Note that there is this related question of which this question is by no means a duplicate. It refers to a related but separate scenario.

Long question title, I'll just go with an example. Suppose I developed an image converter program. It takes the filename of an image as input and produces the converted image as output. Now someone modifies my program (by adding functionality to it for example). Instead of distributing the modified version they host a file upload service on a remote server and make this upload service available to the public. What happens on the server is that each uploaded image gets passed as an input to the modified version of my program and the converted image is provided to the user as a download via a corresponding URI. The point here is that while my program has been modified, all (direct) user interaction goes through a separate (upload) service. This service then interacts with my program.

On the other hand the sole purpose why users interact with that separate service is to use the functionality of my modified program which also is producing all output.

Now my question is does the GNU Affero GPL require them to make the source code of the modified program publicly available?

Section 13 of the AGPL states that

[...] if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version [...]

This FAQ states that

In AGPLv3, what counts as “interacting with [the software] remotely through a computer network?”
If the program is expressly designed to accept user requests and send responses over a network, then it meets these criteria. Common examples of programs that would fall into this category include web and mail servers, interactive web-based applications, and servers for games that are played online.
If a program is not expressly designed to interact with a user through a network, but is being run in an environment where it happens to do so, then it does not fall into this category. For example, an application is not required to provide source merely because the user is running it over SSH, or a remote X session.

This sounds like the AGPL would not require to publish the source code in this case. However I also can't believe that this scenario is considered private use of the program. Thus I would like to clarify this point.

In case you believe that the AGPL doesn't help here I would be happy to learn about alternatives which might be effective for this scenario instead.


Doing further research I realized that the AGPL even covers this topic in their "Why the Affero GPL" under the term Service as a Software Substitute (SaaSS):

[...] The GNU Affero GPL does not address the problem of Service as a Software Substitute (SaaSS).
SaaSS means that users use someone else's web server to do their own computing. This requires them to send their data to the server, which does their computing for them and sends the results back to them. [...]
We don't see any sensible way to address the SaaSS problem with license conditions on particular programs. Even to write a legal condition to distinguish between SaaSS use and non-SaaSS use would be a challenge, and if we had that, we don't see anything that the program's license might require in the SaaSS case that would correct the inherent wrong of SaaSS. Thus, our solution to the problem of SaaSS is simple: refuse to use services that are SaaSS.
If a program is meant specifically and only for SaaSS, you shouldn't write it. But many programs are useful for a variety of kinds of services, including some that are SaaSS and some that are not. It's useful to write and release these programs so people can set up non-SaaSS services with them, and good to release them under the AGPL.

It seems like there is no licensing option that helps protecting against this case but the FSF recommends releasing software which is eligible for usage as a remote service under the AGPL.

  • The quote doesn't talk about your case. It talks about problem of SaaSS being that the user instead of running the software themselves substitutes it with giving someone else control. It says they can not fix the loss of control with a license without changing who is running the software, but can only ensure that the user may receive the source. – Jan Zerebecki May 30 '17 at 20:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.