If a megacorp wants your help to explain ANYTHING to them, you better be paid handsomely per hour. Wtf are people doing charity for trillion dollar empires.
Both projects also share in license, so I have less of an issue with it personally. They're both MIT licensed.
If they contributed it upstream, would we be discussing a blog post "how dare evil megacorp submit a PR that only implements their API! embrace extend extinguish!"? Probably.
Considering how often that happens VS how little times stories like that appear on the frontpage of HN, I'd wager a guess that we wouldn't be discussing it like we're discussing the current license violation.
> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
Simply removing the copyright is a violation of the MIT license.
The real question is why did the author choose MIT if they didn’t want allow mega corps to benefit from their work without contributing back. That’s a feature of the license, not a bug.
MIT and BSD type licenses say you can do almost anything you want, but just don't plagiarize, because that would be intellectual misconduct.
In addition to not just removing the copyright notice from sources, the MIT license requires the copyright notice to be present in all derived works. It makes no mention that if you compile a program, the binaries don't have to have copyright notices.
Yes, they mentioned Spegel, but only to thank the authors for "generously sharing their insights" -- that's not even close to the required statement that part of the project is owned and copyrighted by the authors of Spegel.
You really think the author is going to then feel 100% better about it?
They are just another data point in the long list of authors who chose a permissive license and are then shocked when a billion dollar company takes advantage of it.
If they wanted a less permissive license, they could have used one.
> Spegel was published with an MIT license. Software released under an MIT license allows for forking and modifications, without any requirement to contribute these changes back. I default to using the MIT license as it is simple and permissive. The license does not allow removing the original license and purport that the code was created by someone else. It looks as if large parts of the project were copied directly from Spegel without any mention of the original source.
Can you share what you think the author is really complaining about?
What I'm not OK with is a company doing that without attribution. If XYZ company's product is built on code I wrote, I want to be credited -- both so that I can show it to potential employers, and so that users of XYZ company's product are aware that some of the code in it is something they can use for free and modify for their own purposes. If the attribution wasn't important to me, I would have chosen CC0 instead of MIT.
So yeah, if I was the author, I'd probably feel a lot better about if MS re-added the correct attribution. I'd probably still feel miffed that they tried to pull one over on me in the first place -- but I wouldn't be offended by the fact that they're using my software.
If I write something useful and convenient for people, something that makes peoples' lives better, it's probably not going to see a lot of use realistically speaking. I'm not out there making a name for myself, I'm just doing some stuff.
If Microsoft takes my code, turns it into a separate project with a separate name, distributes it as part of their own commercial offering, uses it in their marketing... great! It means that my ideas are making people's lives better. Yes, it's enriching a giant soulless megacorp who, at a high-level, does not actually care about how people feel and only cares about making money off my work, but I care about how people feel, and if it means that my work gets to make people's lives better then that's great - I wasn't going to make money off it anyway, so I lose nothing.
Unless they take implicit or explicit credit for what I made. I don't need my name on the marketing or an invitation to a launch party, but at least make a note in the docs somewhere that "this project was forked from ...." so that I can point to it and say hey, look at this cool thing I helped make happen.
I guess what would really irritate me, when it comes down to it, is not that the giant corporation did this, but that the individual developers did this - some dev out there found my project, decided to use my code, and made the conscious decision to strip out my attribution and claim it as their own. That's what would actually hurt.
MIT is commonly used for cases where you don't want to scare away potential corporate USERS by the "virality" of something like the GPL. This does not mean that the authors are completely fine with their work being repackaged and DISTRIBUTED as if the company wrote it themselves.
If you lose open source you lose a major resource. You should be looking for ways to protect these authors instead of explaining how "technically it's all actually their fault for being generous in the first place."
This position is absurdly scummy.
You don’t get to posture as anti-corporate while handwaving away an actual license violation just because the license was permissive. That’s not protecting the community - that’s making it easier to exploit. You’re not railing against theft, you’re normalizing it.
Either the community’s rights matter, or they don’t. Pick a side.
Quite the contrary. The licence does not have many constraints, but this one is important. Volunteer developers let their code being used in closed source commercial programs. Recognition is the only thing they expect and the whole point of the licence.
--Carl Spackler, quoting the Dalai Lama
What I see is that Microsoft added headers to their Peerd files. Now they read "Copyright Microsoft", which is correct because Microsoft owns some copyright over those modified files. If those files had had a "Copyright Spegel project" before, Microsoft should have kept it and added their own. But those files did not contain such a header as far as I can see.
Feels like Microsoft was not necessarily trying to steal work (they link the original project in their README).
Microsoft got tremendous value for free by forking. Which makes the obligation to deal ethically and honestly very serious.
You don’t get to take something from anyone without meeting the terms they have set for you to take them. That is theft.
(For clarity, I am saying theft of a right. As it does negatively impact the original creator, in terms of competition and lost attribution to the code they wrote, and Microsoft is not paying the “fee” that taking that right depends on.)
And no third person can can ethically speak for the source of the value and state that it’s no big deal for another party to break some part of a contract/license.
How do you know how much this aspect of the license impacted the original creators decision to share their work, their choice of license, or how they feel and and practically impacted about it now!
In this case, we know they clearly feel the violation was harmful to them at some level. They were snubbed, their work left unacknowledged, while Microsoft leached off them, even though doing the right thing would cost Microsoft essentially nothing.
Please don’t socially absolve the powerful from bad behavior toward smaller parties. That’s bad faith, after the fact, and you are not even benefiting from your own disrespect for the license. Always support the (credibly) injured party.
As for offenses against you, you have every right to be generous and overlook those.
(I once took a year sabbatical to work collaboratively on a project, with the presumed (based on what was a clear discussion to me) attributions being a key factor in me deciding it was worth the time and effort, when other factors made that a difficult decision. Only to have my attribution expectations unfulfilled, and no attempt was made by other parties to work things out. The situation was fraught enough that I couldn’t but help feel bitter about it for some time. I am long over it, but I would certainly take the year back if I could.)
Why "to be fair?" This is a trillion-dollar company with enough lawyers on staff to populate a small city.
Why are we cutting Microsoft slack? If anything, it should be held to the highest of standards.
As I understand it, changing the licensing will do nothing to affect the fork Microsoft already made. It might affect the next megacorp from doing the same thing in the future, but Microsoft can keep working on their fork without giving it a second thought.
This is for sure a cautionary tale for every open source contributor. Choose the original open source license very carefully.
Edit: Might I suggest that when picking the original license, you try to imagine how you might feel if the company that you hate the most (could be Microsoft, Google, Amazon, or other) does the most extreme thing allowed by the license.
Did they remove the copyright? All the source files I checked in Spegel don't have a copyright header. To me it feels like it's the author's mistake.
If the file starts with:
// <MIT header>
// Copyright evantbyrne
Then a fork should read:
// <MIT header>
// Copyright evantbyrne
// Copyright Microsoft
But if you did not add "// Copyright evantbyrne", the MIT license doesn't say that Microsoft should add it. I don't even know if it's legal for Microsoft to do it. You have to add your own copyright to the files where you own a copyright.
> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
It needs to appear somewhere regardless of where exactly the license was placed in the source repository.
They can still do it now, and probably they should (someone can even open a PR?).
You can open that PR, if you care to identify which parts were copied and label them all. Really, the people who copied the code in the first place should have done so, and really should have known better, given they work for a massive corporation that claims to love open source and has had a massive interest in copyright over the past three decades. It's not just a "mistake", it's unacceptable for a professional programmer for a corporation to take code from a FOSS project without crediting it. That's a level of incompetence bordering on malpractice for a profession that deals so heavily with copyright on a day to day basis.
edit: According to the MIT license, the notice itself just needs to accompany the code, so I was wrong about the specificity needed. Still, it does mean that any further forks would be unable to remove the license without personally identifying if all the original code was removed. It's always better to identify what code belongs to who.
Wait. When I contribute to an open source project without signing a CLA, I keep the copyright over the lines I contributed. Still, I don't add a comment above every single line saying that it belongs to me. Nobody would accept such a contribution. Even for fairly big patches.
Are you saying that every single open source project that does not make contributors sign a CLA is doing it wrong?
That's not the point, it is not the author's duty to do that and him pointing out Microsoft's wrongdoing is meaningful at least to me because I will be more cautious if I'm ever being approached in a similar way.
That's the thing: Microsoft approaching the author has nothing to do with the wrong attribution. And I am not sure if the original author here is frustrated because of the wrong attribution or just because they would have hope money and fame from the fact that Microsoft reused their code.
Because it's not like Spegel lacks visibility (given the numbers they shared in the article), the link on Peerd's README is probably not bad for Spegel, and the attention here is publicity again. Probably infinitely more than if Microsoft had done the attribution correctly.
Your point seems to be that the author should not have written the blog post and done a PR instead.
My point is that whatever the authors motives are and whether he did a PR or not, his blogpost was informative to me and has value on its own.
It may not be perfect for all cases (e.g. if some sort of dependency is linked but not present in the source tree it is naturally not really accounted for by Debian copyright files) but then there is always the options of either adding copyright information to every source code file (I don't like that style for redundancy but it is for sure a very clear way to do it) or to hand-craft a human-readable variant similar to the Debian approach but less formally.
In any case it seems that nothing is new aobut this and developers working with FOSS software should very well be aware of these concepts.
It’s why con contributor licenses agreements exist in most open source popular projects.
You should just keep the copyright that is already present in the file! But in the case of Spegel, I don't think that the files contain a copyright header in the first place.
The git history has a clear trail showing author and contributor details.
An explicit copyright notice for every file isn't needed.
This is a straightforward, unquestionable license violation, and no amount of corporate FUD will change that.
Of course, the author keeps their copyright on the lines of code. But that's completely different from how the attribution should be done.
Except that they did not do that. They forked it (as the MIT licence permits), added an attribution to their README, and added their own header to the files with their own copyright. It's not their fault if the original author did not add a header in the first place...
Or where do you see that they actually removed a copyright header from the author? None of the source files I checked in Spegel have one.
And no, their note in the readme is not an attribution. It's thanking them for "sharing their insights", which in no way is code attribution.
Microsoft violated copyright here, bar none. There is no other reasonable interpretation.
They actually thanked the project, it doesn't feel like they were trying to steal it. Maybe they will just accept such a PR and that's all.
And with the bad publicity coming back to Microsoft, maybe those engineers will now understand that they should just avoid re-using open source projects when possible. And the next HN post will be about "BigTech reinvents the wheel in order to have control".
We're all nitpicking here: they mentioned the original project in the README. Peerd is quite different from Spegel, it's not just a copy with a small patch.
Sure, they should do it right. But really, a polite, small PR fixing that would probably be a good first step.
> they mentioned the original project in the README
They thank them for their "generous insights". That's not the same thing. If I take chapters unmodified from Harry Potter and thank Rowling for her "generous insight", that's still not okay.
> Peerd is quite different from Spegel, it's not just a copy with a small patch.
Nobody said it was. It does, however, copy functions and other entire blocks of code with comments directly from Spegel without giving attribution. That is wrong. That is plagiarism.
Well, I have been in big companies where it takes a lot of time for the legal department to check those things. Not because it's fundamentally hard, but because the queue of things they have to do is pretty big.
> They thank them for their "generous insights". That's not the same thing.
Sure, it's wrong. But it's not "purposely stealing without giving any credit at all" either. It feels like an engineer did that, tried to give credit and did it wrong. And now we go on and on saying how this engineer is evil.
In this case I still feel like they are more attributing incorrectly (there is a link to the original repo with a "thank you" note) than plagiarizing.
If there was no mention of the original project at all, then I could call it "accidental plagiarism".
Forking and/or copying files from the Spegel code base into the Peerd code base is permitted, but since the Spegel code base had a single license file covering the entire repo, then the onus is on Microsofts engineers to update the code they copied and include the original license terms, for example, by including something like:
// Copyright (c) Microsoft Corporation.
// Licensed under the MIT License.
// Some code Copyright (c) 2024 The Spegel Authors, under MIT license
If your argument is that they aren't required to do this because the original code didn't have a license header in the file, then it would follow that you are arguing that the MIT license doesn't apply to the code that was copied, in which case Microsoft is using unlicensed code stolen from an open source project.
While I haven't worked at MS specifically, I would assume that like every other tech company I have worked at, they have a team or working group that specializes in adherence to open source licenses specifically to avoid both the legal implications and the bad PR implications of misusing open source software.
My point is that Peerd seems like it's loosely based on Spegel. Maybe a fork that was heavily modified. Not sure if they should track all the code that looks like it was not modified enough and attribute it everywhere.
Probably they should keep a copy of the original LICENSE file somewhere, sure. And if one asks politely, maybe they will do it.
Again: they did credit the original project. So it feels a bit aggressive to say that they "stole it without giving any credit".
Fair use allows for commentary, news reporting, criticism, teaching, research, and scholarship and there are guidelines. Most cases where fair use is sought as a defense requires litigation to clear it up. The other alternative when forking an extremely permissive MIT license is to just follow the license.
> Probably they should keep a copy of the original LICENSE file somewhere, sure. And if one asks politely, maybe they will do it.
They are required to do so by the original license of Spegel. Does Microsoft ask politely when people violate MS licensing by say, pirating their software, or do they work with 3 letter agencies and a massive enforcement team to ensure their licenses are followed?
> My point is that Peerd seems like it's loosely based on Spegel. Maybe a fork that was heavily modified. Not sure if they should track all the code that looks like it was not modified enough and attribute it everywhere.
Yes. Every other tech company I have worked at, including Mozilla, a company that publishes almost everything they do as open source, has had folks dedicated to ensuring license compliance.
> Again: they did credit the original project. So it feels a bit aggressive to say that they "stole it without giving any credit".
They didn't provide credit in the way that the license requires. This isn't a case where a new community member forked or copied code into their first open source project. This is one of the biggest companies in the world with a well-known history of taking and using OSS without proper attribution. I like and use many MS products, but they absolutely do not deserve the benefit of the doubt.
Next time you work in a big company and you feel that the legal department is a PITA and slows you down, remember how people react when they are not, like here :-).
The team that built peerd had the good sense to consult with the author of Spegel before moving forward with their project. A simple note to their business line lawyer (or whatever they call them at Microsoft) at work to say "hey, we are going to use some of this code from this open source project, what do we need to do?" would have taken less time and effort than setting up the meeting with the Spegel person/folks. That is assuming there isn't an easy to find page on how to consume open source software on Microsoft intranet. Every major company I have worked for (HSBC, Mozilla, Amazon, Fastly, Cisco, to name some) has had this going back to 2005. This isn't rocket science.
You also don't need to be a legal expert to comply with most open source licenses, and the MIT license in particular is really easy to comply with. Just copy the code, and whatever file you copy the code into gets an attribution comment at the top.
I would be in favour of checking what small companies do with licences. In my experience, the vast majority of startups blatantly abuse open source all the time.
But here it seems like it's all about an engineer who did some kind of attribution, but didn't do it correctly. And people are happy to say that it's all part of a big evil plan by Microsoft to take over the world.
This is not that though. Seems to be exactly what the maintainer is asserting and that's not OK. :/
I have seen plenty of dev managers refuse to pay for something if they didn't have to.
It's not the money, it's the red tape. Setting up a new vendor, finding the right account, getting the PO approved. Even in a company where that stuff is relatively easy, it's way more friction than a simple meeting where you don't have to ask anyone for permission for anything.
Oh I do.
The person that wanted to setup the meeting likely has no budget control. Big corps like to keep the ability to pay for stuff out of the hands of individuals and isolated in bureaucratic nightmares.
You'd be more than reasonable to demand "$1000/hr with 1 hour minimum" for such a consulting and I'd see HR in MS doing an immediate "hell no" to that.
At least in my company, it very much depends on who's initiating the meeting. If one of our VPs did, then easy, any amount could be approved. However, if it's a team lead, we'd be told to pound sand.
I assumed other companies would be pretty similar.
I'd say my experience is exactly the contrary. Middle managers in my experience in mega corps have a lot of expense latitude for these kinds of things, expedited approvals, corporate credit cards. At least in the finance and tech world.
It's time we switch to "fair source" or "equitable source".
Put MAU/DAU/ARR/market cap limits in your license. Open to everyone with a market cap under $1B or revenues under $100M. All others, please see our "business@" email.
Place viral terms like the AGPL that requires that all other systems touched by your code to be open - especially the backend/server components that typically remain hidden.
We're giving away power to these companies for free, and they use their scale and reach to turn our software into a larger moat that ensnares us and taxes us in everything else we do.
Your contribution of open source in one area might bubble up as Microsoft or Google's ability to control what you see or how you distribute software to customers. It's intangible and hard to describe these insane advantages and network effects big players like this have to lay people, but I know we as software engineers understand this.
Open source has been weaponized against us. They get free labor and use our work to tax us, pin us down, out compete us, and control us. We need to fight back.
"Open source" was literally created as a corporation-safe neutered form of "free software".
It's very akin to the paradox of tolerance.
I’m still tweaking the execution of the license, but in principle my thinking is, “if you’re using my software to make money, and you’re making a lot of money, you should probably be paying me to use my software”.
A shame though it is, helping everybody the same amount is not likely to get your much gratitude from anyone. But that's the job.
That would also mirror what they do with tools like Visual Studio, which is free until you hit a certain number of developers or revenue.
Most software isn't hard to reverse-engineer, and most people aren't exceptional; if a group is big enough to create a GPL-licensed product that competes with Microsoft's, they're big enough to create an MIT-licensed product that competes with Microsoft's.
I like GP’s comment “don’t discuss anything in private and/or offer priority support without being paid”. Also:
- Ensure you get attribution, and support others who deserve attribution
- Develop open-source alternatives to paid programs
- Donate to others who write open-source
I disagree that open-source contributed much to companies becoming so rich. I believe it was more that people gave them (money and) private data, e.g. made posts and interactions that only exist on their locked-down platform. I doubt a lack of open-source and accessible development tools would’ve prevented Google and Facebook; if anything, they would've been founded by richer or more networked people. And it certainly won't prevent them now.
> Open source has been weaponized against us.
This was always going to be the case. We Free Software advocates have been saying this for decades.
And you're not even to the most important part: this isn't about you, me, or megacorps. It's about users.
"Hey, that guy worked with the author, and he was hired and now is a super top dog there... he must be the true genius behind it"
I mean that for ideas, not materialized code. You guys are so focused on small text files and miss the big picture sometimes.
Licenses are a small angle for those things.
https://sfconservancy.org/copyleft-compliance/enforcement-st...
Also, GPL is about source code, not ideas. Source code is not that relevant.
It was created because Linksys shipped GPL code to customers but didn't provide the source.
My work is with DSLs: domain specific languages. The work is in the idea realm (most of the time is spent there), not the source code implementation, which is often trivial once the language is developed.
The gratification also is different. Seeing others use the language is the best one can hope to achieve nowadays. Maybe publish a book about it, but that sounds more trouble than it is worth (judging by how books on patterns, a similar realm, are often misquoted and misused).
That's why all this talk about licenses sounds like nonsense.
I could have kept it a secret and made a book about it, tying my name to it forever.
However, I want my domain specific languages to run free. People not getting in my nerves about them anymore would be enough compensation.
Tho pricing tailored to customers works, as long as it's efficient and non-zero.
You set up your standard, and stick to it whomever comes.
Why? Most businesses don't entertain standard rates, either. It's case-by-case negotiations ("call us", "request quote"). Why should I, as a private person putting stuff out there for free, set up "my standard" and stick to it?
But I guess they don't mean set the same price for everyone - but rather stick to your values in what you do.
Interesting moral proposition, I doubt you'd get many followers. I think it's perfectly reasonable to treat people differently from corporations, and random small and medium corporations differently than huge megacorps without losing any sleep.
Specially in business, charging more to those that can pay more is a very common approach.
and all consumers dislike price discrimination. Airlines is the classic example.
It's just that those companies do this because they can. And i hate it. I much prefer a static, single price for a product.
gaben figured that out and successfully expanded into many markets that were considered basket cases for software licensing.
But the US Supreme Court would be one of them.
But the license of a piece of software is not ridiculous - if you chose a very permissive license, you cannot then go and choose who should or shouldnt be profiting off your software. The license was a pre-commitment.
But lots of people make this pre-commitment, but then makes a moral/ethical judgement post-facto when someone rich seems to be able to extract more value out of the software than what "they deserve", and complain about it.
1. A small company which is barely profitable but is building something which aligns with your values and you see as a positive to the world.
2. A massive mega corporation whose only purpose is profit, mistreats employees, and you view as highly unethical.
You shouldn’t treat those the same way. It’s perfectly ethical to offer your work for free to the first one (helping them succeed in creating a better world) and charging up the wazoo (or better yet, refusing to engage in any way with) the second one.
A company is not a person, and can literally have its entire staff changed in short order. Or be bought.
Companies have no morals. Sometimes people in companies do, but again, that person can vanish instantly.
You should treat a company as a person which may receive a brain transplant at any time. Most especially, when writing contracts or having any expectation of what that company will do.
A business that is privately owned, is run by its founders and which represents the lion's share of its officers income and net worth can be dealt with like any other small business.
Some guy who makes bespoke firmware for industrial microcontrollers or very niche audio encoding software isn't Microsoft. You won't be able to do business with him in a useful way if you treat him like Microsoft.
If you want to be extreme don't distribute it to them in the first place. Licenses do not come into effect until after distribution. So you could have a pay-to-download model that comes with a %100 discount if you're a lone developer or an organization with under X amount of revenue. You wouldn't be able to stop someone redistributing it after the fact, but you're not engaging.
Although at work we have a provider of proprietary software that has an APT repository where the URL includes a secret token, so they can track from where it's being accessed.
Well, the standard for software licensing is to sell cheaper licenses to smaller businesses and more expensive licenses to larger businesses.
I agree with you 100% but I'm guessing getting approached by Microsoft can be pretty ego boosting, which is what these companies exploit.
https://zedshaw.com/blog/2022-02-05-the-beggar-barons/
> No, this begging is particularly different because it capitalizes on the good will of open source developers.
> Microsoft, Apple, and Google are standing on the internet in their trillion dollar business suits with a sign that reads "Starving and homeless. Any free labor will help."
> They aren't holding people up at gun point. Rather they hold out their Rolex encrusted hand and beg, plead, and shame open source developers until they get free labor.
> Once they get this free labor they rarely give credit.
> They're ungrateful beggars that take their donated work hours, jump in their Teslas, and ride off to make more trillions proclaiming, "Haha! That open source idiot just gave me 10 hours of free labor. What a loser."
It's like negotiating with the mafia, you might get something out of it but if you cross the line you'll end up face down in a ditch and authorities will look the other way. Megacorps have stolen, copied, reverse engineered, replicated, etc. things since forever and it always worked out for them.
In this case MS didn't need any help. They could very well take everything and face no real repercussions (this is the reality when the majority is uneducated, and their elected representatives are greedy and spineless). So playing along gives some chance to get something positive out of it.
What’s the scenario here where they could take you to court for refusing to (in GP’s words) doing charity for them?
Scenario 1: Microsoft contacts you and says they want to talk about your open-source project. You never reply.
Scenario 2: Microsoft contacts you (…). You reply “thank you, but I’m not interested. You are of course free to contribute or fork within the constraints of the license.”
Scenario 3: Microsoft contacts (…). You reply “sure! I charge $X/hour or I could do a flat rate of $Y for the meeting. Is that acceptable to you?”
What basis would they have for taking you to court in any situation? As soon as you got a legal letter for any of them, your first step should be to send it to as many news outlets you could think of.
Since this isn't the first time MS does this to a FOSS maintainer, it's clear this tactic doesn't help us.
He was hoping for a fruitful collaboration and offered the help towards this goal. MS taking whatever they wanted anyway just proves that they had no intention to cooperate, let alone to pay handsomely for something that was already free.
Ending up in court means you need to sue the megacorp to enforce the license. This makes it a free lunch for a megacorp.
With every single scenario MS takes whatever they need. They don't have to pay, don't need the help to read code, and you can't afford to force them to respect the license.
P.S.
> As soon as you got a legal letter for any of them, your first step should be to send it to as many news outlets you could think of.
There's a guy rotting away in a El Salvadorian prison with a lot of press to keep him comfort. Not sure your letter will capture the world's attention like you think it will.
Normal people aren't constantly engaging in a fight for survival in every aspect of their lives, and I don't think it's a good thing to ask them to. We should expect the people we deal with to be acting in good faith. I think it would be bad actually if I had to consider if you're going to make money off of my idea when talking to you.
Asking everybody to be constantly vigilant of possible exploitation by megacorps puts an undue burden on individuals. We should have strong and durable protections against those megacorps in other ways.
What I'm saying is that this sort of copying should be criminal (not just illegal, but criminal) and Microsoft, the legal entity, should be held accountable and fined. I acknowledge that this isn't currently possible with our legal framework, but we should work to make it possible.
like what? continue to use (pay) for their products and wait for regulations coming from lobbyist countries? /s
I agree with you, if we're talking about people acting as individual humans collaborating together on FOSS.
But this is really about a for-profit corporation acting in its own interests, using people to do its "deeds". Then I think it makes a lot of sense to treat any "Hey, could we chat to you about your project?" with a great deal of skepticism, because they have a goal with that conversation, it it's unlikely to align with your own goals, in most cases.
Ultimately, people from that corporation is reaching out to you because there is a potential/perceived benefit coming out of that conversation that they want to have with you. If it isn't extremely clear to you what that exact benefit is, I'd say the smart thing to do is being cautious, to avoid situations like this which happen from time to time it seems.
You’re not bilking Ed’s Garage, you’re a rounding error on their petty cash account.