[copyleft-next] Network access to Corresponding Source
Richard Fontana
fontana at sharpeleven.org
Sat Feb 9 03:37:23 UTC 2013
On Fri, Feb 08, 2013 at 04:49:29PM -0500, Joshua Gay wrote:
> Both Section 7(ii) and Section 8 allow users to provide the
> Corresponding Source from a network location so long as it is provided
> at no charge.
>
> I would like to add additional requirements.
>
> The basic thing I'm looking for is that the source be made publicly
> available and not put behind some wall of inconvenience (such as
> requiring a specific device or requiring a user account, etc).
>
> Below are
> three sections: 1) stuff I want to prevent, 2) stuff I don't want to
> prevent, 3) stuff I'm not sure about.
>
> ## Stuff I want to prevent
>
> A person providing source shouldn't make a user do any of the following
> in order to be able to download the source:
>
> * Create a user account
> * Undergo identity verification/authentication (or sign in with some
> third party service like Facebook or Twitter)
> * Complete a survey or lengthy data collection process.
> * First request send a request to the host that your IP address be added
> to a whitelist
> * Require the use of running proprietary software in order to download
> the source code (e.g., requiring the use of some proprietary App Store
> App).
> * Require the use of a specific kind of device or require a person to
> spoof device metadata (similar to how the Android App store will prevent
> you from downloading an App that is not compatible with a certain device).
> * Require some PACER like step of having a PIN mailed to you in the mail.
>
> With the exception of PACER, I have encountered each of the above issues
> when trying to download source of programs licensed under the GPL.
Any suggestions for how to do this in ~25 words or less?
The "in a reasonably equivalent manner" language in section 8 arguably
takes care of it there (and where it doesn't, maybe there isn't really
a problem). It occurs to me that there may be an unnecessary mismatch
between 7(ii) and 8.
Perhaps some of the language in AGPLv3 section 13 might be useful.
What I don't want is to have a laundry list of specific forbidden
burdensome requirements (though that could be covered in the
currently-nonexistent FAQ).
> ## Stuff I don't want to prevent
>
> At the same time, I wouldn't want to prevent a person distributing the
> source from doing things that are sensible.
>
> * Blacklisting spammer/crawler IP addresses.
> * Require users to fill out a captcha
> * Tracking basic info provided in HTTP headers
> * Provide a user with simple instructions like: 'in order to download
> this source, please enter the username "public" and password "anonymous"
> to the following form'.
>
> ## Stuff I'm not sure about
>
> * Requiring the user to use a version control systems (e.g., providing
> access only over a "git clone" statement).
As noted elsewhere, I think this is probably okay. I think the main
objection would be the lack of specificity.
> * Requiring the user to connect to some weird protocol even if there is
> free software that can connect to it (e.g., like, imagine if f-droid
> didn't have an HTTP interface, but it used some weird interface and it
> only provided source via the f-droid app interface running on your
> Replicant/Android/Linux OS) -- in order to connect from GNU/Linux you'd
> either have to figure out how to get f-droid running on GNU/Linux or
> you'd need to figure out how to create a connection to the store).
>
> * Operating system requirements. For example, people do not build
> Android Apps on top of Android, they build them on top of a different OS.
I wasn't sure what you meant by this last one. Do you mean 'you
shouldn't have to be forced to run Android in order to get source code
for an Android app'?
- RF
More information about the copyleft-next
mailing list