Hacker News Reader

Hacker News

Comment by dustinmoris | Hacker News Reader

Full thread

dustinmoris

More context:

First when a board member resigned from the .NET Foundation:

https://rodneylittlesii.com/posts/topic/foundation-echo-cham...

Then this:

https://www.glennwatson.net/posts/dnf-problems-solutions

Lots of different Twitter threads on this topic since a few days. For example other OSS project maintainers also noticed that their project was moved to a different GitHub org without their knowledge:

https://twitter.com/JeremySkinner/status/1445272800185495555...

This is even worse given that the rights were NEVER assigned to the .NET Foundation in the first place:

https://twitter.com/GeoffreyHuntley/status/14453622296420270...

This whole things is EXTREMELY SKETCHY and very very concerning!

View on HN

You missed this one: https://twitter.com/GlennCoder/status/1443356417742675968

And this once just now :( https://twitter.com/robmen/status/1445521876688654340

This also comes on the back of the .NET Foundation now requiring new projects to assign their intellectual property, lock, stock, and barrel, to the foundation itself. You can no longer simply contribute code to the foundation - it has to own it now.

Not an unusual requirement, it's the same as the "bastion of Free Software", the FSF. https://www.gnu.org/licenses/why-assign.en.html

+ code licensed to the .NET Foundation is released under a MIT license anyway, so that it can be used commercially by anybody.

Isn't this very common for large projects? Solves the future problem of potential relicensing, doesn't it? Of having to track down potentially 10's of thousands of contributors that may be hard to find (or even dead) to get their consent?

> Solves the future problem of potential relicensing, doesn't it?

Yeah, by giving the foundation all the power it needs to relicense it however it wants.

> Of having to track down potentially 10's of thousands of contributors that may be hard to find (or even dead) to get their consent?

That's the ideal situation. Make the copyright stuff so hard no one will ever bother trying to take over a project. Linux kernel does this. It will never be licensed as anything other than GPLv2 because it's virtually impossible to obtain the consent of all developers who ever contributed to it. The more Linux grows, the more people contribute to it, the stronger this protection becomes.

>Make the copyright stuff so hard no one will ever bother trying to take over a project.

Also means if the license ever loses a legal case then the project will always be susceptible to that flaw since it cannot be corrected.

Think of a license as code. It currently works, but tomorrow you may find a serious bug, or, in the case of law, laws change outside the project, making a serious bug.

Now you cannot ever fix it.

And, in common cases, it protects the project from contributors wishing to remove their contribution later, breaking the project.

Linus could get a brain tumor and decide to revoke his contributions to the Linux kernel. Or his heirs could do it, since by law they get his copyrights, including all the code he ever contributed. Guess what that would do. Or any contributor to Linux can do it.

10,000 legal minefields is not a good way to run a project.

Yeah, I assumed Linux developers wouldn't actually want to hurt the project they contributed their code to. Linux is not protected from that.

Another example: one day the copyright protection of Linux code is going to run out. That'll probably be a very fun day.

> 10,000 legal minefields is not a good way to run a project.

Agreed. Honestly I think these licenses shouldn't even exist to begin with. Copyright needs to be abolished.

One issue that CLAs solve is the problem of copyright termination after the death of the author; see (https://www.law.cornell.edu/uscode/text/17/203).

DannyBee is an open source lawyer, his comment (https://news.ycombinator.com/item?id=18148727) gives some other advantages of CLAs.

And I wouldn't be surprised if this in response to what happened with identity server.

care to give some links about "what happened with identity server" ?

is that https://leastprivilege.com/2020/10/01/the-future-of-identity... ?

Yes, that's it. It was(is?) a .Net Foundation project that was included in ASP.NET Core starter templates. The maintainers decided to go non-FOSS for the future.

Interestingly though, there seemed to be no talk or discussion of finding new maintainers for the .Net Foundation project. Microsoft decided to update their templates for the upcoming .Net 6 to use the new, non FOSS identity server project(despite their being no real need for any identity server in these setups, and despite it no longer being FOSS).

Even more strange(coming from other FOSS platform communities) was how much shilling for Duende IdentityServer, and by Duende, was occurring in this thread discussing the development(buckle up): https://github.com/dotnet/aspnetcore/issues/32494 . Was really strange for a FOSS community to not be discussing the road forward for FOSS, but to be making arguments like "the license isn't that expensive" and etc. All this time the project is still listed as a .Net Foundation project: https://dotnetfoundation.org/projects/identityserver .

I was somewhat surprised when looking into the .Net Foundation rules that they don't require turning over the project in any way to the community or foundation. I'm wondering now if MS was just going along with the easy path to avoid even more drama while the dust settles and they shore up foundation rules to prevent this from happening in the future.

Kind of unusual, nowadays CLAs are very often not full copyright assignments.

The FSF isn't run by full-time employees of a for-profit megacap company that also owns the runtime and package distribution system the projects use though. It's also not the promise the foundation made when it first began soliciting projects to join it.

This is incorrect.

> Assignment and Contribution Models. The .NET Foundation uses either an assignment model or a contribution model for on-boarding new projects. Under the assignment model, a project transfers ownership of the copyright to the .NET Foundation. Under the contribution model, a project retains ownership of the copyright, but grants the .NET Foundation a broad license to the project’s code and other intellectual property. The project also confirms that the project’s submissions to .NET Foundation are its own original work (there are also instructions for any third party materials that might be included).

They accept both models (Contribution and Assignment).

https://dotnetfoundation.org/projects/submit

Looks like you're right - they removed that option and added it back: https://github.com/dotnet-foundation/projects/commit/7debb15...

The PR that removed the Contribution model was only merged for 2 hours before it was reverted: https://github.com/dotnet-foundation/projects/issues/122

And it was never discussed nor has it ever really been revisited since, as you point out in your own comments on that issue. This is part of the larger issue of how the DFN interacts (or lack thereof) with its own member projects and usually only lets us know about changes after they're announced

I don't believe this is currently true. The contribution model is there. I even recently had a PR accepted to clarify the language on the submission page and form.

For my project, which was also on the contribution model, I balked when they asked me to add them to the copyright line on every file. I pushed back and they said I didn't need to do it. I got the feeling it was just another checklist item from them--but attention to detail matters and communication is key.

Reply on news.ycombinator.com