Live data from Hacker News

Don’t sign a CLA

drewdevault.com

161–170 of 196 posts

Re: Don’t sign a CLA

#161
Hi, I run an open source project and it has a CLA. I chose a fairly permissive one (contributors retain ownership/copyright), however it does allow relicensing. One of the main reasons I chose to do this is:

1. I have a put a lot of time into the project. More than anybody. Years of work. At some point, I'd like to be able to make money off of it, and relicensing will give me that option (enterprise installations and all that).

2. iOS. The GPL, from a lot of what I've read, is incompatible with the Apple store. If you want to release a GPL-licensed app on iOS, you need to be able to relicense it. Please prove me wrong here, but I think this is a big deal.

Here's my take. If I ever want to make the project completely closed, the last GPLed version is still available and able to be forked or continued. I can't erase the project from the face of the earth, which is kind of what the author seems to be suggesting.

Secondly, if I was starting a project that blossomed with the help of hundreds of contributors, I'd be much more likely to not want a CLA. That said, this is my project. Sure, anyone can fork it and do what they want with it, but I am the one creating it. And at some point, I want that to pay off. My choice of GPL is not to protect contributors, it's to protect the users. The CLA lets me have a restrictive license while giving me the freedom to relicense as needed.

If that keeps you from contributing, no hard feelings. But having a CLA lets me navigate a lot of issues that would otherwise keep me up at night (or make me not want to maintain the project at all).

Re: Don’t sign a CLA

#162

Earlier quoted context omitted.

Author here. Thanks for writing up your thoughts. >As they say, not all open source is FOSS This isn't true - you mean "not all open source is copyleft". >> Free and open source software licenses grant explicit freedoms to three groups: the maintainers, the users, and the contributors. >This is not the case of all open source licenses This is also not true. You should review the open source definition: https://openso…

>> As they say, not all open source is FOSS > This isn't true - you mean "not all open source is copyleft". Yes it is, and I'm not sure the commenter does. Software may be free but not open-source, and it may be open-source but not free. The term "free and open-source" signifies both. > This is also not true. You should review the open source definition: > https://opensource.org/osd That is not the definition of open…

> Software may be free but not open-source, and it may be open-source but not free.

Free and Open source software are basically mean to be synonyms, the latter being put forth by people to eliminate the ambiguity in English about the use of the word Free.

The "free" in "free software" means libre software, not gratis software.

https://www.gnu.org/philosophy/free-sw.html

Re: Don’t sign a CLA

#163
I'm not entirely sure I understand why so many people are against CLAs. I've been active in the open source community since 1996, and am currently employed at a company which is 100% based upon service around open source software, which includes our stewardship of several projects which have significantly advanced the community cause. My employer requires a CLA. It is not written in esoteric legalese, but is rather simple to understand before you sign it. It is designed to protect both you, as the contributor, and my employer.

A CLA is a good thing when it's written well, is not overly onerous, and is being used to further contributions. Here is some basic reasons why a company like my employer may want contributors to sign a CLA:

1. It prevents your heirs from terminating your copyright grants in the future if you pass away or any number of other weird quirks of US copyright law that could potentially result in legal fuckery that you do not intend. 2. It prevents enforcement of patents surrounding code you have contributed against my employer. 3. It indemnifies you as the contributor against expectations of support, guarantee, or warranty for your contribution. 4. It commits my employer to maintenance of your contribution once its accepted as long as it is needed in the code-base. 5. It protects my employer from getting in trouble for contributions where the contributor did not have legal license to offer the contribution, because you are asserting that you have such license before offering that contribution.

Yes, it allows for re-licensing, but in practice what this means is that some or all of the code may be dual-licensed at some point in the future to assist in integration with other open source software projects.

To assert you should never sign a CLA seems short-sighted and unreasonable. I can't speak for every project, but my employer has been a good steward of software in the community and the community itself since the day it was founded and has committed to continuing to do so.

While I can certainly understand that you may not wish to sign a CLA with an organization you do not trust, I don't think refusal to sign should be a default position. Instead, like any contract, you should read before you sign and not enter into agreements with entities you do not trust. Simple as that.

Re: Don’t sign a CLA

#164

Earlier quoted context omitted.

What is the practical difference between contributing under a CLA to a project that's currently under an open-source license and contributing under a non-copyleft open-source license while retaining the copyright yourself? Most non-copyleft open-source licenses have their own requirements that must be followed even when re-licensing. Also, technically if you don't pay for code the copyright holder can revoke the lice…

>Also, technically if you don't pay for code the copyright holder can revoke the license at any time I'm pretty sure this is a myth.

That if you don't pay the license can be revoked at any time is probably indeed a myth. On the other hand, there is a chance big enough to worry about that many FOSS license could in fact be revoked by the copyright owners for other reasons, or if not revoked have distribution greatly hindered.

There are two issues (at least).

The first is that some such licenses may be "bare licenses". A bare license is a license to use someone else's property that is not coupled with an equitable interest in that property. Bare licenses can be revoked at will unless they state they are irrevocable.

Of course, you could have a bare license, and separate from that a contract with the copyright owner in which the copyright owner agrees not to revoke the bare license, so a license being a bare license is not necessarily a big deal except when it stands alone. I think that such an associated contract is reasonably likely to be found in most cases.

The second, and more serious issue is where does your license come from when you use FOSS software? This, as far as I know, is largely unexplored in the courts.

Let's say I've released Foo under a FOSS license. The license says it is irrevocable. You get a copy of Foo from me. You've got a license to Foo, from me, and it is yours forever.

Now you give a copy of Foo to Bob. Where does Bob's license come from?

There are two possibilities. (1) It comes from me. Whenever you, or anyone else, no matter how many steps removed from me distributes Foo the recipient automatically receives a license from me. (2) The Foo license allows sublicensing, and you use your sublicensing right to create a license for Bob.

The big question is what happens if it some point I announce that I am no longer issuing new licenses.

The sublicensing case is the most clear. Everyone who already has Foo retains they license (remember, I made the Foo license irrevocable). Their licenses allow sublicensing, so they can continue to distribute, giving their distributees a license (which includes the sublicensing right).

Unfortunately only a couple major FOSS licenses, I believe, allow sublicensing (Apache and MIT). Most of the rest either are silent on it or explicitly say it is not allowed (GPL).

So lets assume non-sublicensable Foo...Bob gets a copy of Foo from you after I have purportedly stopped issuing licenses. I sue Bob for copyright infringement. What is Bob's defense?

Note that I am not attempting to revoke the irrevocable Foo license with anyone--I'm just trying to stop create new* Foo licenses with anyone else.

Bob can't really argue that you gave him a Foo license, because the Foo license does not allow sublicensing.

I think Bob is going to have to argue that there is a contract between me and you, and part of that contract is that I will issue new Foo licenses to anyone you give the software to, and by not issuing Bob a license I'm in breach of my contract with you, and that Bob is a third party beneficiary of my contract with you, and has standing to counter sue to enforce my contract with you to issue him a license. But third party beneficiaries only have standing when they are an intended beneficiary, not when they are incidental beneficiaries.

It would be a big, very unclear, mess.

Re: Don’t sign a CLA

#166
post #130

Earlier quoted context omitted.

>> As they say, not all open source is FOSS > This isn't true - you mean "not all open source is copyleft". Yes it is, and I'm not sure the commenter does. Software may be free but not open-source, and it may be open-source but not free. The term "free and open-source" signifies both. > This is also not true. You should review the open source definition: > https://opensource.org/osd That is not the definition of open…

> Software may be free but not open-source, and it may be open-source but not free. Other than version 1 of the Apple Public Source license, which is considered open source but not free (and also now entirely unused), what cases are you thinking of?

There are specific controversies; take GNU vs OSI. GNU elaborates the differences on their site: https://www.gnu.org/philosophy/free-software-for-freedom.en..... I couldn't find OSI's take on their website, other than a general lack of reference to GNU/FSF's idea of Free Software.

Then there are disagreements on specific licenses. OSI approves licenses GNU does not classify as Free, and GNU classifies licenses as Free that OSI does not approve.

Then there's GitHub, which publishes a site to help you "choose an open source license," which includes a license not approved by OSI (the Unlicense), and only makes a reference to OSI as an "additional resource". Likewise, GitHub lists FSF as an "additional resource," while consistently using the term open source, not free, and not free and open.

Digital Ocean explains the difference between free and open-source software: https://www.digitalocean.com/community/tutorials/Free-vs-Ope....

Eliah Kagan answers the question on AskUbuntu with some explanation of the history and plenty of links: https://askubuntu.com/questions/78958/is-there-a-difference-....

Re: Don’t sign a CLA

#167

Earlier quoted context omitted.

>> As they say, not all open source is FOSS > This isn't true - you mean "not all open source is copyleft". Yes it is, and I'm not sure the commenter does. Software may be free but not open-source, and it may be open-source but not free. The term "free and open-source" signifies both. > This is also not true. You should review the open source definition: > https://opensource.org/osd That is not the definition of open…

That's incorrect. They invented the term. Contrary to the public belief, the term open source did not exist before open source definition.

They did not. Simon Phipps, President of OSI, not only admits as much but provides a link in his blog that proves the point: https://opensource.org/blog/18418.

Re: Don’t sign a CLA

#168
post #73

Earlier quoted context omitted.

> technically if you don't pay for code the copyright holder can revoke the license at any time So Linus can all of a sudden say that Linux is no longer GPL?!

Each contributor may only re-license their contributions independently. If there's any of Linus's own work left in the kernel it would have to be rewritten should he decide that he was fed up with RMS and was going to take Linux closed source. ;)

This is not accurate, you can not retroactively re-license distributed code, only code you distribute going forward. No code would need to be rewritten.

Re: Don’t sign a CLA

#169
post #20

Wait, Free Software Foundation requires a CLA itself! https://www.gnu.org/licenses/why-assign.en.html

It figures - the FSF are believers in releasing under "GPLv3 or later", which almost no-one does, as the FSF are of course empowered to do whatever they want with future GPL versions.

Re: Don’t sign a CLA

#170

Earlier quoted context omitted.

Epic's Unreal Engine is another example

Could you please elaborate?

It's shared source, behind a register wall. You can clone the git tree and privately hack to your heart's content, but commercial usage and sharing of the source are under (fairly reasonable) particular rules.
Post reply on HN