4 ms·

An idea I just thought of: If you're working on a hack project like this then insist on all copyright notices in the code and site being assigned to a made up

An idea I just thought of: If you're working on a hack project like this then insist on all copyright notices in the code and site being assigned to a made up organisation with all the names in it. So put @copyright SmithJonesZuckerbergOrg in all the source files and html. Those files would be a record of the interaction and activity on the hack weekend and would allow for a neat place for lawyers to start in negotiating a smooth buyout in this situation. Because I would rather accept $1K than work with that type of individual.

nostrademons 11y ago
Or just push it to GitHub. Git records the author of each commit with it, assuming you've set up your .gitconfig correctly. In the absence of a contract stating otherwise, copyright remains with the person who wrote each part of the work. 'git blame' will show exactly who wrote what. GitHub gives you a third-party, subpoenable, record of who committed when.
- somedudethere 11y ago
  To be fair the commit time and the authorship time are not the same. You can author something at work and wait to get home to commit it and vice versa.
  - nostrademons 11y ago
    Yeah, you can, but that's more of an issue when proving "Does my employer own my work or do I?" For the startup weekend case, time doesn't matter, you only need to prove authorship - and while a git commit that says "Bobby Boyd <rboyd@gmail.com>" doesn't necessarily mean Bobby Boyd wrote it, that plus Bobby Boyd saying he wrote it, plus a GitHub log showing that the authorship attribution hasn't been tampered with, is pretty good evidence that he wrote it. If Billy NoLastName had written it, why didn't he claim credit for it when he pushed it?
    - eric_bullington 11y ago
      > plus a GitHub log showing that the authorship attribution hasn't been tampered with Unless Github has some backup logs somewhere, that entire log can be wiped out and replaced with whatever someone wants with a simple `git push -f`. Which is why it's so important to sign commits. You sign your commits, and keep your private key private, and as long as any copy of the repo exists anywhere you can access, you can prove authorship/ownership. Commit signing is also very useful for vouching for code integrity.
      - nostrademons 11y ago
        I assume GitHub has backup logs of all activity somewhere, if only to prevent the "Somebody guessed my GitHub password and replaced all my repositories with a README saying 'HAHA U BEEN PWNED!', please help!" situation.
      - michaelmior 11y ago
        You still can't prove authorship. You can prove that at some point you signed that particular commit. But I could easily take a repo including signed commits from you and rewrite and resign the commits with my own private key. This only works if the one doing the signing is a trusted third party.
        eric_bullington 11y ago
        That's a good point, but if you combine signing with an indelible timestamp, like one of the blockchain services or other trusted legal timestamping services, you'd be in pretty good shape.
        michaelmior 11y ago
        I assume you're suggesting something like including such a timestamp in the commit message? If that's the case, that makes a lot of sense to me. It would be cool to have a tool to automate this. Or something like GitTorrent[0] might do the trick if it had wider adoption. [0] http://blog.printf.net/articles/2015/05/29/announcing-gittorrent-a-decentralized-github/ http://blog.printf.net/articles/2015/05/29/announcing-gittor...
- MCRed 11y ago
  Can you give me a reason for "subpoenable" as a requirement? I mean wouldn't the github data be authoritative and easy to check? Or do we really need to be forcing githubs lawyers to get involved to provide answers to a subpoena if there's a lawsuit? Anyway, you make a great point about the commits being clear assignment of copyright, and thanks for that!
  - nostrademons 11y ago
    The subpoenable requirement is because you can rewrite history in git. If you just have a local copy of a repository on your hard disk, your opponent's lawyers might argue "Well, you might have used git commit --amend or manually altered the bits of the repository", and you can't show otherwise. Once you push to GitHub, the repository has become public, and a copy exists somewhere where you can't just manually alter the bits or run git commit --amend. You don't have to actually subpoena GitHub and get their lawyers involved. The fact that you can means that opposing council will know that you're not bluffing or lying when you say "I authored this commit, and I have the commit logs to prove it". Or if they think you are bluffing or lying, they can certainly subpoena GitHub themselves...but if you aren't, that works in your favor.

nostrademons 11y ago

Or just push it to GitHub. Git records the author of each commit with it, assuming you've set up your .gitconfig correctly. In the absence of a contract stating otherwise, copyright remains with the person who wrote each part of the work. 'git blame' will show exactly who wrote what. GitHub gives you a third-party, subpoenable, record of who committed when.

somedudethere 11y ago
To be fair the commit time and the authorship time are not the same. You can author something at work and wait to get home to commit it and vice versa.
- nostrademons 11y ago
  Yeah, you can, but that's more of an issue when proving "Does my employer own my work or do I?" For the startup weekend case, time doesn't matter, you only need to prove authorship - and while a git commit that says "Bobby Boyd <rboyd@gmail.com>" doesn't necessarily mean Bobby Boyd wrote it, that plus Bobby Boyd saying he wrote it, plus a GitHub log showing that the authorship attribution hasn't been tampered with, is pretty good evidence that he wrote it. If Billy NoLastName had written it, why didn't he claim credit for it when he pushed it?
  - eric_bullington 11y ago
    > plus a GitHub log showing that the authorship attribution hasn't been tampered with Unless Github has some backup logs somewhere, that entire log can be wiped out and replaced with whatever someone wants with a simple `git push -f`. Which is why it's so important to sign commits. You sign your commits, and keep your private key private, and as long as any copy of the repo exists anywhere you can access, you can prove authorship/ownership. Commit signing is also very useful for vouching for code integrity.
    - nostrademons 11y ago
      I assume GitHub has backup logs of all activity somewhere, if only to prevent the "Somebody guessed my GitHub password and replaced all my repositories with a README saying 'HAHA U BEEN PWNED!', please help!" situation.
    - michaelmior 11y ago
      You still can't prove authorship. You can prove that at some point you signed that particular commit. But I could easily take a repo including signed commits from you and rewrite and resign the commits with my own private key. This only works if the one doing the signing is a trusted third party.
      - eric_bullington 11y ago
        That's a good point, but if you combine signing with an indelible timestamp, like one of the blockchain services or other trusted legal timestamping services, you'd be in pretty good shape.
        michaelmior 11y ago
        I assume you're suggesting something like including such a timestamp in the commit message? If that's the case, that makes a lot of sense to me. It would be cool to have a tool to automate this. Or something like GitTorrent[0] might do the trick if it had wider adoption. [0] http://blog.printf.net/articles/2015/05/29/announcing-gittorrent-a-decentralized-github/ http://blog.printf.net/articles/2015/05/29/announcing-gittor...
MCRed 11y ago
Can you give me a reason for "subpoenable" as a requirement? I mean wouldn't the github data be authoritative and easy to check? Or do we really need to be forcing githubs lawyers to get involved to provide answers to a subpoena if there's a lawsuit? Anyway, you make a great point about the commits being clear assignment of copyright, and thanks for that!
- nostrademons 11y ago
  The subpoenable requirement is because you can rewrite history in git. If you just have a local copy of a repository on your hard disk, your opponent's lawyers might argue "Well, you might have used git commit --amend or manually altered the bits of the repository", and you can't show otherwise. Once you push to GitHub, the repository has become public, and a copy exists somewhere where you can't just manually alter the bits or run git commit --amend. You don't have to actually subpoena GitHub and get their lawyers involved. The fact that you can means that opposing council will know that you're not bluffing or lying when you say "I authored this commit, and I have the commit logs to prove it". Or if they think you are bluffing or lying, they can certainly subpoena GitHub themselves...but if you aren't, that works in your favor.