Hacker News Reader

Comment by gavinhoward | Hacker News Reader

I've come around to a new appreciation of why a CLA may not be bad.

I have a business. That business deals in copyleft software that I have sole copyright in (or comes from permissively-licensed code).

My customers, which will be businesses, will be required to sign a contract with a CLA so that if they make changes, I will be the copyright holder of those changes.

No, I won't have individuals sign a CLA. But I also won't accept contributions from individuals, like the SQLite authors, who need a guarantee that all of their code can be public domain.

In this way, I will be legally able to loosen the license over time if I so wish. Without CLA's for customers, I couldn't do that.

View on HN

Lawyers at my job pointed out one particularly nasty aspect of CLAs: the lack of liability controls.

All open source licenses have some form of legal liability wording in them, e.g. from GPL v2:

> 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

No CLA I've seen so far does anything to maintain that protection from liability. Those responsible for the software could switch the license to one which leaves you, or your employer, legally liable for any damages incurred. That could very, very quickly, bankrupt you and/or them.

Sure, but in America, anybody can sue anybody for anything. Your lawyers are of course right that having a clause in a software license disclaiming all liability for its use could be helpful in your defense -- but it's not an ironclad guarantee that you will not be sued or even found liable for your contributions in the event that it causes some kind of catastrophe. If this is a major concern for you, you should probably avoid contributing to FOSS altogether.

However, if you don't own the software and don't distribute the software and don't have any other kind of relationship with the users of the software, it's likely going to require the plaintiff to demonstrate particularly egregious conduct on your part in order for a court to find that you have some liability for damages arising from the use of the software. But YMMV.

Well, of course.

But if I accept a contribution, I'm already accepting responsibility for it, so I will not accept it unless I understand it and test the snot out of it.

This is another reason I don't accept contributions from individuals.

It's not about you.

It's about the person/company that signs the CLA. They're the ones that end up in potential legal nightmares, unless the CLA specifically promises to continue to indemnity.

I think my CLA should do that. I'll make sure my lawyer adds that to the draft.

> In this way, I will be legally able to loosen the license over time if I so wish. Without CLA's for customers, I couldn't do that.

Or you can make it poprietary, which is the exact reason I would not want to sign a CLA with you, because I want a guarantee that my contribution remains foss.

True.

But again, I don't take contributions from individuals, so I wouldn't ask you to sign one anyway.

This means that if I take it proprietary, I will have ensured I do not steal from any contributors.

You will not have stolen in the same way that Google/FB don't "steal" your data. Instead, the end user is simply forced into the position to give away their IP to you, where you can adjust the licensing per your whims, even to sell it back to them. It's fine to consider your lack of contributors is related to the "no individual" contributors" choice that you have made, but it would be disingenuous to avoid recognition of how your choices probably result more in "no contributors".

Individual end users will not be contributors.

Businesses will be contributors. These businesses have more "power" than me because they'll be bigger than my one-man shop.

I'll do these CLA's to adjust that power balance.

How many real contributors you have? Is it mainly just you and perhaps some tiny bug fixes?

I have exactly one who fixed some typos in documentation and gave me permission to relicense under any FOSS license.

Reply on news.ycombinator.com