4 ms·
The huge difference is where the copyright of the code lays. OSS projects that require contributors to assign their copyright away, should not be trusted, and s
by j1elo 3y ago
The huge difference is where the copyright of the code lays. OSS projects that require contributors to assign their copyright away, should not be trusted, and should not receive goodwill contributions to begin with. Otherwise, what today is Apache 2.0, tomorrow can become Commercial, while asking nobody for permission, because the maintainers have ownership of 100% of the code.
Not that OSS projects backed by commercial-driven entities usually receive any meaningful amount of contributions from external people... but still, an important detail to think about OSS.
- andrewstuart2 3y agoIt's super frustrating, because I want to assume the best, but I'm starting to agree more and more with this perspective as stuff like this makes me more cautious/cynical. Unless my CLA assigns copyright to a foundation, in which case I am more likely to believe it will be kept in line with the foundation's charter, e.g.
- lima 3y agoThis is incorrect, this can happen with any permissive license (BSD, Apache 2...) regardless of copyright assignments.
- ec109685 3y agoNo, it’s correct. BSD at least allows anyone to create a restrictive fork of the code. With a CLA, it grants Hashicorp rights to your contribution no other corporation has.
- j1elo 3y agoThe rule is simple: If you want to relicense a project, then you need approval from all the individual copyright holders. It does not matter if you are relicensing between permissive OSS licenses such as, for example, from Apache 2.0 to MIT. They are different licenses, so you need permission for the change. That's why OSS is commonly called a "Community". The software's copyright belongs to the hands of all the community of developers who have written and contributed code. What a CLA usually does is grant perpetual permission to do anything with the code, including to relicense without asking. Practically speaking, CLAs grant full control to a single hand. Thus, OSS projects with such CLAs are not part of any so-called "Open Source Community" in any meaningful way. EDIT: Changed "CLAs grant full ownership" -> "CLAs grant full control", to avoid misunderstandings.
- dragonwriter 3y ago> What a CLA usually does is grant perpetual permission to do anything with the code, including to relicense without asking. Practically speaking, CLAs grant full ownership to a single hand. No, they don’t. CLAs don’t transfer ownership.
- j1elo 3y agoWhat CLAs do, is explained in the first half of the sentence. What it means in practice (in the context of talking about relicensing) is hence what "practically speaking" means. Anyway I've edited it to avoid using the word "ownership", which might confuse the intended meaning.
- hamandcheese 3y agoDoes assigning copyright with a CLA mean that I would not be free to, say, submit the same PR to more permissive fork as well as Hashicorp's vault?
- seabass-labrax 3y agoIt depends on the CLA, and there is often very little similarity between one CLA and another. On a technical note, CLAs don't usually assign copyright, they only grant a licence, but one which permits the recipient of the CLA to relicense the contribution whenever they choose to.
- ec109685 3y agoYes, they would be allowed.
- dragonwriter 3y ago> Does assigning copyright with a CLA mean that I would not be free to, say, submit the same PR to more permissive fork as well as Hashicorp's vault? A CLA, by definition, licenses rather than assigns copyright. A CAA assigns copyright. Typically, a CLA does not restrict the licensors right to license the same contribution elsewhere (if it is legally derivative of a project whose own license is restrictive, that may prevent it, however.)
- sanderjd 3y agoI would much rather contribute to a project with a CLA and the possibility to be commercially licensed by the entity driving the work on the project. I'm not that interested in working for Amazon for free...
- growse 3y agoYou can't have it both ways. You either believe in, and enthusiastically participate in the development of free software (the philosophy of which requires freedoms to be available on an equitable basis), or you don't.
- sanderjd 3y agoI am not an ideologue (and I frankly struggle to understand why people find it appealing to be ideologues). I just want there to be a lot of software made that is useful to me. Software is far more useful to me if I can read and modify its source code. So my metric is just whether I think something will incentivize people to make more or less of that kind of software. I worry that people will make less and less software that runs as a service in this fashion, as it n becomes more and more obvious that the benefits of that software flow to giant integrated cloud platform providers rather than to the people who make the software. Being a chump is not motivating, and I think that's the current incentive structure. So I like seeing people try different structures that seem to me like they structure the incentives better. But you're totally right, philosophy has nothing to do with it for me.
- growse 3y ago> ... as it n becomes more and more obvious that the benefits of that software flow to giant integrated cloud platform providers rather than to the people who make the software. The whole point of open source is that everybody has the opportunity to contribute to the benefit of everybody. You don't get to say "oh, but nazis / Amazon / rapists don't get to use this because I disagree with their morals". The incentive to contribute comes from being part of a community that gets to experience better quality software. For many (me included), that's plenty. I really don't care what Amazon does - I'm neither a customer, nor an investor.