@lxo @strypey >Consider, for example, a web shop server program: it controls a web site that shows products and prices for customers to select and add to shopping carts, and it manages information about payments, shipping, returns and refunds. All of this can be reasonably considered the shop's own computing, not that of its remote customers
Such web shop is not only the shop's own computing, it is also the users computing, since they carry out the computation of ordering.

If the web shop doesn't modify the store (like almost all of them), the customers don't need to be provided anything.

If the web shop adds malware and spyware, then they need to provide the modified source.

If the web shop doesn't like the deal that modified versions are to be shared with the customers, they're free to use other web shop software.


That is the AGPLv3 working as intended, rather than a flaw.