Hacker News Reader

Comment by palata | Hacker News Reader

Agreed: don't sign a CLA!

But then following this philosophy, shouldn't you favour copyleft licenses, too? Because if it's permissive, they can suddenly go proprietary without caring "much" about copyrights, right?

I have come to these rules:

- Never sign a CLA.

- In my projects, the "most permissive" licence I use is MPLv2 (which is weak copyleft). When I release OSS software, there is absolutely no point in using a permissive license: MPLv2 should be fine for everybody. Of course sometimes I like the GPL family, and recently I've come to like the EUPL.

View on HN

Would you sign a CLA if it specified the License your code would be able to the project under? (I.e. the project can only use your code if it says MIT or BSD or GPL licensed).

CLAs can have a legitimate purpose in clarifying copyright ownerships.

> Would you sign a CLA if it specified the License your code would be able to the project under?

I don't understand.

> CLAs can have a legitimate purpose in clarifying copyright ownerships.

Isn't that the whole point of a CLA? The CLA is usually a way for the contributor to renounce their copyright. In other words, the project asks me to make a contribution for free, and on top of that they want to own the copyright for it.

If they want to own the copyright for my work, how about they pay me?

i'm fine with my company owning copyright on code I write. Sometimes they let me keep copyright on things I contribute to open source on their time but I get permission before I do that. (they are considering changing the rules such that they retain the copyright and then I would contribute back in their name not my own)

> i'm fine with my company owning copyright on code I write

Sure, but that's not a CLA. You have a contract, and your company buys your work. If you contribute for free to a random project and they ask you to sign a CLA, they are not paying you for your work. They just want your work + your copyright for free.

A CLA doesn't give them your copyright; you still own it, and you're licensing it (hence the "L" in "CLA") to them. And, at least under US law, non-remunerative license agreements can be revoked under certain situations (usually having to do with that free work being turned into profit for the licensor IIRC although I admittedly haven't thought about this aspect of copyright law in twenty years)

> If they want to own the copyright for my work, how about they pay me?

If you want to merge your code into someone else's repository, thereby benefiting from their continued maintenance efforts, how about you give them the copyright? You don't have to if you don't want to. You can keep your copyright by merging your improvements into your own fork and maintaining it yourself. It is within your power.

Seems like a fair deal to me. Everyone gets a nice AGPLv3 project to hack on. That's freedom and it is assured. If you want someone else to maintain that project for you the least you can do is give them control over it by assigning copyright. It's still AGPLv3 for everyone else, and it gives the maintainers the leverage needed to negotiate deals with corporations.

Companies paying for exceptions to the GPL is something even Stallman promotes.

https://www.gnu.org/philosophy/selling-exceptions.html

This is a good thing and strengthens free software. Being against this is a position so extreme that even Stallman rejects it. And it can't be done if you need the consent of every single contributor.

I even emailed Stallman directly to confirm the ethics of this. He says it's better this way because only the copyright owner can do it. Permissive licenses give everyone that power. Copyleft keeps it contained.

  > It is my understanding that as the copyright holders
  > they have the right to do it without any problems.
  > They leverage the AGPLv3 to make it harder for their
  > competitors to use the code to compete against them.

  I see what you mean. The original developer can engage
  in a practice that blocks coopertation.

  By contrast, using some other license, such as the ordinary GPL,
  would permitt ANY user of the program to engage in that practice.
  In a perverse sense that could seem more fair,
  but I think it is also more harmful.

  On balance, using the AGPL is better.

> how about you give them the copyright

under US law, this is an impossibility. Under a CLA, you retain your copyright, and you (typically) give someone else a perpetual, irrevocable license to use your copyrighted material in their own product.

to clarify, it's an impossibility to give it to them irrevocably as under US law you can reclaim a copyright that's been transferred to another party after a statutorily defined period of time

I just looked it up and you're right. Apparently there's no way to sell or give away the copyrights. Ever. You can "transfer" it, license it, whatever... Then suddenly show up and demand it back 35 years later.

This is probably designed for book authors and delinquent publishers that stop selling author's books, then the authors can take back the copyright and go to another publisher.

Why do you believe that the contributor benefits more from contributing to a project than the project does?

Because they get to leave while others get to maintain the code including their contribution until the end of time.

They don't have to accept the contribution if they think it's not worth it. If they think it's worth something, they can pay for it.

I'm confused. The part with Stallman is about using AGPL vs GPL and has nothing to do with the CLA, has it?

It's an excerpt of a much bigger email.

I told him about corporations using AGPLv3 as leverage in order to build SaaS products around the software. As copyright holders, they can do whatever they want while everyone else must comply with license terms. The CLA is a necessary component of that strategy.

I asked him what he thought of the practice. That's what he replied. He didn't go into much detail about SaaS. He said it was too broad a term to judge.

Here's the full email exchange:

  Hello, Dr. Stallman. I would like to know your views
  on the ethics of certain uses of the AGPLv3.

  There are apparently some corporations that
  are releasing free software under the AGPLv3
  while building software-as-a-service platforms
  using the same software. It is my understanding
  that as the copyright holders they have the right
  to do it without any problems. They leverage the
  AGPLv3 to make it harder for their competitors
  to use the code to compete against them.

  In online discussions on this matter, I pointed
  to an article that you wrote regarding the ethics
  of selling exceptions to the GPL. You argued
  that that if selling this exception was unethical
  then so was releasing software under permissive
  licenses, and rejected the idea that it was unethical.
  The conclusion was that this enabled proprietary
  software to be freed, an ideal outcome.

  I'd like to ask if you think the same logic applies
  to the SaaS situation I mentioned. I think it does,
  but others did not agree.

  People are using the AGPLv3 to maximize leverage.
  Corporations seem to be incapable of tolerating the
  license's terms, a situation that leads to copyright
  holders providing a business solution: paying for it.
  They can buy special permission to use the software.
  These days, it appears the choice being offered is to
  buy into the company's SaaS platform instead of
  purchasing a special permission or license.

  The exact mechanism employed by the business
  seems like a minor detail to me but perhaps there
  are some ethical considerations that I'm not seeing.
  So I decided to send you this email and ask what
  your opinion on the matter is.

  Thank you for your time,
      Matheus

  ---

  > There are apparently some corporations [...]

  "Software as a service" covers such a broad range of computing
  practices that I generally don't use it.  It is too broad, and gives
  too little information, to judge whether a practice is good or bad.

  > It is my understanding [...]

  I see what you mean.  The original developer can engage
  in a practice that blocks coopertation.

  By contrast, using some other license, such as the ordinary GPL,
  would permitt ANY user of the program to engage in that practice.
  In a perverse sense that could seem more fair, but I think it
  is also more harmful.

  On balance, using the AGPL is better.

Right. So this is about AGPL, not about CLA... I thought we were talking about CLAs.

> how about you give them the copyright?

I refuse in general. If they want me to read and sign extra legalese, I expect to be paid for it.

If they are unwilling me to pay for my time and code I license away, then I will find other project to contribute to.

> The CLA is usually a way for the contributor to renounce their copyright

I don't know about other countries, but you actually cannot renounce your copyright under American law. It is an impossibility.

The only way your own code can belong irrevocably to someone else is if you are contracted under a work-for-hire arrangement or if you are an employee of the other entity when you produce the work. (Or if you die and your heirs become the new owners)

If you were to write code and then later submit it to a project (say, via PR), they cannot retroactively implement a work-for-hire arrangement.

In all other cases, the creator is the copyright owner forever. That status cannot be assigned to anyone else. (Except to one's heirs upon death.)

A CLA is a licensing agreement (that's the "LA" part!), where you license your own copyrighted material to another entity, and it's often in perpetuity.

But here's the trick: under US law, an author or author's heirs (i.e., copyright holders in non-WFH situations) can revoke a license in certain situations. The provisions allowing this exist specifically so that non-remunerative licenses (i.e., ones the copyright owner didn't get paid to license) can be revoked.

You can read about some of these termination provisions in 17 USC 203, 304(c), and 304(d).

Copyright can be transferred in the US. I think you are confused from copyright can’t be destroyed to put work public domain.

Indeed they can https://www.copyright.gov/help/faq/faq-assignment.html

I never said you cannot transfer copyright. I said you cannot irrevocably give it up.

And this is true: under US law, after 35 years you can reclaim your copyright

Taking the most sensible meaning of renounce, the court in Micro Star v. Formgen opined exactly the opposite of what you claim:

"It is well settled that rights gained under the Copyright Act may be abandoned."

https://casetext.com/case/micro-star-v-formgen-inc

As for reclaiming a transferred copyright, it's possible, but complicated. It also takes at least 35 years, which is likely too long to be of practical use to most folks.

Does that mean that all those projects using CLAs may end up at some point with someone saying "I want you to remove the part of your codebase for which I have a copyright"?

I mean in practice nobody will ever be able to do that, just like most licences are just completely ignored. But I mean in theory?

That is dangerious. While unlikely there are a few possible attachs. If the law changes such that the license is invalid you need to change to an up dated versian. if you allow them to change the license for that case they can change the license to anything. Consult with a lawyer to see if there is legal language that allows them to change the license as needed only so long as it meets the intent... note that intent is tricky. GPL 2 and 3 do not have the same intent according to Linus Torvalds but Richard Stallmen will say they do. good luck getting you contract to allow license changes if the intent is the same and having it really be your intent.

the above all seems unlikely but you cannot discount it. which is another reason to not sign a CLA - you have no idea what future changes you might agree with.

Can you please share why it is dangerous? If I release some code that I wrote myself, I own this code so I can always re release it in another strongly copy left license if there is a defect in AGPL v3 or whatever.

If you sign a CLA you no longer own that code. Thus you trust who ever now owns the code to make decisions you agree with but have no way to assure that.

depending on the terms you may own the code but it isn't a useful right as without everyone else including them you can't use your right to get a good license in place (one they disagree with so of course they won't)

I see you've repeated this in a few comments. Do you have a link?

By the way, I'm not disagreeing. I'm Australian and curious about the US situation. My understanding was that whilst you can't assign copyright — insofar as you ought to always be able refer to yourself as the original author — you can provide an irrevocable license giving someone else the rights to reproduce, license and sublicense as they see fit.

The person you're responding to is wrong. CLAs are not transfers of copyright ownership or code ownership. They're only licenses (that's the "L" in "CLA") that grant the recipient a set of rights for how they are allowed to use your code that you retain ownership over.

> If you sign a CLA you no longer own that code.

This is untrue. The "L" in "CLA" means you are licensing the code to someone else, not transferring copyright.

Edit: [Here](https://github.com/Decathlon/template/blob/master/contributo...) is a sample CLA you see on Github.

Inter alia,

> You hereby grant to Decathlon and to recipients of software distributed by Decathlon a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute your Contributions and such derivative works.

Observe you are licensing the code, not transferring copyright.

What's the practical difference? They still have the right to do anything they want with it.

Those are the terms of that one CLA the terms of others can be different.

... GPLv3, or any later version with a similar spirit published by the Free Software Foundation or its successor.

Remember that without a license most people don't have any right to copy the software at all, so it's in a corporation's best interest to make sure the GPL continues to be valid. And the law always does what's in a corporation's best interest.

What is the spirit - is gpl 2 and 3 the same spirit? Some will argue no.

Right now gpl assumes things fall back to copyright but companies have an interest inencoding open soure into law in a way that would benefit them. Some trickery could make something in gpl illegal and then by law it falls back to the new open source license not no license.

How do you need CLAs to clarify copyright ownership? DCoE does the job equally well.

This is usually a misunderstanding of permissive licenses.

You can't change the license of the code, even if that license is permissive enough for the code to be incorporated in proprietary works.

I mean, often this doesn't really matter because, unlike with GPL, publishers are not required to give you the source-code. But it matters when that source-code gets republished, say, under a source-available license, after having been under MIT/BSD/APL2, in which case, that's illegal, unless the company owns the copyright to do so.

As an example — if you have a file with a copyright header saying the code is licensed under a permissive license, you can't just change that header to a different license. There's even a famous case about it: https://undeadly.org/cgi?action=article&sid=20070913014315

It all comes down to copyright. If you copy a piece of code that's not trivial, even if the license allows you to copy and reuse that piece of code, you're not suddenly the copyright owner of that code. Permissive licenses are permissive, but they do have restrictions, and most importantly, with copyrighted works, excluding the fair use cases that depend on legislation, you can only do what the license allows you to.

So, no, code licensed under permissive licenses can't be re-licensed as proprietary, even if it can be incorporated in proprietary works. And this is often a useful distinction to make, as I can think of several re-licensed projects under source-available licenses that couldn't have been re-licensed without copyright assignments.

> There's even a famous case about it

Note this is not a legal case which has been ruled on, just an opinion. It sounds reasonable to me, but also not a hill I would die on personally.

I didn't mean "re-licenced". I meant that it can become closed-source. Bad wording on my end.

Now I guess they can modify permissively-licenced files without licencing their modifications permissively, in which case the file is a mix between both, and good luck making the difference?

Reply on news.ycombinator.com