5 ms·

But what about GNU their projects require signing a CLA and I don't think they will do a rug pull

bayindirh 1y ago
There's also Eclipse Project's CLA and DCO. They are going for 20+ years.
sokoloff 1y ago
I think there are two differences there: FSF wants to be able to relicense as/if the legal landscape evolves, but in a way consistent with the original license aims. I fully support this (and I want to give them this flexibility), but admit that this is based on my trust in FSF more than anything else. FSF wants a contribution agreement to ensure that it doesn’t have to litigate with 1000s of companies who might claim some contribution that an employee of theirs made was corporate IP*. I also understand this, particularly given the incentive for a company to intentionally cause a “tainted” contribution to get into FSF products. My willingness to “go along” with an FSF CLA is much, much greater than for a random company who wants to trade on and benefit from the goodwill of the “we’re open-source!!” banner and yet be able to rug-pull later. * - I think I have exactly one tiny change into emacs from decades ago. It took me way longer to get corporate sign off on the CLA than it did to author the change.
- phkahler 1y ago
  >> My willingness to “go along” with an FSF CLA is much, much greater than for a random company who wants to trade on and benefit from the goodwill of the “we’re open-source!!” banner and yet be able to rug-pull later. FSF is the only organization that I would trust with a CLA. Everyone else has mixed motives. As this stuff keeps happening I think the GPL will regain popularity.
  - wizzwizz4 1y ago
    Consider adding the Software Freedom Conservancy to that list: I'd even trust them more than the FSF.
    - Supermancho 1y ago
      Can you explain why anyone would trust the SFC over the FSF? The FSF are effectively zealots with a specialized interest. I can understand saying that donations might be better spent with the SFC, but I am not sure that translates to more trust.
      - pabs3 1y ago
        SFC are the same as FSF effectively, or even better. Their GPL lawsuit against Vizio for example is brilliant, they are suing as a third-party beneficiary of the GPL, rather than as a copyright holder. If they win then it means any recipient of GPLed binaries can sue for compliance. https://sfconservancy.org/copyleft-compliance/vizio.html https://sfconservancy.org/copyleft-compliance/vizio.html They are also the only folks doing GPL compliance work for the Linux kernel and hardware vendors.
        sokoloff 1y ago
        > If they win then it means any recipient of GPLed binaries can sue for compliance. I hope they win the case (meaning, I think it's both morally and legally correct), but I hope that the conclusion of the case is not what this sentence says. I don't want "company uses GPL software and takes pains to not distribute it [they run it only internally]; disgruntled employee finds a way to smuggle a copy of the binaries out, gives that copy to someone else; now that someone else can now demand enforcement of the GPL terms" to be legally supported. To me, that's entirely different from "I use GPL software to make a TV and I sell that TV to anyone who will buy it." In that case, any buyer of the TV should be entitled to use the terms in clause 3 & 6 of the license and receive the source code that's covered by GPLv2. https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html (clause numbers above refer to this license)
        wizzwizz4 1y ago
        That's not what "recipient" means: it's a term of art. If I want the source code to your private fork of my GPL'd software, and I see your old laptop on Craig's List, I can't buy the laptop, recover the undeleted binaries from the hard drive, then sue you for the source; this ruling wouldn't affect that.
  - Arch-TK 1y ago
    For a long while I was using MIT a lot, these days I have started switching to GPL especially for anything significant. All because of the nonsense and all the rugpulls.
    - ranger_danger 1y ago
      In my experience, the usefulness of any particular license is only as good as your ability to enforce it in court.
      - type0 1y ago
        Using a license that contributors trust your project to abide by is far more useful than any potential litigation that may or may not happen.
      - palata 1y ago
        It's also a risk for the other side. Big companies wouldn't take the risk to go in court, they'd rather not use your project.
        ranger_danger 1y ago
        That has not been my experience... instead, they realize that struggling individual developers cannot and do not want to fight for their rights, so they openly abuse them knowing nothing will happen.
        bigiain 1y ago
        GPL pretty much guarantees Google won't use you code. Although in this post "Do no evil" world that may no longer be true. And even if it is, Google don't need to use your code. They have enough resources to clean-room re-engineer pretty much any useful piece of code ever written - perhaps short of Linux, MacOS, and Windows. If Google decide they need to use your GPL Open Source project, they'll just assign a team to fully document it while meticulously not using any copyrightable text from your project in their version of the documentation, then assign a different team to write software that matches their own internal documentation - most likely in a different language - probably Golang. Or more likely, they'll make sure there are enough subpoena-able internal internal comms to make it look like they did that, then just get some external-jurisdiction non-english-speaking intern to use Gemini to copyright whitewash the Golang rewrite directly from your open source code. (I just sat here for 5 minutes trying to work out how to end this post on a positive note - but I've got nothing...)
  - account42 1y ago
    The FSF is also the one organization that effectively already has a CLA via the "version n or later" clause commonly used with GPL licenses. The question then is of course why they'd need a real CLA on top of that.
bonzini 1y ago
The text includes this specification: "The Foundation promises that all distribution of the Work, or of any work "based on the Work," that takes place under the control of the Foundation or its assignees, shall be on terms that explicitly and perpetually permit anyone possessing a copy of the work to which the terms apply, and possessing accurate notice of these terms, to redistribute copies of the work to anyone on the same terms". So you're right, in principle the FSF could apply the AGPL to every software they have copyright assigned for, but they also have to be careful not to breach the terms of their own contract. As to the SSPL and similar license, the FSF hasn't publicly commented on it but they also don't include it in their list of approved free software licenses, so we know that the FSF doesn't really think the line could/should be drawn far from the GPLv3 and AGPL.
limagnolia 1y ago
While I generally don't sign CLA's, I will occasionally consider one if the CLA is to a nonprofit foundation which has strong governance in place to prevent restrictive re-licensing. However, sense these cases have to be very carefully evaluated on a case by case basis, it is very rare that I would even consider it.

There's also Eclipse Project's CLA and DCO. They are going for 20+ years.

I think there are two differences there: FSF wants to be able to relicense as/if the legal landscape evolves, but in a way consistent with the original license aims. I fully support this (and I want to give them this flexibility), but admit that this is based on my trust in FSF more than anything else. FSF wants a contribution agreement to ensure that it doesn’t have to litigate with 1000s of companies who might claim some contribution that an employee of theirs made was corporate IP*. I also understand this, particularly given the incentive for a company to intentionally cause a “tainted” contribution to get into FSF products. My willingness to “go along” with an FSF CLA is much, much greater than for a random company who wants to trade on and benefit from the goodwill of the “we’re open-source!!” banner and yet be able to rug-pull later. * - I think I have exactly one tiny change into emacs from decades ago. It took me way longer to get corporate sign off on the CLA than it did to author the change.

phkahler 1y ago
>> My willingness to “go along” with an FSF CLA is much, much greater than for a random company who wants to trade on and benefit from the goodwill of the “we’re open-source!!” banner and yet be able to rug-pull later. FSF is the only organization that I would trust with a CLA. Everyone else has mixed motives. As this stuff keeps happening I think the GPL will regain popularity.
- wizzwizz4 1y ago
  Consider adding the Software Freedom Conservancy to that list: I'd even trust them more than the FSF.
  - Supermancho 1y ago
    Can you explain why anyone would trust the SFC over the FSF? The FSF are effectively zealots with a specialized interest. I can understand saying that donations might be better spent with the SFC, but I am not sure that translates to more trust.
    - pabs3 1y ago
      SFC are the same as FSF effectively, or even better. Their GPL lawsuit against Vizio for example is brilliant, they are suing as a third-party beneficiary of the GPL, rather than as a copyright holder. If they win then it means any recipient of GPLed binaries can sue for compliance. https://sfconservancy.org/copyleft-compliance/vizio.html https://sfconservancy.org/copyleft-compliance/vizio.html They are also the only folks doing GPL compliance work for the Linux kernel and hardware vendors.
      - sokoloff 1y ago
        > If they win then it means any recipient of GPLed binaries can sue for compliance. I hope they win the case (meaning, I think it's both morally and legally correct), but I hope that the conclusion of the case is not what this sentence says. I don't want "company uses GPL software and takes pains to not distribute it [they run it only internally]; disgruntled employee finds a way to smuggle a copy of the binaries out, gives that copy to someone else; now that someone else can now demand enforcement of the GPL terms" to be legally supported. To me, that's entirely different from "I use GPL software to make a TV and I sell that TV to anyone who will buy it." In that case, any buyer of the TV should be entitled to use the terms in clause 3 & 6 of the license and receive the source code that's covered by GPLv2. https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html (clause numbers above refer to this license)
        wizzwizz4 1y ago
        That's not what "recipient" means: it's a term of art. If I want the source code to your private fork of my GPL'd software, and I see your old laptop on Craig's List, I can't buy the laptop, recover the undeleted binaries from the hard drive, then sue you for the source; this ruling wouldn't affect that.
- Arch-TK 1y ago
  For a long while I was using MIT a lot, these days I have started switching to GPL especially for anything significant. All because of the nonsense and all the rugpulls.
  - ranger_danger 1y ago
    In my experience, the usefulness of any particular license is only as good as your ability to enforce it in court.
    - type0 1y ago
      Using a license that contributors trust your project to abide by is far more useful than any potential litigation that may or may not happen.
    - palata 1y ago
      It's also a risk for the other side. Big companies wouldn't take the risk to go in court, they'd rather not use your project.
      - ranger_danger 1y ago
        That has not been my experience... instead, they realize that struggling individual developers cannot and do not want to fight for their rights, so they openly abuse them knowing nothing will happen.
        bigiain 1y ago
        GPL pretty much guarantees Google won't use you code. Although in this post "Do no evil" world that may no longer be true. And even if it is, Google don't need to use your code. They have enough resources to clean-room re-engineer pretty much any useful piece of code ever written - perhaps short of Linux, MacOS, and Windows. If Google decide they need to use your GPL Open Source project, they'll just assign a team to fully document it while meticulously not using any copyrightable text from your project in their version of the documentation, then assign a different team to write software that matches their own internal documentation - most likely in a different language - probably Golang. Or more likely, they'll make sure there are enough subpoena-able internal internal comms to make it look like they did that, then just get some external-jurisdiction non-english-speaking intern to use Gemini to copyright whitewash the Golang rewrite directly from your open source code. (I just sat here for 5 minutes trying to work out how to end this post on a positive note - but I've got nothing...)
- account42 1y ago
  The FSF is also the one organization that effectively already has a CLA via the "version n or later" clause commonly used with GPL licenses. The question then is of course why they'd need a real CLA on top of that.

bonzini 1y ago

The text includes this specification: "The Foundation promises that all distribution of the Work, or of any work "based on the Work," that takes place under the control of the Foundation or its assignees, shall be on terms that explicitly and perpetually permit anyone possessing a copy of the work to which the terms apply, and possessing accurate notice of these terms, to redistribute copies of the work to anyone on the same terms". So you're right, in principle the FSF could apply the AGPL to every software they have copyright assigned for, but they also have to be careful not to breach the terms of their own contract. As to the SSPL and similar license, the FSF hasn't publicly commented on it but they also don't include it in their list of approved free software licenses, so we know that the FSF doesn't really think the line could/should be drawn far from the GPLv3 and AGPL.

limagnolia 1y ago

While I generally don't sign CLA's, I will occasionally consider one if the CLA is to a nonprofit foundation which has strong governance in place to prevent restrictive re-licensing. However, sense these cases have to be very carefully evaluated on a case by case basis, it is very rare that I would even consider it.