Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don’t sign a CLA

drewdevault.com

Post reply on HN
Print view View original

1–10 of 196 posts

Re: Don’t sign a CLA

#2

Post by _jal »

Good general advice. I can't say I have a categoric aversion, but the onus is on upstream to honestly and clearly explain the specific circumstances and reasoning for why the license by itself is insufficient for their special needs.

Re: Don’t sign a CLA

#4

Post by Legogris »

It's a great point to be aware of, but the title and the tone implies that you as a contributor should be a FOSS maximalist.

As they say, not all open source is FOSS. And some people are OK with that. Let them contribute, as long as they are aware of the implications.

When I discover bugs in open-source projects during my day job (which is on a closed-source project), I will be much happier having those fixes merged upstream than having to maintain our own private fork.

> Free and open source software licenses grant explicit freedoms to three groups: the maintainers, the users, and the contributors.

This is not the case of all open source licenses. And that is fine. Don't assume all my work has to be part of your crusade. I will save that for the parts of my life where it makes sense - I am all-for the FOSS movement but there is no need to go full Stallman and say that everything but GPL is evil. If I believed that, I wouldn't be working on a closed-source project in the first place and then this piece would be fully relevant.

A much better title would be "Why I don't sign CLAs" or "The dangers of signing CLAs".

Re: Don’t sign a CLA

#5

Post by jcadam »

I'm sitting on a few custom forks of open source tools (in which I've either fixed a bug or added a feature I needed) which I've more or less kept to myself because the process to contribute back to those projects is just enough of a PITA (due to CLAs and the like) that I can't overcome my apathy/laziness enough to spend the time/effort required to submit my changes and get them accepted.

Ah well.

Re: Don’t sign a CLA

#7

Post by linkmotif »

> A CLA is a kick in the groin to a contributor’s good-faith contribution to the project.

I wouldn’t invest in a company that conducts business “on good faith.” That’s well and good in the domain of interpersonal interaction, but is irresponsible behavior from a company, which must do all it can to safeguard its assets and revenues.

And I don’t think I’m being soulless here. A company like Facebook is entrusted with and responsible for many people’s very livelihoods. As a corporation it must not behave casually. There’s no “in good faith” when you have millions of employees and investors.

Re: Don’t sign a CLA

#8

Post by mcherm »

I think it depends entirely on the purpose of the CLA. Different licenses say different things. Some merely assert that the signer is contributing under the license under which the project is distributed. (Although you may consider it obvious, I am not aware of any existing case law in the US that asserts that submitting a patch necessarily comes with a grant of license to the copyright. And I can guarantee that there isn't case law in every jurisdiction around the world.) Other CLA purposes that seem reasonable to me include a guarantee that IF the contributor has a patent on the submitted code then a license to use that patent is granted to all users of the software.

Even if the CLA does contain text granting some organization which manages the code the right to re-distribute under some other license, I may well be comfortable with that. Sometimes projects choose to move to a new license (GPL v3 wouldn't exist without this). Sometimes a company chooses to offer commercial licenses in addition to free ones. My willingness to contribute under these conditions comes down to the degree to which I trust the organization (realizing that the organization may change, but that almost no human endeavor can be achieved without some level of trust).

On the other hand, if YOU wish to refuse to sign CLAs, you are certainly welcome to do that. But do not be surprised if some organizations reject your offers to contribute patches.

Re: Don’t sign a CLA

#9

Post by monocasa »

Pieter Hintjens makes a similar argument in Social Architecture, describing ZeroMQ's community guidelines:

> All patches are owned by their authors. There SHALL NOT be any copyright assignment process.

> Here we come to the key reason people trust their investments in ZeroMQ: it's logistically impossible to buy the copyrights to create a closed source competitor to ZeroMQ. iMatix can't do this either. And the more people that send patches, the harder it becomes. ZeroMQ isn't just free and open today--this specific rule means it will remain so forever. Note that it's not the case in all MPLv2/GPL projects, many of which still ask for copyright transfer back to the maintainers.

Post reply on HN