Hacker News Reader

Comment by jhallenworld | Hacker News Reader

When I worked for IBM (via acquisition), I wanted to fix bugs in Cygwin (owned by Red Hat). Red Hat does not accept patches unless you get permission from your current employer. I could not get anybody in IBM to sign Red Hat's permission slip. Nobody would sign because it's all risk, no reward from IBM's point of view.

View on HN

I have the same problem in academia, being in a non-CS department, I'm required to notify the University's Center for Technology & Venture Commercialization about assigning my copyright over software to another entity (like the FSF), but so far I have been unsuccessful at getting them to sign the letter the FSF wants, despite the code I would be contributing being completely outside of my work at the University and so therefore theoretically outside of their purview. I suppose the moral is that all large organisations converge towards bureaucratic processes that waste the time of high$/hour employees and attempt to hinder all not immediately commercialisable progress.

What if you would just publish your code on GitHub, would they seek to punish you?

If it's their code by employment contract, they could.

I doubt it, but that's not the issue. The issue is that the FSF wants a signed "ok" from the University that I can assign copyright to the FSF, and the University's Center for Technology & Venture Commercialization won't issue that. I'll wait a year or two until I'm (hopefully) tenured and then press the issue again.

If I were sure it's ok and the university/company is not going to be mad at me I would just publish my code as public domain and let whoever can make use of it decide on themselves. Perhaps some FSF-approved developer would pick the code up if it is useful to them.

In some courses publishing coursework on GitHub can break academic integrity rules related to plagiarism. It’s hurt students as more hiring processes assume portfolios. CS departments are behind the times.

Posting your coursework on a publicly available forum is clearly academic dishonesty, what are you talking about?

Am i taking crazy pills? How is publishing your work in any way dishonest?

For a lot of those courses there's pretty much one way to solve the coursework, so all solutions are pretty similar. It's practically impossible to tell the difference between an original solution and a copied solution with the variables renamed and some code moved around. Or the student can look at the solution and reimplement it themselves, without solving it on their own. Sharing solutions can even get you expelled in many unis.

I'm going to suggest that it's on the universities to find a way around that problem. It's a real problem, but everything being publicly available online is how the world is now. Just varying assignments every year should be enough. If reasonable variations don't make the assignments challenging enough? Well the students are always going to be able to find some reasonable variation online. Starting from absolute scratch is just not a thing anymore in most fields.

They have found a way around that problem...they expel students who share solutions.

It should be on a student to choose whether or not do they want a challenge, what particular aspect and what degree they'd like to be challenged in. The job of an educational institution is to educate, whoever interested can easily invent a challenge for themselves or use an old challenge without looking at ready solutions if they so desire. Forced artificial challenge policy is questionable.

I think we're taking the same pills.

It appears that this is one of those issues that polarizes people very strongly into one of two possible options. My response to the complaints above is usually "tough luck", because I do not see it as my task to ensure that other people cannot cheat. In fact, with today's availability information, I'm certain all those that want to cheat can and will do so easily, no matter what.

This leads me to the conclusion that the fundamental problem is actually the conflation of two very different purposes which are often at odds: teaching and certification. Universities try to do both and it often ends very badly. Certification should be removed from universities and put into separate, specialized organizations.

Wait, so your university owns copyright on all your work by default?! That's a bummer if true. Outrageous, actually.

I think this is US specific.

The rules vary by school and state and whether the contributions used school resources or were created as coursework.

Nope, Its the same in Germany too.

Only if it is directly related to your research under office hours and is done solely by your university. If you use the university laptop to do some OS at home it is not, though in the US it could be and usually is.

My contract requires that anything I develop using University resources, which in practice means potentially anything in my areas of specialisation, the University has some claim on.

It's not entirely unreasonable - imagine someone in Biochemistry developing some drug using University labs etc. and then turning around and selling the formula to a private lab.

But it's the petty bureaucratisation which is infuriating. (And usually the people making the decisions aren't practically qualified.)

If you use any (and I mean any) school funded resources for any of your personal projects, yes, they usually have a basis for a claim.

I have a friend who went to Utah for his bachelor's in CS.

I'm not in CS, but my understanding is that the CS dept has a historical relation with the FSF.

While I was working as an assistant researcher three years ago, my contract also considered all research-derived knowledge uni property. In this case, pretty much anything tangentially related to HTTP performance enhancements would have been claimable by them.

It the software is GPL, and you use it for your company/university to do work with, that is a very dubious claim and more likely falsifiable in court.

GPL is a license applied to a work by the copyright owner after (or at the time of) creation. It has nothing to do with authorship of the work and who owns the copyright.

To elaborate, even if GP developed code as part of a GPL project, the copyright owner could prevent him/her from distributing that code to anyone else, whether that distribution occurs under the GPL or any other license.

Well, that is the result we got from turning Universities from public knowledge centers into private for profit IP accumulating businesses.

It's the standard in many universities and many countries that consider the university your employer if you have a full time equivalent dedication, even if the university only considers you under some kind of stipend or scholarship.

And yes, it's outrageous.

It's actually the norm in the U.S. ...

Come to Sweden then :) As a researcher you explicitly own the rights to any foreground, i.e. results, as stated by law — the so called teacher’s excemption.

Careful, this might only apply to professors, not the rest of the staff.

Might be, but in general the attitude and laws surrounding ownership of code (and most anything else) is very different in Norway, and I would assume Sweden. Here anything you make is explicitly yours and you have full ownership over it, even if you made it on company time. I've talked to several larger IT firms in Norway about this and they all have said that it would be suicide to force their employees to sign away their rights to personal and side projects, but that it would also more or less be impossible to enforce.

If this is indeed true it is a killer argument for moving to sweden.

If you have a job for me, I'm happy to. :)

Europe also more generally has much higher salaries for postdocs and grad students from what I've seen floating around listservs.

> I suppose the moral is that all large organisations converge towards bureaucratic processes that waste the time of high$/hour employees and attempt to hinder all not immediately commercialisable progress.

All large organizations have a decent amount of bureaucracy around copyright and IP, but the difference is good ones make it easy and straightforward for employees to go through that process.

Google, for example, has a well-documented and clear process for contributing to open source software (both in work hours and in personal time): https://opensource.google.com/docs/patching/

I totally understand that large organisations don't want to sign papers about things that are none of their business. It's ridiculous that they need to sign them. This shouldn't be a requirement for Open Source contributions. But with some businesses claiming their employees' unrelated work done in their free time, I can see how this has become a necessity.

It's harmful for open source, and a terrible situation that's not to anyone's benefit. I guess US law should make more clear that employers don't own their employees' private work?

Totally agreed.

I always imagined it stems from historical experiences where staff ran off with ideas that they were paid to have within the scope of their employment. So perhaps this is the only way employers have thought of protecting themselves against that. Ie., what other way do we have to offer them?

It's not only owning the outcome that is the problem, if you develop a software system that in any ways competes with your employer they may have a reason to fire and/or sue you.

The problem as someone else stated above in this discussion is that with a company the size of IBM it is hard to do anything that is guaranteed not to compete with anything they do.

This is also a major obstacle towards open science, and one that the open science community seems generally unaware of. Every day there seems to be another journal article extolling the virtues of data-sharing and imploring other researchers to share, but very few folks seem to treat the elephant in the room, which is that universities have no motivation to allow their researchers to release data for free and potentially relinquish valuable IP.

I'm a current IBMer, and there is a process for getting CLAs signed - it's a bit bureaucratic if it's not a CLA for a company we already work with, but otherwise IBM has no problems with contributing to projects like that.

I left IBM a few months ago, but I led a bunch of developer advocacy efforts for a couple years.

There are several internal programs at IBM that enable employees to make contributions to open source with very little bureaucracy. Go to the intranet site w3.developer.ibm.com for details.

Deeply regrettable. One of my colleagues identified and fixed an issue with Duplicity while he was working on a backups subsystem for our server estate, and after a quick check with a Director I was able to sign off the work for release back to the Duplicity project.

This actually seems like fair policy to me, think of the mess Red Hat would be in if IBM decided that they had copyright on your contributions to Cygwin.

Or is my understanding of copyright law off base?

That's exactly why Red Hat had said permission slips. The ridiculous thing was that IBM refused to sign them

The ridiculous thing is that IP law makes this necessary.

> if IBM decided that they had copyright on your contributions to Cygwin.

How could they decide this if you'd have written the code on a weekend?

Many employers have clauses about owning any IP you produce while employed there, regardless of whether or not it involved company time or property. Whether said clauses are actually enforceable varies from location to location.

Aka "justice by bank balance and time".

At some point software engineering is going to have a union just as a legal defence fund.

Software engineers already have their own chambers of engineers in some states. No need for another trade organization.

The FSF doesn't want to get caught up in a dispute, and thus requires explicit disclaimers of work-for-hire interest from employers https://www.gnu.org/licenses/why-assign.en.html

Couldn't you just submit patches under a pseudonym?

I think that, if you were to ask open source maintainers, "What would you think of me committing fraud to get around your project's policies?" most of them would say, "Thanks, but no thanks."

I do understand your point, but I wouldn't spin it that way or bring it up with them, just start committing using a "new" identity, assuming they have no knowledge of your "main" identity.

Easier said then done.

That dishonesty is exactly what makes it fraudulent.

They're asking you to sign some legal documentation. If you forge a signature rather than getting it signed by your employer, that's fraud. If you create a false identity in order to hide the fact that you have an employer, that's also fraud.

You have exactly two legal (and, just as importantly, honest) options in this situation: Get permission from your employer before contributing, or don't contribute. If you like the project and don't want to create trouble for its maintainers, you will pick one of those two options.

The reason this permission exists is that contributions will not be owned by your employer, but will be part of the project. It depends on your employer if they allow you to work on personal software that they do not claim ownership for or not. I think you are right to not use a pseudonym. I once did, and regret having done so.

> I think you are right to not use a pseudonym. I once did, and regret having done so.

Did it cause you some problems later, or?

Well, the permission exists to ensure that the contributions will be owned by the project and not anyone's employer.

If that permission isn't secured, though, and the employee has a contract with their employer that signs ownership of some or all of their off-hours work over to their employer, and the employer decides to try and exercise those rights, then it's anyone's guess who the real owner would be. Might vary by jurisdiction. Might be down to whether the open source project can afford to lawyer up in the first place.

Given all that, a FOSS project isn't unwise for asking for a permission slip. You could argue that it's being over-cautious, but that's the project maintainer's decision, and it deserves to be respected.

Contributions can be owned by employers and things still work. That's how Linux development works for instance, and the DCO is arguably a similar "permission slip" (though it mainly depends on the honour system with contributors just asserting they have the right to contribute). Some CLAs are very similar to the DCO (for instance, the Apache CLAs or the Google/Kubernetes ones).

It depends on the type of CLA. There are many CLAs that do not imply copyright assignment, it's just legalese to make sure that you are taking liability for making sure that you have the right to add your contributions to the project -- basically a longer-form version of the Linux DCO.

In those cases, your employer would own your contributions and thus you need permission from them to license their copyrighted work (your changes) under whatever the project license is.

But in any case, contributing under a pseudonym is something that you should think about very seriously. This has been done before in the Linux kernel and luckily nobody got sued over it, but it is basically copyright infringement mixed with various levels of fraud and deception. Don't do this to us poor maintainers.

> In those cases, your employer would own your contributions and thus you need permission from them to license their copyrighted work (your changes) under whatever the project license is.

How does your employer own what you do in your free time? AFAIK there is no job contract like that which is legally enforceable. At least in California.

It's jurisdiction by jurisdiction. And even if it's not enforceable, it might still be very expensive to duke that issue out in the courts.

Worrying about these details is the last thing a project maintainer needs to be worrying about. Easier to just require everyone to have a belt, even the ones who say they own suspenders.

It depends on the country. In some countries, work related to your job but done outside work (or work using company resources like a company laptop -- I believe in California this is also the case) might possibly be owned by your employer (if your work contract says so). For instance if you work on databases and in your free time you developed a really awesome database from scratch, that might be owned by your employer because of the training and learning resources your employer provided (I think this is the reasoning -- but personally I find it quite abhorrent).

But I assumed that GP was talking about wanting to contribute something they did on work time, not on their own time.

Out of curiosity, why do you regret it?

> that's also fraud.

No, it's not fraud because there's no intention to gain illegal or unlawful gain. It's just deceit.

A very interesting point. I think it's fraud. You're doing it for (potential) monetary gain. Not your own, but the ownership of copyright which you're claiming and reattributing on behalf of your pseudonym. Still fraud, I suspect.

You'd be surprised. I have first & second-hand experience with the maintainers of GNU projects just agreeing to accept patches on the sly and commit them as themselves with the consent of the submitter because the submitter can't be bothered to sign a copyright release form.

Linux kernel, as an example, expressly rejects this.

Source: multiple discussion with GKH.

I wish Cygwin would get more steam, a new package manager and a repository...

Why wouldn't you use WSL?

Windows < 10/1809 compatibility, ability to ship standalone applications, force of habit, need for something WSL doesn't support.

Ironically, Cygwin might be closer to "native" than WSL is in some cases.

> need for something WSL doesn't support.

Like what...?

> Ironically, Cygwin might be closer to "native" than WSL is in some cases.

Which cases...?

> Like what...?

SQLite, for one. https://github.com/Microsoft/WSL/issues/2395

I haven't used Windows in quite some time, but I believe they are quite different. WSL is more like a very basic version of Wine in that it implements Linux system calls and can execute ELF binaries, and as such requires you to install a host OS for libc and any other libraries you want. Cygwin is more like Winelib in that it provides a custom libc implementation and toolchain that are natively compiled, and as such requires you to rebuild your applications.

My understanding of WSL is that Linux software runs natively on Windows by virtue of a compatibility layer. Eg. if there is a fork() in my code it will be translated into CreateProcess() or something like that.

Correct. It's an interesting architecture, if you're interested in reading more:

https://blogs.msdn.microsoft.com/wsl/2016/04/22/windows-subs...

Right, so like what Wine does. (Remember: Wine Is Not an Emulator.)

I have always been curious on how WSL differs to coLinux or andLinux ( http://www.andlinux.org/ )

About 10/15 years ago I used andLinux to have a Linux shell and other apps inside Windows. It was really good and it seems ahead of its time, as it was not virtualized.

Wine seems basic and immature in comparison to WSL not the other way.

Wine is a lot broader in scope than WSL, while Microsoft is fine with implementing a kernel-level ABI and then shipping a download for an Ubuntu userspace, Wine cannot ship any official Windows components. They had to re-implement every important DLL from scratch in addition to the ABI.

I can see why you would think that, but there is a reason that many think the opposite. Wine is obviously less compatible than WSL, but it is also a much more ambitious project. For WSL to work, it "only" has to implement the kernel translation layer and then run the various userspace tools that Linux does (GNU tools, Gnome, etc).

For Wine to implement even enough to run Notepad, Wine needs a reimplementation of huge portions of userspace. Of course, this also means it is a little bit of an Apples to Oranges comparison.

WSL is actually backwards analogue of WINE, also described as ENIW.

Emulator Not Is Wine? ;)

It is actually ENIW:Now inside Windows

Perhaps you're right, maybe WSL can do all the job nicely so maybe there is little if any point in developing cygwin. I have never tried it to be honest. I just prefer Windows 7 and loosely-integrated solutions - a 3rd-party Linux in a box feels better than a Microsoft Linux in the Windows kernel (yet just using a VM doesn't feel great for performance reasons and beacuse of not rally seamless file system integration).

You could try MSYS2.

Honestly I probably would have just scribbled a name in a terrible hand writing (not hard for me anyways) and called it a day. They just wanted something on file that would never be looked at again.

That's more a Red Hat legal failure than a IBM legal failure.

Reply on news.ycombinator.com