6 ms·

Like other folks have said, anytime you see a CLA, you see the true intentions of the project. A project that will always be FOSS won't have a need for a CLA.

_benedict 2y ago
The ASF requires a CLA for all regular contributors or large contributions, so I don’t think this is a particularly good barometer.
- remram 2y ago
  That's a good point. The ASF's FAQ [1] states that "All software developed by all projects of The Apache Software Foundation is freely available without charge" and that it "is specified in the Foundation's Articles of Incorporation [2]", however I see no such specification in the linked incorporation. Is there some actual legal guarantee there? [1]: https://www.apache.org/foundation/license-faq.html#IsItFree https://www.apache.org/foundation/license-faq.html#IsItFree [2]: https://www.apache.org/foundation/records/incorporator.html https://www.apache.org/foundation/records/incorporator.html
  - fweimer 2y ago
    I think it's mentioned in this document: https://www.apache.org/foundation/records/certificate.html https://www.apache.org/foundation/records/certificate.html
    - remram 2y ago
      Thanks! It seems a little short of the claim in their FAQ though, but it's something: > The purpose of the Corporation is to engage in any lawful act or activity [...] including the creation and maintenance of "open source" software distributed by the Corporation to the public at no charge
      - ted_dunning 2y ago
        I don't think that falls short. The reason for the "any lawful act" language is to allow the ASF to do things like run a conference, accept donations, sell t-shirts and other activities. If the statement was only "develop open-source software" there are all kinds of important activities that support open source development that would be impossible. The fact is, however, that certificates can be changed by the people who can vote. IN the case of the ASF, the members are the ones who vote. Getting those ~800 members to radically trash the traditional goal of the foundation is not going to be possible as long as the current membership is active.
        remram 2y ago
        What I mean is that, if they made some software non-free alongside some free ones (to make money to finance the free ones, for example), that still seems valid as to the current certificate of incorporation. Their FAQ says "all software free no exception" and this document says something weaker.
        immibis 2y ago
        [flagged]
        remram 2y ago
        If you're trying to say something, say it, and point to proof. I don't know where to even find what you are trying about.
- saurik 2y ago
  The difference with the ASF/FSF is that they are non-profits with a mission statement (and, if we don't trust that enough--due to OpenAI, as I don't entirely understand what happened there--with clearly-mission-aligned board leadership) that prevent them from pulling the rug out from under their license. (...and, right as I pushed this comment, I see that someone else looked into it, and maybe the ASF fails to have such a clause anywhere ;P but hopefully it is there and just a bit hidden.)
  - cortesoft 2y ago
    Sure, but that contradicts the statement made in the comment they are replying to: > anytime you see a CLA, you see the true intentions of the project. A project that will always be FOSS won't have a need for a CLA. If there are conditions to the statement, it isn't "anytime you see a CLA".
    - saurik 2y ago
      Sure, but now we would need to find another epicycle for why giving a for-profit corporation this dangerous power over its licensees is safe/benign. There is, at times, some logic to "the exception that proves the rule".
fweimer 2y ago
It depends on the CLA. In some countries, you cannot not have a CLA because there's always an implied contract. Many CLAs are just a hassle (basically, DCO that has to be reviewed by the legal department). But a lot are asymmetrical in a substantial way and the original developer gets to play by different rules than the rest. CLAs in the second category tend to be problematic. Even that is not a completely clear indicator because in some cases, the asymmetry is only intended to help with potential future relicensing in alignment with the project's goals, and not to enable commercialization (either today or at some point in the future). Some organizations have resisted direct commercialization of the code they have been entrusted with for decades, so that can happen even with an asymmetrical CLA.
ziddoap 2y ago
For those of us not in-the-know about licensing acronyms. CLA = Contributor License Agreement
kodablah 2y ago
This is not necessarily true. Sometimes it's needed to pivot to a better/different open source license without going through the pain of contacting every contributor ever. I have seen that pain in some projects that want to go from LGPL to MIT or something. For many contributors, they're ok giving full ownership of their contributions to a project owner on the owner's terms. Some contributors may not be ok with that of course, but it doesn't mean that every project owner has nefarious plans with said code ownership.
- drdaeman 2y ago
  > better/different open source license And that's why "open source" is a really bad term that no one should use unironically, unless they want to confuse the hell out of people. There are protective (copyleft) licenses, and there are permissive licenses - and they're very different beasts. And it's, like, software licensing 101. > that want to go from LGPL to MIT or something I find this extremely weird. In a sane world, picking a copyleft license must mean that you care about user freedoms and want to make sure they're respected no matter what happens. Because that's the whole point of picking a copyleft license - not about letting people peek or tweak some code, not about social brownie points, and most certainly not about marketing campaigns - but about granting users their freedoms. Either people get confused about "open source" and pick... I don't know, whatever looks cool, without even understanding what they're doing; or they're giving up on their principles when they smell the money. I can understand wanting to go from, say, GPL to AGPL, or GPLv2 to GPLv3[+] - it would make sense, as it all goes in line of protecting freedoms. But LGPL to MIT is truly a weird one.
  - riffraff 2y ago
    (L)GPL to MIT is a choice many projects made when they decided they cared more about their code being used than about it staying free. Copyleft licenses were the default choice at some point in time, but then in the '10s most big projects seemed to pick a permissive license, and many switched.
    - drdaeman 2y ago
orthecreedence 2y ago
I think that's a bit reductive. It's possible to have a CLA because you want to sell a non-GPL version of your app to some corporation that's worried about the legalities of the license. This is an additional revenue stream that open-source projects make use of, and it's not fair to say "any project with a CLA is selling out." There's this balance between being a project forever run out of someone's garage and actually growing into a larger and more used system. I'd say the line is dilineated by many factors: who is the project's primary user? Enterprise? Devs? How much money is changing hands? What's the business model? Is there investment involved? How restrictive is the primary license? How restrictive is the CLA? I think any open-source project that has aspirations to actually make money for the creators is shooting themselves in the foot without a CLA. And it's fine to judge them for this, but we live in a system where people have to extract value out of this shit even if it's against their ethos. If people truly and ultimately believe in open-source, then the most logical conclusion is that capitalism does not allow for open source and that must be changed. Fighting things at the license level can only delay the inevitable. But people want to have their cake and eat it too: "I want the system to stay the same AND I want open-source creators to keep pumping out stuff for free forever."
lacker 2y ago
This is not true. Many companies want a CLA because their lawyers are worried about unclear patent law. They don't want someone to contribute some code, and then later claim the contributed code violates their patents. Good examples are React from Facebook, and TypeScript from Microsoft. Both require a CLA. But these projects are never going to go closed-source. They are complements to the companies' core business strategies.
stubish 2y ago
Imagine a world where GPLv2 was found to be unenforceable in a major jurisdiction such as the US. It has been a serious worry in the past. A CLA lets a project survive that situation. But I don't know if it is possible to have a CLA that also cannot be used to fork a project into a commercial license. So the trick would seem to be a CLA that assigns copyright to some sort of non-profit that is legally bound to be unable to take that path.
rpaik 2y ago
Even if a project/company doesn't have a CLA, I don't think that is any sort of guarantee that their license won't change in the future.

_benedict 2y ago

The ASF requires a CLA for all regular contributors or large contributions, so I don’t think this is a particularly good barometer.

remram 2y ago
That's a good point. The ASF's FAQ [1] states that "All software developed by all projects of The Apache Software Foundation is freely available without charge" and that it "is specified in the Foundation's Articles of Incorporation [2]", however I see no such specification in the linked incorporation. Is there some actual legal guarantee there? [1]: https://www.apache.org/foundation/license-faq.html#IsItFree https://www.apache.org/foundation/license-faq.html#IsItFree [2]: https://www.apache.org/foundation/records/incorporator.html https://www.apache.org/foundation/records/incorporator.html
- fweimer 2y ago
  I think it's mentioned in this document: https://www.apache.org/foundation/records/certificate.html https://www.apache.org/foundation/records/certificate.html
  - remram 2y ago
    Thanks! It seems a little short of the claim in their FAQ though, but it's something: > The purpose of the Corporation is to engage in any lawful act or activity [...] including the creation and maintenance of "open source" software distributed by the Corporation to the public at no charge
    - ted_dunning 2y ago
      I don't think that falls short. The reason for the "any lawful act" language is to allow the ASF to do things like run a conference, accept donations, sell t-shirts and other activities. If the statement was only "develop open-source software" there are all kinds of important activities that support open source development that would be impossible. The fact is, however, that certificates can be changed by the people who can vote. IN the case of the ASF, the members are the ones who vote. Getting those ~800 members to radically trash the traditional goal of the foundation is not going to be possible as long as the current membership is active.
      - remram 2y ago
        What I mean is that, if they made some software non-free alongside some free ones (to make money to finance the free ones, for example), that still seems valid as to the current certificate of incorporation. Their FAQ says "all software free no exception" and this document says something weaker.
      - immibis 2y ago
        [flagged]
        remram 2y ago
        If you're trying to say something, say it, and point to proof. I don't know where to even find what you are trying about.
saurik 2y ago
The difference with the ASF/FSF is that they are non-profits with a mission statement (and, if we don't trust that enough--due to OpenAI, as I don't entirely understand what happened there--with clearly-mission-aligned board leadership) that prevent them from pulling the rug out from under their license. (...and, right as I pushed this comment, I see that someone else looked into it, and maybe the ASF fails to have such a clause anywhere ;P but hopefully it is there and just a bit hidden.)
- cortesoft 2y ago
  Sure, but that contradicts the statement made in the comment they are replying to: > anytime you see a CLA, you see the true intentions of the project. A project that will always be FOSS won't have a need for a CLA. If there are conditions to the statement, it isn't "anytime you see a CLA".
  - saurik 2y ago
    Sure, but now we would need to find another epicycle for why giving a for-profit corporation this dangerous power over its licensees is safe/benign. There is, at times, some logic to "the exception that proves the rule".

fweimer 2y ago

It depends on the CLA. In some countries, you cannot not have a CLA because there's always an implied contract. Many CLAs are just a hassle (basically, DCO that has to be reviewed by the legal department). But a lot are asymmetrical in a substantial way and the original developer gets to play by different rules than the rest. CLAs in the second category tend to be problematic. Even that is not a completely clear indicator because in some cases, the asymmetry is only intended to help with potential future relicensing in alignment with the project's goals, and not to enable commercialization (either today or at some point in the future). Some organizations have resisted direct commercialization of the code they have been entrusted with for decades, so that can happen even with an asymmetrical CLA.

ziddoap 2y ago

For those of us not in-the-know about licensing acronyms. CLA = Contributor License Agreement

kodablah 2y ago

This is not necessarily true. Sometimes it's needed to pivot to a better/different open source license without going through the pain of contacting every contributor ever. I have seen that pain in some projects that want to go from LGPL to MIT or something. For many contributors, they're ok giving full ownership of their contributions to a project owner on the owner's terms. Some contributors may not be ok with that of course, but it doesn't mean that every project owner has nefarious plans with said code ownership.

drdaeman 2y ago
> better/different open source license And that's why "open source" is a really bad term that no one should use unironically, unless they want to confuse the hell out of people. There are protective (copyleft) licenses, and there are permissive licenses - and they're very different beasts. And it's, like, software licensing 101. > that want to go from LGPL to MIT or something I find this extremely weird. In a sane world, picking a copyleft license must mean that you care about user freedoms and want to make sure they're respected no matter what happens. Because that's the whole point of picking a copyleft license - not about letting people peek or tweak some code, not about social brownie points, and most certainly not about marketing campaigns - but about granting users their freedoms. Either people get confused about "open source" and pick... I don't know, whatever looks cool, without even understanding what they're doing; or they're giving up on their principles when they smell the money. I can understand wanting to go from, say, GPL to AGPL, or GPLv2 to GPLv3[+] - it would make sense, as it all goes in line of protecting freedoms. But LGPL to MIT is truly a weird one.
- riffraff 2y ago
  (L)GPL to MIT is a choice many projects made when they decided they cared more about their code being used than about it staying free. Copyleft licenses were the default choice at some point in time, but then in the '10s most big projects seemed to pick a permissive license, and many switched.
  - drdaeman 2y ago

orthecreedence 2y ago

I think that's a bit reductive. It's possible to have a CLA because you want to sell a non-GPL version of your app to some corporation that's worried about the legalities of the license. This is an additional revenue stream that open-source projects make use of, and it's not fair to say "any project with a CLA is selling out." There's this balance between being a project forever run out of someone's garage and actually growing into a larger and more used system. I'd say the line is dilineated by many factors: who is the project's primary user? Enterprise? Devs? How much money is changing hands? What's the business model? Is there investment involved? How restrictive is the primary license? How restrictive is the CLA? I think any open-source project that has aspirations to actually make money for the creators is shooting themselves in the foot without a CLA. And it's fine to judge them for this, but we live in a system where people have to extract value out of this shit even if it's against their ethos. If people truly and ultimately believe in open-source, then the most logical conclusion is that capitalism does not allow for open source and that must be changed. Fighting things at the license level can only delay the inevitable. But people want to have their cake and eat it too: "I want the system to stay the same AND I want open-source creators to keep pumping out stuff for free forever."

lacker 2y ago

This is not true. Many companies want a CLA because their lawyers are worried about unclear patent law. They don't want someone to contribute some code, and then later claim the contributed code violates their patents. Good examples are React from Facebook, and TypeScript from Microsoft. Both require a CLA. But these projects are never going to go closed-source. They are complements to the companies' core business strategies.

stubish 2y ago

Imagine a world where GPLv2 was found to be unenforceable in a major jurisdiction such as the US. It has been a serious worry in the past. A CLA lets a project survive that situation. But I don't know if it is possible to have a CLA that also cannot be used to fork a project into a commercial license. So the trick would seem to be a CLA that assigns copyright to some sort of non-profit that is legally bound to be unable to take that path.

rpaik 2y ago

Even if a project/company doesn't have a CLA, I don't think that is any sort of guarantee that their license won't change in the future.