ssddanbrown / Open-Source-Confusion-Cases

A list of cases where open source licenses are misrepresented or where "Open Source" is used in a non-open-source-definition adhering manner.
MIT License
124 stars 1 forks source link

Onlyoffice #38

Open ssddanbrown opened 5 months ago

ssddanbrown commented 5 months ago

They're publishing under the AGPLv3, but seem to propagate misinformation regarding that license, appearing to do so in defensively, possibly in the interest of their business offerings. Misinformation can be found on this page: https://www.onlyoffice.com/license-faq.aspx In particular:

Yes, any developers can use ONLYOFFICE source code in their own application or website, though in accordance with GNU Affero General Public License v.3 this application/website must also be released under the GNU AGPL v.3 license.

Technically not true, section 13 allows combination of GPLv3 with AGPLv3 works, so "their own application or website" could be also be under GPLv3 if distributed. Additionally, the wording does not make it clear that this is if that application or website is distributed/conveyed. If a the applications/website were internal/private only, you don't have to release your works under the same terms.

Pay special attention that according to section 13 of the GNU AGPL v.3 the application/website source codes which ONLYOFFICE source codes are part of must also be opened and published under the GNU AGPL v.3 license.

It does not say this. Section 13 is about providing sources of modified AGPL programs upon network use, and the compatibility with GPLv3 licenses. The requirement to open and publish combined works would depend on a few other factors (How the works are combined, how they are distributed, if they've been modified) and, even then as per above, it does not mean they have to be AGPLv3.

According to Section 7 of the GNU Affero General Public License v.3 (AGPL v.3) we're permitted to supplement terms of this License requiring preservation of specified reasonable legal notices. Using this permission we do not allow you to remove the original ONLYOFFICE logo from ONLYOFFICE products and components or change it to your own one. The interactive user interfaces in modified source and object code versions of the Program must display Appropriate Legal Notices, as required under Section 5 of the GNU AGPL version 3. To discuss any co-branding issues feel free to write to our sales department at sales@onlyoffice.com.

This is a massive stretch of use of the terms of the AGPLv3, and much in contradiction/contention with the license itself. Section 7 of the AGPLv3 does allow supplemental terms as long as they fit into the definitions defined in section 7. They seem to be using term B, and classing their logo retention requirements to be "preservation of specified reasonable legal notices" and/or "Appropriate Legal Notices". The "Definitions" of the AGPL state:

An interactive user interface displays "Appropriate Legal Notices" to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion.

So while the AGPL does allow terms around "legal notices", I don't think the logos by themselves can really be regarded as legal notice. The AGPL's definition of "Appropriate Legal Notices" allows flexibility as long as it achieves certain criteria (which logos by themselves would not achieve). Stretching this to specific implementation requirements around their logo seems way beyond the scope of what the AGPLv3 allows, and against the spirit of such a license by limiting freedom of modification.

These additional terms can likely be removed on receipt as per section 7 of the AGPL:

All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term.

Additional to that, within the license of their files they also state the following:

Pursuant to Section 7(b) of the License you must retain the original Product logo when distributing the program. Pursuant to Section 7(e) we decline to grant you any rights under trademark law for use of our trademarks.

Their combined requirements would put massively limiting requirements on use & distribution, since they both require logos to be kept as specifically desire, while not granting rights to use the trademarks within those logos. So it would be impossible to reuse this software in a modified form, at least in a manner public or with others, without either not following their additional terms or violating their trademark.

Lastly, these requirements seem to be specifically designed to limit certain competitive/commercial use which would go against criteria 5 and 6 of the open source definition.

Overall, these measures seem overly defensive, against the spirit of the chosen license, free software and open source; while their interlayed links to contact their sales team give the impression of mis-communicating the AGPLv3 for their business interests.

PeterKingston commented 1 month ago

Hi, I followed a couple of links from your post and found this clause in the AGPLv3: "All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. "

Doesn't his imply that even if onlyoffice do add there own 'twist' to the license then we can rem,ove them and carry on as though it was a pure AGPLv3 license?

PeterKingston commented 1 month ago

Perhaps wou should invite a few legal people from the organisation that manages AGPLv3? I think the same problem exists with openproject. They publish their code as open source but then say that there are "enterprise" additions. However they allow the public to contribute to source code that appears be a blend of what they class as the open source code and parts that they call their enterprise additions.

They use the marketing power for open source to sell their products and invite people to contribute but they then claim that those same parts are protected by some other means.

I understand their need to make money but in an open source environment I thought traditionally this was done by selling expertise and resources.

ssddanbrown commented 1 month ago

Hi @PeterKingston

Doesn't his imply that even if onlyoffice do add there own 'twist' to the license then we can rem,ove them and carry on as though it was a pure AGPLv3 license?

Yeah, I believe that's correct and I mention that in my original post.

Perhaps wou should invite a few legal people from the organisation that manages AGPLv3?

Maybe we could get the FSF invovled in our recorded GPL related cases, but I have not thought about if I'd want to persue these any further. I'd want to open a conversation up with the project first in this case anyway with a hope of remedy, or at least to gain insight/understanding, rather than coming at this from some kind of more considerable group or legal standing/concern.

I think the same problem exists with openproject. They publish their code as open source but then say that there are "enterprise" additions.

I'd consider that a different kind of issue to what I'm documented in this thread, which is misleading in regard to licensing. The conflation between marketing of open and proprietary under open source, like OpenProject, is very prevalent in the open-core space, and has a much wider range of impact and level of misleading, which makes it a little harder to assess and judge. Some projects do it well by clearly defining the open project, almost as its own thing. But often it's much more unclear. I'd consider that kind of thing within the scope of this project if there's a clear pattern of intent of using the "open source" label to advertise non-open offerings.