5 ms·

This really sucks. I have always had great hope for the Matrix protocol. The AGPL isn't my favorite open source license, but it has its place... but a CLA? T

This really sucks. I have always had great hope for the Matrix protocol. The AGPL isn't my favorite open source license, but it has its place... but a CLA? That is a complete nonstarter. No one should ever sign a CLA that gives a company more rights to your contributions than you get from theirs.

appplication 3y ago
What’s the deal with CLAs? I’m not familiar with them.
- jraph 3y ago
  they allow the company making you sign the CLA change the license the entire project with your contribution in it to what they like, including making it proprietary.
- ensignavenger 3y ago
  When you try to contribute code back upstream, the company will require you to grant them broad rights to do whatever they want with it, including to relicense the code you are contributing under a proprietary license. You do not get the same rights in return to the upstream code. So the company can yake your contributions and go proprietary and you have no recourse.
  - gary_0 3y ago
    I'm surprised it's not more of a thing to have a CLA that allows relicensing only to another OSI-approved license. I don't see many examples along those lines[0]. And the "OSI-approved" wording would allow a project to freely switch between MIT/BSD/GPL/etc or even create their own license (as long as they get it OSI-approved) without having to hunt down past contributors for permission. I would never sign an open-ended CLA, though. For all I know, the project (with my code in it) could end up being bought by Oracle, proprietized, and used by Larry Ellison to construct the Torment Nexus. [0] https://en.wikipedia.org/wiki/Contributor_License_Agreement#CLAs_which_restrict_relicensing https://en.wikipedia.org/wiki/Contributor_License_Agreement#...
    - tpush 3y ago
      Well, the point of the AGPL + CLA combo is precisely to be able to profit off of community contributions by distributing proprietary versions.
    - lmm 3y ago
      > I'm surprised it's not more of a thing to have a CLA that allows relicensing only to another OSI-approved license. That would be meaningless - they could relicense it to MIT, distribute that MIT-licensed version to their subsidiary, and then have that subsidiary sell it under whatever proprietary license they wanted.
- vbezhenar 3y ago
  One example is Linux. You don't need to sign CLA to contribute to Linux. It has contributions from thousands of developers all over the world. It means that to switch Linux license to, say GPLv3, you would need to get permission from all of those developers or rewrite their contributions which is not possible in practice. To avoid this situation, some projects require their contributors to sign contributor license agreement. Terms might differ, but generally you allow your contribution to be relicensed in any way in the future. So today Matrix's AGPL, tomorrow they can go proprietary and you're OK with that. Also they want to sell their source code with proprietary license (so buyer's not obliged to open his modifications) and they also need contributor permission to do that. Basically it's a commercial project which is not interested with external contributions.
  - dbrgn 3y ago
    > tomorrow they can go proprietary and you're OK with that That depends on the CLA's wording. A CLA could allow the right to sell commercial licenses to the code while always keeping the same code under the AGPLv3. I haven't read Element's CLA though.
    - thomastjeffery 3y ago
      I haven't read it either, but a comment nearby (allegedly from the Element CEO) claims that their intent is to use this CLA to sell commercial licenses.
  - jeroenhd 3y ago
    AGPL also has some annoying side effects if you do t use a CLA. For example, Matrix has had a few proof of concepts for pure peer to peer network designs where every device runs its own server. That would be impossible toddeploy to app stores like the Apple App Store because that store is inherently incompatible with (A)GPL. The only way you can publish (A)GPL code to iPhones and iPads legally is to dual license all code from all contributors. With a CLA, a project can relicense the code to itself. Without it, the project can't upload their own project to the App Store and similar platforms. I think you'd be crazy to run Synapse on a phone, but Dendrite is built to be much more efficient for such use cases.
- WhyNotHugo 3y ago
  They grant the organisation (in this case a for-profit) the exclusive right to redistribute the project (and contributions made to it) under a different license. Including a proprietary licence. It is only required if you intend to move to an open-core model, or intend to eventually make the project non-open-source entirely. This is a common first step for many organisations that have moved in this direction. The announcement even makes it clear that they intend to ship versions for a fee, so it's very likely that we'll see a "community edition" and a "full edition" at some point. Or some other model which amounts to the same general idea.
Arathorn 3y ago
Speaking as CEO at Element - I don't particularly like CLAs either from an ideological perspective. However, the only way that Element can retain the right to provide alternative licenses to proprietary forks is if it has the right to do so, which means requiring a CLA. Otherwise the license change would not solve the problem that it's trying to solve, i.e. to provide a way for proprietary forks to contribute back to Matrix development costs, without having to AGPL their forks. [edit: clarify that CLA != assigning code ownership]
- thomastjeffery 3y ago
  > the only way that Element can retain the right to provide alternative licenses to proprietary forks I have a very straightforward and reasonable solution for you: don't do that.
  - camgunz 3y ago
    A better comment here would be a little more curious about why they're doing it (so they can run a business and fund future Matrix/Element development) or to maybe suggest some alternatives.
    - lannisterstark 3y ago
      They're allowed to say they don't like it and people shouldn't do x or y. I'm not sure why you believe that every comment needs to sealion in some way or another, or provide alternatives. People are allowed to dislike choices made by others and state that. And just that. "I'd have preferred you didn't" is a perfectly valid comment to make. They don't have to do what the comment is asking, you don't have to agree with it etc, but it is a valid comment.
      - camgunz 3y ago
        I didn't say it was invalid. I gave an example of how it could do better. I'm allowed to say I don't like their comment, to dislike it and state that. I even did better and gave them constructive criticism, walking the walk, which you are not doing for me.
camgunz 3y ago
I don't have a broad opinion on CLAs, but the Element announcement [0] says it's just the Apache Software Foundation's CLA, which I think most people are fine with [1]. It's more or less just a copyright/patent grant. [0]: https://element.io/blog/element-to-adopt-agplv3/ https://element.io/blog/element-to-adopt-agplv3/ [1]: https://www.apache.org/licenses/contributor-agreements.html#clas https://www.apache.org/licenses/contributor-agreements.html#...
- seany 3y ago
  They're ok with it when it goes to the ASF; which is not what's going on here.
  - ensignavenger 3y ago
    Matrix even has a foundation, they could have the CLA go tot he Matrix Foundation... but they aren't. Even then, I trust the Apache Foundation more than the Matrix Foundation- not that I have any particular distrust of the Matrix Foundation up to this point, just that they don't have the same track record as the Apache Foundation.
    - ensignavenger 3y ago
      On their blog post, they claim to use the "standard Apache CLA" which indeed does grant the license to the ASF... presumably they plan to modify the CLA to grant the license to Element... but I haven't been successful finding a copy of their modifications. The Apache CLA also contains a critical clause : "In return, the Foundation shall not use Your Contributions in a way that is contrary to the public benefit or inconsistent with its nonprofit status and bylaws in effect at the time of the Contribution." Based on the Element blog-post as well as comments they have made here... I doubt they plan to keep that clause in place.
      - camgunz 3y ago
        > Based on the Element blog-post as well as comments they have made here... I doubt they plan to keep that clause in place. I'm trying to understand your objection, but I can't see how the community can suffer here. Even in the worst case scenario where the foundation versions wither and Element takes their versions closed source, can't the community fork the latest open source AGPL versions and continue the work?
bogwog 3y ago
> No one should ever sign a CLA that gives a company more rights to your contributions than you get from theirs. Why not? I've signed CLAs to contribute to open source projects that I use every day. These projects already offer me tremendous value for free, and while my contributions may help other people, they mostly help me since they tend to be fixes for problems that I personally have with them. Having the fix contributed to the project also usually means that it becomes someone else's problem to maintain it in the long run, so it's not even a burden for me. So I already get way more than I give in that kind of situation. Knowing that they can potentially profit off of my contributions gives me some peace of mind. If they can build a sustainable business from it, then they'll be able to survive and I'll be able to keep benefiting from it. It's a win-win! Of course, I guess it's possible (maybe) that they'll be able to do a bait and switch and force me to start paying. I've never had that happen to me, and I might change my mind if it does.
- ensignavenger 3y ago
  There have been GPL/AGPL projects in the past that used CLAs and gone propeietary... I don't have the details at the moment, but I prefer to the ounce of prevention, rather than waiting for it to happen to me.
  - ryukafalz 3y ago
    There have also been Apache v2-licensed projects that have not used CLAs and gone proprietary. The risk of a proprietary fork by Element is not changing as a result of this, and actually the risk of a proprietary fork by anyone else (that includes post-relicense changes) goes away. I too would prefer AGPLv3 with no CLA, but that doesn't seem like it's going to happen at the moment, and this seems like a step in the right direction.
    - ensignavenger 3y ago
      If I (and everyone else) have the same power to make a proprietary fork as they do, then I don't mind so much. It is when they have more power than everyone else that I start to mind.

appplication 3y ago

What’s the deal with CLAs? I’m not familiar with them.

jraph 3y ago
they allow the company making you sign the CLA change the license the entire project with your contribution in it to what they like, including making it proprietary.
ensignavenger 3y ago
When you try to contribute code back upstream, the company will require you to grant them broad rights to do whatever they want with it, including to relicense the code you are contributing under a proprietary license. You do not get the same rights in return to the upstream code. So the company can yake your contributions and go proprietary and you have no recourse.
- gary_0 3y ago
  I'm surprised it's not more of a thing to have a CLA that allows relicensing only to another OSI-approved license. I don't see many examples along those lines[0]. And the "OSI-approved" wording would allow a project to freely switch between MIT/BSD/GPL/etc or even create their own license (as long as they get it OSI-approved) without having to hunt down past contributors for permission. I would never sign an open-ended CLA, though. For all I know, the project (with my code in it) could end up being bought by Oracle, proprietized, and used by Larry Ellison to construct the Torment Nexus. [0] https://en.wikipedia.org/wiki/Contributor_License_Agreement#CLAs_which_restrict_relicensing https://en.wikipedia.org/wiki/Contributor_License_Agreement#...
  - tpush 3y ago
    Well, the point of the AGPL + CLA combo is precisely to be able to profit off of community contributions by distributing proprietary versions.
  - lmm 3y ago
    > I'm surprised it's not more of a thing to have a CLA that allows relicensing only to another OSI-approved license. That would be meaningless - they could relicense it to MIT, distribute that MIT-licensed version to their subsidiary, and then have that subsidiary sell it under whatever proprietary license they wanted.
vbezhenar 3y ago
One example is Linux. You don't need to sign CLA to contribute to Linux. It has contributions from thousands of developers all over the world. It means that to switch Linux license to, say GPLv3, you would need to get permission from all of those developers or rewrite their contributions which is not possible in practice. To avoid this situation, some projects require their contributors to sign contributor license agreement. Terms might differ, but generally you allow your contribution to be relicensed in any way in the future. So today Matrix's AGPL, tomorrow they can go proprietary and you're OK with that. Also they want to sell their source code with proprietary license (so buyer's not obliged to open his modifications) and they also need contributor permission to do that. Basically it's a commercial project which is not interested with external contributions.
- dbrgn 3y ago
  > tomorrow they can go proprietary and you're OK with that That depends on the CLA's wording. A CLA could allow the right to sell commercial licenses to the code while always keeping the same code under the AGPLv3. I haven't read Element's CLA though.
  - thomastjeffery 3y ago
    I haven't read it either, but a comment nearby (allegedly from the Element CEO) claims that their intent is to use this CLA to sell commercial licenses.
- jeroenhd 3y ago
  AGPL also has some annoying side effects if you do t use a CLA. For example, Matrix has had a few proof of concepts for pure peer to peer network designs where every device runs its own server. That would be impossible toddeploy to app stores like the Apple App Store because that store is inherently incompatible with (A)GPL. The only way you can publish (A)GPL code to iPhones and iPads legally is to dual license all code from all contributors. With a CLA, a project can relicense the code to itself. Without it, the project can't upload their own project to the App Store and similar platforms. I think you'd be crazy to run Synapse on a phone, but Dendrite is built to be much more efficient for such use cases.
WhyNotHugo 3y ago
They grant the organisation (in this case a for-profit) the exclusive right to redistribute the project (and contributions made to it) under a different license. Including a proprietary licence. It is only required if you intend to move to an open-core model, or intend to eventually make the project non-open-source entirely. This is a common first step for many organisations that have moved in this direction. The announcement even makes it clear that they intend to ship versions for a fee, so it's very likely that we'll see a "community edition" and a "full edition" at some point. Or some other model which amounts to the same general idea.

Arathorn 3y ago

Speaking as CEO at Element - I don't particularly like CLAs either from an ideological perspective. However, the only way that Element can retain the right to provide alternative licenses to proprietary forks is if it has the right to do so, which means requiring a CLA. Otherwise the license change would not solve the problem that it's trying to solve, i.e. to provide a way for proprietary forks to contribute back to Matrix development costs, without having to AGPL their forks. [edit: clarify that CLA != assigning code ownership]

thomastjeffery 3y ago
> the only way that Element can retain the right to provide alternative licenses to proprietary forks I have a very straightforward and reasonable solution for you: don't do that.
- camgunz 3y ago
  A better comment here would be a little more curious about why they're doing it (so they can run a business and fund future Matrix/Element development) or to maybe suggest some alternatives.
  - lannisterstark 3y ago
    They're allowed to say they don't like it and people shouldn't do x or y. I'm not sure why you believe that every comment needs to sealion in some way or another, or provide alternatives. People are allowed to dislike choices made by others and state that. And just that. "I'd have preferred you didn't" is a perfectly valid comment to make. They don't have to do what the comment is asking, you don't have to agree with it etc, but it is a valid comment.
    - camgunz 3y ago
      I didn't say it was invalid. I gave an example of how it could do better. I'm allowed to say I don't like their comment, to dislike it and state that. I even did better and gave them constructive criticism, walking the walk, which you are not doing for me.

camgunz 3y ago

I don't have a broad opinion on CLAs, but the Element announcement [0] says it's just the Apache Software Foundation's CLA, which I think most people are fine with [1]. It's more or less just a copyright/patent grant. [0]: https://element.io/blog/element-to-adopt-agplv3/ https://element.io/blog/element-to-adopt-agplv3/ [1]: https://www.apache.org/licenses/contributor-agreements.html#clas https://www.apache.org/licenses/contributor-agreements.html#...

seany 3y ago
They're ok with it when it goes to the ASF; which is not what's going on here.
- ensignavenger 3y ago
  Matrix even has a foundation, they could have the CLA go tot he Matrix Foundation... but they aren't. Even then, I trust the Apache Foundation more than the Matrix Foundation- not that I have any particular distrust of the Matrix Foundation up to this point, just that they don't have the same track record as the Apache Foundation.
  - ensignavenger 3y ago
    On their blog post, they claim to use the "standard Apache CLA" which indeed does grant the license to the ASF... presumably they plan to modify the CLA to grant the license to Element... but I haven't been successful finding a copy of their modifications. The Apache CLA also contains a critical clause : "In return, the Foundation shall not use Your Contributions in a way that is contrary to the public benefit or inconsistent with its nonprofit status and bylaws in effect at the time of the Contribution." Based on the Element blog-post as well as comments they have made here... I doubt they plan to keep that clause in place.
    - camgunz 3y ago
      > Based on the Element blog-post as well as comments they have made here... I doubt they plan to keep that clause in place. I'm trying to understand your objection, but I can't see how the community can suffer here. Even in the worst case scenario where the foundation versions wither and Element takes their versions closed source, can't the community fork the latest open source AGPL versions and continue the work?

bogwog 3y ago

> No one should ever sign a CLA that gives a company more rights to your contributions than you get from theirs. Why not? I've signed CLAs to contribute to open source projects that I use every day. These projects already offer me tremendous value for free, and while my contributions may help other people, they mostly help me since they tend to be fixes for problems that I personally have with them. Having the fix contributed to the project also usually means that it becomes someone else's problem to maintain it in the long run, so it's not even a burden for me. So I already get way more than I give in that kind of situation. Knowing that they can potentially profit off of my contributions gives me some peace of mind. If they can build a sustainable business from it, then they'll be able to survive and I'll be able to keep benefiting from it. It's a win-win! Of course, I guess it's possible (maybe) that they'll be able to do a bait and switch and force me to start paying. I've never had that happen to me, and I might change my mind if it does.

ensignavenger 3y ago
There have been GPL/AGPL projects in the past that used CLAs and gone propeietary... I don't have the details at the moment, but I prefer to the ounce of prevention, rather than waiting for it to happen to me.
- ryukafalz 3y ago
  There have also been Apache v2-licensed projects that have not used CLAs and gone proprietary. The risk of a proprietary fork by Element is not changing as a result of this, and actually the risk of a proprietary fork by anyone else (that includes post-relicense changes) goes away. I too would prefer AGPLv3 with no CLA, but that doesn't seem like it's going to happen at the moment, and this seems like a step in the right direction.
  - ensignavenger 3y ago
    If I (and everyone else) have the same power to make a proprietary fork as they do, then I don't mind so much. It is when they have more power than everyone else that I start to mind.