From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 16800138334 for ; Mon, 25 Jun 2018 21:06:08 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id AC834E09DF; Mon, 25 Jun 2018 21:06:05 +0000 (UTC) Received: from mail-ua0-x244.google.com (mail-ua0-x244.google.com [IPv6:2607:f8b0:400c:c08::244]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 3C06AE0992 for ; Mon, 25 Jun 2018 21:06:05 +0000 (UTC) Received: by mail-ua0-x244.google.com with SMTP id v15-v6so2677648ual.11 for ; Mon, 25 Jun 2018 14:06:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=scriptkitty-com.20150623.gappssmtp.com; s=20150623; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to; bh=9YP40m+Ib0ZKOZWrUwjh8WdhD6nUHPNYi5VLvX+suTc=; b=zO5V2XJDtCvDTDut5KcH1iRfeSbVQU8drws3eW0bQ/FitEdMEYcqluMsIhtkOTcNeZ yGrPwuDfMIdTTujvPrGF1hK4lVhAxfzADvowWvzKOgWLOb002ZT/6MJg0ZoCmQEMfkWb PhrkjFHSjL5GXdyoF1aIbVR7CnvYHunx8Zay3knPsBh6sNdrc1Q0MGwmnZ9W+Fm9CBDH sj4l0J4qK02Tw4Zprm6nFf8d/cSrJQQU9C8AzHic7TuYxaDiQUi/HJ/7nbLv9a63puvL MtjJ+yzLROJvvMlYKJjDT8LESIvAOQ/F+Bk6JEJDg0RjrBbyqU6LWBYgeS2/p/6mxAm6 iiSg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to; bh=9YP40m+Ib0ZKOZWrUwjh8WdhD6nUHPNYi5VLvX+suTc=; b=RouBS4h/5yAgpC71Kj0SQgxIl0C5x+OclKkbN5cUgcoHq/gVhVp6OdDuvFf1Spp609 aw6zSY635IIpOKC53Ij10pLrMEYa9PyqtNWP8xZotjh05JDIRgd62l9hdp4EAWRaDzX6 tntcf0zdogV5BRW7Lylk+swZUmY+UmfydgLlcnRtGOYIkb9x3Z5dxSEVNZuaxby/9FJV 18urvWO7QOtnurMS0P0BIW84tgGE/y/rbNUbFoUhN56V8pLvw0JUIuu/b7puiTuCzPMn eB2FdXDPM2ja40c2YVbyOxr7TihrJxv8DwsdP8CzYutn6xi9VKDz/R1gAlVcqz1OAc7M N3Tg== X-Gm-Message-State: APt69E3RZ0UHEBHaJZ8YXBtmcyg/NKV6F8kPl5fTs95kgEyaQQFpZ3Ba eRCw+tNXWAOLj+VjxxFRzBr9tQoRV3oijtm8KSWisg== X-Google-Smtp-Source: ADUXVKKLjG0YOt3Y5QgwO0UWwxQrvu0Rur7pM4VcMJOl8H0kSPqS5xZJH5KjfIx3eCjgyY8Gr6orcFrArciUwWbhXUk= X-Received: by 2002:ab0:4c24:: with SMTP id l36-v6mr8857720uaf.27.1529960763745; Mon, 25 Jun 2018 14:06:03 -0700 (PDT) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Project discussion list X-BeenThere: gentoo-project@lists.gentoo.org Reply-To: gentoo-project@lists.gentoo.org MIME-Version: 1.0 Sender: antarus@scriptkitty.com Received: by 2002:ab0:4803:0:0:0:0:0 with HTTP; Mon, 25 Jun 2018 14:06:02 -0700 (PDT) X-Originating-IP: [2620:15c:2:11:20e4:9b52:f6a8:ef6a] In-Reply-To: References: <23310.46809.293787.611345@a1i15.kph.uni-mainz.de> <23317.12829.91552.529904@a1i15.kph.uni-mainz.de> <20180625013334.GA28404@kroah.com> <23344.37042.753481.563752@a1i15.kph.uni-mainz.de> <20180625070525.GA6151@kroah.com> <23344.40875.105369.227774@a1i15.kph.uni-mainz.de> <20180625110540.GB3058@kroah.com> <23344.65054.620110.958503@a1i15.kph.uni-mainz.de> <0a9228f1-338e-06a3-f3f4-6b27eea71408@iee.org> From: Alec Warner Date: Mon, 25 Jun 2018 17:06:02 -0400 X-Google-Sender-Auth: rdhstFB5ibUiIWduZPjBmKtnqJQ Message-ID: Subject: Re: [gentoo-project] Re: [gentoo-core] Re: Poll: Would you sign a Contributer License Agreement? To: gentoo-project Content-Type: multipart/alternative; boundary="000000000000d7fd2f056f7dbf25" X-Archives-Salt: 24f3e4a5-e178-45b5-ba8e-0d61e4d11dfc X-Archives-Hash: 879770b0ace40390856d9098cf11f25a --000000000000d7fd2f056f7dbf25 Content-Type: text/plain; charset="UTF-8" On Mon, Jun 25, 2018 at 4:52 PM, Denis Dupeyron wrote: > On Mon, Jun 25, 2018 at 3:31 PM Alec Warner wrote: > > I think you paint a fairly black and white picture here. If there are > *concrete* issues then I want to see them here (e.g. adopting a DCO means > these 5 people cannot contribute without some additional work) because its > up to Gentoo to work out these issues. Maybe that means accepting > contributions on a contingent basis while we work out the issues. Maybe it > means delaying making the DCO mandatory for everyone. Maybe it means > talking to lawyers to discuss specific legal problems. > > I have no opinion of the document itself, whatever it is. I was just > making you guys aware that if this did happen, I and a bunch of others > will be asked to stop contributing in any form until the document, > whether good or bad, was reviewed and us allowed to sign it. Again, > you can make the document as suitable as possible to us, it would > still have to be reviewed by our corporate lawyers. If somebody, > somewhere, decides this has to go full corporate, i.e., to Japan where > I'm suspecting lawyers are not very familiar with both US law and > open-source matters, you're no longer counting in months. And again, > we're talking about the maintenance and continued development of > things like portage and OpenRc. I'm hoping I don't have to make the > case to you that it's difficult if at all possible to replace paid > developers with a loose bunch of volunteers. > So I would rather get some consensus on the wording of the DCO and send it to $employer_legal_department for review, as opposed to just doing nothing. Gentoo the organization decides when / if the DCO is mandatory. I'm proposing we finalize the wording and get a review (to unblock the DCO, which is nominally a thing Gentoo wants to do.) I think it should be a goal to retain the volunteers who are paid; and if we cannot do that then well, that is a problem for future us (e.g. we need to ask and have the employer unable to say yes for whatever reason.) I feel like you are suggesting just not asking..and I'm not really on board with that. -A > > > I'd rather do a DCO and see things like "well we tried to recruit 20 new > people but 15 of them left because of a DCO" than be subject to > unsubstantiated fear. At least on that basis we can decide that the DCO is > 'too risky to staff' and stop requiring it. But that would be an experience > based on actually trying something. > > You just won't get 20 recruits or candidates. You will get much fewer > to none of them. Mark my words. Imagine the situation. Young software > developer has to choose between living his/her life on one hand, and > on the other going through our stupid recruitment system, wait for > months, and then ask his manager to ask his manager to ask etc... that > his/her employer reviews this document and clears him/her to sign it. > This person will either do nothing or become an arch developer. We > don't live in a vacuum. > I'm less convinced by theoretical problems than by practical ones that we have experience with though. Maybe we can collect data from other projects who require a DCO and see if they lost contributors? -A > > Again, I don't have any opinion on the document nor the process. I'm > just trying to raise issues which I haven't seen being raised before > it's too late. When our employer asks us to stop contributing we will > have no choice but to comply. > > --000000000000d7fd2f056f7dbf25 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Mon, Jun 25, 2018 at 4:52 PM, Denis Dupeyron <<= a href=3D"mailto:calchan@gentoo.org" target=3D"_blank">calchan@gentoo.org> wrote:
On = Mon, Jun 25, 2018 at 3:31 PM Alec Warner <antarus@gentoo.org> wrote:
> I think you paint a fairly black and white picture here. If there are = *concrete* issues then I want to see them here (e.g. adopting a DCO means t= hese 5 people cannot contribute without some additional work) because its u= p to Gentoo to work out these issues. Maybe that means accepting contributi= ons on a contingent basis while we work out the issues. Maybe it means dela= ying making the DCO mandatory for everyone. Maybe it means talking to lawye= rs to discuss specific legal problems.

I have no opinion of the document itself, whatever it is. I was just=
making you guys aware that if this did happen, I and a bunch of others
will be asked to stop contributing in any form until the document,
whether good or bad, was reviewed and us allowed to sign it. Again,
you can make the document as suitable as possible to us, it would
still have to be reviewed by our corporate lawyers. If somebody,
somewhere, decides this has to go full corporate, i.e., to Japan where
I'm suspecting lawyers are not very familiar with both US law and
open-source matters, you're no longer counting in months. And again, we're talking about the maintenance and continued development of
things like portage and OpenRc. I'm hoping I don't have to make the=
case to you that it's difficult if at all possible to replace paid
developers with a loose bunch of volunteers.

So I would rather get some consensus on the wording of the DCO and se= nd it to $employer_legal_department for review, as opposed to just doing no= thing. Gentoo the organization decides when / if the DCO is mandatory. I= 9;m proposing we finalize the wording and get a review (to unblock the DCO,= which is nominally a thing Gentoo wants to do.)
I think it shoul= d be a goal to retain the volunteers who are paid; and if we cannot do that= then well, that is a problem for future us (e.g. we need to ask and have t= he employer unable to say yes for whatever reason.) I feel like you are sug= gesting just not asking..and I'm not really on board with that.

-A
=C2=A0

> I'd rather do a DCO and see things like "well we tried to rec= ruit 20 new people but 15 of them left because of a DCO" than be subje= ct to unsubstantiated fear. At least on that basis we can decide that the D= CO is 'too risky to staff' and stop requiring it. But that would be= an experience based on actually trying something.

You just won't get 20 recruits or candidates. You will get much = fewer
to none of them. Mark my words. Imagine the situation. Young software
developer has to choose between living his/her life on one hand, and
on the other going through our stupid recruitment system, wait for
months, and then ask his manager to ask his manager to ask etc... that
his/her employer reviews this document and clears him/her to sign it.
This person will either do nothing or become an arch developer. We
don't live in a vacuum.

I'm les= s convinced by theoretical problems than by practical ones that we have exp= erience with though.
Maybe we can collect data from other project= s who require a DCO and see if they lost contributors?

=
-A
=C2=A0

Again, I don't have any opinion on the document nor the process. I'= m
just trying to raise issues which I haven't seen being raised before it's too late. When our employer asks us to stop contributing we will have no choice but to comply.


--000000000000d7fd2f056f7dbf25--