From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id F1C89138334 for ; Thu, 27 Sep 2018 14:14:18 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id E08D1E091C; Thu, 27 Sep 2018 14:14:17 +0000 (UTC) Received: from mail-qk1-x732.google.com (mail-qk1-x732.google.com [IPv6:2607:f8b0:4864:20::732]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 9BA38E091A for ; Thu, 27 Sep 2018 14:14:17 +0000 (UTC) Received: by mail-qk1-x732.google.com with SMTP id c13-v6so1662250qkm.4 for ; Thu, 27 Sep 2018 07:14:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:openpgp:autocrypt:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=D0Mlp90dSl2y0aRhuSNsbvUG1gOLpvZT8pgVh9pqbaA=; b=PjfY8tH2SFc0jcIhzRWALMHsnERj7JMHJpAgzmTI24M7A0fDJwHtZH3Ka129LXRTRv /OIZpo/2L0CYdBfQis0Ak3l9TjgfZtFktFxagMPQjo6cnjThKLYZpYlmWlbIVEUgHjJ/ zup7rIkSVEK3v7VHZqr+QVWJD5ll0mwynYNqd5gFDYYWMQ050RDGdB9pTkY91CtF6IWo U90cswCu68tzg7p49OO5mz7wgXMlx1QxfCXFr3/qCWN9h5WIIq9r0yTKZcNdlDYdHZe4 3K13lU7wOzHbXbHvz9KT8BwTtW3NEyHtVevU4jNwc4v+q3RbTEIMrkbVQjvsX5odwCOn JG0g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:openpgp:autocrypt :message-id:date:user-agent:mime-version:in-reply-to :content-language:content-transfer-encoding; bh=D0Mlp90dSl2y0aRhuSNsbvUG1gOLpvZT8pgVh9pqbaA=; b=XskWhNngIpP/1jfgd3Vo7NP12hrQLy8ypnFS/b2ibesRJh9KHHjREjO2j0KNI9ys/q wrqEYOBFQ3Z7x3qRpMXIPejQYZpFR5NvVa81YPR6R/5rr0FRru9xF6G9A52duPbOF5xp PZ6nfwnx/TzvGTKRV7RX4Ea5iT5mgYl1x5wkqEH5Q6LsHUcSTWujdkUN3OJbW885UmeW Np2/0e+re/vSnBlHFAer+bTjdqMcp1KbJTEn4QwFrNgO8IDAwmMFEtWhNGkRjv0FynhV x0ohOloze7Qr2L6G8Q861wxo6mz1Wz1WebMZQav8x8DC50uUretgb6UycZFHKW8XBygB RuGQ== X-Gm-Message-State: ABuFfogTToZd8XLiSI/FqczLoF7LBXgbN06qpanrs5re7VaeADYrh6dW uTF/ZOyIKuWqJPMsmv7DMf0VNLpm X-Google-Smtp-Source: ACcGV60Rv/YAgjtunmyEsYAw+fqjdhvVB4Rh1dgvmsZ9WRyqx8JVgIEpzOgKQYtje5zrVI/SlYfyZA== X-Received: by 2002:a37:655:: with SMTP id 82-v6mr8025612qkg.223.1538057656046; Thu, 27 Sep 2018 07:14:16 -0700 (PDT) Received: from ?IPv6:2604:6000:130f:8578:5e26:aff:fe7e:5367? ([2604:6000:130f:8578:5e26:aff:fe7e:5367]) by smtp.gmail.com with ESMTPSA id w6-v6sm1190937qtk.9.2018.09.27.07.14.14 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 27 Sep 2018 07:14:14 -0700 (PDT) Subject: Re: [gentoo-project] [RFC] GLEP 76: Copyright Policy [v4] To: gentoo-project@lists.gentoo.org References: <23325.35685.793702.267278@a1i15.kph.uni-mainz.de> <23337.15822.698153.812236@a1i15.kph.uni-mainz.de> <2faff4c2-ed97-5a52-5078-365d1c6cf2a1@gmail.com> From: kuzetsa Openpgp: preference=signencrypt Autocrypt: addr=kuzetsa@gmail.com; prefer-encrypt=mutual; keydata= xsFNBFAAvSMBEACekA6f2B5X9zrQGsSvo1hZZ81cNu13WyZy66VS0JKGR17eSONbRN29h8FF sWEdXDnG4l7IcsaGynKkoMZHJKCl75aOW7y68ef7AzGnSabRSQmx6916VwhRrNPzBaAfb4qr 7YhrbX1whf5Rya1M1IWGPNez4QhPxaQBVP4mbE+csKeOEIpKQ2ZYo9q3uGso6rMj4nlh3I9P gVA5w6MX+G7JhcS9xgq/uIPIkZtX6w4xIhG4mfxg4kGARl4pf2eyF/KRCUww9J4geiIgkdMX VNV/jC/imb5GAnrPW9ZLdd5iZa/kUtsW5e/G/VNS0pdDjRABcm9hKeoLE3U8iCCLlu2+vrMM Rr8Ln4LeFg4JQ/Dyg38U8ZG7bu/CcVi3gG3B5m99LdAhiGX+ZgR7gvOzjddLhtIovVPOak7h Owzn1R5Y5H3eCfKfGjVGGdyih7lMxYVlrFVZbeJggk4UkBrOsdqabgx3Yu/fqF6MGlh0bOIt 85w0k/vjzSaa4XfzVh7LIpnGa8OIVrj963fYjYNjPKr2locKINUy4XbsXmgzOwdfQw6VEtno qNqeS3/1I5oWFq3aJUbGaYzQ+ngDUfb2rrRdbCVFkHzX9lCifjQfeBtFLgJsSgkb/k0lby2V 3Hiv/tMpRBq2mYGN0jq7ldm+aN7fKIgR3qJgGWKVD1qJfE24VwARAQABzSRTYXJhaCBXaGl0 ZSA8a3V6ZXRzYUBwb2luZGV4dGVyLm92aD7CwZAEEwEIADsCGyMFCwkIBwIGFQoJCAsCBBYC AwECHgECF4AWIQQwfzEOnm1uw4oeqaa+TU79BSl8ZwUCW6x8xgIZAQAKCRC+TU79BSl8Z0QP D/jadN2l5lyzYvc7kVe0xxMxw18xVSKpBUCYn9g8f5QhxNFqRVYugF+XIAtY/S5ibd3KwwUb 3nqtLll9L1IJWqE4gK2gT6teYu7SEJ3d9H4/pQpyWzXONdcthao9ufe7fRuqH9bbhtWxNkrP LDYtH3Cx+C753bUThP0MYiz4HFb5PBc0RpuENIPocObyxiCrRtoZeSbMeCVI1jyATRh04C/y t/rLbdPQztLuoothnRU831u/KO8bflJUy1L20B8WO8EK2ssgkysplhE+5lCZ3fmA7+LZ/qGO BanEQdvtppJQ+CNnS/AWYhnAvp1Tzbn7ZZtCiSsTvfuE3RG0oU0Z0ClnUptfn+bjUvGV/Xse iY4xuQa9x4umQjYIJMRKrFs+zebS60k+h7Bz4KzhGZK8i/eMHVIuS+yZRCRSAiXRsWWu/pwt 0rit7dYe5sKEvYYq5hmtGZtjfcQa4VPfSGFF+vblO9YdFGO23Y/AFLS5bR6B+UoLRL/l4+R3 XudGIhb56QeHEVNJXGA3fMtRUErNUfJkh38uTKVCzZe8IAjWWQ8WLF9TBXoJqleDLDiLnFRK rmPUYkagB+3PKOSlGJRElskU+R45eVv/6wENpZW7Sq8cRuIHgeB7gei64ou6A6/XSPOwp6OZ XDyX6tHRVdmLPcsJyRL6oEK0D+3vejAb1piFzsFNBFAAvSMBEACcwelGdl0EqexFc/58Q+bt Z85IdFiQ1eRN17YPCQ9RHXCPoryfZqLKsNgvdqHzzzYQWN5DrMyR1hGVkyS+bQ7AUXiswxWy S/lv4HOfHe3srtjier5ypgkITYLKo+YB0BhNKZPNbFlIEKpl2BvVN/1wx5Yrb99jCwEbaoEK xy1qoPIcrnVPfnjHteZ09VQHZgpIYzMRgZA9RxZeAIr+9sCnLk9UbrTwg6bz7t1/YevZePUl vGcj6ietTJQKp3ADBj3UuVZlvYPKwafDW+vQPuhrNMoboivVm0L7Q6ZIonNhp1xEhxgjtxPT 47rCJX6CBbeSLRkmPD9wffAAJUXhIDu3gDw19kbLUb5Ug9f8OSh/6W9p6mDf5F7o/eOKLVwz xibWXGT5oHkgZrkjTS3U1OCZXFEE0qoMtkKj3RKMOa0AGIG/uM0dvRmHfLZ4Ei6m7nQen2cD NYOGq0wnpUfOzsKnIdwJzy02QSWMqu4SuqU0wpurW1YdcqYhQGswfCtAO+ZPDK/6diqM4bwk DTzOWxsZUpQaArjW5gVUp9j9ShM8Yprj0s+H8Rbqdro8GKn6jA69ojApD7ksI/r8duvDyWOr heIrUL/d9z4V2UEJqOJN+I8sqUVt0RsSN7Pcm5WyKzQan6p13iRNHyM4612F++MwEQaTQSM1 FMjo7H/SEitk+QARAQABwsFfBBgBAgAJBQJQAL0jAhsMAAoJEL5NTv0FKXxnszYP/RTft8Rk qwpaAQ4piq7dS310NWmxN3ig1N/2rlR6sYTIxQrr2FD21h/DwZ6JA4bROcp4epZrmvZRqYjs FA7fNr6Hm71G7cU/msZN1Tqm/XI3OQmG2eKNsYu5OEY9ALRGHQC66UeyfND+5RC4+wBz/+Cf rVZoP1rkivY+TaYDqScy2KnuXIDGpzcXHxQWf1Se/Wn3nHo9QhixlHmLFY8gE0XgugKZL7in Z1jZcqMjK8/9d0WErrCRMu5WmGYBB1OFZsMxXZAd6sI11ILiVhzmcYCqOT7fpnpTIELDWEZm atl62DO4AznO8QTj+puB4x1WrKhLZ/fRxAXVvQgd4xHdXhl1qv+BBBlCrA89vbs7RnXS+Sy1 OSR/C7Os4xDmAcUGpPpWEEHOWUKTgQDWNKHSuI+j29WTq7FedewTRKIU0oKygUikJ7+fbWue x0bTu8w8hbFKovWsHK5nVy9F2k3JnfdQZWL+byxVa1aq59aiOep1qnLCJLNAFoxfuFSI8QRV wRyuruB+/af3NfjU+2T9E7hmgSlPUACuxzu2eOKjLNjAu34FBv9VOqskTP0jIwpJHoKFQQWR lXJLKaVN0vClBp1lqegRsdLQbU0bZ2uYWUrHWzLEPhrWpJ1bVaFoIytLhdL6EKkx5nhfmYTq sFdfkmk54/J+iTXdjvnZBURJKuLP Message-ID: <3213a040-f131-b9be-b350-4bbcda10427c@gmail.com> Date: Thu, 27 Sep 2018 10:14:13 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Project discussion list X-BeenThere: gentoo-project@lists.gentoo.org Reply-To: gentoo-project@lists.gentoo.org MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Archives-Salt: af184ff8-ff97-4c27-9398-d1339d2ccc47 X-Archives-Hash: edc69836fb69907e16ccfcd4a85f41f6 On 09/27/2018 09:43 AM, Rich Freeman wrote: > On Thu, Sep 27, 2018 at 9:08 AM kuzetsa wrote: >> >> in this case, the GCO (or the DCO from which it borrowed it's ideas) >> should explicitly state its purposes, rather than relying on the >> assumption that a person can be tracked down if the license was is ever >> in doubt. > > While I'm all for having background, I don't see how it actually > changes the situation. > > Also, there is no need to track people down, ever. The purpose of the > GCO/DCO is to make the contributor liable for their contributions, and > this is already accomplished. If the true copyright holder wants to > try to track them down that is their problem. This suggests the "real name" requirement from GCO / DCO could be enforced, but isn't. Even if name alone was all that is truly required, without a way to tie a specific name to a specific person who has the same name, the legal meaning is moot due to "real names" not being a unique identifier. > If somebody provides us evidence that they are the true copyright > holder and ask us to remove their code, we simply have to remove their > code. No stack of licenses/certificates/attestations/etc will ever > change that. > > It is like buying a house. If you buy a house from somebody, and it > later turns out that they never owned the house, then the owner is > going to be able to take his house back from you free of charge. It > doesn't matter how many documents the "seller" signed in the process - > it was never their house to sell. However, those documents CAN place > some liability on them for such things, or provide you with due > diligence / reasonable care so that it shows that you acted in good > faith and the owner won't go after you beyond just getting back their > house. You're still out the house either way. Nobody is proving their name or where they're located. In this metaphor, I believe gentoo is the one buying a house without verifying the identity of the seller. (see above) > I believe this is the basic principle behind these kinds of documents. > It is basically an affirmation of compliance, which is a form of > showing reasonable care on the part of the recipient. > >> >> people can and do physically relocate from time to time, and if they're >> no longer a contributor there's no way to track them down, should the >> need arise for any legal or ethical questions (the kind of purpose which >> the policy makes no mention of: a way to reach the contributor) >> > > See above. Tracking down the contributor is unlikely to really get us > far, and it really makes no sense. The purpose of the DCO is to > collect the affirmation of compliance up-front so that we don't have > to try to get it later. It doesn't change who owns copyright. If it > turns out somebody lied to us then bad things will always happen, but > they just won't be as bad as they could have been. > It's true that affirmation of compliance would be helpful, but if gentoo doesn't ask for that diligently, relying on the presumed validity of a name (and no other significant metadata) is little use to anyone's legal injury which could've been prevented be a more rigorous policy. -