Re: [gentoo-project] [RFC] GLEP 76: Copyright Policy [v4]

["Michał Górny" <mgorny@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 3820 bytes --]

On Thu, 2018-09-27 at 09:52 -0400, NP-Hardass wrote:
> On 09/27/2018 08:42 AM, Rich Freeman wrote:
> > On Thu, Sep 27, 2018 at 8:00 AM NP-Hardass <NP-Hardass@gentoo.org> wrote:
> > > 
> > > On 09/26/2018 03:25 PM, Ulrich Mueller wrote:
> > > > Here is another small update of the copyright GLEP, resulting from a
> > > > recent discussion on IRC. This is not a change of policy, but merely
> > > > a clarification of the real name requirement:
> > > > 
> > > > - The Signed-off-by line must contain the name of a natural person.
> > > > 
> > > > - A copyright holder can be a legal entity (e.g., a company) in some
> > > >   jurisdictions.
> > > > 
> > > 
> > > IANAL, but as per the Berne Convention, anonymous and pseudonymous works
> > > are granted copyright protection.  What's the rationale behind mandating
> > > a real name?
> > 
> > The DCO/GCO have nothing to do with obtaining copyright protection.
> > This is always present if not waived.
> > 
> > It is about showing due diligence in the event somebody claims that
> > somebody ripped off their work and contributed it to Gentoo without
> > authorization.
> > 
> > If your real name is attached to a statement saying that you didn't
> > steal the work, and you did steal the work, then they can go after you
> > as well as Gentoo.  That deters contributing stuff without checking on
> > its legality.  That same deterrence also helps show good faith on
> > Gentoo's part.  This is why organizations generally pursue these
> > policies.
> > 
> > If somebody violates a copyright anonymously, then they have no skin
> > in the game.  They can just disappear if anything bad happens.  If a
> > contributor isn't willing to stake their own money and reputation on
> > the statement that something is legal to contribute, then why should
> > Gentoo assume that they've put a lot of effort into the accuracy of
> > that statement?
> > 
> 
> And, AFAICT, this only applies to the Signed-off-by line (the
> committer).  The author may be anonymous or pseudonymous... So, your
> statement is that people making commits to Gentoo must have real
> names... and be public.  This doesn't have any impact on whether the
> source of the code is legit, just gives you a point of blame for who
> actually committed it (which, TBH, doesn't mean much).  I can say John
> Doe committed code that wasn't legal.  But i_steal_code_1337 authored
> it... I guess we know not to accept code from him... or do we... since
> we have no way of vetting authors.  Making the restriction of names for
> committers and not authors, IMO, has no weight.  Requiring that all
> contributions be from real named sources is a pretty drastic change, and
> not what is being proposed, TTBOMK.
> 
> But that's really besides the point... The current status quo (as is the
> case with me) is that a committer may be pseudonymous under the
> condition that the Foundation have that individual's name in the event
> of a copyright issue. So, I still don't understand how forcing everyone
> to publicly use a real name achieves something that we aren't currently
> achieving...  Is that incorrect?
> 

Gentoo publishes a number of open source projects.  The code of those
projects is used beyond Gentoo and beyond Gentoo Foundation.  Therefore,
it is natural that we need all the copyright assessments and agreements
to be *public* and not hidden behind some opaque Foundation which may or
may not actually have the data (how can a regular Gentoo user be sure of
that?), and which may or may not choose to actually disclose it.

As for the case with you, I think the 'status quo' is more complex but
that's beside the point, and I don't think it would be helpful to anyone
expanding on that.

-- 
Best regards,
Michał Górny

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 963 bytes --]