Hacker News Reader

Comment by iforgotpassword | Hacker News Reader

> By working on a project with a CLA, where you sign away your code, you're giving carte blanche for the company to take away your freedom to use their software.

Ok it's been a while so I don't remember the details or how it played out, but when Linux introduced a CoC, there were people who contributed to the kernel in the past that threatened to withdraw their code from the kernel, which would've been a nightmare to handle and clean up. How much power does a contributor have if my project is using a standard licence like GPL or BSD? Does the contributor hold any copyright over their code? Im not talking about rug pulls here, let's just say the contributor gets really mad at me for some reason.

View on HN

I don't think a contributor can unilatary withdraw their code from a code base unless there is license change. Then it wouldn't be about "withdrawing" their code but refusing to allow it to be distributed under a different license than the one that applied when they submitted it.

So if Linus wanted to relicense the kernel under a different license than GPL2 he couldn't do it by himself without tracking down all the contributors and getting them to agree to the license change or removing the code in question which, for someting as large and with as many contributors as the kernel, would be basically impossible.

The CoC is completely different. It's not a license change but a process change. If a contributor doesn't like a new CoC or a new processs they can decide to no longer contribute in the future under that process, including no longer maintaining "their" code already in the kernel but they can't force anyone to remove it.

I think that the developer can demand a withdrawal of their contribution, though I don't know what happens to the code that's already published under a FOSS license. Regardless, many projects including the Linux kernel require the developer to sign off their contributions under the terms of the 'developer certificate of origin' [1]. While the developer retains the copyright to the contribution under DCO, they acknowledge that it will be distributed in perpetuity under the original license. So, retracting the contribution may not be an option.

[1] https://developercertificate.org/

The main purpose of a DCO is to take the portion of a CLA that guarantees the developer actually has a right to license the code under the project's license, as it's something that some users worry about using the software without. Basically so if someone copies some code from one of the Windows leaks into Linux and Microsoft comes to sue the Linux Foundation over it, they can point to it and say "we had legal sign off they had the right to license this code, please sue them instead".

In terms of irrevocability, the DCO is not that different from most open source licenses who themselves claim to be perpetual. The arguments for exceptions to that being true all either apply to e.g. both the GPL and the DCO, or to neither.

Generally the consensus is that an irrevocable license grant means irrevocable, though there are some concerns about examples set by e.g. the precedent that lets artists claw back rights from record labels after 30 years.

> I think that the developer can demand a withdrawal of their contribution

I don't. And neither do you, judging from your last sentence:

> So, retracting the contribution may not be an option.

So what did you mean by the first one?

The second statement was specifically about when the DCO is in effect. The first one is about when it isn't.

Ah, OK, gotcha.

Without a separate CLA or copyright assignment, the contributor retains the copyright to their code, and licenses it to the project under the terms of the GPL (or whatever license).

The license is basically a legally-binding promise not to sue, as long as you follow the rules in the license. So the general consensus is that they can't terminate the license unless you violate the license. (Though there are dissenting opinions on that.)

Reply on news.ycombinator.com