5 ms·

What happens if not everyone responds to the emails?

shaggyfrog 10y ago
The OpenBSD team is asking that very same question: https://marc.info/?l=openbsd-tech&m=149028593819547&w=2 https://marc.info/?l=openbsd-tech&m=149028593819547&w=2
- amenghra 10y ago
  Now I can respond on his behalf...
  - notaplumber 10y ago
    Take a look at the code they've attributed to him. I don't think he's overly concerned, not about that anyway. The overreaching attempt at re-licencing others work on the other hand...
    - flukus 10y ago
      Is it just the direct contributions though? Everything added/modified after that should be considered a derivative work.
    - amenghra 10y ago
      > + *) Removed old DES API. > + [Rich Salz] I'm confused. Taking credit for other people's work?
- jwilk 10y ago
  Why is https://github.com/openssl/openssl/commit/24956ca00f014a917fb181a8abc39b349f3f316f https://github.com/openssl/openssl/commit/24956ca00f014a917f... on the list of Theo de Raadt's contributions?
okket 10y ago
Might be problematic later... "If we do not hear from you, we will assume that you have no objection"
- protomyth 10y ago
  That's not going to fly if someone gets testy. Perhaps they should have talked to a project that's done it before like the Squeak folks. They really had to know how the OpenBSD contributors would react to the Apache license.
  - throwaway91111 10y ago
    Someone might object. Perhaps this is the fastest route forward (i.e. directly asking for concerns).
    - BucketSort 10y ago
      I'm not sure.
  - cdegroot 10y ago
    Squeak guy here - I did a lot of prodding around the relicensing and it was pretty much the same situation. An old code base and a license that was "open source" at heart but had problematic language. It's impossible to reach everybody - Squeak has code going back to 1978 I think :-). We got the thumbs up from the main contributors (Kay and friends - in fact, I think it was Alan who started pushing for this), we got the thumbs up from Apple (that took a while but they were very cooperative and nice), we decided that Disney didn't own any of the code (that was a big relief ;-)), and then when we didn't get any objections from major contributors we went ahead and hoped for the best. Law is not mathematics, it's a human endeavour and that makes the application of the rules, however precise they're written, often more messy than we techies are comfortable with. 90% of my encounters with legal stuff is "what are the trade-offs". Ditto here - you trade off the burden of having a shitty license against the vanishingly small risk that some contributor will want to retract its code and live with the decision - if you can show you did your due diligence the impact should be low.
LeoPanthera 10y ago
I'm guessing, but if they can identify who contributed which parts of the code, they can clean-room reverse engineer those parts.
- hermitdev 10y ago
  I don't think that'd be as easy as you'd think. They would need brand new contributors to make those changes. There'd be no way to prove that existing contributors hadn't been tainted by reading the source under the previous license - especially problematic if they've contributed changes to any affected source files.
  - geofft 10y ago
    Is there a legal source (i.e., not a hacker-folklore source) for the claim that a "clean room" reimplementation needs to be from someone who is not mentally contaminated by awareness of the old implementation? In particular, in Oracle v. Google it turned out that Google employed the same person (Joshua Bloch) to write a bunch of Dalvik core libraries who had previously written the same Java core libraries, and that somehow was not an issue in the case. Only the nine identical lines of rangeCheck were an issue. So I'm questioning my understanding of the law here.
    - dragonwriter 10y ago
      > Is there a legal source (i.e., not a hacker-folklore source) for the claim that a "clean room" reimplementation needs to be from someone who is not mentally contaminated by awareness of the old implementation? Exposure increases the risk that work that appears like it might be derivative will be found to derivative, but there is no legal rule about it, it's just evidence from which a trier of fact might, in combination with other evidence, conclude derivation in violation of copyright. Clean room means that (presuming the trier of fact accepts that it was a clean room) there can be no derivation or copying, because there was no access to the source from which that could have occurred. This isn't about the legal rule directly, but about evidence from which one might conclude that a violation of the rule occurred. Of course, given API copyrights, rewriting code to implement the API of existing code is potentially problematic even with a clean room implementation, since the API is preserved.
viraptor 10y ago
I don't think there's an if. Some people will have moved to other address, some employee addresses will be gone, some company domains won't exist anymore, some developer may not be alive anymore. They choose to see that as implicit agreement. Hope they consulted with lawyers on that one.
tossaway234234 10y ago
If not everyone responds, or some people decline, then the code they contributed will have to be rewritten. It's a pain, but pretty much the only way to ensure all code is compliant. I assume there is some tool that combines a blame line with a licence.
- koolba 10y ago
  I've read about code being rewritten for license compliance but how does that work in practice? Even a self contained file isn't so straightforward as how would you differentiate between "new code" and simply copying the old one as a "new patch"?
  - kibwen 10y ago
    I don't know if a rewrite for the sake of license compliance because of an actively litigating party has ever happened in OSS. In practice, we just don't know how far someone would go to prove ownership over individual characters in a source file.
    - michel-slm 10y ago
      I wonder if Mozilla went through this: "It is possible that there may be Mozilla source files containing contributed code for which the copyright holders refuse to grant permission for relicensing under the MPL/GPL/LGPL triple license. In those cases we will investigate whether the situation can be resolved by someone writing new code to replace the code which cannot be relicensed. (This may require writing a complete new source file, or simply rewriting one or more portions of an existing file.)" https://www-archive.mozilla.org/MPL/relicensing-faq.html#permission-not-granted https://www-archive.mozilla.org/MPL/relicensing-faq.html#per...
      - kibwen 10y ago
        I have no doubt that there are projects that have rewritten code because of the hypothetical threat of imagined future legal action, but I don't actually know of real legal action that has happened because of a relicensing, and the pressing question is what sort of form that copyright claim would take (which we won't know without a dedicated prosecutor, but can probably guess at).
obstinate 10y ago
Presumably this depends on how many don't respond (or respond in the negative) and the extent of their contributions. If the contributions are small and most people are for, it may be possible to rewrite some code. They may also find that a lot of the contributors' code has since been deleted, and therefore that they do not need their permission. It will be interesting to see, to be sure.
- dragonwriter 10y ago
  Code being deleted may not be enough to make it safe, if it was deleted because it was replaced by code which was legally derivative of it.

The OpenBSD team is asking that very same question: https://marc.info/?l=openbsd-tech&m=149028593819547&w=2 https://marc.info/?l=openbsd-tech&m=149028593819547&w=2

amenghra 10y ago
Now I can respond on his behalf...
- notaplumber 10y ago
  Take a look at the code they've attributed to him. I don't think he's overly concerned, not about that anyway. The overreaching attempt at re-licencing others work on the other hand...
  - flukus 10y ago
    Is it just the direct contributions though? Everything added/modified after that should be considered a derivative work.
  - amenghra 10y ago
    > + *) Removed old DES API. > + [Rich Salz] I'm confused. Taking credit for other people's work?
jwilk 10y ago
Why is https://github.com/openssl/openssl/commit/24956ca00f014a917fb181a8abc39b349f3f316f https://github.com/openssl/openssl/commit/24956ca00f014a917f... on the list of Theo de Raadt's contributions?

okket 10y ago

Might be problematic later... "If we do not hear from you, we will assume that you have no objection"

protomyth 10y ago
That's not going to fly if someone gets testy. Perhaps they should have talked to a project that's done it before like the Squeak folks. They really had to know how the OpenBSD contributors would react to the Apache license.
- throwaway91111 10y ago
  Someone might object. Perhaps this is the fastest route forward (i.e. directly asking for concerns).
  - BucketSort 10y ago
    I'm not sure.
- cdegroot 10y ago
  Squeak guy here - I did a lot of prodding around the relicensing and it was pretty much the same situation. An old code base and a license that was "open source" at heart but had problematic language. It's impossible to reach everybody - Squeak has code going back to 1978 I think :-). We got the thumbs up from the main contributors (Kay and friends - in fact, I think it was Alan who started pushing for this), we got the thumbs up from Apple (that took a while but they were very cooperative and nice), we decided that Disney didn't own any of the code (that was a big relief ;-)), and then when we didn't get any objections from major contributors we went ahead and hoped for the best. Law is not mathematics, it's a human endeavour and that makes the application of the rules, however precise they're written, often more messy than we techies are comfortable with. 90% of my encounters with legal stuff is "what are the trade-offs". Ditto here - you trade off the burden of having a shitty license against the vanishingly small risk that some contributor will want to retract its code and live with the decision - if you can show you did your due diligence the impact should be low.

LeoPanthera 10y ago

I'm guessing, but if they can identify who contributed which parts of the code, they can clean-room reverse engineer those parts.

hermitdev 10y ago
I don't think that'd be as easy as you'd think. They would need brand new contributors to make those changes. There'd be no way to prove that existing contributors hadn't been tainted by reading the source under the previous license - especially problematic if they've contributed changes to any affected source files.
- geofft 10y ago
  Is there a legal source (i.e., not a hacker-folklore source) for the claim that a "clean room" reimplementation needs to be from someone who is not mentally contaminated by awareness of the old implementation? In particular, in Oracle v. Google it turned out that Google employed the same person (Joshua Bloch) to write a bunch of Dalvik core libraries who had previously written the same Java core libraries, and that somehow was not an issue in the case. Only the nine identical lines of rangeCheck were an issue. So I'm questioning my understanding of the law here.
  - dragonwriter 10y ago
    > Is there a legal source (i.e., not a hacker-folklore source) for the claim that a "clean room" reimplementation needs to be from someone who is not mentally contaminated by awareness of the old implementation? Exposure increases the risk that work that appears like it might be derivative will be found to derivative, but there is no legal rule about it, it's just evidence from which a trier of fact might, in combination with other evidence, conclude derivation in violation of copyright. Clean room means that (presuming the trier of fact accepts that it was a clean room) there can be no derivation or copying, because there was no access to the source from which that could have occurred. This isn't about the legal rule directly, but about evidence from which one might conclude that a violation of the rule occurred. Of course, given API copyrights, rewriting code to implement the API of existing code is potentially problematic even with a clean room implementation, since the API is preserved.

viraptor 10y ago

I don't think there's an if. Some people will have moved to other address, some employee addresses will be gone, some company domains won't exist anymore, some developer may not be alive anymore. They choose to see that as implicit agreement. Hope they consulted with lawyers on that one.

tossaway234234 10y ago

If not everyone responds, or some people decline, then the code they contributed will have to be rewritten. It's a pain, but pretty much the only way to ensure all code is compliant. I assume there is some tool that combines a blame line with a licence.

koolba 10y ago
I've read about code being rewritten for license compliance but how does that work in practice? Even a self contained file isn't so straightforward as how would you differentiate between "new code" and simply copying the old one as a "new patch"?
- kibwen 10y ago
  I don't know if a rewrite for the sake of license compliance because of an actively litigating party has ever happened in OSS. In practice, we just don't know how far someone would go to prove ownership over individual characters in a source file.
  - michel-slm 10y ago
    I wonder if Mozilla went through this: "It is possible that there may be Mozilla source files containing contributed code for which the copyright holders refuse to grant permission for relicensing under the MPL/GPL/LGPL triple license. In those cases we will investigate whether the situation can be resolved by someone writing new code to replace the code which cannot be relicensed. (This may require writing a complete new source file, or simply rewriting one or more portions of an existing file.)" https://www-archive.mozilla.org/MPL/relicensing-faq.html#permission-not-granted https://www-archive.mozilla.org/MPL/relicensing-faq.html#per...
    - kibwen 10y ago
      I have no doubt that there are projects that have rewritten code because of the hypothetical threat of imagined future legal action, but I don't actually know of real legal action that has happened because of a relicensing, and the pressing question is what sort of form that copyright claim would take (which we won't know without a dedicated prosecutor, but can probably guess at).

obstinate 10y ago

Presumably this depends on how many don't respond (or respond in the negative) and the extent of their contributions. If the contributions are small and most people are for, it may be possible to rewrite some code. They may also find that a lot of the contributors' code has since been deleted, and therefore that they do not need their permission. It will be interesting to see, to be sure.

dragonwriter 10y ago
Code being deleted may not be enough to make it safe, if it was deleted because it was replaced by code which was legally derivative of it.