, that would not give anybody freedom to alter the
operation of those kiosks.

> * Allowing a user to log into your box and run the software.

So if I want to have a dialup server, it must include the source for
all its 

> For example, suppose someone wanted to use GCC as a basis for the
> compiler for a new language, but they didn't want to release the source
> for it.  All they would need to do is make the changes, put them behind
> a web-accessible SOAP API, and tell people to use that for compilation
> (and perhaps distribute a small client for that service to install as
> /usr/bin/secretarch-gcc).  This would sidestep the GPL, since the code
> is not being distributed to those users; nevertheless, the users of such
> a service certainly deserve the code behind it, under a Free license.
> The license I suggested is an attempt to avoid that.

I just don't see a way to avoid that in a free way.  I understand your
motivation for doing this, but I don't think you can do it without
prohibiting behavior necessary for freedom.  I'd be interested to see
a way to do so.

>> I do wonder what "publically" means.  If I'm offering to hand a CD to
>> anyone who asks me for one in person, is that public enough?  Or must
>> I run a web server to distribute it, and thus (assuming this license
>> is broadly used) have to distribute a web server too?
>
> "Publically" meaning that rather than making special arrangements with
> any particular party, it would be acceptable to tell users of your
> service that the source is already available from such-and-such
> location.  It's possible that this should be clarified, but I believe
> that "publically available" has a legal meaning.
>
> That clause was mostly included for convenience, so that you were not
> required to make arrangements with each individual user who wanted
> source, and could just provide a notice saying "source available here".

Perhaps the approach seen in some Free licenses -- "provide a way for
the source to be obtained" is better?  A few extra words to add
clarity, specifying what we *actually* mean, can only be an improvement.

>> Does the Department of Transportation need to make stoplight software
>> generally available?
>
> While I do think government software should always be Free Software and
> distributed to the public, I would not really classify that case as
> "direct interaction", or really "interaction" at all.

But I manipulate an input device to obtain results from the computer
-- I move my car over the magnetometer, and the light changes.  If
that's built on software under your license, is it direct interaction?
How can I be made aware of my rights to the source in that situation?

>> Does google have to make its source code available?
>
> If that code is a derivative of code under such a license, then yes.
>
>> If so, why?  It's
>> not going to do anybody else any *good*, since we don't have
>> 100 kilomachine clusters sitting around idle to use.  So this doesn't
>> get us Freedom; we can't change the google interface we use in
>> practice.
>
> And getting a copy of Apache doesn't entitle you to hardware equivalent
> to that which powers apache.org, and getting a copy of Neverball or
> BZFlag doesn't entitle you to 3D hardware, and getting a copy of CERNlib
> doesn't entitle you to a particle accelerator.

No, but if I don't have those things then I can't use the software
anyway.  

> You would have no rights to change the version of the software Google
> runs on its own servers.  You _could_ deploy the software on your own
> systems however you pleased.  That is certainly Freedom.

It's not the same kind of freedom I have with respect to Emacs or Linux.

>> I think it's great that some sites publish their code.  But I don't
>> see any benefit to freedom from compelling them to do so.  On the
>> other hand, a compulsive *open interface* would be a useful thing.
>> Say, if Google were using a weirdly licensed web server which
>> compelled them to provide an RPC function allowing arbitrary queries,
>> so that others could access their data in surprising new ways.
>
> This, on the other hand, seems like a ridiculous restriction.  No server
> should mandate what services you must provide using that server.

OK.  Then why is it OK to mandate that those using a modified Apache
must provide source-download services?  And is it *better* to say that
it must be done some other way?

-Brian

-- 
Brian Sniffen                                       bts@alum.mit.edu