Hacker News Reader

Comment by Pannoniae | Hacker News Reader

I am seeing parallels to the Amazon vs. ElasticSearch fiasco.

Also interesting to mention that they haven't said a single word about CLAs. If this project would require a CLA (and copyright assignment) to contribute, then it doesn't matter that it's a foundation, they could also re-licence it easily, which is exactly what they are fighting against.

View on HN

CLAs are very misunderstood in the software industry. Every open source project should make its contributors sign CLAs, and you should be wary of using one that doesn't. Why? Because any single contributor can claim at any point in the future that the project is using their code illegally, and that you/your company should pay them for using their proprietary IP for all of these years. Can you prove that you audited every single line in the project you used and were sure of its copyright status? A CLA ensures exactly that. There's a reason why Linux Foundation, Apache, CNCF, Mozilla, heck even FSF all have strict CLA requirements.

Relicensing is a completely separate conversation, and there are plenty of open source CLAs which don't have that provision.

> Because any single contributor can claim at any point in the future that the project is using their code illegally

So, you've never heard of a Developer Certificate of Origin? If it's good enough for Linux, it's good enough for me.

> The Developer Certificate of Origin (DCO) is a statement that a software developer agrees to, saying that the contributor is allowed to make the contribution and that the project has the right to distribute it under its license.

So in other words, a CLA.

CLA's required by some projects effectively require the contributor to give away all rights to the receiving organization. There are other forms of CLA that do not transfer these rights, but are still agreements (which is what the A stands for) between the contributor and the receiving organization. These might allow the recipient to change the license, or they might not. The DCO is just a statement and does not permit the receiving organization to distribute under incompatible licensing terms.

I'm sure some organization can write a "DCO" which says the exact same thing. Ultimately what matters isn't the title of the document but the content. There are plenty of CLAs that just ask for the bare minimum for the project to be able to function (see ones from any of the organizations I mentioned).

Unfortunately, many CLAs give the company that controls the code the power to take the project proprietary (and they will call this the bare minimum of what they need). It's repeatedly happened, so contributors need to be careful with what they sign. Perhaps for a small bug fix they won't care, but for anything larger, beware.

> So in other words, a CLA.

Sure, in the same way that a cantaloupe is a hand grenade.

This kind of trolling can easily be prevented by saying "Sure, we will remove your contributions. Name the exact line numbers affected"

The burden of ensuring license compliance falls to the consumer, not the producer.

> Every open source project should make its contributors sign CLAs

What's the point of open source if you have to reveal you real identity?

Wow, is everybody here paid by Zuck to use their real names?

You are technically correct but I do see a difference between signing a CLA with The Linux Foundation, Eclipse, ASF etc. and a purely commercial corporate entity.

You are entirely right; it's nowhere comparable. I'm just talking about the theoretical impacts. (after all, the re-licencing was also a theoretical problem, i.e. Hashicorp might abuse the non-compete clause so Terraform is not safe to use) I just find it interesting to mention - after all, the important details the ones which are not talked about.

For at least a few years now, companies relicensing their open source software has not been just a theoretical possibility, but a plausible thing that could happen any time.

I don’t know what happens to the Linux Foundation when we’re all in the nursing home, but them relicensing everything is not currently plausible. It is a merely theoretical possibility.

Yeah this makes sense. "CLAs (or DCOs) assigning copyright to foundations are good, CLAs assigning copyright to corporate entities are questionable" does seem like a pretty good rule of thumb for contributors who care about this kind of thing (which I agree most people should).

For what it's worth, the CNCF is not big on CLAs in general although, as far as I know, they don't specifically prohibit them. In general, they prefer to use a developer certificate of origin.

Are you sure of the CNCF not being big on CLAs?

According to the link below:

> Anyone who is contributing any code to any CNCF project must have the CLA signed.

https://contribute.cncf.io/resources/glossary/#:~:text=Contr...

That's a bit surprising to read because here's what @cra of the Linux Foundation said a couple years ago:

It’s [a Developer Certificate of Origin] how the Linux kernel works, where basically it takes all the basic things that most CLAs do, which would be like, ‘Did I write this code? Did I not copy it elsewhere? Do I have the rights to give this to you, and you sign off on?’ It’s been a very successful model played out in the kernel and many other ecosystems. I’m generally not really supportive of having CLAs unless there’s a real strict business need."

https://opensource.com/article/20/2/open-source-projects-gov...

FYI 99% of CNCF projects use DCO, only a handful still use CLA but we give projects a CHOICE in the matter. I prefer DCO personally because it's a lower barrier to entry for contributors (e.g., not formal legal agreement to sign and be reviewed by lawyers)

Doesn't Kubernetes require a CLA?

Yes. A small number of CnCF projects do. Google originally had a CLA in k8s and this was kept.

it does, they even have a label for it: https://github.com/kubernetes/kubernetes/pulls?q=label%3A%22...

> signing a CLA with The Linux Foundation, Eclipse, ASF etc.

what is the reason those require CLA? Why underlying license is not enough?

If there’s no intention of ever changing the license, then there is no need for a CLA.

A CLA is required when the repo owner wants the ability to change the license down the road without contacting N contributors.

yes, but it's not always malicious. one example is to dual license the code. for example, Qt is available under GPL (LGPL?) and has a CLA that allows them to commercially license your contributions to businesses.

a good CLA in this instance would guarantee you that your code cannot be relicensed exclusively away from GPL. the software is still free as in freedom, but the organization can fund itself by courting businesses that would not touch GPL software.

Another example is OpenStreetMap which changed its license because we learned that the old one wasn't adequate for the purpose intended.

We have no idea how today's licenses will be challenged in the future and I believe it's a good practice to keep a door open to being able to change the license going forward.

That it's not done maliciously is a purpose for foundations which serve as trust anchors.

that's an interesting point, thanks.

I'm still skeptical of a CLA for such a project since a ton (currently all) of the copyright is held by Hashicorp meaning they would have to consent to the future license change as well, regardless of the CLA or foundation membership. In general I think that makes a point for a CLA, but in this case I don't think it does.

> Qt is available under GPL (LGPL?) and has a CLA that allows them to commercially license your contributions to businesses.

but that's exactly the case which happened in case of Hashi, so CLA allowed them to continue working on commercial product only, with all 3p contributions being under their proprietary license.

Qt's situation is different, since they have contractual obligations to continue releasing under (L)GPL - failure to do so allows the KDE Project to release Qt under MIT.

A CLA is not required for that. A copyright assignment is. A CLA is not necessarily a copyright assignment, and a copyright assignment is not necessarily a CLA.

Ideally we would want to let people contribute freely without the need to sign anything extra. However, for the exact process we will defer to the Linux Foundation / CNCF. The ultimate goal is to ensure that a rug pull like this is never allowed to happen again.

(Marcin here, co-founder of Spacelift, one of the members of the OpenTF initiative)

If they aim for making it a CNCF project, it may very well be a simple inbound=outbound licensing (everyone keeps their copyrights). The CNCF gives projects two options: DCO or CLA, where the CLA is a very simple formality. It being a foundation and not a for-profit company already makes licensing shenanigans unlikely.

They've already got more FTEs on this than Amazon seemingly put on OpenSearch.

Companies saying "we will let some FTEs contribute to this project along with their regular work" is very different from Amazon paying a dedicated team to work on it full time.

Marcin here, co-founder of Spacelift, one of the members of the OpenTF initiative

We provided a dedicated team on a temporary basis. Once the project is in the foundation, we will make a financial contribution, with which dedicated developers will be funded. At that point our devs will gradually hand over to the new, fully independent team. The other members of the initiative so far follow the same pattern but I can't speak on their behalf re: exact commitments.

Thank you for doing that correctly, I hope TF thrives!

Do you know if the Terraform language server will also be forked? It has also suffered from Hashicorp's lack of attention.

EDIT: oh you answered that question in a response to my top-level comment. Thank you!

It’s a bit different because OpenSearch is a project of and by Amazon, not a project where many companies participate equally under a foundation.

Reply on news.ycombinator.com