On Fri, Feb 08, 2013 at 04:49:29PM -0500, Joshua Gay wrote:
Both Section 7(ii) and Section 8 allow users to provide the Corresponding Source from a network location so long as it is provided at no charge.
I would like to add additional requirements.
The basic thing I'm looking for is that the source be made publicly available and not put behind some wall of inconvenience (such as requiring a specific device or requiring a user account, etc).
Below are three sections: 1) stuff I want to prevent, 2) stuff I don't want to prevent, 3) stuff I'm not sure about.
## Stuff I want to prevent
A person providing source shouldn't make a user do any of the following in order to be able to download the source:
- Create a user account
- Undergo identity verification/authentication (or sign in with some
third party service like Facebook or Twitter)
- Complete a survey or lengthy data collection process.
- First request send a request to the host that your IP address be added
to a whitelist
- Require the use of running proprietary software in order to download
the source code (e.g., requiring the use of some proprietary App Store App).
- Require the use of a specific kind of device or require a person to
spoof device metadata (similar to how the Android App store will prevent you from downloading an App that is not compatible with a certain device).
- Require some PACER like step of having a PIN mailed to you in the mail.
With the exception of PACER, I have encountered each of the above issues when trying to download source of programs licensed under the GPL.
Any suggestions for how to do this in ~25 words or less?
The "in a reasonably equivalent manner" language in section 8 arguably takes care of it there (and where it doesn't, maybe there isn't really a problem). It occurs to me that there may be an unnecessary mismatch between 7(ii) and 8.
Perhaps some of the language in AGPLv3 section 13 might be useful.
What I don't want is to have a laundry list of specific forbidden burdensome requirements (though that could be covered in the currently-nonexistent FAQ).
## Stuff I don't want to prevent
At the same time, I wouldn't want to prevent a person distributing the source from doing things that are sensible.
- Blacklisting spammer/crawler IP addresses.
- Require users to fill out a captcha
- Tracking basic info provided in HTTP headers
- Provide a user with simple instructions like: 'in order to download
this source, please enter the username "public" and password "anonymous" to the following form'.
## Stuff I'm not sure about
- Requiring the user to use a version control systems (e.g., providing
access only over a "git clone" statement).
As noted elsewhere, I think this is probably okay. I think the main objection would be the lack of specificity.
- Requiring the user to connect to some weird protocol even if there is
free software that can connect to it (e.g., like, imagine if f-droid didn't have an HTTP interface, but it used some weird interface and it only provided source via the f-droid app interface running on your Replicant/Android/Linux OS) -- in order to connect from GNU/Linux you'd either have to figure out how to get f-droid running on GNU/Linux or you'd need to figure out how to create a connection to the store).
- Operating system requirements. For example, people do not build
Android Apps on top of Android, they build them on top of a different OS.
I wasn't sure what you meant by this last one. Do you mean 'you shouldn't have to be forced to run Android in order to get source code for an Android app'?
- RF