11 ms·

It Matters Who Owns Your Copylefted Copyrights (2021)

125 points by pabs3 2y ago

palata 2y ago
> Violations Are More Common Than You Think For what I see in robotics, I can say that most products I see being shipped violate hundreds (thousands?) of licenses. Both permissive (which generally require attribution) and all kinds of copyleft. Many IoT products use stuff like https://www.balena.io/os https://www.balena.io/os and essentially ship products that contain docker containers of all sorts. If you ship an Ubuntu container, you ship a ton of packages with it that have license requirements, right? Nobody cares, nobody knows, nobody wanna know. That's the situation.
- Joel_Mckay 2y ago
  In general, Debian has been rather strict with what licenses it allows in its repositories. The right to transfer copyrighted works may also open people to legal action from employers in some countries outside the US. i.e. the identical contract text can have two different meanings depending where it is signed. I prefer to license most works as Apache 2.0, and this ensures people can do whatever they need to get the use-case solved in whatever legal obligation they are encumbered within. Note, implicit personal copyright is always in effect... The original author(s) must explicitly state the work is public-domain/CC0, or you could be in violation. From what I've seen over the years, there are a few groups of trouble makers: 1. Companies from countries that have zero software copyright/patent laws. So will cycle GPL works into the closed-source production pipeline in commercial settings. i.e. the culture views the US concept of owning ideas as absurd. 2. Folks that think linking against a LGPL shared object for compatibility reasons obligates developers divulge source-code. Note, there is source code released under several different licenses for legal compatibility reasons. i.e. the work may be fine with static linking under one version, and at the same time violate LGPL with the identical binary. 3. submarine attacks... malicious/foolish folks that distribute works they have zero legal right to re-license, re-publish, or possess. For Unity developers on US soil, the store is peppered with works still owned by Studios that can get you sued out of existence. CC0 and Apache 2.0 are the safest options in my opinion, but one still must trust the authors aren't poisoning the chain of trust with copyright violations. This is another reason why out-of-band package managers are dangerous to commercial entities. Microsoft will be in business for a long time yet... =3
  - palata 2y ago
    > I prefer to license most works as Apache 2.0, and this ensures people can do whatever they need to get the use-case solved in whatever legal obligation they are encumbered within. I prefer copyleft licenses, because they ensure that the end user has access to my code :-). I don't do release free work on the Internet to help companies make money out of my work; I want to protect the users. The great, great thing about Linux being GPL is that Android manufacturers have to share their modified sources, which helps mainlining a lot of hardware.
    - Joel_Mckay 2y ago
      I am happy when people find a financial upside to my work... but also understand the $1m revenue limit clause Unreal engine used. Lets be honest, after a year staring at the same code base... nobody cares what happens to source-code... lol =3
      - palata 2y ago
        I take it from another angle: I don't care so much about what people do with my code. It's not that I don't want others to make money with it (not at all). It's just that as a user, I'm always happier when I get access to the sources of the product I buy. So I release my code under a copyleft licence for the sake of the other users like me. To push the idea to the extreme, imagine a world where all the open source software that was ever written was under the GPLv3? Maybe most software would be open source in one way or another (and GPLv3 gives you a way to update the software). So you could buy a smart TV, get access to its sources and to tools that would allow you to upgrade it. I think it would be pretty amazing.
        bruce511 2y ago
        I'm not as sure as you that it would work out that way. Let's take your TV example. I bought my TV from the local store, or Amazon, or perhaps second hand from some random guy on ebay. Naturally I connect the TV to my home wifi, use the built-in Netflix app etc. Assume I'm like your aunt. I barely have the skills to plug it in, much less read the code. In this scenario is it OK that every previous owner, distributer, retailer, had the ability to add to, or change, the code in the TV? Do you think a highly skilled person, such as yourself, can audit the code to see that nothing nefarious has been added? Today I have "limited trust". I have to assume Samsung is gleaning at least some data from my TV. But I'm reasonably sure it doesn't have malware on it. In your hypothetical future, can you be as sure?
- Uehreka 2y ago
  If you don’t modify any of the source for the applications in those containers, then you have no changes to release. IANAL, but my understanding is that the GPL applies to a body of source code and not other things running alongside that source code. The distinctions are nuanced (Galoob v. Nintendo, etc.) but generally if you’re violating the GPL, you can kinda feel it. Like, in Welte v. Sitecom, Sitecom didn’t just ship Welte’s work with their product (that would’ve been fine) they modified his work and failed to give source code access to their users (which is what the GPL demands).
  - palata 2y ago
    > If you don’t modify any of the source for the applications in those containers, then you have no changes to release. Pretty sure this is wrong. GPL says that if you distribute the binary, you must distribute the sources with it [1]. Modified or not. And not a vague link to the upstream project: the actual sources that were used to build the actual binary you ship. Then pretty much all licences (permissive or copyleft) require some kind of attribution. [1]: https://www.gnu.org/licenses/gpl-faq.html#UnchangedJustBinary https://www.gnu.org/licenses/gpl-faq.html#UnchangedJustBinar...
    - LegionMammal978 2y ago
      Either the source itself, or a written offer to provide the source. But you're right that 'vaguely gesturing' at it doesn't seem to be permitted. Not to mention the license terms not being prominent in the binary (with hardly anyone outside of GNU actually putting a license command into their programs). This kind of stuff is why I'm not in the business of distributing free software.
- Tomte 2y ago
  And licenses are the easiest part. Scanning for occurrences of copyright notices deep down in the directory tree is usually more burdensome, because every singly file could contain a new copyright owner. In theory, it could also contain a new license, but after your project has seen n license texts, it is increasingly rare to see the n+1th license text. Because there are far more people and combinations of people that license texts.
- aulin 2y ago
  Not sure about balena, most Linux based embedded projects I worked on were based on Yocto and all the source is available either through OpenEmbedded or some vendor consortium (e.g. Linaro). You only need to provide sources for the copyleft components you change and direct requests to the above entities for the rest.
  - palata 2y ago
    Yocto does provide a way to track the sources. Balena (which just let's you ship docker containers from the Internet) doesn't.
benatkin 2y ago
This is why I don't want to put any free testing into a copylefted copyright like Element, let alone code or docs contributions. I realize I'm testing Discord for free, but it's different with Element, because for years I perceived it as being a vendor-neutral open source project. The copyleft is so it isn't vendor neutral. OTOH there are projects like Forgejo which are copyleft but are still vendor neutral. Even though it's vendor neutral, I wouldn't be too thrilled if it were AGPL, but it's just GPL. So I am still a happy Codeberg user. (Element is AGPL) Zulip is my favorite open source chat now. It's used by some stuff that's relevant to me right now including Bytecode Alliance and Julia.
- palata 2y ago
  What's the deal with Element? Is it AGPL, but exclusively developed by one company? Or does it take contributions but with a CLA giving the copyright to the company? I'm not aware of the situation there. Not sure I follow why AGPL is a problem, though.
  - benatkin 2y ago
    It's bait and switch, they built the community of Matrix and Element around a promise of openness but specifically chose a license to make it another Discord or Slack. You can read between the lines here: https://element.io/blog/element-to-adopt-agplv3/ https://element.io/blog/element-to-adopt-agplv3/ HN thread to help with the context: https://news.ycombinator.com/item?id=38162275 https://news.ycombinator.com/item?id=38162275
    - ValentineC 2y ago
      To be precise, I'm guessing the problem is more of the CLA, and not AGPL itself.
      - palata 2y ago
        Yes, CLAs are abusive, IMO. If I do work for free, I own the copyright (unless my company does, but that's another story). There is no way I give it for free to the organisation that manages the upstream project. Developers should not sign CLAs. But that has nothing to do with the licence itself (be it AGPL or something else).
globalnode 2y ago
ive always wondered about open source, it seems to me like its a pretty good deal for companies
- bruce511 2y ago
  It is an excellent deal for companies. It's also an excellent deal for end users. Open Source is not designed to be "anti company". It's designed to be pro-user. (I'm not sure why you're being down-voted, your comment is a common belief, if somewhat missing the point of OSS).
- immibis 2y ago
  Permissive open source (MIT, BSD) is a voluntary donation to the likes of Jeff Bezos, but AGPL gives them real obligations to share back.
  - KPGv2 2y ago
    > Permissive open source (MIT, BSD) is a voluntary donation to the likes of Jeff Bezos This is like saying planting a tree that converts CO2 to oxygen is a voluntary donation to Jeff Bezos. Just because you do something that helps everyone without distinguishing between the people being helped doesn't mean it's bad.
    - immibis 2y ago
      (A)GPL helps everyone proportionately, without distinguishing between the people being helped. MIT allows one person to try and capture the entire benefit.
      - bigstrat2003 2y ago
        > MIT allows one person to try and capture the entire benefit. No it doesn't. Software is not a scarce good. If Jeff Bezos uses my MIT-licensed software to make billions, he has taken nothing away from the rest of humanity. They can still use it just as much as he could.
munchler 2y ago
> When you take a job, in most places in the world, by default, your employer owns and/or effectively controls all your copyrights. Is this really true? I haven't checked my employment agreement, but I'm pretty sure that my employer only controls the copyrights for a) work I do for them, and b) any other side work I happen to do in my employer's field (which never happens). AFAIK, work I do on my own that is unrelated to my employer belongs to me, and I've never had anyone from my job try to assert otherwise. (I have plenty of publicly-visible code on GitHub that they could glom onto if they wanted, although none of it is commercially important.) --- Edit: My employee agreement says "I understand that the provisions this Agreement requiring assignment of Company Work Product do not apply to any Non-Company Work Product that qualifies fully under the provisions of Section 2870 of the California Labor Code, or any similar state invention law." That labor code says "Any provision in an employment agreement which provides that an employee shall assign, or offer to assign, any of his or her rights in an invention to his or her employer shall not apply to an invention that the employee developed entirely on his or her own time without using the employer’s equipment, supplies, facilities, or trade secret information except for those inventions that either: (1) Relate at the time of conception or reduction to practice of the invention to the employer’s business, or actual or demonstrably anticipated research or development of the employer; or (2) Result from any work performed by the employee for the employer."
- bluehatbrit 2y ago
  You should probably check it, in the UK this is pretty standard, and I believe it is in the US as well. I suspect most of Europe is similar as well. It will vary by company and industry, but in my experience when you ask HR and Legal to put together a contract for a knowledge-worker, this is a standard edition by them. I've never had a job actually assert anything around this personally, but I do make sure to have anything notable signed off by my employer as "mine". That's assuming it's unrelated to my employers field of course.
  - deleted 2y ago
    [deleted]
  - josephg 2y ago
eikenberry 2y ago
My new rule is to never contribute and do my best to avoid using any free software that requires a CLA. Shared copyright ownership is very important to maintaining software freedoms. It makes it impossible for a single party to change the license in ways counter to the communities desires. There have been many recent examples of this sort of bad behavior that have driven this point home for me.
- palata 2y ago
  Agreed: don't sign a CLA! But then following this philosophy, shouldn't you favour copyleft licenses, too? Because if it's permissive, they can suddenly go proprietary without caring "much" about copyrights, right? I have come to these rules: - Never sign a CLA. - In my projects, the "most permissive" licence I use is MPLv2 (which is weak copyleft). When I release OSS software, there is absolutely no point in using a permissive license: MPLv2 should be fine for everybody. Of course sometimes I like the GPL family, and recently I've come to like the EUPL.
  - deleted 2y ago
    [deleted]
  - patmorgan23 2y ago
    Would you sign a CLA if it specified the License your code would be able to the project under? (I.e. the project can only use your code if it says MIT or BSD or GPL licensed). CLAs can have a legitimate purpose in clarifying copyright ownerships.
    - palata 2y ago
      > Would you sign a CLA if it specified the License your code would be able to the project under? I don't understand. > CLAs can have a legitimate purpose in clarifying copyright ownerships. Isn't that the whole point of a CLA? The CLA is usually a way for the contributor to renounce their copyright. In other words, the project asks me to make a contribution for free, and on top of that they want to own the copyright for it. If they want to own the copyright for my work, how about they pay me?
bunsenhoneydew 2y ago
I’ve previously worked doing technology assessments in the M&A world and copyleft is a big deal there. I’ve had to comb through code (not always automatable) to find any copyleft code and then have had to sit through many meetings with lawyers trying to explain the risk and complexity involved. I’ve seen it tank entire acquisitions.
jongjong 2y ago
Of course, GPL and copyleft is a kind of trick which serves the interests of the one who owns the exclusive copyrights. GPL was a real gold mine in the early days because companies didn't bother to distinguish between copyleft and permissive MIT-style licenses when using open source. It became a kind of trap to allow open source devs to monetize their copyrights by selling licenses to allow companies to keep their derived work private.
- matheusmoreira 2y ago
  That's such an extreme position that even Stallman rejects it. Think it over. Even Stallman, the guy who fetches web pages by mail so as to avoid running non-free JavaScript, promotes the business model of selling permission to violate the GPL to corporations. https://www.gnu.org/philosophy/selling-exceptions.html https://www.gnu.org/philosophy/selling-exceptions.html It's okay to do it. This preserves freedom for everyone and gives you the leverage needed to negotiate a contract with a corporation. Everyone can enjoy hacking on an AGPLv3 project. The companies that can't will pay you for the privilege. They might pay you enough that you can work full time on it, maybe even hire more contributors, maybe just enjoy life. If you're against this, then logically you are also against permissive licenses which allow all this and more. Even Stallman, the most extreme free software proponent alive today, found this to be too extreme. He didn't consider permissive licenses to be immoral, therefore he isn't against this. I even emailed him to confirm. AGPLv3 is better because only the copyright owner gets to do it, nobody else. Permissive licenses allow everybody else to do it, no questions asked. They just give away all the leverage, completely free. One of the biggest wealth transfer in history, from well meaning developers and straight into the pockets of corporations.
  - jongjong 2y ago
    As an open source dev, I like GPL for that reason. It was a kind of trick which kept some monetization paths open for the dev. It no longer works though because now most companies refuse to incorporate GPL libraries into their products. They have tools to check for dependencies automatically. Now open source is almost impossible to monetize.
kmeisthax 2y ago
As someone who wants GPL enforcement, I still say don't sign a CLA, for two reasons: - Centralizing copyright ownership in a single entity grants that entity the ability to lock down the project at any time and defeat the copyleft (e.g. Oracle killing off OpenSolaris). I consider this a worse outcome than a copyleft that is unenforced. It also encourages malicious enforcement (e.g. Oracle v. Google) that runs contrary to the goals of FOSS. - Due to some very specific peculiarities of US law, regular users can sue companies that don't follow the GPL, because the source code disclosure requirement makes you a third-party beneficiary of the copyright license (which in US law is a contract). The last one is a bit unfair to the article because the rulings in question happened after it was published. But it obviates the biggest benefit of centralized ownership - clear and unambiguous standing to sue. If things were the opposite - i.e. the courts said third-party beneficiaries can't sue and only owners can - then there would be an argument for keeping ownership of critical parts of the project in an entity with no conflict of interest against enforcement. Even then, I don't see why ownership has to be centralized. Under US law, joint owners of a single copyrighted work both have standing to sue. Having more owners means more people with standing. In lieu of a classic CLA with a single point of failure, you could have a policy of accepting any code that is either owned by the developer itself (after their employment contracts have been vetted) or any of a number of trustworthy FOSS organizations who are committed to enforcing GPL. All parties would have standing to sue individually and could additionally sue as a class in a single action.
- Thorrez 2y ago
  >Centralizing copyright ownership in a single entity grants that entity the ability to lock down the project at any time and defeat the copyleft (e.g. Oracle killing off OpenSolaris). I don't understand how copyright ownership of FOSS code would impact an entity locking down the project. I don't think owning the copyright gives the entity the ability to do that. Maybe owning the trademark or the Github repo would, but not the copyright.
  - rocqua 2y ago
    If you want to switch the license on a software project away from GPL, that is possible. All old versions were and will remain GPL. Any new versions can stop being GPL as long as all copyright holders agree to let this happen. You cannot use the GPL license to allow publishing this new version. But you can use permission by all copyright holders as an exception.
vegetablepotpie 2y ago
The source of the conflict is summed up here. > The central thread here is collective action by principled people who will use copyleft primarily as a tool for rights of users and for the improvement of copylefted projects. Joint stock companies are about hierarchy and control. Free software is very much not about that. Free software is a syndicalist movement by software developers. Software developers have taken control over computing infrastructure, we develop it on our own terms. We have settled on a decentralized model, which shares openly, without constraint. People with the hierarchical mindset hate another party taking ownership because that’s something they don’t have control over. They would be happy to have you hunched over a keyboard desperately typing while they bark orders at you, regardless of whether or not that produces anything of value. Linux and GCC are both inspired products that grew in the cradle of copyleft, they are excellent because of their open development. Meanwhile, large corporations are happy silo themselves into unproductive morasses and play ritualistic political games [1]. Copyleft benefits users because it produces better software. Enforcement is the only card to play to make sure that continues. Unfortunately our reaction to licensing has been immature. When asked about licensing, we’re happy to throw up our hands and say “I don’t care about that” (see WTFPL) and carry on with development as if some helpful person from legal will do the legwork for us in exchange for our wonderful output. The fact is, legal is still in the 19th-century as far as intellectual property is concerned, and are happy to respond in a formal and threatening way to anything that challenges their hegemony. We have to work with our colleagues in the legal community, educate, and give them a place in our decentralized world. Otherwise, we’ll just be workers fighting for our slice of the pie in a rat race, commanded by people who are happy with consistent mediocrity. Users will suffer. [1] http://minimsft.blogspot.com/2005/06/bob-herbold-fiefdom-syndrome-and-bobs.html?m=1 http://minimsft.blogspot.com/2005/06/bob-herbold-fiefdom-syn...
nathanmills 2y ago
Corporate ownership of open source copyrights is actually optimal from an efficiency standpoint. Companies have the resources and legal teams to properly steward these projects, while non-profits like the FSF are bogged down with bureaucracy and outdated ideological concerns. The article vastly overstates the importance of enforcement. In practice, the collaborative nature of modern software development makes strict copyleft enforcement unnecessary and potentially harmful to innovation. Most companies comply voluntarily because it makes business sense. I've worked at several major tech companies and have never once encountered the kind of enforcement issues described here. This seems like a solution in search of a problem.
einpoklum 2y ago
Why is it not possible for FOSS authors (who hold copyrights and have not signed them away to their employers) to contract with NGOs like the Free Software Conservancy, allowing it to act on their behalf when it comes to enforcement? Do the copyrights really need to be transferred? I mean, people use lawyers, why can't they let the FSC act in a similar role and with similar powers of attorney?
- pabs3 2y ago
  That is possible, SFC member projects get that service, as well as Linux, Debian and probably other projects too. Copyright transfer isn't needed for that, there is the option of signing enforcement agreements instead. https://sfconservancy.org/copyleft-compliance/ https://sfconservancy.org/copyleft-compliance/
  - einpoklum 2y ago
    But then why even ask for copyright transfer? i.e. why is that what the linked article promotes? Suggesting signing over the copyright to another entity partially undercuts the very argument.
    - pabs3 2y ago
      Maybe it makes some things easier on Conservancy? I am not sure.

125 points by pabs3 2y ago

> Violations Are More Common Than You Think For what I see in robotics, I can say that most products I see being shipped violate hundreds (thousands?) of licenses. Both permissive (which generally require attribution) and all kinds of copyleft. Many IoT products use stuff like https://www.balena.io/os https://www.balena.io/os and essentially ship products that contain docker containers of all sorts. If you ship an Ubuntu container, you ship a ton of packages with it that have license requirements, right? Nobody cares, nobody knows, nobody wanna know. That's the situation.

Joel_Mckay 2y ago
In general, Debian has been rather strict with what licenses it allows in its repositories. The right to transfer copyrighted works may also open people to legal action from employers in some countries outside the US. i.e. the identical contract text can have two different meanings depending where it is signed. I prefer to license most works as Apache 2.0, and this ensures people can do whatever they need to get the use-case solved in whatever legal obligation they are encumbered within. Note, implicit personal copyright is always in effect... The original author(s) must explicitly state the work is public-domain/CC0, or you could be in violation. From what I've seen over the years, there are a few groups of trouble makers: 1. Companies from countries that have zero software copyright/patent laws. So will cycle GPL works into the closed-source production pipeline in commercial settings. i.e. the culture views the US concept of owning ideas as absurd. 2. Folks that think linking against a LGPL shared object for compatibility reasons obligates developers divulge source-code. Note, there is source code released under several different licenses for legal compatibility reasons. i.e. the work may be fine with static linking under one version, and at the same time violate LGPL with the identical binary. 3. submarine attacks... malicious/foolish folks that distribute works they have zero legal right to re-license, re-publish, or possess. For Unity developers on US soil, the store is peppered with works still owned by Studios that can get you sued out of existence. CC0 and Apache 2.0 are the safest options in my opinion, but one still must trust the authors aren't poisoning the chain of trust with copyright violations. This is another reason why out-of-band package managers are dangerous to commercial entities. Microsoft will be in business for a long time yet... =3
- palata 2y ago
  > I prefer to license most works as Apache 2.0, and this ensures people can do whatever they need to get the use-case solved in whatever legal obligation they are encumbered within. I prefer copyleft licenses, because they ensure that the end user has access to my code :-). I don't do release free work on the Internet to help companies make money out of my work; I want to protect the users. The great, great thing about Linux being GPL is that Android manufacturers have to share their modified sources, which helps mainlining a lot of hardware.
  - Joel_Mckay 2y ago
    I am happy when people find a financial upside to my work... but also understand the $1m revenue limit clause Unreal engine used. Lets be honest, after a year staring at the same code base... nobody cares what happens to source-code... lol =3
    - palata 2y ago
      I take it from another angle: I don't care so much about what people do with my code. It's not that I don't want others to make money with it (not at all). It's just that as a user, I'm always happier when I get access to the sources of the product I buy. So I release my code under a copyleft licence for the sake of the other users like me. To push the idea to the extreme, imagine a world where all the open source software that was ever written was under the GPLv3? Maybe most software would be open source in one way or another (and GPLv3 gives you a way to update the software). So you could buy a smart TV, get access to its sources and to tools that would allow you to upgrade it. I think it would be pretty amazing.
      - bruce511 2y ago
        I'm not as sure as you that it would work out that way. Let's take your TV example. I bought my TV from the local store, or Amazon, or perhaps second hand from some random guy on ebay. Naturally I connect the TV to my home wifi, use the built-in Netflix app etc. Assume I'm like your aunt. I barely have the skills to plug it in, much less read the code. In this scenario is it OK that every previous owner, distributer, retailer, had the ability to add to, or change, the code in the TV? Do you think a highly skilled person, such as yourself, can audit the code to see that nothing nefarious has been added? Today I have "limited trust". I have to assume Samsung is gleaning at least some data from my TV. But I'm reasonably sure it doesn't have malware on it. In your hypothetical future, can you be as sure?
Uehreka 2y ago
If you don’t modify any of the source for the applications in those containers, then you have no changes to release. IANAL, but my understanding is that the GPL applies to a body of source code and not other things running alongside that source code. The distinctions are nuanced (Galoob v. Nintendo, etc.) but generally if you’re violating the GPL, you can kinda feel it. Like, in Welte v. Sitecom, Sitecom didn’t just ship Welte’s work with their product (that would’ve been fine) they modified his work and failed to give source code access to their users (which is what the GPL demands).
- palata 2y ago
  > If you don’t modify any of the source for the applications in those containers, then you have no changes to release. Pretty sure this is wrong. GPL says that if you distribute the binary, you must distribute the sources with it [1]. Modified or not. And not a vague link to the upstream project: the actual sources that were used to build the actual binary you ship. Then pretty much all licences (permissive or copyleft) require some kind of attribution. [1]: https://www.gnu.org/licenses/gpl-faq.html#UnchangedJustBinary https://www.gnu.org/licenses/gpl-faq.html#UnchangedJustBinar...
  - LegionMammal978 2y ago
    Either the source itself, or a written offer to provide the source. But you're right that 'vaguely gesturing' at it doesn't seem to be permitted. Not to mention the license terms not being prominent in the binary (with hardly anyone outside of GNU actually putting a license command into their programs). This kind of stuff is why I'm not in the business of distributing free software.
Tomte 2y ago
And licenses are the easiest part. Scanning for occurrences of copyright notices deep down in the directory tree is usually more burdensome, because every singly file could contain a new copyright owner. In theory, it could also contain a new license, but after your project has seen n license texts, it is increasingly rare to see the n+1th license text. Because there are far more people and combinations of people that license texts.
aulin 2y ago
Not sure about balena, most Linux based embedded projects I worked on were based on Yocto and all the source is available either through OpenEmbedded or some vendor consortium (e.g. Linaro). You only need to provide sources for the copyleft components you change and direct requests to the above entities for the rest.
- palata 2y ago
  Yocto does provide a way to track the sources. Balena (which just let's you ship docker containers from the Internet) doesn't.

benatkin 2y ago

This is why I don't want to put any free testing into a copylefted copyright like Element, let alone code or docs contributions. I realize I'm testing Discord for free, but it's different with Element, because for years I perceived it as being a vendor-neutral open source project. The copyleft is so it isn't vendor neutral. OTOH there are projects like Forgejo which are copyleft but are still vendor neutral. Even though it's vendor neutral, I wouldn't be too thrilled if it were AGPL, but it's just GPL. So I am still a happy Codeberg user. (Element is AGPL) Zulip is my favorite open source chat now. It's used by some stuff that's relevant to me right now including Bytecode Alliance and Julia.

palata 2y ago
What's the deal with Element? Is it AGPL, but exclusively developed by one company? Or does it take contributions but with a CLA giving the copyright to the company? I'm not aware of the situation there. Not sure I follow why AGPL is a problem, though.
- benatkin 2y ago
  It's bait and switch, they built the community of Matrix and Element around a promise of openness but specifically chose a license to make it another Discord or Slack. You can read between the lines here: https://element.io/blog/element-to-adopt-agplv3/ https://element.io/blog/element-to-adopt-agplv3/ HN thread to help with the context: https://news.ycombinator.com/item?id=38162275 https://news.ycombinator.com/item?id=38162275
  - ValentineC 2y ago
    To be precise, I'm guessing the problem is more of the CLA, and not AGPL itself.
    - palata 2y ago
      Yes, CLAs are abusive, IMO. If I do work for free, I own the copyright (unless my company does, but that's another story). There is no way I give it for free to the organisation that manages the upstream project. Developers should not sign CLAs. But that has nothing to do with the licence itself (be it AGPL or something else).

globalnode 2y ago

ive always wondered about open source, it seems to me like its a pretty good deal for companies

bruce511 2y ago
It is an excellent deal for companies. It's also an excellent deal for end users. Open Source is not designed to be "anti company". It's designed to be pro-user. (I'm not sure why you're being down-voted, your comment is a common belief, if somewhat missing the point of OSS).
immibis 2y ago
Permissive open source (MIT, BSD) is a voluntary donation to the likes of Jeff Bezos, but AGPL gives them real obligations to share back.
- KPGv2 2y ago
  > Permissive open source (MIT, BSD) is a voluntary donation to the likes of Jeff Bezos This is like saying planting a tree that converts CO2 to oxygen is a voluntary donation to Jeff Bezos. Just because you do something that helps everyone without distinguishing between the people being helped doesn't mean it's bad.
  - immibis 2y ago
    (A)GPL helps everyone proportionately, without distinguishing between the people being helped. MIT allows one person to try and capture the entire benefit.
    - bigstrat2003 2y ago
      > MIT allows one person to try and capture the entire benefit. No it doesn't. Software is not a scarce good. If Jeff Bezos uses my MIT-licensed software to make billions, he has taken nothing away from the rest of humanity. They can still use it just as much as he could.

munchler 2y ago

> When you take a job, in most places in the world, by default, your employer owns and/or effectively controls all your copyrights. Is this really true? I haven't checked my employment agreement, but I'm pretty sure that my employer only controls the copyrights for a) work I do for them, and b) any other side work I happen to do in my employer's field (which never happens). AFAIK, work I do on my own that is unrelated to my employer belongs to me, and I've never had anyone from my job try to assert otherwise. (I have plenty of publicly-visible code on GitHub that they could glom onto if they wanted, although none of it is commercially important.) --- Edit: My employee agreement says "I understand that the provisions this Agreement requiring assignment of Company Work Product do not apply to any Non-Company Work Product that qualifies fully under the provisions of Section 2870 of the California Labor Code, or any similar state invention law." That labor code says "Any provision in an employment agreement which provides that an employee shall assign, or offer to assign, any of his or her rights in an invention to his or her employer shall not apply to an invention that the employee developed entirely on his or her own time without using the employer’s equipment, supplies, facilities, or trade secret information except for those inventions that either: (1) Relate at the time of conception or reduction to practice of the invention to the employer’s business, or actual or demonstrably anticipated research or development of the employer; or (2) Result from any work performed by the employee for the employer."

bluehatbrit 2y ago
You should probably check it, in the UK this is pretty standard, and I believe it is in the US as well. I suspect most of Europe is similar as well. It will vary by company and industry, but in my experience when you ask HR and Legal to put together a contract for a knowledge-worker, this is a standard edition by them. I've never had a job actually assert anything around this personally, but I do make sure to have anything notable signed off by my employer as "mine". That's assuming it's unrelated to my employers field of course.
- deleted 2y ago
  [deleted]
- josephg 2y ago

eikenberry 2y ago

My new rule is to never contribute and do my best to avoid using any free software that requires a CLA. Shared copyright ownership is very important to maintaining software freedoms. It makes it impossible for a single party to change the license in ways counter to the communities desires. There have been many recent examples of this sort of bad behavior that have driven this point home for me.

palata 2y ago
Agreed: don't sign a CLA! But then following this philosophy, shouldn't you favour copyleft licenses, too? Because if it's permissive, they can suddenly go proprietary without caring "much" about copyrights, right? I have come to these rules: - Never sign a CLA. - In my projects, the "most permissive" licence I use is MPLv2 (which is weak copyleft). When I release OSS software, there is absolutely no point in using a permissive license: MPLv2 should be fine for everybody. Of course sometimes I like the GPL family, and recently I've come to like the EUPL.
- deleted 2y ago
  [deleted]
- patmorgan23 2y ago
  Would you sign a CLA if it specified the License your code would be able to the project under? (I.e. the project can only use your code if it says MIT or BSD or GPL licensed). CLAs can have a legitimate purpose in clarifying copyright ownerships.
  - palata 2y ago
    > Would you sign a CLA if it specified the License your code would be able to the project under? I don't understand. > CLAs can have a legitimate purpose in clarifying copyright ownerships. Isn't that the whole point of a CLA? The CLA is usually a way for the contributor to renounce their copyright. In other words, the project asks me to make a contribution for free, and on top of that they want to own the copyright for it. If they want to own the copyright for my work, how about they pay me?

bunsenhoneydew 2y ago

I’ve previously worked doing technology assessments in the M&A world and copyleft is a big deal there. I’ve had to comb through code (not always automatable) to find any copyleft code and then have had to sit through many meetings with lawyers trying to explain the risk and complexity involved. I’ve seen it tank entire acquisitions.

jongjong 2y ago

Of course, GPL and copyleft is a kind of trick which serves the interests of the one who owns the exclusive copyrights. GPL was a real gold mine in the early days because companies didn't bother to distinguish between copyleft and permissive MIT-style licenses when using open source. It became a kind of trap to allow open source devs to monetize their copyrights by selling licenses to allow companies to keep their derived work private.

matheusmoreira 2y ago
That's such an extreme position that even Stallman rejects it. Think it over. Even Stallman, the guy who fetches web pages by mail so as to avoid running non-free JavaScript, promotes the business model of selling permission to violate the GPL to corporations. https://www.gnu.org/philosophy/selling-exceptions.html https://www.gnu.org/philosophy/selling-exceptions.html It's okay to do it. This preserves freedom for everyone and gives you the leverage needed to negotiate a contract with a corporation. Everyone can enjoy hacking on an AGPLv3 project. The companies that can't will pay you for the privilege. They might pay you enough that you can work full time on it, maybe even hire more contributors, maybe just enjoy life. If you're against this, then logically you are also against permissive licenses which allow all this and more. Even Stallman, the most extreme free software proponent alive today, found this to be too extreme. He didn't consider permissive licenses to be immoral, therefore he isn't against this. I even emailed him to confirm. AGPLv3 is better because only the copyright owner gets to do it, nobody else. Permissive licenses allow everybody else to do it, no questions asked. They just give away all the leverage, completely free. One of the biggest wealth transfer in history, from well meaning developers and straight into the pockets of corporations.
- jongjong 2y ago
  As an open source dev, I like GPL for that reason. It was a kind of trick which kept some monetization paths open for the dev. It no longer works though because now most companies refuse to incorporate GPL libraries into their products. They have tools to check for dependencies automatically. Now open source is almost impossible to monetize.

kmeisthax 2y ago

As someone who wants GPL enforcement, I still say don't sign a CLA, for two reasons: - Centralizing copyright ownership in a single entity grants that entity the ability to lock down the project at any time and defeat the copyleft (e.g. Oracle killing off OpenSolaris). I consider this a worse outcome than a copyleft that is unenforced. It also encourages malicious enforcement (e.g. Oracle v. Google) that runs contrary to the goals of FOSS. - Due to some very specific peculiarities of US law, regular users can sue companies that don't follow the GPL, because the source code disclosure requirement makes you a third-party beneficiary of the copyright license (which in US law is a contract). The last one is a bit unfair to the article because the rulings in question happened after it was published. But it obviates the biggest benefit of centralized ownership - clear and unambiguous standing to sue. If things were the opposite - i.e. the courts said third-party beneficiaries can't sue and only owners can - then there would be an argument for keeping ownership of critical parts of the project in an entity with no conflict of interest against enforcement. Even then, I don't see why ownership has to be centralized. Under US law, joint owners of a single copyrighted work both have standing to sue. Having more owners means more people with standing. In lieu of a classic CLA with a single point of failure, you could have a policy of accepting any code that is either owned by the developer itself (after their employment contracts have been vetted) or any of a number of trustworthy FOSS organizations who are committed to enforcing GPL. All parties would have standing to sue individually and could additionally sue as a class in a single action.

Thorrez 2y ago
>Centralizing copyright ownership in a single entity grants that entity the ability to lock down the project at any time and defeat the copyleft (e.g. Oracle killing off OpenSolaris). I don't understand how copyright ownership of FOSS code would impact an entity locking down the project. I don't think owning the copyright gives the entity the ability to do that. Maybe owning the trademark or the Github repo would, but not the copyright.
- rocqua 2y ago
  If you want to switch the license on a software project away from GPL, that is possible. All old versions were and will remain GPL. Any new versions can stop being GPL as long as all copyright holders agree to let this happen. You cannot use the GPL license to allow publishing this new version. But you can use permission by all copyright holders as an exception.

vegetablepotpie 2y ago

The source of the conflict is summed up here. > The central thread here is collective action by principled people who will use copyleft primarily as a tool for rights of users and for the improvement of copylefted projects. Joint stock companies are about hierarchy and control. Free software is very much not about that. Free software is a syndicalist movement by software developers. Software developers have taken control over computing infrastructure, we develop it on our own terms. We have settled on a decentralized model, which shares openly, without constraint. People with the hierarchical mindset hate another party taking ownership because that’s something they don’t have control over. They would be happy to have you hunched over a keyboard desperately typing while they bark orders at you, regardless of whether or not that produces anything of value. Linux and GCC are both inspired products that grew in the cradle of copyleft, they are excellent because of their open development. Meanwhile, large corporations are happy silo themselves into unproductive morasses and play ritualistic political games [1]. Copyleft benefits users because it produces better software. Enforcement is the only card to play to make sure that continues. Unfortunately our reaction to licensing has been immature. When asked about licensing, we’re happy to throw up our hands and say “I don’t care about that” (see WTFPL) and carry on with development as if some helpful person from legal will do the legwork for us in exchange for our wonderful output. The fact is, legal is still in the 19th-century as far as intellectual property is concerned, and are happy to respond in a formal and threatening way to anything that challenges their hegemony. We have to work with our colleagues in the legal community, educate, and give them a place in our decentralized world. Otherwise, we’ll just be workers fighting for our slice of the pie in a rat race, commanded by people who are happy with consistent mediocrity. Users will suffer. [1] http://minimsft.blogspot.com/2005/06/bob-herbold-fiefdom-syndrome-and-bobs.html?m=1 http://minimsft.blogspot.com/2005/06/bob-herbold-fiefdom-syn...

nathanmills 2y ago

Corporate ownership of open source copyrights is actually optimal from an efficiency standpoint. Companies have the resources and legal teams to properly steward these projects, while non-profits like the FSF are bogged down with bureaucracy and outdated ideological concerns. The article vastly overstates the importance of enforcement. In practice, the collaborative nature of modern software development makes strict copyleft enforcement unnecessary and potentially harmful to innovation. Most companies comply voluntarily because it makes business sense. I've worked at several major tech companies and have never once encountered the kind of enforcement issues described here. This seems like a solution in search of a problem.

einpoklum 2y ago

Why is it not possible for FOSS authors (who hold copyrights and have not signed them away to their employers) to contract with NGOs like the Free Software Conservancy, allowing it to act on their behalf when it comes to enforcement? Do the copyrights really need to be transferred? I mean, people use lawyers, why can't they let the FSC act in a similar role and with similar powers of attorney?

pabs3 2y ago
That is possible, SFC member projects get that service, as well as Linux, Debian and probably other projects too. Copyright transfer isn't needed for that, there is the option of signing enforcement agreements instead. https://sfconservancy.org/copyleft-compliance/ https://sfconservancy.org/copyleft-compliance/
- einpoklum 2y ago
  But then why even ask for copyright transfer? i.e. why is that what the linked article promotes? Suggesting signing over the copyright to another entity partially undercuts the very argument.
  - pabs3 2y ago
    Maybe it makes some things easier on Conservancy? I am not sure.