It Matters Who Owns Your Copylefted Copyrights (2021)

https://sfconservancy.org/blog/2021/jun/30/who-should-own-foss-copyrights/

by pabs3 • 2 years ago

125 204 2 years ago

palata19• 2 years ago

Violations Are More Common Than You Think

For what I see in robotics, I can say that most products I see being shipped violate hundreds (thousands?) of licenses. Both permissive (which generally require attribution) and all kinds of copyleft.

Many IoT products use stuff like https://www.balena.io/os and essentially ship products that contain docker containers of all sorts. If you ship an Ubuntu container, you ship a ton of packages with it that have license requirements, right?

Nobody cares, nobody knows, nobody wanna know. That's the situation.

Joel_Mckay6• 2 years ago

In general, Debian has been rather strict with what licenses it allows in its repositories.

The right to transfer copyrighted works may also open people to legal action from employers in some countries outside the US. i.e. the identical contract text can have two different meanings depending where it is signed.

I prefer to license most works as Apache 2.0, and this ensures people can do whatever they need to get the use-case solved in whatever legal obligation they are encumbered within.

Note, implicit personal copyright is always in effect... The original author(s) must explicitly state the work is public-domain/CC0, or you could be in violation.

From what I've seen over the years, there are a few groups of trouble makers:

1. Companies from countries that have zero software copyright/patent laws. So will cycle GPL works into the closed-source production pipeline in commercial settings. i.e. the culture views the US concept of owning ideas as absurd.

2. Folks that think linking against a LGPL shared object for compatibility reasons obligates developers divulge source-code. Note, there is source code released under several different licenses for legal compatibility reasons. i.e. the work may be fine with static linking under one version, and at the same time violate LGPL with the identical binary.

3. submarine attacks... malicious/foolish folks that distribute works they have zero legal right to re-license, re-publish, or possess. For Unity developers on US soil, the store is peppered with works still owned by Studios that can get you sued out of existence.

CC0 and Apache 2.0 are the safest options in my opinion, but one still must trust the authors aren't poisoning the chain of trust with copyright violations.

This is another reason why out-of-band package managers are dangerous to commercial entities. Microsoft will be in business for a long time yet... =3

palata19• 2 years ago

I prefer to license most works as Apache 2.0, and this ensures people can do whatever they need to get the use-case solved in whatever legal obligation they are encumbered within.

I prefer copyleft licenses, because they ensure that the end user has access to my code :-). I don't do release free work on the Internet to help companies make money out of my work; I want to protect the users.

The great, great thing about Linux being GPL is that Android manufacturers have to share their modified sources, which helps mainlining a lot of hardware.

Uehreka• 2 years ago

If you don’t modify any of the source for the applications in those containers, then you have no changes to release. IANAL, but my understanding is that the GPL applies to a body of source code and not other things running alongside that source code. The distinctions are nuanced (Galoob v. Nintendo, etc.) but generally if you’re violating the GPL, you can kinda feel it.

Like, in Welte v. Sitecom, Sitecom didn’t just ship Welte’s work with their product (that would’ve been fine) they modified his work and failed to give source code access to their users (which is what the GPL demands).

palata19• 2 years ago

If you don’t modify any of the source for the applications in those containers, then you have no changes to release.

Pretty sure this is wrong. GPL says that if you distribute the binary, you must distribute the sources with it [1]. Modified or not. And not a vague link to the upstream project: the actual sources that were used to build the actual binary you ship.

Then pretty much all licences (permissive or copyleft) require some kind of attribution.

[1] https://www.gnu.org/licenses/gpl-faq.html#UnchangedJustBinar...

Tomte4• 2 years ago

And licenses are the easiest part. Scanning for occurrences of copyright notices deep down in the directory tree is usually more burdensome, because every singly file could contain a new copyright owner.

In theory, it could also contain a new license, but after your project has seen n license texts, it is increasingly rare to see the n+1th license text. Because there are far more people and combinations of people that license texts.

aulin4• 2 years ago

Not sure about balena, most Linux based embedded projects I worked on were based on Yocto and all the source is available either through OpenEmbedded or some vendor consortium (e.g. Linaro).

You only need to provide sources for the copyleft components you change and direct requests to the above entities for the rest.

palata19• 2 years ago

Yocto does provide a way to track the sources. Balena (which just let's you ship docker containers from the Internet) doesn't.

benatkin6• 2 years ago

This is why I don't want to put any free testing into a copylefted copyright like Element, let alone code or docs contributions. I realize I'm testing Discord for free, but it's different with Element, because for years I perceived it as being a vendor-neutral open source project. The copyleft is so it isn't vendor neutral.

OTOH there are projects like Forgejo which are copyleft but are still vendor neutral. Even though it's vendor neutral, I wouldn't be too thrilled if it were AGPL, but it's just GPL. So I am still a happy Codeberg user. (Element is AGPL)

Zulip is my favorite open source chat now. It's used by some stuff that's relevant to me right now including Bytecode Alliance and Julia.

palata19• 2 years ago

What's the deal with Element? Is it AGPL, but exclusively developed by one company? Or does it take contributions but with a CLA giving the copyright to the company? I'm not aware of the situation there.

Not sure I follow why AGPL is a problem, though.

benatkin6• 2 years ago

It's bait and switch, they built the community of Matrix and Element around a promise of openness but specifically chose a license to make it another Discord or Slack.

You can read between the lines here: https://element.io/blog/element-to-adopt-agplv3/

HN thread to help with the context: https://news.ycombinator.com/item?id=38162275

globalnode• 2 years ago

ive always wondered about open source, it seems to me like its a pretty good deal for companies

bruce5117• 2 years ago

It is an excellent deal for companies. It's also an excellent deal for end users.

Open Source is not designed to be "anti company". It's designed to be pro-user.

(I'm not sure why you're being down-voted, your comment is a common belief, if somewhat missing the point of OSS).

immibis8• 2 years ago

Permissive open source (MIT, BSD) is a voluntary donation to the likes of Jeff Bezos, but AGPL gives them real obligations to share back.

KPGv216• 2 years ago

Permissive open source (MIT, BSD) is a voluntary donation to the likes of Jeff Bezos

This is like saying planting a tree that converts CO2 to oxygen is a voluntary donation to Jeff Bezos.

Just because you do something that helps everyone without distinguishing between the people being helped doesn't mean it's bad.

munchler3• 2 years ago

When you take a job, in most places in the world, by default, your employer owns and/or effectively controls all your copyrights.

Is this really true? I haven't checked my employment agreement, but I'm pretty sure that my employer only controls the copyrights for a) work I do for them, and b) any other side work I happen to do in my employer's field (which never happens).

AFAIK, work I do on my own that is unrelated to my employer belongs to me, and I've never had anyone from my job try to assert otherwise. (I have plenty of publicly-visible code on GitHub that they could glom onto if they wanted, although none of it is commercially important.)

---

Edit: My employee agreement says "I understand that the provisions this Agreement requiring assignment of Company Work Product do not apply to any Non-Company Work Product that qualifies fully under the provisions of Section 2870 of the California Labor Code, or any similar state invention law."

That labor code says "Any provision in an employment agreement which provides that an employee shall assign, or offer to assign, any of his or her rights in an invention to his or her employer shall not apply to an invention that the employee developed entirely on his or her own time without using the employer’s equipment, supplies, facilities, or trade secret information except for those inventions that either:

(1) Relate at the time of conception or reduction to practice of the invention to the employer’s business, or actual or demonstrably anticipated research or development of the employer; or

(2) Result from any work performed by the employee for the employer."

bluehatbrit• 2 years ago

You should probably check it, in the UK this is pretty standard, and I believe it is in the US as well. I suspect most of Europe is similar as well. It will vary by company and industry, but in my experience when you ask HR and Legal to put together a contract for a knowledge-worker, this is a standard edition by them.

I've never had a job actually assert anything around this personally, but I do make sure to have anything notable signed off by my employer as "mine". That's assuming it's unrelated to my employers field of course.

josephg7• 2 years ago

Yeah I always check this too - and if needed add a clause to my contract to make it clear that programming work I do outside of business hours & using my own equipment remains mine. I do a lot of opensource work and it would be a disaster to have copyright ownership clouds hanging overhead.

But for a company to assert a copyright like this, they would have to actually sue. And companies will always be loathe to sue employees over incidental stuff like this because the negative press will almost always make it not worth it.

purple_turtle9• 2 years ago

this is a standard edition by them

note that in many/some cases they are happy to drop such clause if you demand it

at least I negotiated it away multiple times (though it was not some large corporation, they were more cargo-culting contract text)

j-bos5• 2 years ago

I work at a fortune 500 and you have to go through hoops to own anything. By letter of the contract they own all the IP we produce which legally includes photos taken. Doubtful they'd enforce that, but it gives them a strong position if one were to write any useful code outside of work.

munchler3• 2 years ago

I work for a Fortune 500 as well, FWIW.

jarsin2• 2 years ago

Are you saying if you worked as a programmer in your standard fortune 500 company and wrote fiction on the weekends they own the copyright to the fiction?

Would be interesting to see how it would play out if a programmers fiction blew up as big as Harry Potter or something.

bruce5117• 2 years ago

You miss the point completely.

Let's say you take a photo and paste it on the internet. It is then used (without your permission) in a global ad campaign.

Your ability to sue is zero. All the user has to do is show that you don't have standing.

Your employer doesn't care. They'll happily ignore the violation. They're not interested in defending some random photo.

Incidentally if you posted the photo to somewhere like Facebook, the user can buy the license to use it from Facebook instead of from you, but that's another discussion for another day.

kps2• 2 years ago

Likewise, I have commercially irrelevant code on GitHub/Codeberg. But as it is all under BSD or MIT licenses, it makes no practical difference to me if my current employer wants to claim ownership; I can pick up where I left off all the same.

munchler3• 2 years ago

IANAL, but I think that if they were to assert copyright over your code, the license you chose would be irrelevant (since the code was never yours to license in the first place).

Joel_Mckay6• 2 years ago

The employment lawyer I consulted a few years back stated all work done outside office hours is essentially implicit property of your employer in Canada/UK... unless explicitly stated in your employment contract that external unrelated projects are your own.

In most of the US, all work done outside of your employers business is implicitly your own... unless explicitly stated in your employment contract that they have rights to such works.

In general, most commercial businesses won't care unless their IP or resources were misappropriated for a personal project. Best of luck =3

nmstoker• 2 years ago

My UK contract had no IP terms and after many years they tried to sneak them in via the employee handbook - I objected and we negotiated, ending up with a reasonable and amicable split: anything directly related to their line of business is theirs (whether in the office or not) but everything else is mine personally.

This seems the ideal balance as we each get what's valuable to us without overreaching (the original proposed terms would've covered literally everything including random stuff like books and video posts, which they didn't genuinely care about)

einpoklum4• 2 years ago

Is this really true?

From my personal experience, this really depends. Some employment agreements are stated very widely, so the employer even gets retroactive ownership of things you do in the past; some include copyrights for work you'll do in the future, after employment, in the same domain which can be said to be based on work you've done for the employer; some include all side-work regardless of domain, while you work there; some don't.

aulin4• 2 years ago

What is your own time when you work remotely with flexible hours?

purple_turtle9• 2 years ago

The time I am not getting paid for.

If employer want to control my time they are obligated to pay me for it.

If they want to control all of it, I expect to be paid hourly rate 24h/day.

eikenberry2• 2 years ago

My new rule is to never contribute and do my best to avoid using any free software that requires a CLA. Shared copyright ownership is very important to maintaining software freedoms. It makes it impossible for a single party to change the license in ways counter to the communities desires. There have been many recent examples of this sort of bad behavior that have driven this point home for me.

palata19• 2 years ago

Agreed: don't sign a CLA!

But then following this philosophy, shouldn't you favour copyleft licenses, too? Because if it's permissive, they can suddenly go proprietary without caring "much" about copyrights, right?

I have come to these rules:

- Never sign a CLA.

- In my projects, the "most permissive" licence I use is MPLv2 (which is weak copyleft). When I release OSS software, there is absolutely no point in using a permissive license: MPLv2 should be fine for everybody. Of course sometimes I like the GPL family, and recently I've come to like the EUPL.

patmorgan23• 2 years ago

Would you sign a CLA if it specified the License your code would be able to the project under? (I.e. the project can only use your code if it says MIT or BSD or GPL licensed).

CLAs can have a legitimate purpose in clarifying copyright ownerships.

bad_user• 2 years ago

This is usually a misunderstanding of permissive licenses.

You can't change the license of the code, even if that license is permissive enough for the code to be incorporated in proprietary works.

I mean, often this doesn't really matter because, unlike with GPL, publishers are not required to give you the source-code. But it matters when that source-code gets republished, say, under a source-available license, after having been under MIT/BSD/APL2, in which case, that's illegal, unless the company owns the copyright to do so.

As an example — if you have a file with a copyright header saying the code is licensed under a permissive license, you can't just change that header to a different license. There's even a famous case about it: https://undeadly.org/cgi?action=article&sid=20070913014315

It all comes down to copyright. If you copy a piece of code that's not trivial, even if the license allows you to copy and reuse that piece of code, you're not suddenly the copyright owner of that code. Permissive licenses are permissive, but they do have restrictions, and most importantly, with copyrighted works, excluding the fair use cases that depend on legislation, you can only do what the license allows you to.

So, no, code licensed under permissive licenses can't be re-licensed as proprietary, even if it can be incorporated in proprietary works. And this is often a useful distinction to make, as I can think of several re-licensed projects under source-available licenses that couldn't have been re-licensed without copyright assignments.

bruce5117• 2 years ago

Your rule is a common one, but somewhat misses the point of the argument. In the absence of a CLA who does own the copyright to the work you do?

The point of the article us that it may, or may not, be you.

I notice that you weren't clear on this part in your post, suggesting perhaps that it's not something that's front-of-mind like the CLA is.

On the CLA front I'm on the fence. Assign, don't assign, that's for each person to decide.

But the alternative to CLA is not necessarily "I keep the copyright". That's the point the article is asking you to consider.

Aside; unless you have a specific bit of paper assigning copyright to you, and assuming you have a day job, it's very unlikely that you hold the copyright even if you only do OSS work at home on weekends.

And lastly - have you ever enforced your copyright legally? If you have never enforced a copyright violation then your work is effectively public domain. Yes the threat that you could take action exists, but in practice your contributed-to-project can change their license and call your bluff.

mcny2• 2 years ago

I am sorry but I don't understand what you're saying.

Your rule is a common one, but somewhat misses the point of the argument. In the absence of a CLA who does own the copyright to the work you do?

If I don't own the copyright in the absence of a CLA, then I don't have the authority to sign a CLA and therefore the CLA should be void. I can't sell/gift/whatever you something I don't own.

Disclaimer: I anal. Even if I were a lawyer which I am not, I am definitely NOT your lawyer.

makemyworkforme2• 2 years ago

The contributor owns the copyright. In Germany for example, there's no transfer of copyright, only non-exclusive license to use. The Developer Certificate of Origin can be used to be make it legal.

KPGv216• 2 years ago

In the absence of a CLA who does own the copyright to the work you do

under US law, if you are not an employee of the company that owns the code you're contributing to, and you didn't sign a work-for-hire agreement with them, then you own the code you produce, full stop.

matheusmoreira7• 2 years ago

You should consider signing one anyway depending on whether you like the creator. This gives the maintainer of the project a way to make money from his work: sublicensing it to companies under a different license. This promotes the use of extreme copyleft licenses like the AGPLv3.

I actually emailed Stallman to ask about the ethics of this. He replied that it's better for everyone when only the creator has this power. Permissive licenses give everyone else that power too. Copyleft licenses don't. Only the copyright owner can sublicense. Others must comply or pay for it.

  > It is my understanding that as the copyright holders
  > they have the right to do it without any problems.
  > They leverage the AGPLv3 to make it harder for their
  > competitors to use the code to compete against them.

  I see what you mean. The original developer can engage
  in a practice that blocks coopertation.

  By contrast, using some other license, such as the ordinary GPL,
  would permitt ANY user of the program to engage in that practice.
  In a perverse sense that could seem more fair,
  but I think it is also more harmful.

  On balance, using the AGPL is better.

KPGv216• 2 years ago

Only the copyright owner can sublicense

If that were true, then the distribution of OSS would be illegal.

If I contribute to an open source project, I have licensed my code to that project. If someone downloads that project, the OSS project has sublicensed my code to them.

I doubt there's a CLA in the world that doesn't grant the right to sublicense.

For example, here is the CLA for VS Code: https://opensource.microsoft.com/pdf/microsoft-contribution-...

the key bit is:

You grant Microsoft . . . a . . . license . . . to sublicense any or all of the foregoing rights to third parties

plagiarist• 2 years ago

I don't understand why this isn't everyone's policy for open-source contributions.

oldmanhorton• 2 years ago

Surely there is a middle ground for contributions which you don't really care to retain ownership of? I don't sign CLAs for projects I want to form a long term contributor relationship with, but if I am just trying to fix a small bug that the (probably corporate) owners don't care to fix themselves, I'll sign that code away without hesitation.

surajrmal• 2 years ago

Because 1) I work on an open source project as part of my employment, not for free on the side and 2) If there was no cla, most likely the source would not be open as the project wouldn't want external contributions. That's strictly worse. Also, the types of contributions that the project would ideally see are mostly from other companies, not people working in their free time, so the cla doesn't really discourage contribution.

rendaw• 2 years ago

It also makes it impossible for a single (or multiple parties) to change the license in ways in line with the community's desire, including moving to more permissive licenses.

And I'm not really sure I get the risk here. Projects (Redis, Terraform) changed license, the community responded by forking, and the result is at worst more fragmentation. If a company doesn't think a project is worth maintaining without a more monetizable license having multiple code owners isn't going to force them to keep maintaining the software.

I'm not saying multiple owners doesn't have benefits, but it's far from clear enough to present a cut and dried policy like this I think.

eikenberry2• 2 years ago

It also makes it impossible for a single (or multiple parties) to change the license in ways in line with the community's desire, including moving to more permissive licenses.

You contribute under the existing license because you approve of that license. Not allowing change is not allowing change... there is no way to make it to allow only change you like. So it is a compromise and, IMO, a good one. .. And, while not specifically relevant to my point, moving to a more permissive license isn't necessarily a good thing.

If a company doesn't think a project is worth maintaining without a more monetizable license having multiple code owners isn't going to force them to keep maintaining the software.

My thought is that it would be better if companies didn't have this option. That releasing software under a free software license but then reserving the rights to change it later for business reasons is bad behavior. It is using free software as a marketing tool while you keep on hand on to yank it out from under your users at a whim. I think free software is better (best?) when developed to scratch an itch and released to reduce the long term maintenance and development burden (and hopefully some altruistic leanings).

afiori• 2 years ago

To an extent I think that the outrage over redis new licence was excessive, this based on two (I think true) facts:

1. The new limitations had a temporal limitation of two years since release, that is every commit/release would automatically return to the old license after two years of the commit/release publication date

2. Using a two years old version is not that bad unless you are a cloud vendor reselling the software

3. A permissive license in this case was effectively a lot of free money given to Amazon

bunsenhoneydew• 2 years ago

I’ve previously worked doing technology assessments in the M&A world and copyleft is a big deal there. I’ve had to comb through code (not always automatable) to find any copyleft code and then have had to sit through many meetings with lawyers trying to explain the risk and complexity involved. I’ve seen it tank entire acquisitions.

jongjong2• 2 years ago

Of course, GPL and copyleft is a kind of trick which serves the interests of the one who owns the exclusive copyrights. GPL was a real gold mine in the early days because companies didn't bother to distinguish between copyleft and permissive MIT-style licenses when using open source. It became a kind of trap to allow open source devs to monetize their copyrights by selling licenses to allow companies to keep their derived work private.

matheusmoreira7• 2 years ago

That's such an extreme position that even Stallman rejects it.

Think it over. Even Stallman, the guy who fetches web pages by mail so as to avoid running non-free JavaScript, promotes the business model of selling permission to violate the GPL to corporations.

https://www.gnu.org/philosophy/selling-exceptions.html

It's okay to do it. This preserves freedom for everyone and gives you the leverage needed to negotiate a contract with a corporation. Everyone can enjoy hacking on an AGPLv3 project. The companies that can't will pay you for the privilege. They might pay you enough that you can work full time on it, maybe even hire more contributors, maybe just enjoy life.

If you're against this, then logically you are also against permissive licenses which allow all this and more. Even Stallman, the most extreme free software proponent alive today, found this to be too extreme. He didn't consider permissive licenses to be immoral, therefore he isn't against this.

I even emailed him to confirm. AGPLv3 is better because only the copyright owner gets to do it, nobody else. Permissive licenses allow everybody else to do it, no questions asked. They just give away all the leverage, completely free. One of the biggest wealth transfer in history, from well meaning developers and straight into the pockets of corporations.

jongjong2• 2 years ago

As an open source dev, I like GPL for that reason. It was a kind of trick which kept some monetization paths open for the dev. It no longer works though because now most companies refuse to incorporate GPL libraries into their products. They have tools to check for dependencies automatically. Now open source is almost impossible to monetize.

kmeisthax• 2 years ago

As someone who wants GPL enforcement, I still say don't sign a CLA, for two reasons:

- Centralizing copyright ownership in a single entity grants that entity the ability to lock down the project at any time and defeat the copyleft (e.g. Oracle killing off OpenSolaris). I consider this a worse outcome than a copyleft that is unenforced. It also encourages malicious enforcement (e.g. Oracle v. Google) that runs contrary to the goals of FOSS.

- Due to some very specific peculiarities of US law, regular users can sue companies that don't follow the GPL, because the source code disclosure requirement makes you a third-party beneficiary of the copyright license (which in US law is a contract).

The last one is a bit unfair to the article because the rulings in question happened after it was published. But it obviates the biggest benefit of centralized ownership - clear and unambiguous standing to sue. If things were the opposite - i.e. the courts said third-party beneficiaries can't sue and only owners can - then there would be an argument for keeping ownership of critical parts of the project in an entity with no conflict of interest against enforcement.

Even then, I don't see why ownership has to be centralized. Under US law, joint owners of a single copyrighted work both have standing to sue. Having more owners means more people with standing. In lieu of a classic CLA with a single point of failure, you could have a policy of accepting any code that is either owned by the developer itself (after their employment contracts have been vetted) or any of a number of trustworthy FOSS organizations who are committed to enforcing GPL. All parties would have standing to sue individually and could additionally sue as a class in a single action.

Thorrez2• 2 years ago

Centralizing copyright ownership in a single entity grants that entity the ability to lock down the project at any time and defeat the copyleft (e.g. Oracle killing off OpenSolaris).

I don't understand how copyright ownership of FOSS code would impact an entity locking down the project. I don't think owning the copyright gives the entity the ability to do that. Maybe owning the trademark or the Github repo would, but not the copyright.

rocqua• 2 years ago

If you want to switch the license on a software project away from GPL, that is possible. All old versions were and will remain GPL. Any new versions can stop being GPL as long as all copyright holders agree to let this happen.

You cannot use the GPL license to allow publishing this new version. But you can use permission by all copyright holders as an exception.

danielheath• 2 years ago

If I contribute code to a GPL project without signing a CLA, and they later decide to re-license, they cannot use my contributions in the re-licensed version.

If I've signed a CLA, they can.

the_gipsy• 2 years ago

The entity holding the copyright can change to a new restrictive license, and continue development there, effectively killing the old GPL version and so locking down the project.

The original contributors would not agree, but they gave up their rights.

kevin_thibedeau• 2 years ago

So it's okay if the FSF does it but not anybody else?

tmtvl2• 2 years ago

The FSF is the only entity I'd trust with a CLA. Considering they're the stewards of the GPL, if they went evil everything would be FUBAR anyway. So I'd say yeah, the FSF doing it is fine.

bluGill13• 2 years ago

Stallman is old. Who will take over when he dies? What when thos people die? Sure you trust them today but do you trust them in 50 years?

Tomte4• 2 years ago

because the source code disclosure requirement makes you a third-party beneficiary of the copyright license

Isn‘t this an open question and a main point in the Vizio case where trial is still a few months off?

rlpb• 2 years ago

Centralizing copyright ownership in a single entity grants that entity the ability to lock down the project at any time...

By this logic, as well as refusing to sign CLAs you should also refuse to adopt any MIT licensed or similar software, since that can also be "locked down".

Do you?

dzaima• 2 years ago

MIT allows anyone to lock the project down, not just one entity, so there isn't ever anyone who can benefit more than others from a contribution.

latexr• 2 years ago

Centralizing copyright ownership in a single entity grants that entity the ability to lock down the project at any time and defeat the copyleft

It also grants the ability to make the project more open. I once wanted to change a project I was part of to a more permissive public domain license. Leadership was in favour but ultimately rejected it due the impracticality of dealing with getting agreement from everyone who had ever contributed (there were no CLAs). So it remained with the old license.

If an entity unilaterally changes the license, you can still fork it at the time the change was made and continue from there.

Now, I’m not defending Contributor License Agreements. I also dislike them and the hurdles they cause to contribution. Plus, the situation you described of the project becoming more locked down instead of less is likely more common, and forks can be a pain for everyone. Still, wanted to share the other side.

tzs2• 2 years ago

I think you may be overestimating the usefulness of a third-party beneficiary approach. There are two issues with it:

(1) Isn't SFC vs the only case where how third-party beneficiary law applies to GPL enforcement has come up? That case has not yet gone to trial. The third-party beneficiaries have only been considered in the context of motions of summary judgement. The court ruled that this will have to be determined at trial.

(2) You can only have a third-party beneficiary to a contract when there is a contract.

The defendant should be able to defeat a third-party beneficiary claim by saying that they did not agree to the license. They saw code they wanted to use and thought it was public domain or thought their use would be covered by fair use or decided that they would go ahead and infringe its copyright because they thought the risk of the copyright owners suing was negligible.

That approach would have some risks if the copyright owners later do sue, because it would be tantamount to admitting their infringement was willful which can greatly increase statutory damages.

vegetablepotpie• 2 years ago

The source of the conflict is summed up here.

The central thread here is collective action by principled people who will use copyleft primarily as a tool for rights of users and for the improvement of copylefted projects.

Joint stock companies are about hierarchy and control. Free software is very much not about that. Free software is a syndicalist movement by software developers. Software developers have taken control over computing infrastructure, we develop it on our own terms. We have settled on a decentralized model, which shares openly, without constraint.

People with the hierarchical mindset hate another party taking ownership because that’s something they don’t have control over. They would be happy to have you hunched over a keyboard desperately typing while they bark orders at you, regardless of whether or not that produces anything of value. Linux and GCC are both inspired products that grew in the cradle of copyleft, they are excellent because of their open development. Meanwhile, large corporations are happy silo themselves into unproductive morasses and play ritualistic political games [1].

Copyleft benefits users because it produces better software. Enforcement is the only card to play to make sure that continues. Unfortunately our reaction to licensing has been immature. When asked about licensing, we’re happy to throw up our hands and say “I don’t care about that” (see WTFPL) and carry on with development as if some helpful person from legal will do the legwork for us in exchange for our wonderful output. The fact is, legal is still in the 19th-century as far as intellectual property is concerned, and are happy to respond in a formal and threatening way to anything that challenges their hegemony. We have to work with our colleagues in the legal community, educate, and give them a place in our decentralized world. Otherwise, we’ll just be workers fighting for our slice of the pie in a rat race, commanded by people who are happy with consistent mediocrity. Users will suffer.

[1] http://minimsft.blogspot.com/2005/06/bob-herbold-fiefdom-syn...

nathanmills• 2 years ago

Corporate ownership of open source copyrights is actually optimal from an efficiency standpoint. Companies have the resources and legal teams to properly steward these projects, while non-profits like the FSF are bogged down with bureaucracy and outdated ideological concerns.

The article vastly overstates the importance of enforcement. In practice, the collaborative nature of modern software development makes strict copyleft enforcement unnecessary and potentially harmful to innovation. Most companies comply voluntarily because it makes business sense.

I've worked at several major tech companies and have never once encountered the kind of enforcement issues described here. This seems like a solution in search of a problem.

einpoklum4• 2 years ago

Why is it not possible for FOSS authors (who hold copyrights and have not signed them away to their employers) to contract with NGOs like the Free Software Conservancy, allowing it to act on their behalf when it comes to enforcement? Do the copyrights really need to be transferred? I mean, people use lawyers, why can't they let the FSC act in a similar role and with similar powers of attorney?

pabs36• 2 years ago

That is possible, SFC member projects get that service, as well as Linux, Debian and probably other projects too. Copyright transfer isn't needed for that, there is the option of signing enforcement agreements instead.

https://sfconservancy.org/copyleft-compliance/

einpoklum4• 2 years ago

But then why even ask for copyright transfer? i.e. why is that what the linked article promotes? Suggesting signing over the copyright to another entity partially undercuts the very argument.

It Matters Who Owns Your Copylefted Copyrights (2021)

Related Stories