5 ms·

I've been turned off many times from contributing because projects had incomplete or inscrutable CLAs. Of course, the person in charge of asking for a CLA signa

by remram 3y ago

I've been turned off many times from contributing because projects had incomplete or inscrutable CLAs. Of course, the person in charge of asking for a CLA signature is usually not very knowledgeable about their own CLA, being a programmer and not a lawyer. For example, I have been asked to sign CLAs that granted rights to "recipients" or "organizations" that they hadn't named, having simply adopted a template CLA without filling it in. Some placed specific requirements on me, like "notifying the Project Manager", without information on how to do that or who they were. cla-assistant.io even has the unbelievable default of stating that it's a "CLA for multiple repositories or organizations" without naming them. How can you agree to a contract without knowing where it applies? In my experience it is rarely possible to legally contribute to a project that uses a CLA. You can ignore the legal issue with the assumption that none of it will come up anyway, but that's a weird way to approach contracts.

cxr 3y ago
I factor CLAs into my determination of how difficult a project upstream is going to be to work with (incl. whether to remain downstream as a user, too—if I even am at that point) and/or how irrational its maintainers are. It doesn't inspire confidence, for example, when a project doesn't practice good hygiene with respect to keeping a tightly focused bugtracker (usually on the basis that it's too bureaucratic and they're lazy) but then turn around and ask you jump through a thousand unnecessary hoops that includes a CLA signoff just to fix a broken link in the README or code comments. And I have even less interest tacitly endorsing projects by people who get abusive or are obnoxiously stubborn about not being able to admit when they're wrong or reveal that they don't even understand their own CLA[1]. 1. e.g., <https://github.com/neovim/neovim/issues/3036 https://github.com/neovim/neovim/issues/3036>
- deleted 3y ago
  [deleted]
- williamvds 3y ago
  As soon as I see a CLA I'm turned off even using a piece of FOSS software. I get it's usually just the lawyers protecting the company just in case a contributor tries something dodgy in the future. Out of principle however, I resent the broad assignment of copyright and granting them the right to relicense. Of course I expect most of these projects would never exercise that right, but the mere fact that they _could_ take my Free work and make it non-Free is very disturbing. So I'm simply not going to use it. I'm not going to get invested, then find a problem that I could theoretically submit a patch for. Rather than think of all the users who would benefit from my change, I'll just see it as free work for a megacorp.
  - tpoacher 3y ago
    indeed you could argue that a CLA makes it non-FOSS, since the idea is to restrict your freedoms and the degree of openness in the first place
  - saulpw 3y ago
    I have a CAA on my GPL project so that I have the right to start releasing it as MIT, that is, more Free. Also so I can dual-license it to a corporation and make a modicum of money from the software that is 98% my work. I absolutely never intend to make future versions non-free (and I don't even have the right to make already released versions non-free). Do you find this disturbing?
    - bkor 3y ago
      > I have a CAA on my GPL project so that I have the right to start releasing it as MIT, that is, more Free. That really depends on the CAA. It might allow way more. The text might be (legally) not applicable or have flaws, etc. > Do you find this disturbing? It is a barrier to contribute. I would not even bother trying to contribute. Your statements here are already a bit conflicting to me. You partly might want to monetize the software. You partly might want to release it as MIT. I don't see how you'd still have a means to monetize if you'd release it as MIT. Feels like you want to keep all options open. That all said, hey, you developed it, so cool if you'd listen to people with different opinions but I'd likely not need your software anyway I guess. Further, loads of non-CAA pure GPL software never receive any contributions. It takes quite a bit of effort to be noticed and get contributions. FYI: If I reread above parts might come across as harsh but none is meant that way.
      - Spivak 3y ago
        > It is a barrier to contribute. Most CLAs are a bot on the MR where you click sign, type your name, and it's done. If you don't really care about your code ownership then it's barely a speed bump compared to the rest of getting a PR merged.
      - saulpw 3y ago
JohnFen 3y ago
I agree. The existence of a CLA is a big red flag to me, and I avoid such projects.

by remram 3y ago

cxr 3y ago

I factor CLAs into my determination of how difficult a project upstream is going to be to work with (incl. whether to remain downstream as a user, too—if I even am at that point) and/or how irrational its maintainers are. It doesn't inspire confidence, for example, when a project doesn't practice good hygiene with respect to keeping a tightly focused bugtracker (usually on the basis that it's too bureaucratic and they're lazy) but then turn around and ask you jump through a thousand unnecessary hoops that includes a CLA signoff just to fix a broken link in the README or code comments. And I have even less interest tacitly endorsing projects by people who get abusive or are obnoxiously stubborn about not being able to admit when they're wrong or reveal that they don't even understand their own CLA[1]. 1. e.g., <https://github.com/neovim/neovim/issues/3036 https://github.com/neovim/neovim/issues/3036>

deleted 3y ago
[deleted]
williamvds 3y ago
As soon as I see a CLA I'm turned off even using a piece of FOSS software. I get it's usually just the lawyers protecting the company just in case a contributor tries something dodgy in the future. Out of principle however, I resent the broad assignment of copyright and granting them the right to relicense. Of course I expect most of these projects would never exercise that right, but the mere fact that they _could_ take my Free work and make it non-Free is very disturbing. So I'm simply not going to use it. I'm not going to get invested, then find a problem that I could theoretically submit a patch for. Rather than think of all the users who would benefit from my change, I'll just see it as free work for a megacorp.
- tpoacher 3y ago
  indeed you could argue that a CLA makes it non-FOSS, since the idea is to restrict your freedoms and the degree of openness in the first place
- saulpw 3y ago
  I have a CAA on my GPL project so that I have the right to start releasing it as MIT, that is, more Free. Also so I can dual-license it to a corporation and make a modicum of money from the software that is 98% my work. I absolutely never intend to make future versions non-free (and I don't even have the right to make already released versions non-free). Do you find this disturbing?
  - bkor 3y ago
    > I have a CAA on my GPL project so that I have the right to start releasing it as MIT, that is, more Free. That really depends on the CAA. It might allow way more. The text might be (legally) not applicable or have flaws, etc. > Do you find this disturbing? It is a barrier to contribute. I would not even bother trying to contribute. Your statements here are already a bit conflicting to me. You partly might want to monetize the software. You partly might want to release it as MIT. I don't see how you'd still have a means to monetize if you'd release it as MIT. Feels like you want to keep all options open. That all said, hey, you developed it, so cool if you'd listen to people with different opinions but I'd likely not need your software anyway I guess. Further, loads of non-CAA pure GPL software never receive any contributions. It takes quite a bit of effort to be noticed and get contributions. FYI: If I reread above parts might come across as harsh but none is meant that way.
    - Spivak 3y ago
      > It is a barrier to contribute. Most CLAs are a bot on the MR where you click sign, type your name, and it's done. If you don't really care about your code ownership then it's barely a speed bump compared to the rest of getting a PR merged.
    - saulpw 3y ago

JohnFen 3y ago

I agree. The existence of a CLA is a big red flag to me, and I avoid such projects.