4 ms·

Contributor Agreements are specifically there for license rug-pulls, so they can change the license in the future as they own all the copyrights. So the fact th

Contributor Agreements are specifically there for license rug-pulls, so they can change the license in the future as they own all the copyrights. So the fact that they have a CA means they are prepping for a rug-pull and thus this bullet point.

jen20 1y ago
Are you suggesting the FSF has a copyright assignment for the purposes of “rug pulls”?
- ilc 1y ago
  Yes. The FSF requires assignment so they can re-license the code to whatever new license THEY deem best. Not the contributors. A CLA should always be a warning.
  - craftkiller 1y ago
    IANAL but their official reason for the CLA seems pretty reasonable to me: https://www.gnu.org/licenses/why-assign.en.html https://www.gnu.org/licenses/why-assign.en.html tl;dr: If someone violates the GPL, the FSF can't sue them on your behalf unless they are a copyright holder. (personally I don't release anything under virus licenses like the GPL but I don't think there's a nefarious purpose behind their CLA)
    - dragonwriter 1y ago
      > If someone violates the GPL, the FSF can't sue them on your behalf unless they are a copyright holder. This seems to be factually untrue; you can assign specific rights under copyright (such as your right to sue and receive compensation for violations by third parties) without assigning the underlying copyright. Transfer of the power to relicense is not necessary for transfer of the power to sue.
      - teddyh 1y ago
        Whether or not it is acually true, this is what their lawyer has told them, and so the FSF is acting accordingly. You can’t reasonably blame them for that.
        dragonwriter 1y ago
        I can’t reasonably excuse the FSF for it, and if you think about what the FSF’s mission and prime means of pursuing it is, I think you’ll see why your blame-outsourcing excuse doesn't really work in this case.
        teddyh 1y ago
        Well. What I wrote was (from what I heard) the original reason for the copyright assignment requirement. However, since a few years ago, the FSF does not require GNU projects to have copyright assignment anymore. The FSF leaves the choice up to the individual project maintainers, which would, one assumes, drop the requirement if it affected developers and contributions for their project. Some have indeed dropped it, some have not.
- eikenberry 1y ago
  It was, some see the GPL2->GPL3 as a rug-pull... but it doesn't matter today as the FSF stopped requiring CAs back in 2021.
  - mirashii 1y ago
    That's a harder argument to make given the "or later" clause was the default in the GPLv2, and also optional.
latexr 1y ago
I can’t speak for Zed’s specific case, but several years ago I was part of a project which used a permissive license. I wanted to make it even more permissive, by changing it to one of those essentially-public-domain licenses. The person with the ultimate decision power had no objections and was fine with it, but said we couldn’t do that because we never had Contributor License Agreements. So it cuts both ways.
- ItsHarper 1y ago
  It's reasonable for a contributor to reject making their code available more permissively
  - latexr 1y ago
    Of course. Just like it is reasonable for them to reject the reverse. It is reasonable for them to reject any change, which is the point.
- eikenberry 1y ago
  You seem to be assuming that a more permissive license is good. I don't believe this is true. Linux kernel is a great example of a project where going more permissive would be a terrible idea.
  - latexr 1y ago
    Saying I believe one specific project—of which I was a major contributor and knew intimately—would benefit from a more permissive license in no way means I think every other project should do the same. Every case is different, and my projects have different licenses according to what makes sense. Please don’t extrapolate and assume someone’s general position from one example.
zahlman 1y ago
CLAs represent an important legal protection, and I would never accept a PR from a stranger, for something being developed in public, without one. They're the simplest way to prove that the contributor consented to licensing the code under the terms of the project license, and a CYA in case the contributed code is e.g. plagiarized from another party. (I see that I have received two downvotes for this in mere minutes, but no replies. I genuinely don't understand the basis for objecting to what I have to say here, and could not possibly understand it without a counterargument. What I'm saying seems straightforward and obvious to me; I wouldn't say it otherwise.)
- max-privatevoid 1y ago
  I think the proper way to do this would be a DCO. https://developercertificate.org/ https://developercertificate.org/
  - Conlectus 1y ago
    DCOs only document that the contributor has the right to contribute the code, not the license under which they contribute it. CLAs do both.
- Eliah_Lakhin 1y ago
  I upvoted your comment. I share your view and just wanted to say you're not the only one who thinks this way.
  - Conlectus 1y ago
    There are dozens of us. Dozens!
Conlectus 1y ago
I’m not sure where this belief came from, or why the people who believe it feel so strongly about it, but this is not generally true. With the exception of GPL derivatives, most popular licenses such as MIT already include provisions allowing you to relicense or create derivative works as desired. So even if you follow the supposed norm that without an explicit license agreement all open source contributions should be understood to be licensed by contributors under the same terms as the license of the project, this would still allow the project owners to “rug pull” (create a fork under another license) using those contributions. But given that Zed appears to make their source available under the Apache 2.0 license, the GPL exception wouldn’t apply.
- max-privatevoid 1y ago
  Indeed, if you discount all the instances where it is true, it is not true. From my understanding, Zed is GPL-3.0-or-later. Most projects that involve a CLA and have rugpull potential are licensed as some GPL or AGPLv3, as those are the licenses that protect everyone's rights the strongest, and thanks to the CLA trap, the definition of "everyone" can be limited to just the company who created the project. https://github.com/zed-industries/zed/blob/main/crates/zed/Cargo.toml#L7 https://github.com/zed-industries/zed/blob/main/crates/zed/C...
  - Conlectus 1y ago
    Good catch on the license in that file. I went by separate documents in the repo that said the source is available “under the licenses documented in the repository”, and took that to mean at-choice use of the license files that were included. I think the caveat to the claim that CLAs are only useful for rug pulls still important, but this is a case where it is indeed a relevant thing to consider.
hsn915 1y ago
CA means: this is not just a hobby project, it's a business, and we want to retain the power to make business decisions as we see fit. I don't like the term "rug-pull". It's misleading. If you have an open source version of Zed today, you can keep it forever, even if future versions switch to closed source or some source-available only model.
- jeremyjh 1y ago
  If you build a product and a community around a certain set of values, and then you completely swap value systems its a rug pull. They build a user base by offering something they don't intend to continue offering. What the fuck else do you want to call it?
  - hsn915 1y ago
    If someone offers you free stuff for a while, then stops offering it, you should show gratitude for having the privilege of receiving the fruit of their work for free. You should show gratitude, not hostility.
    - jeremyjh 1y ago
      I agree with that, but it’s also fine for us to be skeptical of products that are clearly headed down that path, and recommend people not use them. That is what we are discussing here.

jen20 1y ago

Are you suggesting the FSF has a copyright assignment for the purposes of “rug pulls”?

ilc 1y ago
Yes. The FSF requires assignment so they can re-license the code to whatever new license THEY deem best. Not the contributors. A CLA should always be a warning.
- craftkiller 1y ago
  IANAL but their official reason for the CLA seems pretty reasonable to me: https://www.gnu.org/licenses/why-assign.en.html https://www.gnu.org/licenses/why-assign.en.html tl;dr: If someone violates the GPL, the FSF can't sue them on your behalf unless they are a copyright holder. (personally I don't release anything under virus licenses like the GPL but I don't think there's a nefarious purpose behind their CLA)
  - dragonwriter 1y ago
    > If someone violates the GPL, the FSF can't sue them on your behalf unless they are a copyright holder. This seems to be factually untrue; you can assign specific rights under copyright (such as your right to sue and receive compensation for violations by third parties) without assigning the underlying copyright. Transfer of the power to relicense is not necessary for transfer of the power to sue.
    - teddyh 1y ago
      Whether or not it is acually true, this is what their lawyer has told them, and so the FSF is acting accordingly. You can’t reasonably blame them for that.
      - dragonwriter 1y ago
        I can’t reasonably excuse the FSF for it, and if you think about what the FSF’s mission and prime means of pursuing it is, I think you’ll see why your blame-outsourcing excuse doesn't really work in this case.
        teddyh 1y ago
        Well. What I wrote was (from what I heard) the original reason for the copyright assignment requirement. However, since a few years ago, the FSF does not require GNU projects to have copyright assignment anymore. The FSF leaves the choice up to the individual project maintainers, which would, one assumes, drop the requirement if it affected developers and contributions for their project. Some have indeed dropped it, some have not.
eikenberry 1y ago
It was, some see the GPL2->GPL3 as a rug-pull... but it doesn't matter today as the FSF stopped requiring CAs back in 2021.
- mirashii 1y ago
  That's a harder argument to make given the "or later" clause was the default in the GPLv2, and also optional.

latexr 1y ago

I can’t speak for Zed’s specific case, but several years ago I was part of a project which used a permissive license. I wanted to make it even more permissive, by changing it to one of those essentially-public-domain licenses. The person with the ultimate decision power had no objections and was fine with it, but said we couldn’t do that because we never had Contributor License Agreements. So it cuts both ways.

ItsHarper 1y ago
It's reasonable for a contributor to reject making their code available more permissively
- latexr 1y ago
  Of course. Just like it is reasonable for them to reject the reverse. It is reasonable for them to reject any change, which is the point.
eikenberry 1y ago
You seem to be assuming that a more permissive license is good. I don't believe this is true. Linux kernel is a great example of a project where going more permissive would be a terrible idea.
- latexr 1y ago
  Saying I believe one specific project—of which I was a major contributor and knew intimately—would benefit from a more permissive license in no way means I think every other project should do the same. Every case is different, and my projects have different licenses according to what makes sense. Please don’t extrapolate and assume someone’s general position from one example.

zahlman 1y ago

CLAs represent an important legal protection, and I would never accept a PR from a stranger, for something being developed in public, without one. They're the simplest way to prove that the contributor consented to licensing the code under the terms of the project license, and a CYA in case the contributed code is e.g. plagiarized from another party. (I see that I have received two downvotes for this in mere minutes, but no replies. I genuinely don't understand the basis for objecting to what I have to say here, and could not possibly understand it without a counterargument. What I'm saying seems straightforward and obvious to me; I wouldn't say it otherwise.)

max-privatevoid 1y ago
I think the proper way to do this would be a DCO. https://developercertificate.org/ https://developercertificate.org/
- Conlectus 1y ago
  DCOs only document that the contributor has the right to contribute the code, not the license under which they contribute it. CLAs do both.
Eliah_Lakhin 1y ago
I upvoted your comment. I share your view and just wanted to say you're not the only one who thinks this way.
- Conlectus 1y ago
  There are dozens of us. Dozens!

Conlectus 1y ago

I’m not sure where this belief came from, or why the people who believe it feel so strongly about it, but this is not generally true. With the exception of GPL derivatives, most popular licenses such as MIT already include provisions allowing you to relicense or create derivative works as desired. So even if you follow the supposed norm that without an explicit license agreement all open source contributions should be understood to be licensed by contributors under the same terms as the license of the project, this would still allow the project owners to “rug pull” (create a fork under another license) using those contributions. But given that Zed appears to make their source available under the Apache 2.0 license, the GPL exception wouldn’t apply.

max-privatevoid 1y ago
Indeed, if you discount all the instances where it is true, it is not true. From my understanding, Zed is GPL-3.0-or-later. Most projects that involve a CLA and have rugpull potential are licensed as some GPL or AGPLv3, as those are the licenses that protect everyone's rights the strongest, and thanks to the CLA trap, the definition of "everyone" can be limited to just the company who created the project. https://github.com/zed-industries/zed/blob/main/crates/zed/Cargo.toml#L7 https://github.com/zed-industries/zed/blob/main/crates/zed/C...
- Conlectus 1y ago
  Good catch on the license in that file. I went by separate documents in the repo that said the source is available “under the licenses documented in the repository”, and took that to mean at-choice use of the license files that were included. I think the caveat to the claim that CLAs are only useful for rug pulls still important, but this is a case where it is indeed a relevant thing to consider.

hsn915 1y ago

CA means: this is not just a hobby project, it's a business, and we want to retain the power to make business decisions as we see fit. I don't like the term "rug-pull". It's misleading. If you have an open source version of Zed today, you can keep it forever, even if future versions switch to closed source or some source-available only model.

jeremyjh 1y ago
If you build a product and a community around a certain set of values, and then you completely swap value systems its a rug pull. They build a user base by offering something they don't intend to continue offering. What the fuck else do you want to call it?
- hsn915 1y ago
  If someone offers you free stuff for a while, then stops offering it, you should show gratitude for having the privilege of receiving the fruit of their work for free. You should show gratitude, not hostility.
  - jeremyjh 1y ago
    I agree with that, but it’s also fine for us to be skeptical of products that are clearly headed down that path, and recommend people not use them. That is what we are discussing here.