3 ms·

There's one thing that a company can do if they want to prove to their users that they'll always stay open. Ask their external contributors to sign a DCO (deve

There's one thing that a company can do if they want to prove to their users that they'll always stay open. Ask their external contributors to sign a DCO (developer certificate of origin) instead of a CLA (contributor license agreement.) The latter transfers the copyright to your contribution to the company, the former is merely an assertion that you do own that copyright and are legally allowed to contribute. This way, all external contributors own a small part of the copyright to the project. This makes changing the license almost impossible, as it would require either seeking permission from all those contributors or removing all of the code that they wrote. Whether a company uses a DCO or CLA should be the litmus test of how they really feel about open source. I'd strongly reconsider making your business dependent on any products from the latter.

justinclift 3y ago
> This way, all external contributors own a small part of the copyright to the project. People don't need to sign a DCO, or any other document, for that to be the case.
- verdverm 3y ago
  A DCO is more about protecting the project from using code it shouldn't, in that the developer certifies the origin (of the code) is safe to use, by either being their own creation or that the code used has a compatible license.
  - justinclift 3y ago
    While interesting, maybe that should be a reply to the comment I'm replying to as well? :)
    - verdverm 3y ago
      yeah, it would be cool if HN was more of a DAG than a tree
TheCoreh 3y ago
> it would require either seeking permission from all those contributors or removing all of the code that they wrote. I might be mistaken, but I believe this would only apply to copyleft licenses? Permissive licenses allow redistributing under a different license, as long as the attribution and original copyright disclaimer are retained.
- sytse 3y ago
  Exactly, I made a diagram for this, it is the first graphic on https://opencoreventures.com/blog/2022-10-preventing-the-bait-and-switch-open-core/ https://opencoreventures.com/blog/2022-10-preventing-the-bai...
jen20 3y ago
A CLA need not come with copyright assignment, and projects which require copyright assignment need not have a CLA (for example: the FSF requires copyright assignment but does not have a CLA). For my part, I have thousands of lines of code in Terraform for which I have never signed a CLA or copyright assignment. Nothing stops MPLv2-licensed files being used in a commercial source tree, provided the terms are compiled with.
- thayne 3y ago
  > I have thousands of lines of code in Terraform for which I have never signed a CLA or copyright assignment If that is true, Hashicorp can't change the license on any of the files that contain such code from MPL to BSL, as far as I understand. IANAL, but from what I understand of the license, it doesn't prevent them from distributing a binary with the BSL, but they would need to continue distributing any files with such contributions under the MPL along with any modifications to those files. And keeping track of which files would have that limitation sounds like a nightmare.
  - jen20 3y ago
    Indeed so - Go makes it fairly easy to track since packages are made up of multiple files, but it will need to be done.

justinclift 3y ago

> This way, all external contributors own a small part of the copyright to the project. People don't need to sign a DCO, or any other document, for that to be the case.

verdverm 3y ago
A DCO is more about protecting the project from using code it shouldn't, in that the developer certifies the origin (of the code) is safe to use, by either being their own creation or that the code used has a compatible license.
- justinclift 3y ago
  While interesting, maybe that should be a reply to the comment I'm replying to as well? :)
  - verdverm 3y ago
    yeah, it would be cool if HN was more of a DAG than a tree

TheCoreh 3y ago

> it would require either seeking permission from all those contributors or removing all of the code that they wrote. I might be mistaken, but I believe this would only apply to copyleft licenses? Permissive licenses allow redistributing under a different license, as long as the attribution and original copyright disclaimer are retained.

sytse 3y ago
Exactly, I made a diagram for this, it is the first graphic on https://opencoreventures.com/blog/2022-10-preventing-the-bait-and-switch-open-core/ https://opencoreventures.com/blog/2022-10-preventing-the-bai...

jen20 3y ago

A CLA need not come with copyright assignment, and projects which require copyright assignment need not have a CLA (for example: the FSF requires copyright assignment but does not have a CLA). For my part, I have thousands of lines of code in Terraform for which I have never signed a CLA or copyright assignment. Nothing stops MPLv2-licensed files being used in a commercial source tree, provided the terms are compiled with.

thayne 3y ago
> I have thousands of lines of code in Terraform for which I have never signed a CLA or copyright assignment If that is true, Hashicorp can't change the license on any of the files that contain such code from MPL to BSL, as far as I understand. IANAL, but from what I understand of the license, it doesn't prevent them from distributing a binary with the BSL, but they would need to continue distributing any files with such contributions under the MPL along with any modifications to those files. And keeping track of which files would have that limitation sounds like a nightmare.
- jen20 3y ago
  Indeed so - Go makes it fairly easy to track since packages are made up of multiple files, but it will need to be done.