3 ms·

What’s the deal with CLAs? I’m not familiar with them.

jraph 3y ago
they allow the company making you sign the CLA change the license the entire project with your contribution in it to what they like, including making it proprietary.
ensignavenger 3y ago
When you try to contribute code back upstream, the company will require you to grant them broad rights to do whatever they want with it, including to relicense the code you are contributing under a proprietary license. You do not get the same rights in return to the upstream code. So the company can yake your contributions and go proprietary and you have no recourse.
- gary_0 3y ago
  I'm surprised it's not more of a thing to have a CLA that allows relicensing only to another OSI-approved license. I don't see many examples along those lines[0]. And the "OSI-approved" wording would allow a project to freely switch between MIT/BSD/GPL/etc or even create their own license (as long as they get it OSI-approved) without having to hunt down past contributors for permission. I would never sign an open-ended CLA, though. For all I know, the project (with my code in it) could end up being bought by Oracle, proprietized, and used by Larry Ellison to construct the Torment Nexus. [0] https://en.wikipedia.org/wiki/Contributor_License_Agreement#CLAs_which_restrict_relicensing https://en.wikipedia.org/wiki/Contributor_License_Agreement#...
  - tpush 3y ago
    Well, the point of the AGPL + CLA combo is precisely to be able to profit off of community contributions by distributing proprietary versions.
  - lmm 3y ago
    > I'm surprised it's not more of a thing to have a CLA that allows relicensing only to another OSI-approved license. That would be meaningless - they could relicense it to MIT, distribute that MIT-licensed version to their subsidiary, and then have that subsidiary sell it under whatever proprietary license they wanted.
vbezhenar 3y ago
One example is Linux. You don't need to sign CLA to contribute to Linux. It has contributions from thousands of developers all over the world. It means that to switch Linux license to, say GPLv3, you would need to get permission from all of those developers or rewrite their contributions which is not possible in practice. To avoid this situation, some projects require their contributors to sign contributor license agreement. Terms might differ, but generally you allow your contribution to be relicensed in any way in the future. So today Matrix's AGPL, tomorrow they can go proprietary and you're OK with that. Also they want to sell their source code with proprietary license (so buyer's not obliged to open his modifications) and they also need contributor permission to do that. Basically it's a commercial project which is not interested with external contributions.
- dbrgn 3y ago
  > tomorrow they can go proprietary and you're OK with that That depends on the CLA's wording. A CLA could allow the right to sell commercial licenses to the code while always keeping the same code under the AGPLv3. I haven't read Element's CLA though.
  - thomastjeffery 3y ago
    I haven't read it either, but a comment nearby (allegedly from the Element CEO) claims that their intent is to use this CLA to sell commercial licenses.
- jeroenhd 3y ago
  AGPL also has some annoying side effects if you do t use a CLA. For example, Matrix has had a few proof of concepts for pure peer to peer network designs where every device runs its own server. That would be impossible toddeploy to app stores like the Apple App Store because that store is inherently incompatible with (A)GPL. The only way you can publish (A)GPL code to iPhones and iPads legally is to dual license all code from all contributors. With a CLA, a project can relicense the code to itself. Without it, the project can't upload their own project to the App Store and similar platforms. I think you'd be crazy to run Synapse on a phone, but Dendrite is built to be much more efficient for such use cases.
WhyNotHugo 3y ago
They grant the organisation (in this case a for-profit) the exclusive right to redistribute the project (and contributions made to it) under a different license. Including a proprietary licence. It is only required if you intend to move to an open-core model, or intend to eventually make the project non-open-source entirely. This is a common first step for many organisations that have moved in this direction. The announcement even makes it clear that they intend to ship versions for a fee, so it's very likely that we'll see a "community edition" and a "full edition" at some point. Or some other model which amounts to the same general idea.

they allow the company making you sign the CLA change the license the entire project with your contribution in it to what they like, including making it proprietary.

ensignavenger 3y ago

When you try to contribute code back upstream, the company will require you to grant them broad rights to do whatever they want with it, including to relicense the code you are contributing under a proprietary license. You do not get the same rights in return to the upstream code. So the company can yake your contributions and go proprietary and you have no recourse.

gary_0 3y ago
I'm surprised it's not more of a thing to have a CLA that allows relicensing only to another OSI-approved license. I don't see many examples along those lines[0]. And the "OSI-approved" wording would allow a project to freely switch between MIT/BSD/GPL/etc or even create their own license (as long as they get it OSI-approved) without having to hunt down past contributors for permission. I would never sign an open-ended CLA, though. For all I know, the project (with my code in it) could end up being bought by Oracle, proprietized, and used by Larry Ellison to construct the Torment Nexus. [0] https://en.wikipedia.org/wiki/Contributor_License_Agreement#CLAs_which_restrict_relicensing https://en.wikipedia.org/wiki/Contributor_License_Agreement#...
- tpush 3y ago
  Well, the point of the AGPL + CLA combo is precisely to be able to profit off of community contributions by distributing proprietary versions.
- lmm 3y ago
  > I'm surprised it's not more of a thing to have a CLA that allows relicensing only to another OSI-approved license. That would be meaningless - they could relicense it to MIT, distribute that MIT-licensed version to their subsidiary, and then have that subsidiary sell it under whatever proprietary license they wanted.

vbezhenar 3y ago

One example is Linux. You don't need to sign CLA to contribute to Linux. It has contributions from thousands of developers all over the world. It means that to switch Linux license to, say GPLv3, you would need to get permission from all of those developers or rewrite their contributions which is not possible in practice. To avoid this situation, some projects require their contributors to sign contributor license agreement. Terms might differ, but generally you allow your contribution to be relicensed in any way in the future. So today Matrix's AGPL, tomorrow they can go proprietary and you're OK with that. Also they want to sell their source code with proprietary license (so buyer's not obliged to open his modifications) and they also need contributor permission to do that. Basically it's a commercial project which is not interested with external contributions.

dbrgn 3y ago
> tomorrow they can go proprietary and you're OK with that That depends on the CLA's wording. A CLA could allow the right to sell commercial licenses to the code while always keeping the same code under the AGPLv3. I haven't read Element's CLA though.
- thomastjeffery 3y ago
  I haven't read it either, but a comment nearby (allegedly from the Element CEO) claims that their intent is to use this CLA to sell commercial licenses.
jeroenhd 3y ago
AGPL also has some annoying side effects if you do t use a CLA. For example, Matrix has had a few proof of concepts for pure peer to peer network designs where every device runs its own server. That would be impossible toddeploy to app stores like the Apple App Store because that store is inherently incompatible with (A)GPL. The only way you can publish (A)GPL code to iPhones and iPads legally is to dual license all code from all contributors. With a CLA, a project can relicense the code to itself. Without it, the project can't upload their own project to the App Store and similar platforms. I think you'd be crazy to run Synapse on a phone, but Dendrite is built to be much more efficient for such use cases.

WhyNotHugo 3y ago

They grant the organisation (in this case a for-profit) the exclusive right to redistribute the project (and contributions made to it) under a different license. Including a proprietary licence. It is only required if you intend to move to an open-core model, or intend to eventually make the project non-open-source entirely. This is a common first step for many organisations that have moved in this direction. The announcement even makes it clear that they intend to ship versions for a fee, so it's very likely that we'll see a "community edition" and a "full edition" at some point. Or some other model which amounts to the same general idea.