Perhaps we should switch to the "Affero GPLv3 or later" license for our code

[specious]

Our frontend and backend code is currently released as free software under the GPL-3.0 license, which is considered a strong copyleft license (a concept that originated as a response to the increasing practice of using copyright law to secure exclusive rights over proprietary software) that legally compels creators of derivative works to also in turn license the derivative work under the same license and to make the derivative source code available.

However, this provision only comes into effect when a version of the derivatative work is distributed outside of a private setting:

"One of the fundamental requirements of the GPL is that when you distribute object code to users, you must also provide them with a way to get the source."

This positively implies that private use of derivative works does not require the release of anything (even if copies are distributed within the organization). In addition, original authors are not restricted from also releasing their own work under other terms or licenses.

The very similar AGPL-3 license is a slightly stronger variant of the GPL-3 (see the word diff between the GPL-3 and the second and final draft of the AGPL-3) that broadens the scope of the license (namely section 13 and the preamble) to include the requirement that source code also be made available when the derivative work is used to provide a remote service over a public network.

As explained in this detailed overview:

"The AGPL V3 license is a strong copyleft license that enforces open source on all components derived from any previous work. It closes the server-side loophole, where the source code isn’t made available if the software isn’t released. AGPL defines a user as anyone who accesses the server-side application if it is public-facing. For applications that reside inside the organization’s network, AGPL does not trigger the release of the source code."

I would like to propose to re-license the code in both of the repositories under the AGPL, because it provides stronger protection. Even code that is currently intended for client-side use would be protected from being used across a network in the future.

An arguable downside of using a license as strong as the AGPL (or GPL) is that it forces any work that incorporates a derivative of the AGPL code to be released in its entirety under the stronger license, meaning that projects licensed under less restrictive licenses such as the Apache license will be unlikely to incorporate code from this project, as that project would then need to become an AGPL project.

On the other hand, a strong license like the AGPL serves as powerful protection, as in the case of Truth Social having been found to use code from the Mastodon project, which is published under the AGPL, without having fully complied with its license. Publishing our code under the AGPL will likely mean that the Software Freedom Conservancy will have an interest in helping to protect it and will attract community contribution. Commercial companies, however, are likely to steer clear of AGPL code.

A project licensed under the AGPL is more likely to be able to include code licensed under more permissive licenses, than the other way. However, it's complicated. In particular (possibly surprisingly), the GPL-3 and AGPL-3 are only partially compatible with each other:

"Please note that the GNU AGPL is not compatible with GPLv2. It is also technically not compatible with GPLv3 in a strict sense: you cannot take code released under the GNU AGPL and convey or modify it however you like under the terms of GPLv3, or vice versa. However, you are allowed to combine separate modules or source files released under both of those licenses in a single project, ..."

This convenient chart visualizes some of the free licenses that would be subsumed by the AGPL-3 (meaning code under those licences could be included in this project and become AGPL code). Notably, as shown, the Mozilla Public License 1.1 is incompatible with GPL code, while MPL 2.0 is known to be semi-compatible with the AGPL, as explained here:

"The one exception to covered source files remaining under the MPL occurs when code under version 2.0 or later is combined with separate code files under the GNU GPL, GNU Lesser GPL (LGPL), or Affero GPL (AGPL). In this case, the program as a whole will be under the chosen GNU license, but the MPL-covered files will be dual-licensed, so that recipients can choose to distribute them under that GNU License or the MPL. The initial author of MPL code may choose to opt out of this GPL compatibility by adding a notice to its source files."

This article on Wikipedia goes into detail on license compatibility, while this in-depth article from O'Reilly explains the differences between the GPL, LGPL and the MPL (however, note that it does not refer to the latest versions of these licenses).

In light of future compatibility nuances, whereby code under this the GPL or AGPL isn't automatically future-compatible, I propose to license the code for this project as GNU AGPL-3.0-or-later.

It's important to note that publishing code under a particular free software license implies taking a stance on the importance of free software. A weak license ensures ample compatibility, but offers little protection. A strong license leads to sometimes unfortunate compatibility issues.

Essentially, licensing this software under the AGPL makes it into an AGPL "seed". Any software that grows from it is also going to be under the AGPL. It will stand in contrast to software that can "swing the other way".

Some projects that have chosen to publish their source code under the AGPL license:

• Grafana (multiple repositories)

  See discussion: 8.0.0-beta1 release notes do not mention licensing change grafana/grafana#34091

• Mastodon

  See discussion: Switch license to GNU AGPL? mastodon/mastodon#49

• Internet Archive (multiple repositories)

See all AGPL-3.0 repositories on github.

[danieltoben]

I agree with this switch, and I appreciate your research into licensing!

[specious]

All of the code is published under the AGPL 3.0 or later as of these commits:

• 100f0c2
• littermap/littermap@54ce2b4