3 ms·

FSF, Apache, Python Software Foundation, Canonical, basically everyone who's serious about OSS requires a CLA. The main exception I can think of is Debian. I'

• icebraining 12y ago
  The Linux kernel doesn't require a CLA either. Linus Torvalds: To be fair, people just like hating on Canonical. The FSF and Apache Foundation CLA's are pretty much equally broken. And they may not be broken because of any relicencing, but because the copyright assignment paperwork ends up basically killing the community. Basically, with a CLA, you don't get the kind of "long tail" that the kernel has of random drive-by patches. And since that's how lots of people try the waters, any CLA at all - changing the license or not - is fundamentally broken. https://plus.google.com/+gregkroahhartman/posts/NstZfwXbAti https://plus.google.com/+gregkroahhartman/posts/NstZfwXbAti
• pnathan 12y ago
  IIRC the main point about not doing so is "We're going to ensure that this body of work has so many legal threads hanging off of it that it ensures no single agent can track them all down and relicence the work otherwise. While, IMO, the FSF & other non-profit agencies are an appropriate holding body, I would seriously have issues with a for-profit company asking for a CLA for open source work. I would instead reply with a request for a Statement of Work & some cash...
• mjg59 12y ago
  "basically everyone who's serious about OSS requires a CLA." Nonsense. Red Hat don't require a CLA for any of their projects. The Linux kernel doesn't have a CLA. Libreoffice doesn't have a CLA. Mozilla don't require a CLA. The Python CLA might have that name but is actually just an explicit statement that the contribution is licensed under certain terms, which makes it entirely unlike the Apache or Canonical ones. "I'm not sure what the history is there or why their lawyers came to a different conclusion than everyone else." Most projects with CLAs have them because they see other projects with CLAs and it seems like the safest option. The common justification of "We need to know that the contribution is authorised" is more elegantly solved by the Developer Certificate of Origin approach, and the secondary justification of "What if an original contributor revokes permission to distribute" is only a problem in countries with string moral rights and a CLA isn't going to save you there anyway. The FSF has copyright assignment for strategic purposes (they want to be able to launch enforcement lawsuits without requiring that the original authors all register their copyrights), and Canonical have a CLA because they want to be able to release proprietary versions of their code without granting anybody else the same freedom. The majority of cases are just entirely unnecessary.
  • pgaddict 12y ago
    Couldn't agree more - the claim that "being serious about OSS" requires a CLA is nonsense, and in many cases is just a cargo cult (I need it because others use it). Also, people somehow fail to realize that for CLAs to work, there needs to be a legal entity governing the project - which for many OSS projects is not the case. CLAs certainly have pros/cons - it gives the project the right to enforce the license independently, but it also gives the project the opportunity to relicense the project without consent from the contributors. That may be a problem, especially when the project is driven by for-profit organizations.