[Koha] Proposal To Switch Koha's License to GPLv3 and AGPLv3 or AGPLv3

[david at lang.hm]

On Tue, 11 May 2010, Chris Cormack wrote:

> It's interesting who comes out of the woodwork when licensing comes
> up, it seems people have strong opinions on it, even people only
> tangentially related to the project.
> I think you are missing a lot of context to this discussion, it has
> come up quite a few times in the past, and the fact is the growing
> trend worldwide of Software as a Service, and the ghettoisation of
> code and users that can result from that is what is behind (at least
> for myself) this discussion.
> I think that users should have the right to have the source code of
> the software they are using, and I believe that this freedom is one of
> the 4 freedoms the GPL was designed to protect.
> I think that these freedoms outweigh some nebulous security concern,
> and that the important thing is that users are protected from lockin.
> If you have a better way to achieve this than APGL3, or GPLv3 + an
> additional clause, I'm all ears.

You are right that I have not seen the prior discussions (I've only been 
subscribed to the list for a month or two). You are also right that I am 
not (yet) involved with this project (not even as a user yet, I haven't 
had the time yet to test and figure out how to enter my several thousand 
books). If you feel that this means that my opinions are irrelavent, 
please let me know and I will unsubscribe and search for another tool to 
consider using instead.

A little background on me since I am not an active community member yet. 
My full time job is in security as a major financial services company. I 
have been using Linux as my desktop full time for over 12 years at work 
(longer at home) and while I don't contribute much code to the projects 
that I use, I do use a lot of opensource projects and do a fair amount of 
testing, bug reporting, and (after becoming familiar with the project) 
support for other users on the mailing lists.


As for your concerns. Yes, if you believe that SaaS is a major problem, 
then AGPL is the license that you need (and no, GPLv3 is not good enough 
to prevent the problem you are describing). However your post at the start 
of this thread did not make it clear that this is what you were pushing 
for.

I don't happen to believe that this is a major problem, and definantly not 
a problem large enough to be worth the drawbacks involved with moving to a 
lesser used license like the AGPL.

Even though the GPLv3 allows code to be converted to AGPL, that doesn't 
mean that doing so won't annoy people who don't want to use the AGPL that 
you take code from (for examples of a similar problem, look at the outrage 
from people who release code under BSD licenses against project that are 
GPL and incorporate their code) , and you may not be able to submit any 
fixes that you have back upstream to them. If you maintain a dual GPLv3 
and AGPL license, then you don't achieve your goal, anyone wanting to do 
things that you don't want them to do will just use the GPLv3 license.

I believe that if the open project moves rapidly enough in developing it's 
version, anyone who tries to maintain a fork is going to fall behind and 
find that they are better off using the community version than their own 
fork. In a good community with many different companies involved (which I 
understand Koha is), the combined resources of the rest of the community 
will outstrip the resources of any one company that tries to maintain a 
fork. You will occasionally have a company that misbehaves, or at least 
skirts the line, but I don't think adding restrictions to the license will 
really help much in this area.

Unless a company is going to go only the SaaS route, they will be giving 
their code to their clients, and any one of those clients can redistribute 
the code. So the probability of the source being locked up out of sight is 
relativly low.

But as the android problem with the linux kernel is showing, even if the 
code is available it doesn't nessasarily do the main project much good if 
the company working on the fork isn't interested in getting their changes 
merged back upstream. Perl is especially good for a company who chooses to 
make life hard for outsiders wanting to merge the changes back as there 
are so many different ways to do things and to obuscate what is happening. 
It doesn't even take malice on the part of the company, just hiring 
developers who use coding styles and perl features significantly different 
from the community will make merging things back hard enough that they 
become almost the same as writing the features from scratch.

So I don't believe that AGPL is really going to be effective at solving 
the problem that you are anticipating, and I do see drawbacks in using 
it as your license.

David Lang