Hacker News Reader

Comment by Someone1234 | Hacker News Reader

I may be misreading the Contributor License Agreement Wikipedia page, but it seems to me that the core reason why CLAs exist is to undermine the core concept of OSS software. Essentially it allows some company to randomly re-license free contributions to turn them private/for-profit.

The fact that your contributions are now effectively owned by DataStax and then licensed back to the people who actually wrote them(!) gives me a very bad feeling, like you've just become an unpaid employee of DataStax.

I will fully admit that I haven't read DataStax's CLA in full, but that is because I cannot without giving them access to my GitHub account...

PS - I understand that the FSF does this also, but the FSF isn't a for-profit company so apples and oranges in my view.

View on HN

> but it seems to me that the core reason why CLAs exist is to undermine the core concept of OSS software. Essentially it allows some company to randomly re-license free contributions to turn them private/for-profit.

While your assertion is true, it's not the only reason (or even the main reason) for CLAs in OSS.

IANAL, but this has actually happened in the past (the big case I'm aware of predates open source but not free software -- google for Diku MUD). Let's say that someone infringes on the license. So you take them to court to get them to follow the license. If you have a CLA you are the copyright holder so you can just do this. If you don't, to make your case you have to round up virtually everyone who has ever contributed to your project because they are copyright holders too. So, in effect, it doesn't matter if they infringe on the license or not because you can't hold them to it.

So you take them to court to get them to follow the license. If you have a CLA you are the copyright holder so you can just do this. If you don't, to make your case you have to round up virtually everyone who has ever contributed to your project because they are copyright holders too.

How so? As long as your code is also being used, you can sue for copyright infringement on your work. I don't see why you need to call up anyone else.

You can sue for anything you damn well please, that doesn't mean you're going to get anywhere.

I'm not a lawyer and can't explain why things are the way they are. I can only inform you that this is the way things have shaked out in the past.

Then can you point out specific cases when that has happened? Because frankly, it doesn't make sense to me, nor is it my recollection, that a copyright infringement suit can only be won if every single holder is part of the accusation.

You're right - you only need an author whose contributions were (supposedly) infringed. Of course, if you have more of them, covering larger amounts of code, that might help.

A prime example is the SFC vs. VMWare lawsuit, where SFC represents a single contributor to Linux Kernel (Christoph Hellwig).

https://sfconservancy.org/news/2015/mar/05/vmware-lawsuit/

> If you don't, to make your case you have to round up virtually everyone who has ever contributed to your project because they are copyright holders too.

This is demonstrably untrue - all the Linux kernel GPL enforcement cases have been brought by individuals without involving any other kernel copyright holders.

Which cases? Help add to my knowledge and I'll gladly admit I'm wrong here -- every successful GPL infringement case I know of was from Busybox.

http://en.wikipedia.org/wiki/Gpl-violations.org#Notable_vict... covers a couple. But Busybox works just as well here - it doesn't have a CLA and only one of the original authors is involved in recent cases.

This is awesome -- happy to admit I'm wrong on this point and CLAs may not be needed. I'm curious if any victories like this exist in the USA.

> Let's say that someone infringes on the license. So you take them to court to get them to follow the license. If you have a CLA you are the copyright holder so you can just do this. If you don't, to make your case you have to round up virtually everyone who has ever contributed to your project because they are copyright holders too.

No, if you hold a valid sublicensable license (which includes any F/OSS license, as that's rather the point of Free Software/Open Source Software), and make a derivative work as authorized by that license, you hold the copyright on the derivative work and can enforce it without any participation by the upstream copyright holders.

You may run into difficulty if the offender can show by a preponderance of the evidence that their allegedly-infringing work is derived from the upstream rather than your derivative work, in which case the upstream would have to take action.

> Essentially it allows some company to randomly re-license free contributions to turn them private/for-profit.

On the other hand, without signing over your rights, you can effectively hold up a project from moving forward. For example, if a project wanted to move from GPLv2 to GPLv3, IIRC, you can't do that without the permission of all contributors unless they have signed over their rights. And as @trestletech has pointed out not all contributors are created equal[1].

One the one hand, you have people making significant contributions (and you don't want to just stomp all over them), on the other hand you could have people making tiny contributions, yet are holding up everyone else.

[1]: https://github.com/datastax/nodejs-driver/commit/6f3c6b2f454...

Some projects use "GPLv2 or any later version", though I'm not sure how that holds up legally.

The GPLv2 requires that all derivative works be licensed under the GPLv2 or any later version of the GPL. The maintainer can get a way with this in a way semantically equivalent to forking the project using a later version of the GPLv2.

As long as contributors are licensing their contributions under the terms of the GPLv2, they're also licensing them under all future versions.

> The GPLv2 requires that all derivative works be licensed under the GPLv2 or any later version of the GPL

No it doesn't. The relevant part of the license is:

Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation.

ie, it's optional to use the "or any later version" language.

> if a project wanted to move from GPLv2 to GPLv3, IIRC, you can't do that without the permission of all contributors unless they have signed over their rights

You only need them to license their code under "GPLv2 or later" while you license the project only under "GPLv2". This way you're free to upgrade the license if and when you want.

A contributor can have legitimate reasons for not wanting their code re-licensed. For example, the Linux kernel deliberately did not move to GPLv3. Would such a contributor be "holding the project up" or would they be rightly demanding that the license under which they contributed code be honored?

Obviously the devil's in the details of the terms of the CLA. I had previously thought the purpose of the CLA was to allow the projects organizers to make copyright claims in court, not to allow them to re-license.

My "holding up the project" comment was more in relation to people that make small contributions (e.g. correct spelling mistakes and/or typos), but (maybe?) legally still need to sign off on a relicense. In this case, it really comes across as petty to put up a huge fight.

What huge fight? The guy is just saying that he isn't willing to invest the time in understanding the full implications of the contract he's being asked to sign, and that they can pay him if they want him to bother. At a very reasonable rate, I might add, considering he's a software developer and that carefully reading a CLA might take an hour or more.

I wasn't aiming in particular at this person with the "huge fight" part.

If you are a Massive Multiauthor Collaboration Site, you might be able to get the FSF to issue you an oopsiedoodle-oo.

http://www.gnu.org/copyleft/fdl.html#section11

It's an ambiguous question that AFAIK/IANAL doesn't have a clear-cut answer. A while after the GPLv3 came out Eben Moglen ventured an opinion that a work like Linux could probably, from a purely legal perspective, change licenses but he made clear that was just his guess:

http://www.cnet.com/news/linux-to-gplv3-a-practical-matter-n...

FSF, Apache, Python Software Foundation, Canonical, basically everyone who's serious about OSS requires a CLA.

The main exception I can think of is Debian. I'm not sure what the history is there or why their lawyers came to a different conclusion than everyone else.

(Disclaimer: I am the DataStax founder but I am not involved in the drivers team or their CLA.)

The Linux kernel doesn't require a CLA either.

Linus Torvalds: To be fair, people just like hating on Canonical. The FSF and Apache Foundation CLA's are pretty much equally broken. And they may not be broken because of any relicencing, but because the copyright assignment paperwork ends up basically killing the community. Basically, with a CLA, you don't get the kind of "long tail" that the kernel has of random drive-by patches. And since that's how lots of people try the waters, any CLA at all - changing the license or not - is fundamentally broken.

https://plus.google.com/+gregkroahhartman/posts/NstZfwXbAti

IIRC the main point about not doing so is "We're going to ensure that this body of work has so many legal threads hanging off of it that it ensures no single agent can track them all down and relicence the work otherwise.

While, IMO, the FSF & other non-profit agencies are an appropriate holding body, I would seriously have issues with a for-profit company asking for a CLA for open source work. I would instead reply with a request for a Statement of Work & some cash...

"basically everyone who's serious about OSS requires a CLA."

Nonsense. Red Hat don't require a CLA for any of their projects. The Linux kernel doesn't have a CLA. Libreoffice doesn't have a CLA. Mozilla don't require a CLA. The Python CLA might have that name but is actually just an explicit statement that the contribution is licensed under certain terms, which makes it entirely unlike the Apache or Canonical ones.

"I'm not sure what the history is there or why their lawyers came to a different conclusion than everyone else."

Most projects with CLAs have them because they see other projects with CLAs and it seems like the safest option. The common justification of "We need to know that the contribution is authorised" is more elegantly solved by the Developer Certificate of Origin approach, and the secondary justification of "What if an original contributor revokes permission to distribute" is only a problem in countries with string moral rights and a CLA isn't going to save you there anyway.

The FSF has copyright assignment for strategic purposes (they want to be able to launch enforcement lawsuits without requiring that the original authors all register their copyrights), and Canonical have a CLA because they want to be able to release proprietary versions of their code without granting anybody else the same freedom. The majority of cases are just entirely unnecessary.

Couldn't agree more - the claim that "being serious about OSS" requires a CLA is nonsense, and in many cases is just a cargo cult (I need it because others use it). Also, people somehow fail to realize that for CLAs to work, there needs to be a legal entity governing the project - which for many OSS projects is not the case.

CLAs certainly have pros/cons - it gives the project the right to enforce the license independently, but it also gives the project the opportunity to relicense the project without consent from the contributors. That may be a problem, especially when the project is driven by for-profit organizations.

But this is not a CLA with DataStax but with Apache right?

Edit: Oops, no it looks like it's with DataStax. Then I can understand why people wouldn't sign it.

I cannot even read the CLA, so to be honest I'm not sure who it is with.

Reply on news.ycombinator.com