Live data from Hacker News

Don’t sign a CLA

drewdevault.com

11–20 of 196 posts

Re: Don’t sign a CLA

#11
“I never signed anything though... I just clicked submit on an agreement and there might have been a checkbox checked, or not.”

The article should make it more clear that the same warning also should apply to digital signatures and agreements in their various forms.

Re: Don’t sign a CLA

#12
post #4

It's a great point to be aware of, but the title and the tone implies that you as a contributor should be a FOSS maximalist. As they say, not all open source is FOSS. And some people are OK with that. Let them contribute, as long as they are aware of the implications. When I discover bugs in open-source projects during my day job (which is on a closed-source project), I will be much happier having those fixes merged…

> the title and the tone implies that you as a contributor should be a FOSS maximalist.

But what if somebody was changed the license from BSD to proprietary after you've contributed to the project? Would you still be happy about it then?

I think the idea was: I have my code contributed under BSD, so you cannot re-license my code without clearance from me.

Re: Don’t sign a CLA

#13
post #9

Pieter Hintjens makes a similar argument in Social Architecture, describing ZeroMQ's community guidelines: > All patches are owned by their authors. There SHALL NOT be any copyright assignment process. > Here we come to the key reason people trust their investments in ZeroMQ: it's logistically impossible to buy the copyrights to create a closed source competitor to ZeroMQ. iMatix can't do this either. And the more pe…

Correct me if I'm wrong, but my understanding is that copyright transfer is not even legally applicable in many jurisdictions.

Re: Don’t sign a CLA

#14
post #5

I'm sitting on a few custom forks of open source tools (in which I've either fixed a bug or added a feature I needed) which I've more or less kept to myself because the process to contribute back to those projects is just enough of a PITA (due to CLAs and the like) that I can't overcome my apathy/laziness enough to spend the time/effort required to submit my changes and get them accepted. Ah well.

I feel you, red tape to report a bug, red tape to send a patch, and then the owner sends you to hell because they don’t owe you anything.

Re: Don’t sign a CLA

#15

> A CLA is a kick in the groin to a contributor’s good-faith contribution to the project. I wouldn’t invest in a company that conducts business “on good faith.” That’s well and good in the domain of interpersonal interaction, but is irresponsible behavior from a company, which must do all it can to safeguard its assets and revenues. And I don’t think I’m being soulless here. A company like Facebook is entrusted with…

"Good faith" and by extension "bad faith" are quasi-legal terms. To do business in good faith is to act by the letter and spirit of terms without an intention of attempting to defraud.

As I understand it, someone who acts in Good faith usually has more leniency then someone who acts in bad faith. For instance, I had a friend who upon leaving an apartment building was charged several hundred dollars for maintenance having to replace lightbulbs - she disputed the debt, but the apartment complex attempted to charge her interest on it during the dispute. Because the apartment complex acted in bad faith, not only was the debt canceled, but the apartment complex had to pay out additional damages to her.

A business should act on good faith. That doesn't mean not having legal agreements or being naive, it means following the letter and spirit of laws. You might be able to technically trick someone into letting you steal their open source contributions and sell them, but that would be bad faith.

Wikipedia explains it this way: "In contract law, the implied covenant of good faith and fair dealing is a general presumption that the parties to a contract will deal with each other honestly, fairly, and in good faith, so as to not destroy the right of the other party or parties to receive the benefits of the contract. It is implied in every contract in order to reinforce the express covenants or promises of the contract. A lawsuit (or a cause of action) based upon the breach of the covenant may arise when one party to the contract attempts to claim the benefit of a technical excuse for breaching the contract, or when he or she uses specific contractual terms in isolation in order to refuse to perform his or her contractual obligations, despite the general circumstances and understandings between the parties. When a court or triar or fact interprets a contract, there is always an "implied covenant of good faith and fair dealing" in every written agreement.[1]" - https://en.wikipedia.org/wiki/Good_faith_(law)

Re: Don’t sign a CLA

#16
post #3

But can't you take any MIT or Apache (or similarly permissively licensed) project closed source anyway?

You can make the next version proprietary or whatever, but you obviously can't retroactively revoke the license from released code :)

Re: Don’t sign a CLA

#18
post #12
post #4

It's a great point to be aware of, but the title and the tone implies that you as a contributor should be a FOSS maximalist. As they say, not all open source is FOSS. And some people are OK with that. Let them contribute, as long as they are aware of the implications. When I discover bugs in open-source projects during my day job (which is on a closed-source project), I will be much happier having those fixes merged…

> the title and the tone implies that you as a contributor should be a FOSS maximalist. But what if somebody was changed the license from BSD to proprietary after you've contributed to the project? Would you still be happy about it then? I think the idea was: I have my code contributed under BSD, so you cannot re-license my code without clearance from me.

No, but I would be just as upset if I wouldn't have done that contribution.

There is no way they can change the past - my contribution is still open source and so is the project up until the version where they introduced the license change. The version I made my contribution to is still BSD but the current upstream master might not be.

Re: Don’t sign a CLA

#19
post #4

It's a great point to be aware of, but the title and the tone implies that you as a contributor should be a FOSS maximalist. As they say, not all open source is FOSS. And some people are OK with that. Let them contribute, as long as they are aware of the implications. When I discover bugs in open-source projects during my day job (which is on a closed-source project), I will be much happier having those fixes merged…

>not all open source is FOSS

>This is not the case of all open source licenses.

false. open source is literally just a friendlier name and otherwise rebranding of free software. all open source is free software and all free software is open source. if you are contributing to FOSS qua FOSS, then you want it to remain FOSS. FOSS refers to that software which guarantees your right to change it, so if you are making changes, you clearly benefit from it remaining FOSS.

note further the game theoretic implications: if a minority of projects use CLAs, it is possible to avoid contributing to such projects. If people are willing to contribute to such projects, then their number might expand. Those interested in the continuation of FOSS, which should be anyone, especially those interested in software development, should therefore be interested in not signing CLAs.

Post reply on HN