8 ms·

Good that it's open source, but I found this blurb from their contributing guidelines [0] to be contribution inhibiting: You will need to complete a Contributo

by chejazi 11y ago

Good that it's open source, but I found this blurb from their contributing guidelines [0] to be contribution inhibiting: You will need to complete a Contributor License Agreement (CLA) before your pull request can be accepted. This agreement testifies that you are granting us permission to use the source code you are submitting, and that this work is being submitted under appropriate license that we can use it. [0] https://github.com/Microsoft/ChakraCore/blob/master/CONTRIBUTING.md https://github.com/Microsoft/ChakraCore/blob/master/CONTRIBU...

sjrd 11y ago
Most open source projects have a CLA, nowadays. I don't see how this would inhibit contributions.
cjbprime 11y ago
NodeJS has exactly the same restriction.
- silverwind 11y ago
  Node.js does not require a CLA anymore since it left Joyent behind.
  - cjbprime 11y ago
    Oops thanks!
- deleted 11y ago
  [deleted]
jhchen 11y ago
What's wrong with a CLA? It's incredibly common for projects open sourced by companies.
- JupiterMoon 11y ago
  It means that the company owns the copyright to everything and can close the source again any time they want. EDIT Dear mods. Some pretty measured posts are getting serious heat in this (and other threads relating to MS) maybe you could look into it?
  - teddyh 11y ago
    It also means that the company can sell proprietary versions with extended functionality, and the company is therefore motivated to not allow contributions to the free code which duplicates functionality which they sell.
    - comex 11y ago
      However, since ChakraCore is released under a permissive license (like most corporate open source projects), Microsoft could do the same thing without a CLA. It matters more when something is under a GPL variant...
      - carussell 11y ago
        It's a good point, but it matters for Apache licensed code, too, because Apache 2.0 has a self-destruct clause in the patent grant to keep all parties' lawyers in check. CLAs (like the one Microsoft uses) routes around that. The way this ends up working for Microsoft projects licensed under Apache 2.0 is that it essentially allows Microsoft to do anything with the contributions (as if it were licensed under MIT, with a liberal interpretation of the implied patent grant), but requires everyone else to continue abiding by Apache 2.0. Not exactly balanced. EDIT: I'm totally confused about why people are having a problem with this comment.
        krisdol 11y ago
        >I'm totally confused about why people are having a problem with this comment. It seems like half of this submission is a graveyard. Disappointing.
stonesam92 11y ago
Don't most large organisations require something similar with their own open source projects? I know Google and Facebook do. It's just a way of confirming that you own the rights to your contribution, and that you explicitly give Microsoft permission to use it. (And if you didn't want to grant them permission, you would have no reason to contribute!)
- carussell 11y ago
  > Don't most large organisations require something similar with their own open source projects? I know Google and Facebook do. Mozilla gets by without one. Apple's approach for managing Swift, too. > It's just a way of confirming that you own the rights to your contribution, and that you explicitly give Microsoft permission to use it. If that's all they wanted to do, they could get by with something resembling the terms that Mozilla gets its committer's to sign. Usually these CLAs are specifically written to go a lot further than that, though. They usually take away a lot of the contributors' bargaining power. Microsoft's CLAs included.
  - magicalist 11y ago
    > * Mozilla gets by without one. Apple's approach for managing Swift, too.* Mozilla does have one. > Code committed by you to a Mozilla Repository, whether written by you or a third party, must be governed by the Mozilla Public License 2.0, or another license or set of licenses acceptable to the Mozilla Foundation for the Code in question. https://static.mozilla.com/foundation/documents/commit-access/committers-agreement.pdf https://static.mozilla.com/foundation/documents/commit-acces... Swift has a much shorter one: > By submitting a pull request, you represent that you have the right to license your contribution to Apple and the community, and agree by submitting the patch that your contributions are licensed under the Swift license. https://github.com/apple/swift/blob/master/CONTRIBUTING.md https://github.com/apple/swift/blob/master/CONTRIBUTING.md
    - carussell 11y ago
      Neither of those are CLAs. Please correct your comment. I'm particularly perplexed why you linked to that Mozilla document, for two reasons: 1. It says what it is, and as I said above, it's not a CLA. I've signed that document. It's required by everyone to get commit access to the Mozilla repositories. Here's how it works if you want to contribute to Mozilla: you send in a patch, they accept it, and say thank you. Nobody has to sign anything. (The same process goes for Swift, by the way.) 2. I specifically mentioned such a committer's agreement in my comment. It's even in the part you quoted.
binarycrusader 11y ago
Yes, many projects do not, but some very popular ones do: Google Go requires one. Apache requires one. Some FSF projects require one. I could go on, but the point is that CLAs exist for good reasons. There may be another, different way to accomplish the same goals, but since it isn't my pocketbook funding the project, I don't feel like I have a right to complain. As such, just because a project has a CLA doesn't mean there's anything nefarious or inhibiting going on.
- krisdol 11y ago
  In the case of the MIT license, I don't see much harm in throwing in a CLA because it's nearly impossible for Microsoft to do anything to break the terms of the license; however, while I am not a lawyer and this isn't legal advice, in general signing a CLA (including in this instance) often gives the other party rights to re-license the work and continue to use the work if they end up in violation of the original license. For istance, a hugely popular, third-party Minecraft modification platform called Bukkit was partially licensed under the GPL (v2, I believe); however, it turned out that this code was not permitted to be distributed as GPL because it linked to to proprietary code, and Mojang was not eager to open source anything anytime soon. Because contributors submitted their contributions to be used under the terms of the GPL, and the project failed to meet the requirements of the GPL, contributors were then able to file legal DMCA notices of copyright infringement to take down the project. Regardless of what license the project is filed under, as an individual contributor working for free for the community, the license of a project determines the terms under which I am sharing my work. I expect those to be respected in perpetuity, and I would like the right to rescind my contribution if the copyright holder is in violation of the license. (Please don't turn this into a GPL vs MIT discussion) EDIT Echoing other responders here, if you downvoted I would really appreciate the discussion of why.
  - binarycrusader 11y ago
    Regardless of what license the project is filed under, as an individual contributor working for free for the community, the license of a project determines the terms under which I am sharing my work. I expect those to be respected in perpetuity, and I would like the right to rescind my contribution if the copyright holder is in violation of the license. The CLA is just another license to consider with the project; just like projects that have the "any later version" GPL clause. That little addition is important to some individuals. I think a more successful argument would be against the lack of specific guarantees in existing CLAs, rather than CLAs themselves. For example, the CLA could give joint copyright to the involved parties, but also agree to only publish the code under a license published by the Free Software Foundation. CLAs, as you point out, are sometimes a necessary mechanism to ensure that a project can correct licensing issues when they arise. Obviously, through careful choice of licensing it may be possible to avoid the need for a CLA entirely, such as is starting to be done with the Apache License 2.0 by some projects. So I would think of this differently: depending on the license, some projects may need a CLA for protections only available to them with one. For those projects, the community should encourage them to encode their intentions in the CLA to assuage fears and provide certain guarantees to contributors. Finally, keep in mind that the entire world does not follow US Contract / Copyright law (or even the bern conventions). In some countries, a CLA may be the only possible way to ensure that a project won't have problems later. While the current versions of today's "free software" licenses have generally tried to account for that, legal situations change over time.

by chejazi 11y ago

sjrd 11y ago

Most open source projects have a CLA, nowadays. I don't see how this would inhibit contributions.

cjbprime 11y ago

NodeJS has exactly the same restriction.

silverwind 11y ago
Node.js does not require a CLA anymore since it left Joyent behind.
- cjbprime 11y ago
  Oops thanks!
deleted 11y ago
[deleted]

jhchen 11y ago

What's wrong with a CLA? It's incredibly common for projects open sourced by companies.

JupiterMoon 11y ago
It means that the company owns the copyright to everything and can close the source again any time they want. EDIT Dear mods. Some pretty measured posts are getting serious heat in this (and other threads relating to MS) maybe you could look into it?
- teddyh 11y ago
  It also means that the company can sell proprietary versions with extended functionality, and the company is therefore motivated to not allow contributions to the free code which duplicates functionality which they sell.
  - comex 11y ago
    However, since ChakraCore is released under a permissive license (like most corporate open source projects), Microsoft could do the same thing without a CLA. It matters more when something is under a GPL variant...
    - carussell 11y ago
      It's a good point, but it matters for Apache licensed code, too, because Apache 2.0 has a self-destruct clause in the patent grant to keep all parties' lawyers in check. CLAs (like the one Microsoft uses) routes around that. The way this ends up working for Microsoft projects licensed under Apache 2.0 is that it essentially allows Microsoft to do anything with the contributions (as if it were licensed under MIT, with a liberal interpretation of the implied patent grant), but requires everyone else to continue abiding by Apache 2.0. Not exactly balanced. EDIT: I'm totally confused about why people are having a problem with this comment.
      - krisdol 11y ago
        >I'm totally confused about why people are having a problem with this comment. It seems like half of this submission is a graveyard. Disappointing.

stonesam92 11y ago

Don't most large organisations require something similar with their own open source projects? I know Google and Facebook do. It's just a way of confirming that you own the rights to your contribution, and that you explicitly give Microsoft permission to use it. (And if you didn't want to grant them permission, you would have no reason to contribute!)

carussell 11y ago
> Don't most large organisations require something similar with their own open source projects? I know Google and Facebook do. Mozilla gets by without one. Apple's approach for managing Swift, too. > It's just a way of confirming that you own the rights to your contribution, and that you explicitly give Microsoft permission to use it. If that's all they wanted to do, they could get by with something resembling the terms that Mozilla gets its committer's to sign. Usually these CLAs are specifically written to go a lot further than that, though. They usually take away a lot of the contributors' bargaining power. Microsoft's CLAs included.
- magicalist 11y ago
  > * Mozilla gets by without one. Apple's approach for managing Swift, too.* Mozilla does have one. > Code committed by you to a Mozilla Repository, whether written by you or a third party, must be governed by the Mozilla Public License 2.0, or another license or set of licenses acceptable to the Mozilla Foundation for the Code in question. https://static.mozilla.com/foundation/documents/commit-access/committers-agreement.pdf https://static.mozilla.com/foundation/documents/commit-acces... Swift has a much shorter one: > By submitting a pull request, you represent that you have the right to license your contribution to Apple and the community, and agree by submitting the patch that your contributions are licensed under the Swift license. https://github.com/apple/swift/blob/master/CONTRIBUTING.md https://github.com/apple/swift/blob/master/CONTRIBUTING.md
  - carussell 11y ago
    Neither of those are CLAs. Please correct your comment. I'm particularly perplexed why you linked to that Mozilla document, for two reasons: 1. It says what it is, and as I said above, it's not a CLA. I've signed that document. It's required by everyone to get commit access to the Mozilla repositories. Here's how it works if you want to contribute to Mozilla: you send in a patch, they accept it, and say thank you. Nobody has to sign anything. (The same process goes for Swift, by the way.) 2. I specifically mentioned such a committer's agreement in my comment. It's even in the part you quoted.

binarycrusader 11y ago

Yes, many projects do not, but some very popular ones do: Google Go requires one. Apache requires one. Some FSF projects require one. I could go on, but the point is that CLAs exist for good reasons. There may be another, different way to accomplish the same goals, but since it isn't my pocketbook funding the project, I don't feel like I have a right to complain. As such, just because a project has a CLA doesn't mean there's anything nefarious or inhibiting going on.

krisdol 11y ago
In the case of the MIT license, I don't see much harm in throwing in a CLA because it's nearly impossible for Microsoft to do anything to break the terms of the license; however, while I am not a lawyer and this isn't legal advice, in general signing a CLA (including in this instance) often gives the other party rights to re-license the work and continue to use the work if they end up in violation of the original license. For istance, a hugely popular, third-party Minecraft modification platform called Bukkit was partially licensed under the GPL (v2, I believe); however, it turned out that this code was not permitted to be distributed as GPL because it linked to to proprietary code, and Mojang was not eager to open source anything anytime soon. Because contributors submitted their contributions to be used under the terms of the GPL, and the project failed to meet the requirements of the GPL, contributors were then able to file legal DMCA notices of copyright infringement to take down the project. Regardless of what license the project is filed under, as an individual contributor working for free for the community, the license of a project determines the terms under which I am sharing my work. I expect those to be respected in perpetuity, and I would like the right to rescind my contribution if the copyright holder is in violation of the license. (Please don't turn this into a GPL vs MIT discussion) EDIT Echoing other responders here, if you downvoted I would really appreciate the discussion of why.
- binarycrusader 11y ago
  Regardless of what license the project is filed under, as an individual contributor working for free for the community, the license of a project determines the terms under which I am sharing my work. I expect those to be respected in perpetuity, and I would like the right to rescind my contribution if the copyright holder is in violation of the license. The CLA is just another license to consider with the project; just like projects that have the "any later version" GPL clause. That little addition is important to some individuals. I think a more successful argument would be against the lack of specific guarantees in existing CLAs, rather than CLAs themselves. For example, the CLA could give joint copyright to the involved parties, but also agree to only publish the code under a license published by the Free Software Foundation. CLAs, as you point out, are sometimes a necessary mechanism to ensure that a project can correct licensing issues when they arise. Obviously, through careful choice of licensing it may be possible to avoid the need for a CLA entirely, such as is starting to be done with the Apache License 2.0 by some projects. So I would think of this differently: depending on the license, some projects may need a CLA for protections only available to them with one. For those projects, the community should encourage them to encode their intentions in the CLA to assuage fears and provide certain guarantees to contributors. Finally, keep in mind that the entire world does not follow US Contract / Copyright law (or even the bern conventions). In some countries, a CLA may be the only possible way to ensure that a project won't have problems later. While the current versions of today's "free software" licenses have generally tried to account for that, legal situations change over time.