>Question: suppose Google had code running on their servers that was licensed under AGPL. AFAIK that means they have to release the code, but because Google's code is proprietary and closed what would happen? A whistle blower notices and exposes them?
I don't think they have to do anything, even if they did had AGPL.
The license is only relevant if they distribute the source (or a product written in it), not as to what they privately do with it on their servers.
Now, if they had used that code on, say, Android, that's a different thing.
The main difference between GPL and AGPL is that with AGPL, running software and exposing it on the web also effectively counts as distributing the software.
There are some contentious points with AGPL. For example, lets say your website is backed by an AGPL-licensed database. Do you have to open-source your website? Or only modifications you make to the database software? Or only if you expose the database software directly? Very often these questions are not clear with the AGPL, but just having these ambiguities is enough for a company like Google to stay clear completely.
This is incorrect, as far as I know. The FSF page [1] says as much. IANAL, but the relevant portion of the license appears to be this:
You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways:
d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements. [2]
No, that's the point of AGPL. It extends rights to users of a hosted application, as well a users of hosted applications linked to it. As the linked motivation states, "Even if you think you aren’t linking to anything important, it still presents a huge risk to Google because of how integrated much of our code is".
The lines between "distribute the source (or a product written in it)" and "what you privately do on your servers" is (I think) hard to discern for a lot of Google's code.
If I have open source code that estimates your shoes size based on your IP address, and I make a website that will output your result... which category of code is this? What if I use this code to customize the UI for a shoe store?
Honest question, is there an established way of deciding whether something counts as "distributed"? Is it simply a question of what machine it runs on?
Hasn't been tested in court to my knowledge, but my understanding is that leading IP lawyers who otherwise disagree on a bunch of things about the GPL (Eben Moglen, Lawrence Rosen) agree that e.g a modified GPLd publicly accessible web server doesn't count as distribution.
No, RTFL. AGPL doesn't need your product/binary/code to be distributed, it's enough that you offer a (web) service based in part on AGPL-licensed code.
I don't think they have to do anything, even if they did had AGPL.
The license is only relevant if they distribute the source (or a product written in it), not as to what they privately do with it on their servers.
Now, if they had used that code on, say, Android, that's a different thing.