[bluesign]

not a lawyer, but if there is no requirement without modification, lets say I developed X, someone made a version Y, they gave it to you. ( as you are the only user, they are only required to share modifications with you ), then you run this without modifications as a network service. how is it ensured users of you have access to the source?

[hugoroy]

Here's how it goes:

You develop X and distribute it to B.

B modifies X (becomes X.1) and because B has been well advised by lawyers, B knows that modification of software is an act restricted under copyright law, and so B went to go read the LICENSE file and found Section 13 of AGPL. As a result because he/she is diligent, B ensures that the source code of X.1 can be accessed by putting a link to a server in X.1's user interface.

See Section 13 of AGPL:

B's "modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge ..."

B distributes X.1 to C

C runs X.1 which is a version that already offers all users a way to get the source code.

[darnir]

You're absolutely correct and if I'm not wrong this is a common loophole used by companies to get around the AGPL (when they really want to)

That is, contract the development to a third party. Let's say A wants proprietary modifications to an AGPL product (X). A contracts B, a solutions provider to make the changes. B is legally required to provide the changes to their X.1 product to anyone that uses it. However, only A is their direct user. Now since A did not modify X to X.1 they are not required to provide a direct download link in the application to the sources for X.1

I'm unsure if GPL style protections still apply and I as a user can request the sources from A by making an explicit request. (I guess not, since they never shared the application with me, only access to it via the network)

[em-bee]

i don't think that works. it should not matter who makes the modifications. you are running a modified version of X hence you must provide the source.

but the distribution requirement in the AGPL should trigger just as well as in the GPL. the only difference is that access through the network is added as a trigger.

so i don't actually believe that the AGPL distribution requirement only triggers on modifications. it should trigger on unmodified versions too, just like the GPL. whoever provides the program, is required to provide the source.

this certainly was the intent, and if the AGPL does not implement that intent then that would be a major flaw, which i can't believe they would allow to slip through when designing the license