GnuTLS, copyright assignment, and GNU project governance | Hacker News Reader

GnuTLS, copyright assignment, and GNU project governance

lwn.net

67 pointsjmillikin28 comments

Copyright assignment has a major purpose that is not acknowledged in this article. In some jurisdictions (I know that this used to be the case in the state of New York) it is the case that, by default, all software produced by employees who are software developers belongs to the employer, whether or not that software was developed on personal equipment, away from the office. In those jurisdictions it is also the case that many programmers who labor under this oppressive legal regime are entirely unaware that their time is not truly their own. They may therefore contribute to open source projects, and claim licensing on software, that is not truly valid.

The FSF copyright assignment process stands as a guarantee that GNU software, at least, will never encounter any issues based on these legal facts. You may use GNU software with assurance that the legal status of that software is very, very clear.

What about the rest of us? Well there is a defense for copyright infringement that basically says, "I relied on reasonable assurances that I was not, in fact, infringing." That covers your past infringement. But not necessarily future offenses. But the risk is still low. As a practical matter, companies rarely sue over this type of issue, and if they do, they generally have little interest in suing every innocent bystander who accidentally infringed. So many may find the risk acceptable.

But Stallman is an absolutist. He wants absolute guarantees. And copyright assignment helps him get there.

Please note that I am not a lawyer and this is not legal advice.

Contributor license agreements take care of this issue, there is no need for assignment. The only legal reason for assignment is that it is a prerequisite for suing in court. Otherwise, only the actual code author could sue, not the project it was contributed to.

Basically, assignments do not fix the issue you are raising any more than standard contributor agreements.

I am an ip lawyer, but this is not legal advice

It's worth noting that the ASF also requires copyright assignments.

No, AFAIK it requires copyright licenses given through a contributor agreement, which are not the same.

I can confirm that it's a Contributor License Agreement: http://www.apache.org/licenses/#clas

> Except for the license granted herein to the Foundation and recipients of software distributed by the Foundation, You reserve all right, title, and interest in and to Your Contributions.

Oops. My recollection was of paperwork but I got the nature of it wrong.

I'm not sure if it's as straightforward as this. There are two routes in for ASF software, the CLA you refer to, and the SGA for existing code: http://www.apache.org/licenses/software-grant.txt

I've signed the SGA for some code, but still have trouble parsing the details. There is language in the preamble that "Licensor owns or has sufficient rights to contribute the software source code and other related intellectual property". I'd think that "contribution of code" is more than just a shared license. But in the actual clauses, only a "non-exclusive, worldwide, royalty-free, irrevocable" license is mentioned.

Based on the discussion at the time, I presumed I was signing a grant of ownership of code. And the the NOTICE within the project says "Copyright 2010-2012 The Apache Software Foundation", which implies the ASF claims ownership. But I'm not sure of the basis of this claim. Do you have more insight?

Non exclusive means it is not an assignment. Copyright assignments are exclusive, and you need to own at least one copyright right exclusively to sue. They also must be clear assignments to be effective. At least every ASF agreement I have seen was a license, not an assignment

As for notice, you should ignore notices, they have no real meaning anymore. If they are wrong, they are just wrong, it does not give you any rights by putting your name on code you don't own copyright to. Additionally, for collective works, valid notice for one serves as valid notice for all owners.

I appreciate the response. While I agree that there is no assignment currently present in the CLA or SGA, the preamble makes me think it once did have one. Searching deeper I do find that the ASF _requires_ you to list the Apache Foundation as the copyright holder: http://apache.org/legal/src-headers.html#notice

As for for the legal role of the NOTICE file, I think there may be more complexity than that. Here, for example, we find Lawrence Rosen and Roy Fielding (among others) discussing what must go in NOTICE instead of in LICENSE: https://issues.apache.org/jira/browse/LEGAL-62

I know they have not required assignment for at least the past 6 years (when google signed the agreement). I don't know about back past that. However, don't confuse this with whether people have assigned copyright for things to the ASF. There certainly are cases where this has occurred. Google has assigned copyright in some large software contributions to the ASF, for example.

NOTICE files have special meaning in the Apache license. I misread (I was on my phone) and thought you were talking about copyright notice previously. Even Larry thinks that copyright notice is mostly worthless. However, you can't removes notices that currently exist unless you are the copyright owner, so they have rules for moving them to NOTICE files.

Again, you should not confuse organizational requirements and policies with what the law requires or recognizes.

Internal to Google, I have set requirements about the form of copyright notice/etc, for example. This isn't just because of legal requirements, but because it stops useless developer arguments and time wasting. Sanity and consistency are important in this kind of thing, and without rules folks have a penchant for starting mailing list arguments about it every few months.

Besides that, it also helps deal with the outside world. By having strict, sane, and consistent policies, dealing with corporate and other contributors becomes a lot easier. They want to add 600 new copyright lines to your file, you point them to the policy that says no.

Agree on all, and thanks for the continued insight. While it's clearly institutional policy rather than law, I'm a little concerned that the ASF appears to claim copyright ownership of all of their projects' code, but doesn't actually have this ownership. My worry would be that as a result they wouldn't have legal standing to enforce license restrictions. I've written a question to the Apache project list that I'm part of asking for clarification about our specific case.

No problem, happy to help how I can. There are legal theories under which they could sue, just not copyright infringement in the US. Standing is one of the few very well settled areas of copyright law in the US (IE at least 8 circuits worth of federal appeals courts have all held the same thing about who has standing to sue for infringement)

One particular nitpick:

> One of these [scenarios for relicensing GPLed softwar] is relicensing to a later version of the GPL. This scenario is in most cases already covered by the default "or later" language that is usually applied to software licensed under the GPL.

That language doesn't actually cover the case in question. The "or later" clause lets the licensee choose which version of the GPL they want, but the FSF's interest in relicensing to a later version is often that it wants to impose the stricter terms of a newer GPL version on licensees. A licensee could avoid the GPLv3 patent restrictions on software licensed "GPLv2 or later," for example, by choosing to stick with the GPLv2.

A licensee could avoid the GPLv3 patent restrictions on software licensed "GPLv2 or later," for example, by choosing to stick with the GPLv2.

... unless he want to use a newer version of the software which RMS has decided should be licensed under the GPLv3 only. FreeBSD has run into this problem with gcc, for example: We could no longer backport bug fixes, but instead had to "clean-room" re-develop them.

Right, I'm saying that's intentional on the part of the FSF, and an "any later version" clause doesn't let them do that. Obviously, that's not helpful for you, but if that's what they're trying to do, they need to be able to relicense in order to do it, which means either copyright assignment or agreement from the copyright holders.

I find Richard's response perfectly reasonable. The work was donated to, copyright-assigned to, and done under the auspices of the FSF / GNU Project for years. Resigning from GNU and forking the project is one thing, but trying to remove the project from GNU is something else altogether.

Reasonable, but dumb.

The maintainer will fork the project under a new name, and continue to work for it. GNU will be left with a piece of software that slowly bitrots and becomes outdated, unless it can attract someone else to take it over.

I think it deserves a new name if it is no longer a GNU project anyway.

Would you care to contribute something beyond what was discussed in the article? Do you also think gnuplot and Gnutella should change their names? Given that Nikos controls the gnutls.org domain, should be obligated to turn control over to gnu? For free, or can he charge them for the transfer?

Oh...he should charge them all right.

If the project is important enough for free soft in general, they'll find someone. If not, oh well, the cost for waste disposal of bit-rotted software project is rather small, no?

They had someone, who seemed to be doing a good enough job. Now they have to find someone else to do that job, while competing with a new fork of the code.

And the cost of obsolete code is not a bit of web storage; it reflects on the project as a whole. The GNU userland tools have been important for Linux. But what happens if people move to different user land tools?

It's not super important, but it is a shame that people leave projects.

Perhaps if free software and open source software had invested in a bunch of diplomats to translate the flames between De Raadt, Torvalds, Stallman, etc things would look very different today.

That sounds like a self-fulfilling statement.

There are other options than the two you've outlined. What if they find someone to maintain it, who isn't that good? How come the GNU Hurd hasn't yet been disposed of?

Hm. According to european copyright/authorship rules a transfer of copyright is simply impossible as we have the "Droit d'auteur" principle that makes authorship rights inalienable. This is a known major difference between european and US style copyright.

Therefore I question the transfer of copyright in this case but IANAL.

This simple fact is the reason that FSFE adopted the fiduciary license agreement http://fsfe.org/activities/ftf/fla.en.html to emulate the FSF approach under european laws.

Knowing a bit the background of the FLA, I think that was a just an additional way to convince lawyers to understand the free software licensing model. The patrimonial rights can be transferred in Europe too that's clearly what you do when you make the transfer of copyright in US. As the common ground of the Berne Convention has been ratified by US and Europe, the transfer of copyright (on the patrimonial aspect[1]) is based on a common legal ground.

[1] Concerning the "moral rights" in software/computer program, it's usually not legally applicable for software.

No, in Europe economic rights are not always transferable, either. The classical example is the German Urheberrechtsgesetz, which does not allow for the transfer of either moral or economic rights [1]. General practice is to grant the publisher a right to use the work (which can be exclusive or non-exclusive, perpetual or time-limited, etc.).

This is a subtle, but important distinction. Because such a grant does not entail unlimited rights to relicense the work and the author retains a number of unwaivable rights associated with the work. (German law intentionally aims to protect authors against various exploitative practices by publishers, making it very difficult for authors to sign rights away.)

The Berne Convention does not make it necessary for the signatories to allow for such a transfer, either. It only says that if economic rights can be transfered, moral rights remain with the author.

Also, moral rights most definitely apply to computer programs in many jurisdictions.

[1]http://de.wikipedia.org/wiki/Deutsches_Urheberrecht#.C3.9Cbe...

There are also many jurisdictions where moral rights are excluded to computer programs. Moral rights on computer programs are usually limited to "practical" rights like claiming being the authors. It's not really in opposition to the transfer of economic rights.

You are correct about the German case for moral rights but that was the main issue with the FLA. The FLA was mainly designed by a German lawyer thinking about his national legal framework.

In my perspective, we should avoid the over-legalization of (free) software development. And transfer of copyright/"patrimonial rights" is one of them, there are many way to exercise your rights as a free software author. I sponsored and supported for many years the FSF but I personally think that they made a big mistake, they underestimated the capacity of the "copyright mess" to secure free software (the Linux kernel is one of the example, you won't be able to find all the authors if you want to change the license to a non-free license). I know that seems to be a contradiction but as free software is relying on copyright, you can use also benefit from the multiple ownerships from the same artwork/computer program to secure free software. A single entity and a transfer of ownership can be even more risky...

> Therefore I question the transfer of copyright in this case but IANAL.

Yeah it makes no sense there, at least in Germany or France where moral rights can not be transferred (and corporations can not own works, at best they enjoy an exclusive license to the work of an employee). SQLite also had some trouble at least in france, because moral rights not being transferrable means an author can not put his own work in the public domain (the work will fall in the public domain after ~life+70y, but can't be put there)

Reply on news.ycombinator.com