Don’t sign a CLA • Hacker News Board

Re: Don’t sign a CLA

#21

Post by kevin_b_er » Fri, Oct 05, 2018, 2:51 PM UTC

monocasa wrote: post #9

Pieter Hintjens makes a similar argument in Social Architecture, describing ZeroMQ's community guidelines: > All patches are owned by their authors. There SHALL NOT be any copyright assignment process. > Here we come to the key reason people trust their investments in ZeroMQ: it's logistically impossible to buy the copyrights to create a closed source competitor to ZeroMQ. iMatix can't do this either. And the more pe…

And as a result, ZeroMQ has a bizarre LGPLv3 license with supposed exceptions and claims it doesn't need commercial licensing as a result.

Re: Don’t sign a CLA

#22

Post by Sir_Cmpwn » Fri, Oct 05, 2018, 2:51 PM UTC

Legogris wrote: post #18

rqs wrote: post #12

Earlier quoted context omitted.

> the title and the tone implies that you as a contributor should be a FOSS maximalist. But what if somebody was changed the license from BSD to proprietary after you've contributed to the project? Would you still be happy about it then? I think the idea was: I have my code contributed under BSD, so you cannot re-license my code without clearance from me.

No, but I would be just as upset if I wouldn't have done that contribution. There is no way they can change the past - my contribution is still open source and so is the project up until the version where they introduced the license change. The version I made my contribution to is still BSD but the current upstream master might not be.

Yes, but now that version is quickly becoming stale, growing CVEs and perhaps becoming incompatible with the new upstream, with a community left in disarray that more often than not fails to support a fork.

Re: Don’t sign a CLA

#23

Post by evmar » Fri, Oct 05, 2018, 2:51 PM UTC

Even if you don't sign a CLA, can't someone take an Apache/BSD/MIT-licensed work and make a closed source form of it? The license effectively just requires them to mention where the code came from. Whether you signed a CLA or not seems pretty irrelevant.

Apache says for example: "You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole [...]".

I think the OP's concern only applies to GPL software, which in my experience is pretty rare at this point.

Re: Don’t sign a CLA

#24

Post by sparkie » Fri, Oct 05, 2018, 2:52 PM UTC

rqs wrote: post #12

Legogris wrote: post #4

It's a great point to be aware of, but the title and the tone implies that you as a contributor should be a FOSS maximalist. As they say, not all open source is FOSS. And some people are OK with that. Let them contribute, as long as they are aware of the implications. When I discover bugs in open-source projects during my day job (which is on a closed-source project), I will be much happier having those fixes merged…

> the title and the tone implies that you as a contributor should be a FOSS maximalist. But what if somebody was changed the license from BSD to proprietary after you've contributed to the project? Would you still be happy about it then? I think the idea was: I have my code contributed under BSD, so you cannot re-license my code without clearance from me.

Changing from BSD to proprietary does not invalidate any prior BSD license on work that has been published.

In such event, you can still distribute the existing source code, or fork the project in order for it to remain BSD-only.

Re: Don’t sign a CLA

#25

Post by jerf » Fri, Oct 05, 2018, 2:52 PM UTC

rqs wrote: post #12

Legogris wrote: post #4

It's a great point to be aware of, but the title and the tone implies that you as a contributor should be a FOSS maximalist. As they say, not all open source is FOSS. And some people are OK with that. Let them contribute, as long as they are aware of the implications. When I discover bugs in open-source projects during my day job (which is on a closed-source project), I will be much happier having those fixes merged…

> the title and the tone implies that you as a contributor should be a FOSS maximalist. But what if somebody was changed the license from BSD to proprietary after you've contributed to the project? Would you still be happy about it then? I think the idea was: I have my code contributed under BSD, so you cannot re-license my code without clearance from me.

To have contributed under BSD means that you have contributed under a license that permits relicensing. To contribute under the "BSD license but secretly I'm not going to let you relicense" means that you have not in fact contributed under the BSD license in the first place, but your secret license.

If you want to contribute under your secret license, what it means is that you don't want to spend any time in the first place contributed to the BSD-licensed project. Make your changes and use them, but don't contribute them back. The BSD license permits this fully, including your ability to distribute and sell the resulting software, subject to the advertising clause as appropriate. So it's not like there's anything onerous about this idea.

Re: Don’t sign a CLA

#26

Post by dec0dedab0de » Fri, Oct 05, 2018, 2:52 PM UTC

Legogris wrote: post #4

It's a great point to be aware of, but the title and the tone implies that you as a contributor should be a FOSS maximalist. As they say, not all open source is FOSS. And some people are OK with that. Let them contribute, as long as they are aware of the implications. When I discover bugs in open-source projects during my day job (which is on a closed-source project), I will be much happier having those fixes merged…

As they say, not all open source is FOSS...

> Free and open source software licenses grant explicit freedoms to three groups: the maintainers, the users, and the contributors.

This is not the case of all open source licenses...

Wrong. FOSS = Free Open Source Software, which is really redundant, because all Open Source Software is Free Software. Open Source is essentially the marketing branch of Free Software. The Open Source Definition, and the Four Freedoms are basically the same thing. The only difference is that Open Source cares more about being practical, and Free Software is trying to save the world.

EDIT: I am always surprised by the number of people on HN who seem to not understand this. I know there has been a push the last 10 years or so against copyleft, and specifically the GPL. I didn't think it extended to forgetting what these words in our industry actually mean.

Re: Don’t sign a CLA

#27

Post by vorpalhex » Fri, Oct 05, 2018, 2:52 PM UTC

I won't contribute to any open source project with a CLA - which has been a shame for a few open source projects. I caught a serious security vulnerability in one project including them openly posting admin secrets - and privately contacted and let them know, appropriately - only to get back a response of "Can you sign our CLA and help us fix this?".

I politely told them I don't do CLAs. I checked a few weeks later and the passwords were still posted.

Re: Don’t sign a CLA

#28

Post by craigsmansion » Fri, Oct 05, 2018, 2:55 PM UTC

Legogris wrote: post #4

It's a great point to be aware of, but the title and the tone implies that you as a contributor should be a FOSS maximalist. As they say, not all open source is FOSS. And some people are OK with that. Let them contribute, as long as they are aware of the implications. When I discover bugs in open-source projects during my day job (which is on a closed-source project), I will be much happier having those fixes merged…

> to go full Stallman and say that everything but GPL is evil.

Can you provide a quote where he says or implies such a thing?

Re: Don’t sign a CLA

#29

Post by mikeash » Fri, Oct 05, 2018, 2:55 PM UTC

rqs wrote: post #12

Legogris wrote: post #4

It's a great point to be aware of, but the title and the tone implies that you as a contributor should be a FOSS maximalist. As they say, not all open source is FOSS. And some people are OK with that. Let them contribute, as long as they are aware of the implications. When I discover bugs in open-source projects during my day job (which is on a closed-source project), I will be much happier having those fixes merged…

> the title and the tone implies that you as a contributor should be a FOSS maximalist. But what if somebody was changed the license from BSD to proprietary after you've contributed to the project? Would you still be happy about it then? I think the idea was: I have my code contributed under BSD, so you cannot re-license my code without clearance from me.

That’s a bizarre idea. If you don’t want people doing things the license allows, don’t contribute under that license. If you don’t want people relicensing your code without your specific permission, then the BSD license is not the one you want, and you shouldn’t contribute to projects that use it.

Re: Don’t sign a CLA

#30

Post by ddevault » Fri, Oct 05, 2018, 2:55 PM UTC

Legogris wrote: post #4

It's a great point to be aware of, but the title and the tone implies that you as a contributor should be a FOSS maximalist. As they say, not all open source is FOSS. And some people are OK with that. Let them contribute, as long as they are aware of the implications. When I discover bugs in open-source projects during my day job (which is on a closed-source project), I will be much happier having those fixes merged…

Author here. Thanks for writing up your thoughts.

>As they say, not all open source is FOSS

This isn't true - you mean "not all open source is copyleft".

>> Free and open source software licenses grant explicit freedoms to three groups: the maintainers, the users, and the contributors.

>This is not the case of all open source licenses

This is also not true. You should review the open source definition:

https://opensource.org/osd

>I am all-for the FOSS movement but there is no need to go full Stallman and say that everything but GPL is evil

I did not say that, nor do I believe it, nor is it really related.

>When I discover bugs in open-source projects during my day job (which is on a closed-source project), I will be much happier having those fixes merged upstream than having to maintain our own private fork.

This is definitely a valid position to hold, and I have signed CLAs on behalf of my employer before for this very reason. I suppose my article is targeted more at people contributing in their spare time, and to discourage maintainers from adopting a CLA in the first place.