We lease an appliance to our clients (4 physical servers running 12 VMs).

One of the servers exposes a website which in turn uses the other VMs. Clients have no access to the VMs or the software which runs on them. One of the reasons is that we process classified documents (and while security through obscurity is no defence, why make anything easy for an attacker?)

So the appliances are owned and maintained by us but can be accessed across a network by clients.

I'd like to use some functionality which is in a library licensed under the GPLv3. If needs be, I can implement the library myself without needing to refer the the library in question, but I'd obviously prefer to use the existing code (to avoid reinventing wheels).

With the caveat that none of us are lawyers, can someone clarify if, in their experience, this counts as distribution under the definition of the GPLv3?


The application runs on the server. Under the GPLv3, you are distributing the code to the person running the code on the server (yourself) and don't need to go any further. This is known as the ASP loophole. See GPLv3 and Software as a Service from the FSF for more on that from GPLv3 perspective.

For completeness and contrast, the AGPL goes a step further to say that the application is distributed to those running the web application. if the library was licensed under the AGPL instead, one would be required to release the source of the application.

  • Thanks for the detail, after seeing your comments on the OP, I found details of the loophole. In the interests of "not being an a$$hole", I'm willing (nay eager) to provide enhancements we make to the library back to the community, but I can't quite justify giving away 3500+ hours of paid developer time for the use of a library method. In any case, thanks - I appreciate the clarification. – Basic Oct 1 '13 at 21:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.