4 ms·

This was a problem for us and the lack of the ability to switch off PRs continues to cause problems. Community submissions are virtually always throw away, par

This was a problem for us and the lack of the ability to switch off PRs continues to cause problems. Community submissions are virtually always throw away, particularly on a complex code base. We ended up saying it's a legal problem [1], which it partly is. But throw away not only because of quality issues, always because of project scope issues. Yes, you feel the project is completely useless unless emoji icons animate in diagrams. That's great, fork the project and kill ours off by adding the feature (which they won't and it won't). When you know what the project scope is, tight enforcement of that scope is critical to prevent the complexity of the project from running away and ultimately killing the project entirely. https://github.com/jgraph/drawio https://github.com/jgraph/drawio

j1elo 6y ago
> When you know what the project scope is, tight enforcement of that scope is critical to prevent the complexity of the project from running away and ultimately killing the project entirely. Which is why I believe a "benevolent dictatorship" style of governance has more chances (nitpick prevention: more, not all the chances) to become successful and thrive. If you let too many community members decide on what is in and out of scope, the project ends up being a conglomerate of the most random favorite features from the most vocal participants.
- distalx 6y ago
  And sometime these most vocal participants are all talk and no code.
drej 6y ago
> Note: We cannot accept non-trivial PRs for legal reasons. We need to retain copyright over the entire codebase. Does a CLA solve this? (Genuine question, I don't know.)
- MayeulC 6y ago
  Yes, this is what a CLA solves. And I tend to refrain from contributing to projects that have a CLA, although it might not be reasonable: there's little difference with licensing your contribution under MIT, I think. However, if you license your project under AGPL, you probably deemed AGPL comfortable for your needs. I did too, so licensing my contribution under something else feels a bit uncomfortable, especially if it is substantial.
- dodobirdlord 6y ago
  No, because if a contributor is legally not entitled to agree to the CLA and does anyway, it’s now your problem. Nemo dat quod non habet, nobody gives what they don’t have.
franga2000 6y ago
I never understood the legal issues there. Contributor License Agreements exist to solve that very problem. Want to make all contributions that are merged back into the project count as your own? No problem, simply put it in a CLA and make all PR authors sign it. If you get a takedown notice because the author of the PR actually included code they didn't write? You have a binding agreement from them, claiming that they had the right to sign over the code. You remove the code and move on with your life while they get prosecuted directly. It's like buying something at a pawn shop that turns out to have been stolen - you aren't responsible and if they did everything right, neither is the pawn shop.
- davidjgraph 6y ago
  We have a contract downstream where we provide turnkey delivery of software that uses the project as a base. The contract say we must own all the software delivered and we're liable for it. We don't want to be liable for code not written in-house.
  - franga2000 6y ago
    Fair enough, I can definitely see how reviewing contributed code to the required level of scrutiny would probably take at least as long, probably longer, as writing it in-house.
- ozim 6y ago
  I would add that is not only code contributor did not write. It might be that contributor does not understand his legal obligations to his current employer and I think probably no one is going to attach note from their company that they are allowed to contribute to the project. In the end paw shop is responsible if they are buying stolen goods, signing a paper is not a "get out of the jail free card" because a thief would sign on anything anyway just to sell stuff. Even if you get the paper that contribution is legal there is still a chance of legal trouble.
- dodobirdlord 6y ago
  The code could be copied from elsewhere, owned by the contributor’s employer, found to be an asset not eligible to be unilaterally signed away in a divorce proceeding, or any number of circumstances in which the contributor is not legally entitled to agree to the CLA. And now you can be sued for damages.

j1elo 6y ago

> When you know what the project scope is, tight enforcement of that scope is critical to prevent the complexity of the project from running away and ultimately killing the project entirely. Which is why I believe a "benevolent dictatorship" style of governance has more chances (nitpick prevention: more, not all the chances) to become successful and thrive. If you let too many community members decide on what is in and out of scope, the project ends up being a conglomerate of the most random favorite features from the most vocal participants.

distalx 6y ago
And sometime these most vocal participants are all talk and no code.

drej 6y ago

> Note: We cannot accept non-trivial PRs for legal reasons. We need to retain copyright over the entire codebase. Does a CLA solve this? (Genuine question, I don't know.)

MayeulC 6y ago
Yes, this is what a CLA solves. And I tend to refrain from contributing to projects that have a CLA, although it might not be reasonable: there's little difference with licensing your contribution under MIT, I think. However, if you license your project under AGPL, you probably deemed AGPL comfortable for your needs. I did too, so licensing my contribution under something else feels a bit uncomfortable, especially if it is substantial.
dodobirdlord 6y ago
No, because if a contributor is legally not entitled to agree to the CLA and does anyway, it’s now your problem. Nemo dat quod non habet, nobody gives what they don’t have.

franga2000 6y ago

I never understood the legal issues there. Contributor License Agreements exist to solve that very problem. Want to make all contributions that are merged back into the project count as your own? No problem, simply put it in a CLA and make all PR authors sign it. If you get a takedown notice because the author of the PR actually included code they didn't write? You have a binding agreement from them, claiming that they had the right to sign over the code. You remove the code and move on with your life while they get prosecuted directly. It's like buying something at a pawn shop that turns out to have been stolen - you aren't responsible and if they did everything right, neither is the pawn shop.

davidjgraph 6y ago
We have a contract downstream where we provide turnkey delivery of software that uses the project as a base. The contract say we must own all the software delivered and we're liable for it. We don't want to be liable for code not written in-house.
- franga2000 6y ago
  Fair enough, I can definitely see how reviewing contributed code to the required level of scrutiny would probably take at least as long, probably longer, as writing it in-house.
ozim 6y ago
I would add that is not only code contributor did not write. It might be that contributor does not understand his legal obligations to his current employer and I think probably no one is going to attach note from their company that they are allowed to contribute to the project. In the end paw shop is responsible if they are buying stolen goods, signing a paper is not a "get out of the jail free card" because a thief would sign on anything anyway just to sell stuff. Even if you get the paper that contribution is legal there is still a chance of legal trouble.
dodobirdlord 6y ago
The code could be copied from elsewhere, owned by the contributor’s employer, found to be an asset not eligible to be unilaterally signed away in a divorce proceeding, or any number of circumstances in which the contributor is not legally entitled to agree to the CLA. And now you can be sued for damages.