Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Missing open-source contributor presents a dilemma when accepting their PR

bettersoftware.uk

Post reply on HN
Print view View original

31–40 of 73 posts

Re: Missing open-source contributor presents a dilemma when accepting their PR

#31

Post by toast0 »

DannyBee wrote: post #26

" and I find it hard to see how damages could be levied in this situation." Unfortunately, this would be intentional copyright infringement (assuming the code is copyrightable, blah blah blah), since you are doing it on purpose with knowledge that it is copyrighted. In a number of countries, copyright infringement is also strict liability - it doesn't matter if you had any intent to commit it, but if you did, the dam…

> In the US, for example, statutory damages for intentional copyright infringement (IE you don't have to prove any actual damage) are 150k per infringement.

I was of the possibly wrong impression that statuatory damages require that the work have been registered with the library of congress. Which seems unlikely for a small patch that might not even be copyrightable anyway.

Re: Missing open-source contributor presents a dilemma when accepting their PR

#32

Post by bawolff »

thayne wrote: post #21
deadbunny wrote: post #16

I don't like them and won't contribute to projects with them but isn't this the exact point of a CLA[1]? A textfile in the repo seems a lot easier to track and audit than PR comments and a bot to chase people. 1. https://en.m.wikipedia.org/wiki/Contributor_License_Agreemen...

No. The purpose of a CLA is so that the owner of the project can use the code in a commercial product that might not comply with the OSS license (particularly if that license is a copyleft licence such as GPL, AGPL, or MPL) and/or they can change the license more easily.

That's more the risk than the purpose. Some people do CLA's for that purpose, but sometimes it really is about having a paper trail that the software is open source, or to make it easier to sue people who violate the license.

Re: Missing open-source contributor presents a dilemma when accepting their PR

#33

Post by DannyBee »

toast0 wrote: post #31
DannyBee wrote: post #26

" and I find it hard to see how damages could be levied in this situation." Unfortunately, this would be intentional copyright infringement (assuming the code is copyrightable, blah blah blah), since you are doing it on purpose with knowledge that it is copyrighted. In a number of countries, copyright infringement is also strict liability - it doesn't matter if you had any intent to commit it, but if you did, the dam…

> In the US, for example, statutory damages for intentional copyright infringement (IE you don't have to prove any actual damage) are 150k per infringement. I was of the possibly wrong impression that statuatory damages require that the work have been registered with the library of congress. Which seems unlikely for a small patch that might not even be copyrightable anyway.

It's also required to file suit anyway, but for that purpose does not have to be done before the infringement (IE you can register after infringement) - see Fourth Estate Public Benefit Corp. v. Wall-Street.com LLC et al

You are somewhat correct on the statutory damages part.

You can also register after learning of infringement there, as long as it is within 3 months of publication: https://www.law.cornell.edu/uscode/text/17/412

This is just the statutory damages side. The author is also wrong in the "no loss" thing anyway because what courts consider loss is much greater than the average expectation of people :)

I also think they severely underestimate the ease with which they can cut off contributory/etc infringement liability claims.

They seem to think they just get to remove the code and go about their life, but in practice, it's not that simple.

Re: Missing open-source contributor presents a dilemma when accepting their PR

#34

Post by krisoft »

I’m not a lawyer at all. What i feel is that the existence of the copyright assignment bot makes this decision worse.

I think it is perfectly reasonable to say “you contributed to the project knowing that the project is licensed X, therefore we can assume that you are ok with your contribution being under the same license and we just merge it”. Not saying that it is wise legally, but it feels to be a coherent theory at least. (Again not a lawyer.)

But if you have a “copyright-assignment” nagging robot that kinda reveals that you think one needs to jump that extra hoop. After that if you ignore that the robot’s question went unanswered it is harder to argue that you just went with the default assumption. Since if you feel it is worth asking the question that means you did not believe that the implied agreement is enough.

Re: Missing open-source contributor presents a dilemma when accepting their PR

#35

Post by worik »

The actual problem here is the existence of "intellectual property". It is corrupting all sorts of things and making plenty of simple things very hard, as in this case.

I do not think that getting rid of intellectual property entirely is the best solution, but it would be an improvement.

Surely we can do better?

Re: Missing open-source contributor presents a dilemma when accepting their PR

#36

Post by thayne »

bawolff wrote: post #32
thayne wrote: post #21

Earlier quoted context omitted.

No. The purpose of a CLA is so that the owner of the project can use the code in a commercial product that might not comply with the OSS license (particularly if that license is a copyleft licence such as GPL, AGPL, or MPL) and/or they can change the license more easily.

That's more the risk than the purpose. Some people do CLA's for that purpose, but sometimes it really is about having a paper trail that the software is open source, or to make it easier to sue people who violate the license.

A DCO [1] would serve that purpose better. It's possible that the desire to have the flexibility to change the license at some point in the future is initially well-intentioned (for example you may start out as GPL, but want the option to change to Apache 2.0 later), so having a CLA doesn't necessarily imply they plan on doing a rug pull. And of course there is probably also some cargo cult of using a CLA because that is what other projects do, but there are other ways of insuring everything is open source that don't require the contributor to give you unlimited rights.

[1]: https://en.m.wikipedia.org/wiki/Developer_Certificate_of_Ori...

Re: Missing open-source contributor presents a dilemma when accepting their PR

#37

Post by cxr »

geenat wrote: post #25
sgentle wrote: post #17

"Whenever you add Content to a repository containing notice of a license, you license that Content under the same terms, and you agree that you have the right to license that Content under those terms. If you have a separate agreement to license that Content under different terms, such as a contributor license agreement, that agreement will supersede." https://docs.github.com/en/site-policy/github-terms/github-t...

Really good to see Github being pro-active to the benefit of the open source community.

It's a stupid synthesis, though, just like the one from the article:

> The repository is MIT-licensed, and clearly advertised as such, so it’s reasonable to expect all contributions are made under that license

You don't have to assume anything, given the way pull requests work. It's not like it's a code snippet extracted from one of their comments on the bugtracker and then subsequently integrated upstream. They published something: their fork.

Look at the repo the pull request is coming from—the one the requestor published. What is the license they published it under? Did they just dump a bunch of stuff online that says it's licensed under MIT? Yup. So if they have the rights to grant it to you, then you can use it under the MIT license.

The only time this doesn't apply is when the contributor deletes their repo. The pull request turns into a patch merge request. But the repo doesn't have to remain available indefinitely. The mere fact that it was published under such-and-such license at some time and was available to you/whoever is sufficient.

Re: Missing open-source contributor presents a dilemma when accepting their PR

#39

Post by incompatible »

If the change is small enough, it wouldn't contain any original literary expression, as required to be copyrightable, and would be automatically in the public domain. Especially if there's only one way to make the change, you can't rewrite it some other way while preserving the intent.
Post reply on HN