Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CLAs create different issues than making (small) open source contributions

utcc.utoronto.ca

Post reply on HN
Print view View original

31–40 of 70 posts

Re: CLAs create different issues than making (small) open source contributions

#31

Post by gavinhoward »

electroly wrote: post #29
gavinhoward wrote: post #21

I agree with this, but at the same time, that's exactly why I will have a CLA. I am a one-man shop. I struggle to read code written by others because I struggle to build theory of mind. So I do not want your contributions. My CLA is supposed to drive you away from giving them to me. But on the flip side, I also want to be able to give commercial licenses to customers instead of the current AGPL-like license I have. F…

If you don't have any other contributors, you're free to offer any license to anyone you'd like. Simply not accepting contributions will do the trick; you don't also need a CLA in that situation. It doesn't make sense to have a CLA for a project that doesn't accept contributions.

The CLA is really for corporate customers who give me bug fixes for their environments.

Re: CLAs create different issues than making (small) open source contributions

#32

Post by Spivak »

coldpie wrote: post #27
williamvds wrote: post #9

Earlier quoted context omitted.

As soon as I see a CLA I'm turned off even using a piece of FOSS software. I get it's usually just the lawyers protecting the company just in case a contributor tries something dodgy in the future. Out of principle however, I resent the broad assignment of copyright and granting them the right to relicense. Of course I expect most of these projects would never exercise that right, but the mere fact that they _could_…

Just like cookie banners, CLAs are one of those idiot lawyer things where some jackass at a big corp invented the idea to justify their paycheck, and now everyone cargo cults it because they think they need it. 99% of projects do not need a CLA and 99% of websites do not need a cookie banner.

I think I would actually flip that for CLAs -- 99% of projects do need a CLA it's just annoying because assignment isn't the assumed default when contributing to other projects. The number of projects where there is more than one owner (be that a person, foundation, or llc) is insignificant. Almost all outside contributions are from people who have no expectations at all over their code and are just scratching their own itch. Plus unless you're a huge project the legal issues are just ignored when it comes to re-licensing.

So maybe you're right but "99% of projects have a CLA in the form of not giving a fuck" is far more accurate.

Re: CLAs create different issues than making (small) open source contributions

#33

Post by Spivak »

bkor wrote: post #16
saulpw wrote: post #13

Earlier quoted context omitted.

I have a CAA on my GPL project so that I have the right to start releasing it as MIT, that is, more Free. Also so I can dual-license it to a corporation and make a modicum of money from the software that is 98% my work. I absolutely never intend to make future versions non-free (and I don't even have the right to make already released versions non-free). Do you find this disturbing?

> I have a CAA on my GPL project so that I have the right to start releasing it as MIT, that is, more Free. That really depends on the CAA. It might allow way more. The text might be (legally) not applicable or have flaws, etc. > Do you find this disturbing? It is a barrier to contribute. I would not even bother trying to contribute. Your statements here are already a bit conflicting to me. You partly might want to m…

> It is a barrier to contribute.

Most CLAs are a bot on the MR where you click sign, type your name, and it's done. If you don't really care about your code ownership then it's barely a speed bump compared to the rest of getting a PR merged.

Re: CLAs create different issues than making (small) open source contributions

#34

Post by hgs3 »

bkor wrote: post #23
amtamt wrote: post #12

Can there be somewhat standardized CLAs, along the lines of Apache/ MIT... licenses?

I'm aware of the following: https://harmonyagreements.org/ Still, CLAs are a barrier on their own already. Standardizing them doesn't help. Plus as another commenter mentioned: sometimes a standard CLA is used but then various bits aren't filled in.

Standardizing CLA's helps the same way standardizing software licenses helps prevent license proliferation [1].

Code hosting websites, like GitHub, should provide a mechanism for registered users to electronically sign a CLA from their web interface. No hassle, no unfilled bits, and you've got a 3rd party (e.g. GitHub) notarizing the contract.

[1] https://en.wikipedia.org/wiki/License_proliferation

Re: CLAs create different issues than making (small) open source contributions

#35

Post by stanleydrew »

coldpie wrote: post #27
williamvds wrote: post #9

Earlier quoted context omitted.

As soon as I see a CLA I'm turned off even using a piece of FOSS software. I get it's usually just the lawyers protecting the company just in case a contributor tries something dodgy in the future. Out of principle however, I resent the broad assignment of copyright and granting them the right to relicense. Of course I expect most of these projects would never exercise that right, but the mere fact that they _could_…

Just like cookie banners, CLAs are one of those idiot lawyer things where some jackass at a big corp invented the idea to justify their paycheck, and now everyone cargo cults it because they think they need it. 99% of projects do not need a CLA and 99% of websites do not need a cookie banner.

This isn't a good analogy. Copyright is a real thing, and getting explicit consent from your contributors to use their copyrighted material is an important defensive measure.

Re: CLAs create different issues than making (small) open source contributions

#36

Post by pydry »

gavinhoward wrote: post #21

I agree with this, but at the same time, that's exactly why I will have a CLA. I am a one-man shop. I struggle to read code written by others because I struggle to build theory of mind. So I do not want your contributions. My CLA is supposed to drive you away from giving them to me. But on the flip side, I also want to be able to give commercial licenses to customers instead of the current AGPL-like license I have. F…

If you dont want contributions you dont need a CLA. You just dont accept them.

Re: CLAs create different issues than making (small) open source contributions

#37

Post by gavinhoward »

pydry wrote: post #36
gavinhoward wrote: post #21

I agree with this, but at the same time, that's exactly why I will have a CLA. I am a one-man shop. I struggle to read code written by others because I struggle to build theory of mind. So I do not want your contributions. My CLA is supposed to drive you away from giving them to me. But on the flip side, I also want to be able to give commercial licenses to customers instead of the current AGPL-like license I have. F…

If you dont want contributions you dont need a CLA. You just dont accept them.

Look at my answer to a sibling comment.

Re: CLAs create different issues than making (small) open source contributions

#38

Post by pydry »

A1kmm wrote: post #26
bmitc wrote: post #17

How is a CLA any different of a legal agreement than agreeing to a license? The CLAs I have seen basically boil down to the project maintainers maintaining ownership of the code, ability to adjust the license if desired, and protect them from people contributing code that the contributor doesn't have the rights for. I have seen projects suffer from single contributors stubbornly refusing to budge on relicensing, even…

If I contribute to an AGPL project and license my changes back to you under AGPL, that means you can't one day decide to start selling my changes together with a closed-source module; the copyleft works to protect me against you deciding to take my changes closed-source, not just to protect the original maintainer from that. If I contribute to an AGPL project and sign a CLA that assigns copyright to you, you might an…

>If I contribute to an AGPL project and sign a CLA that assigns copyright to you, you might announce tomorrow that you are going to run off with my contribution and start only releasing new versions under a non-FOSS licence.

That is generally the point of a CLA. If that bothers you you're supposed to not contribute and not sign. The up side is that that revenue model might mean that they can pay people to do that work instead of relying upon drive by pull requests and maintainers dedicating their time for free.

Back in the early days of open source I saw a lot of people get mad at viral licensing because it did exactly what it was supposed to. There was some weird sort of entitlement complex going on where people felt entitled not only to use open source but that it was somehow unfair that they couldn't also violate the terms and conditions of using it.

I was similarly perplexed by the reaction back then too.

Re: CLAs create different issues than making (small) open source contributions

#39

Post by coldpie »

stanleydrew wrote: post #35
coldpie wrote: post #27

Earlier quoted context omitted.

Just like cookie banners, CLAs are one of those idiot lawyer things where some jackass at a big corp invented the idea to justify their paycheck, and now everyone cargo cults it because they think they need it. 99% of projects do not need a CLA and 99% of websites do not need a cookie banner.

This isn't a good analogy. Copyright is a real thing, and getting explicit consent from your contributors to use their copyrighted material is an important defensive measure.

Defensive against what? Can you provide some examples of a real-world (not hypothetical) problem that a CLA would have solved?

Re: CLAs create different issues than making (small) open source contributions

#40

Post by coldpie »

Spivak wrote: post #32
coldpie wrote: post #27

Earlier quoted context omitted.

Just like cookie banners, CLAs are one of those idiot lawyer things where some jackass at a big corp invented the idea to justify their paycheck, and now everyone cargo cults it because they think they need it. 99% of projects do not need a CLA and 99% of websites do not need a cookie banner.

I think I would actually flip that for CLAs -- 99% of projects do need a CLA it's just annoying because assignment isn't the assumed default when contributing to other projects. The number of projects where there is more than one owner (be that a person, foundation, or llc) is insignificant. Almost all outside contributions are from people who have no expectations at all over their code and are just scratching their…

Yeah. I'm saying "not giving a fuck" is the correct solution for 99% of projects. CLAs are a solution in search of a problem.
Post reply on HN