3 ms·

I've come around to a new appreciation of why a CLA may not be bad. I have a business. That business deals in copyleft software that I have sole copyright in (

I've come around to a new appreciation of why a CLA may not be bad. I have a business. That business deals in copyleft software that I have sole copyright in (or comes from permissively-licensed code). My customers, which will be businesses, will be required to sign a contract with a CLA so that if they make changes, I will be the copyright holder of those changes. No, I won't have individuals sign a CLA. But I also won't accept contributions from individuals, like the SQLite authors, who need a guarantee that all of their code can be public domain. In this way, I will be legally able to loosen the license over time if I so wish. Without CLA's for customers, I couldn't do that.

driminicus 3y ago
> In this way, I will be legally able to loosen the license over time if I so wish. Without CLA's for customers, I couldn't do that. Or you can make it poprietary, which is the exact reason I would not want to sign a CLA with you, because I want a guarantee that my contribution remains foss.
- gavinhoward 3y ago
  True. But again, I don't take contributions from individuals, so I wouldn't ask you to sign one anyway. This means that if I take it proprietary, I will have ensured I do not steal from any contributors.
  - omniglottal 3y ago
    You will not have stolen in the same way that Google/FB don't "steal" your data. Instead, the end user is simply forced into the position to give away their IP to you, where you can adjust the licensing per your whims, even to sell it back to them. It's fine to consider your lack of contributors is related to the "no individual" contributors" choice that you have made, but it would be disingenuous to avoid recognition of how your choices probably result more in "no contributors".
    - gavinhoward 3y ago
      Individual end users will not be contributors. Businesses will be contributors. These businesses have more "power" than me because they'll be bigger than my one-man shop. I'll do these CLA's to adjust that power balance.
tgma 3y ago
How many real contributors you have? Is it mainly just you and perhaps some tiny bug fixes?
- gavinhoward 3y ago
  I have exactly one who fixed some typos in documentation and gave me permission to relicense under any FOSS license.
Twirrim 3y ago
Lawyers at my job pointed out one particularly nasty aspect of CLAs: the lack of liability controls. All open source licenses have some form of legal liability wording in them, e.g. from GPL v2: > 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. No CLA I've seen so far does anything to maintain that protection from liability. Those responsible for the software could switch the license to one which leaves you, or your employer, legally liable for any damages incurred. That could very, very quickly, bankrupt you and/or them.
- justinludwig 3y ago
  Sure, but in America, anybody can sue anybody for anything. Your lawyers are of course right that having a clause in a software license disclaiming all liability for its use could be helpful in your defense -- but it's not an ironclad guarantee that you will not be sued or even found liable for your contributions in the event that it causes some kind of catastrophe. If this is a major concern for you, you should probably avoid contributing to FOSS altogether. However, if you don't own the software and don't distribute the software and don't have any other kind of relationship with the users of the software, it's likely going to require the plaintiff to demonstrate particularly egregious conduct on your part in order for a court to find that you have some liability for damages arising from the use of the software. But YMMV.
- gavinhoward 3y ago
  Well, of course. But if I accept a contribution, I'm already accepting responsibility for it, so I will not accept it unless I understand it and test the snot out of it. This is another reason I don't accept contributions from individuals.
  - 3y ago

driminicus 3y ago

> In this way, I will be legally able to loosen the license over time if I so wish. Without CLA's for customers, I couldn't do that. Or you can make it poprietary, which is the exact reason I would not want to sign a CLA with you, because I want a guarantee that my contribution remains foss.

gavinhoward 3y ago
True. But again, I don't take contributions from individuals, so I wouldn't ask you to sign one anyway. This means that if I take it proprietary, I will have ensured I do not steal from any contributors.
- omniglottal 3y ago
  You will not have stolen in the same way that Google/FB don't "steal" your data. Instead, the end user is simply forced into the position to give away their IP to you, where you can adjust the licensing per your whims, even to sell it back to them. It's fine to consider your lack of contributors is related to the "no individual" contributors" choice that you have made, but it would be disingenuous to avoid recognition of how your choices probably result more in "no contributors".
  - gavinhoward 3y ago
    Individual end users will not be contributors. Businesses will be contributors. These businesses have more "power" than me because they'll be bigger than my one-man shop. I'll do these CLA's to adjust that power balance.

tgma 3y ago

How many real contributors you have? Is it mainly just you and perhaps some tiny bug fixes?

gavinhoward 3y ago
I have exactly one who fixed some typos in documentation and gave me permission to relicense under any FOSS license.

Twirrim 3y ago

Lawyers at my job pointed out one particularly nasty aspect of CLAs: the lack of liability controls. All open source licenses have some form of legal liability wording in them, e.g. from GPL v2: > 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. No CLA I've seen so far does anything to maintain that protection from liability. Those responsible for the software could switch the license to one which leaves you, or your employer, legally liable for any damages incurred. That could very, very quickly, bankrupt you and/or them.

justinludwig 3y ago
Sure, but in America, anybody can sue anybody for anything. Your lawyers are of course right that having a clause in a software license disclaiming all liability for its use could be helpful in your defense -- but it's not an ironclad guarantee that you will not be sued or even found liable for your contributions in the event that it causes some kind of catastrophe. If this is a major concern for you, you should probably avoid contributing to FOSS altogether. However, if you don't own the software and don't distribute the software and don't have any other kind of relationship with the users of the software, it's likely going to require the plaintiff to demonstrate particularly egregious conduct on your part in order for a court to find that you have some liability for damages arising from the use of the software. But YMMV.
gavinhoward 3y ago
Well, of course. But if I accept a contribution, I'm already accepting responsibility for it, so I will not accept it unless I understand it and test the snot out of it. This is another reason I don't accept contributions from individuals.
- 3y ago