3 ms·

How is a CLA any different of a legal agreement than agreeing to a license? The CLAs I have seen basically boil down to the project maintainers maintaining own

by bmitc 3y ago

How is a CLA any different of a legal agreement than agreeing to a license? The CLAs I have seen basically boil down to the project maintainers maintaining ownership of the code, ability to adjust the license if desired, and protect them from people contributing code that the contributor doesn't have the rights for. I have seen projects suffer from single contributors stubbornly refusing to budge on relicensing, even if the relicense would benefit the project.

A1kmm 3y ago
If I contribute to an AGPL project and license my changes back to you under AGPL, that means you can't one day decide to start selling my changes together with a closed-source module; the copyleft works to protect me against you deciding to take my changes closed-source, not just to protect the original maintainer from that. If I contribute to an AGPL project and sign a CLA that assigns copyright to you, you might announce tomorrow that you are going to run off with my contribution and start only releasing new versions under a non-FOSS licence. This fear applies particularly if you are a for-profit company who might one day lose your desire to do FOSS. This exact thing, in fact (other than the AGPL part anyway) happened recently with just about every Hashicorp project - so it is not just some hypothetical fear. I would not contribute (unless I was being paid) to someone else's project unless there was no CLA (inbound = outbound licensing), or they were a not-for-profit with appropriate constitutional limitations on profit-seeking behaviour.
- pydry 3y ago
  >If I contribute to an AGPL project and sign a CLA that assigns copyright to you, you might announce tomorrow that you are going to run off with my contribution and start only releasing new versions under a non-FOSS licence. That is generally the point of a CLA. If that bothers you you're supposed to not contribute and not sign. The up side is that that revenue model might mean that they can pay people to do that work instead of relying upon drive by pull requests and maintainers dedicating their time for free. Back in the early days of open source I saw a lot of people get mad at viral licensing because it did exactly what it was supposed to. There was some weird sort of entitlement complex going on where people felt entitled not only to use open source but that it was somehow unfair that they couldn't also violate the terms and conditions of using it. I was similarly perplexed by the reaction back then too.
- bmitc 3y ago
  You're just explaining what a CLA does. There's pros and cons toward one. I for one don't see the problem. Yes, the maintainers retain control, and that can be good or bad. But contributors getting a portion of control can also be good or bad. One way is not strictly better or worse than the other. But if a project that has a CLA also has a currently permissive license, then take the supposedly open source route and fork it.
thatcks 3y ago
A CLA is a legal contract between two parties. An open source license is a general grant of additional permissions under copyright (and sometimes some additional promises regarding things like patents), provided that the person using those permissions (to make and distribute copies) adheres to certain requirements. (I am the author of the linked-to article.)
- bmitc 3y ago
  How is a software license not a legal contract? Everywhere I've seen treats it as such. A normal CLA is just making things that are implicit when contributing code explicit. It is a clarifying statement and agreement on who maintains control. So if the complaint is that CLAs force you and your company or institution to be explicit when contributing code, then I'm not sure I understand the complaint.

by bmitc 3y ago

A1kmm 3y ago

If I contribute to an AGPL project and license my changes back to you under AGPL, that means you can't one day decide to start selling my changes together with a closed-source module; the copyleft works to protect me against you deciding to take my changes closed-source, not just to protect the original maintainer from that. If I contribute to an AGPL project and sign a CLA that assigns copyright to you, you might announce tomorrow that you are going to run off with my contribution and start only releasing new versions under a non-FOSS licence. This fear applies particularly if you are a for-profit company who might one day lose your desire to do FOSS. This exact thing, in fact (other than the AGPL part anyway) happened recently with just about every Hashicorp project - so it is not just some hypothetical fear. I would not contribute (unless I was being paid) to someone else's project unless there was no CLA (inbound = outbound licensing), or they were a not-for-profit with appropriate constitutional limitations on profit-seeking behaviour.

pydry 3y ago
>If I contribute to an AGPL project and sign a CLA that assigns copyright to you, you might announce tomorrow that you are going to run off with my contribution and start only releasing new versions under a non-FOSS licence. That is generally the point of a CLA. If that bothers you you're supposed to not contribute and not sign. The up side is that that revenue model might mean that they can pay people to do that work instead of relying upon drive by pull requests and maintainers dedicating their time for free. Back in the early days of open source I saw a lot of people get mad at viral licensing because it did exactly what it was supposed to. There was some weird sort of entitlement complex going on where people felt entitled not only to use open source but that it was somehow unfair that they couldn't also violate the terms and conditions of using it. I was similarly perplexed by the reaction back then too.
bmitc 3y ago
You're just explaining what a CLA does. There's pros and cons toward one. I for one don't see the problem. Yes, the maintainers retain control, and that can be good or bad. But contributors getting a portion of control can also be good or bad. One way is not strictly better or worse than the other. But if a project that has a CLA also has a currently permissive license, then take the supposedly open source route and fork it.

thatcks 3y ago

A CLA is a legal contract between two parties. An open source license is a general grant of additional permissions under copyright (and sometimes some additional promises regarding things like patents), provided that the person using those permissions (to make and distribute copies) adheres to certain requirements. (I am the author of the linked-to article.)

bmitc 3y ago
How is a software license not a legal contract? Everywhere I've seen treats it as such. A normal CLA is just making things that are implicit when contributing code explicit. It is a clarifying statement and agreement on who maintains control. So if the complaint is that CLAs force you and your company or institution to be explicit when contributing code, then I'm not sure I understand the complaint.