From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 6BDD1138334 for ; Fri, 1 Jun 2018 02:33:07 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 2DFC4E08FC; Fri, 1 Jun 2018 02:33:06 +0000 (UTC) Received: from mail-pl0-f65.google.com (mail-pl0-f65.google.com [209.85.160.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id D5652E08ED for ; Fri, 1 Jun 2018 02:33:05 +0000 (UTC) Received: by mail-pl0-f65.google.com with SMTP id i5-v6so14385536plt.2 for ; Thu, 31 May 2018 19:33:05 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=47Rbfy1yVyIw9+jtDZug+BMHugdukNbBd6as39+A3cY=; b=kFB2drF9c2Mtqsm1dRF6d5jhOAEytHbheouJ2+qlA/dMpc0Hd5R+zNKxPNaiXNjhx6 MidSIHnoQo+kL94zi4voc6aqqOB6Rs1zGkkmGQZVAOarAOrtfAoUL9t2L8+ttnvpw6/k AeN6doKwBuI2NDHnYmfR81YH3dFciFJgLaHSy67YpvDBtIzcwCjMkSh01RyU5fG0GW1j 8tjf5HzqFfklKA+rW5lTzz7mv+WMhyq8sXh9dOrj5y2HJpbPwvlLyvqtk1Wrp6nCUAiM XKfOutXyUYxW9VTkLOURKbwtbhZDiohSbutwrCh24BLggLjoXKpOX7Ve9tXc5L9xJwMw 3c1Q== X-Gm-Message-State: ALKqPwe2PO1o5fcRPuVR0Pqs8rt8vuHXheWYlfJqOKw2zZfWbhRl9Nq7 6DgfrgznDHfS7vtqodPxZC2CRRjTsaSofkG+eqmVEQ== X-Google-Smtp-Source: ADUXVKJz5xMHL+HbcHAfsz+RQGoYeuweghhUM53OiTFPEG3sgXE+PYv1afBBM2gG4M7qOs8pePiKr+KYIn8JVinkqLc= X-Received: by 2002:a17:902:b488:: with SMTP id y8-v6mr9150233plr.157.1527820384321; Thu, 31 May 2018 19:33:04 -0700 (PDT) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Project discussion list X-BeenThere: gentoo-project@lists.gentoo.org Reply-To: gentoo-project@lists.gentoo.org MIME-Version: 1.0 References: <23310.46809.293787.611345@a1i15.kph.uni-mainz.de> <20180530182136.GB18004@kroah.com> <23311.6978.886855.373818@a1i15.kph.uni-mainz.de> <535aa147-a5b3-2578-fb4c-b59fc85af155@gentoo.org> <80051242-f4dd-329b-654f-c9052631be5b@gentoo.org> In-Reply-To: From: Rich Freeman Date: Thu, 31 May 2018 22:32:51 -0400 Message-ID: Subject: Re: [gentoo-project] Re: [gentoo-dev-announce] Poll: Would you sign a Contributer License Agreement? To: gentoo-project Cc: jstein@gentoo.org Content-Type: text/plain; charset="UTF-8" X-Archives-Salt: 0a52fdb7-eb14-41b5-953a-9b28e3ae0190 X-Archives-Hash: 5d2451c1e256238616926326163019c5 On Thu, May 31, 2018 at 9:55 PM R0b0t1 wrote: > > On Thu, May 31, 2018 at 6:52 PM, Raymond Jennings wrote: > > I refuse to sign anything. > > > > If the GPL works as intended, then anyone using my work would > > themselves be making a derived work of their own for which they > > themselves could enforce the GPL. > > They could pursue the violation for just the copyright on the changes they made, not to the work they derived it from. For example, if somebody reproduced this email illegally (let's assume it was distributed under a non-free license), I could sue them for copying these two paragraphs, or for the email as a whole, but not if they removed my additions and only sent the quoted text above. Likewise you could sue them for copying the quoted text above, or for the email as a whole, but not if they removed the quoted text and only copied my additions. This email as a whole is a derived work, but if I didn't quote you it probably wouldn't be. > > It is for this reason I never understood the point of contributor > agreements for open source projects. Even the FSF's justification, so > that they may pursue GPL violations without requiring you present, > seems to fall apart as various Linux kernel contributors have gone > after companies on their own for profit without the consent of Mr. > Torvalds, the other contributors, or the Linux Foundation. > You're comparing apples and oranges here. The Linux kernel doesn't require people to sign CLAs. That means that the Linux Foundation generally CAN'T pursue copyright violators, but the individual contributors CAN. If the contributors signed traditional CLAs, then the Linux Foundation COULD pursue copyright violators, but the individual contributors COULD NOT. A traditional CLA transfers the rights of the creator to the assignee, at least under US law. I'm speaking generally of course since what any particular CLA does is governed by the wording of that particular CLA, and of course the governing law. The FSF wants people to sign CLAs so that THEY can pursue copyright violators. The contributor already has this right, probably. There are a few other nuances (again, talking about traditional CLAs that assign copyright): * Some question whether somebody holding copyright over only a small part of software could on their own pursue a violator, or how effective this would be. These people argue that a CLA consolidates the copyrights so that instead of a bazillion people owning copyrights to 3 lines each, you end up with 1 entity owning copyright to the whole thing, which eliminates this issue. * A CLA also can allow for relicensing beyond the limits of the standard "or a later version" language (for projects that even use this language). If a CLA is signed then an organization could choose to switch from GPL to CDDL, or from BSD to Apache. Of course, many traditional CLAs would also let them switch from GPL to "all rights reserved," with the caveat that whatever was prevsiously released under the GPL could still be redistributed and modified by recipients under the GPL. Note that the above pertains mostly to traditional CLAs. For the FSFe FLA approach the main benefits are: * Gentoo could re-license under a different free license, within the limits of the agreement, assuming we owned enough of the code or otherwise dealt with that issue. This could be useful if some new license comes out later not related to the GPL/etc. If you care about such things you'll want to read it for yourself, but the agreement is structured to prevent shenanigans like proprietary re-licensing. * One of the goals originally in the FLA was to make it exclusive in a way that would ensure that Gentoo would know that you hadn't given somebody else permission to use your contribution under a non-free license (which means we know anybody doing this is in violation). However, looking at the wording of section 2.3 of the new version I'm not sure that this feature even applies anymore, as there don't seem to be any copyleft restrictions on the grant back and its ability to relicense. That seems like a bug the FSFe might want to look into. In any case, without an FLA with the correct wording, there is no way to know if somebody is in violation without contacting the original contributor, because the original contributor could have given them permission to use it under a non-free license. This makes detecting violations more difficult. (I realize the above might be confusing, and can elaborate further if desired.) -- Rich