[copyleft-next] Network access to Corresponding Source

Richard Fontana fontana at sharpeleven.org
Sat Feb 9 03:37:23 UTC 2013


On Fri, Feb 08, 2013 at 04:49:29PM -0500, Joshua Gay wrote:
> Both Section 7(ii) and Section 8 allow users to provide the
> Corresponding Source from a network location so long as it is provided
> at no charge.
> 
> I would like to add additional requirements.
> 
> The basic thing I'm looking for is that the source be made publicly
> available and not put behind some wall of inconvenience (such as
> requiring a specific device or requiring a user account, etc). 
>
> Below are
> three sections: 1) stuff I want to prevent, 2) stuff I don't want to
> prevent, 3) stuff I'm not sure about.
> 
> ## Stuff I want to prevent
> 
> A person providing source shouldn't make a user do any of the following
> in order to be able to download the source:
> 
> * Create a user account
> * Undergo identity verification/authentication (or sign in with some
> third party service like Facebook or Twitter)
> * Complete a survey or lengthy data collection process.
> * First request send a request to the host that your IP address be added
> to a whitelist
> * Require the use of running proprietary software in order to download
> the source code (e.g., requiring the use of some proprietary App Store
> App).
> * Require the use of a specific kind of device or require a person to
> spoof device metadata (similar to how the Android App store will prevent
> you from downloading an App that is not compatible with a certain device).
> * Require some PACER like step of having a PIN mailed to you in the mail.
> 
> With the exception of PACER, I have encountered each of the above issues
> when trying to download source of programs licensed under the GPL.

Any suggestions for how to do this in ~25 words or less? 

The "in a reasonably equivalent manner" language in section 8 arguably
takes care of it there (and where it doesn't, maybe there isn't really
a problem). It occurs to me that there may be an unnecessary mismatch
between 7(ii) and 8.

Perhaps some of the language in AGPLv3 section 13 might be useful.

What I don't want is to have a laundry list of specific forbidden
burdensome requirements (though that could be covered in the
currently-nonexistent FAQ). 

> ## Stuff I don't want to prevent
> 
> At the same time, I wouldn't want to prevent a person distributing the
> source from doing things that are sensible.
> 
> * Blacklisting spammer/crawler IP addresses.
> * Require users to fill out a captcha
> * Tracking basic info provided in HTTP headers
> * Provide a user with simple instructions like: 'in order to download
> this source, please enter the username "public" and password "anonymous"
> to the following form'.
> 
> ## Stuff I'm not sure about
> 
> * Requiring the user to use a version control systems (e.g., providing
> access only over a "git clone" statement).

As noted elsewhere, I think this is probably okay. I think the main
objection would be the lack of specificity.
 
> * Requiring the user to connect to some weird protocol even if there is
> free software that can connect to it (e.g., like, imagine if f-droid
> didn't have an HTTP interface, but it used some weird interface and it
> only provided source via the f-droid app interface running on your
> Replicant/Android/Linux OS) -- in order to connect from GNU/Linux you'd
> either have to figure out how to get f-droid running on GNU/Linux or
> you'd need to figure out how to create a connection to the store).
> 
> * Operating system requirements. For example, people do not build
> Android Apps on top of Android, they build them on top of a different OS.

I wasn't sure what you meant by this last one. Do you mean 'you
shouldn't have to be forced to run Android in order to get source code
for an Android app'?

 - RF



More information about the copyleft-next mailing list