ShaneCurcuru

Open Collective (really Open Finance Consortium Inc.) is a US 501(c)(6) nonprofit that runs a payments and accounting platform, providing fund acceptance and budget services to a ton of different community collectives and funding groups, making it easier to connect funders with groups that are often not incorporated.

Open Source Collective is a separate 501(c)(6) organization that actively supports funders wanting to support FOSS projects or communities specifically. They share some board members, and they simply use Open Collective to do all the finance work, while also offering some level of advice and other IP holding services: https://docs.oscollective.org/welcome-and-introduction-to-os...

Open Source Endowment is different, in that it's soliciting 501(c)(3) donations, which the OSE board and membership will use for the endowment to choose FOSS projects/communities to provide grants for.

This topic should be a FAQ page on the OSE site, especially for funders who just want to donate "to some good FOSS" without knowing where to find it. When you donate to OSC, you pick specific collectives to give to (and it's not tax deductible). When you donate to OSE, you're giving to the endowment, that the OSE Members setup policies for how/where/when to provide grants to projects/communities (and it could be tax deductible).

Personally I know it since I've been volunteering there since 1999 and know how elections work and know most of the membership. But that probably doesn't help much if you don't know me.

Practically, I know it because the ASF is a Membership organization, meaning there are hundreds of individual Members who have been elected by their peers inside the ASF. The Membership is the group who elects the board. The ASF has only individuals as Members (never corporations), and quite a lot of folks have made their careers about their ASF project work, while hopping between multiple jobs at various vendors.

So to mount an attack like that, you'd need to "evil-ise" a over a hundred Members to get them to vote for your hand-picked candidates who would be shunned by basically everyone else involved in the ASF.

https://apache.org/foundation/governance/members.html

Vendor neutrality and our permissive license are baked very, very deeply into everything the ASF does.

A fair number of 501(c)(3) foundations are similarly membership corporations, where the board is elected from the set of people who've been volunteering there for years, so they are unlikely to change direction like that. Some (c)(3)s are not, but still have a good track history. (c)(6) organizations are a mixed bag, since some explicitly allow sponsors to pay for board seats - a very different world.

Apparently marketing people who want to sell stuff under those new licenses think "source available" is uncool.

Some folks are working on terminology over here, if you're curious.

https://github.com/softwarecommons/softwarecommons.com/issue...

SSPL is definitely not open source, it violates #6:

https://opensource.org/definition-annotated#6

That's the point of open source, and free software in a way as well. Copyleft licenses have restrictions, but as long as you follow those restrictions, you can build whatever you want using the software. SSPL, FSL, BUSL licenses outright prevent you from competing in certain commercial ways, no matter what.

Just because most business models don't want to comply with copyleft doesn't mean it's not open source - it just means it doesn't fit your business model.

If you simply believe "CLAs are bad", you're missing the point (unless you refuse all legal documents on principle, or something).

The question is: WHO are you signing the CLA over to?

If it's a for-profit company, well, then do you trust that company to follow through?

If it's a non-profit, then look to see (in the US) if they're a 501(c)(3) public charity, which have legal restrictions on their governance, which typically require serving some larger public good. Also look at their history of past governance. I certainly hope (as an ASF peep) that we've shown who we are to be who we plan to be in the future; namely producing software for the public good.

Key reasons the ASF uses a CLA are protecting the org from future IP issues, and partly simply to be able to fix some future typo or legal issue in our license if one ever comes up. But the ASF will always provide all of it's released software under a similar style permissive license to Apache-2.0, as long as the organization is around.

If they're a 501(c)(6), then they're a business league, and might act more like a for-profit corporation, so...

As noted elsethread, there are several 501(c)(3)s that pay for software development, either via having their employees/contractors do it (directly or indirectly), or by providing grants or one-off funding for specific kinds of work. It really depends on the organization what their policies are.

The LF has plenty of employees who help code on their various sub-foundations in one way or another. Python, NumFocus, PHP, and some others have grant programs to help pay developers to work on specific code. And Conservancy and SPI are fiscal hosts that allow their independent projects to fundraise and pay for their own work.

On the other hand, the ASF explicitly does not allow funding to pay for project development, at least not in the context of the ASF itself. The ASF does have a paid infra staff/contractors who do write code, but it's all to run infra, not for project releases.

As noted elsethread, it's all about what the charity was setup to do.

Naming things is hard, as software engineers know. It's only OCF that's shutting down, not OC, or OCE, or OSC, or even OCNZ (I just found out about that one today).

In any case, there are plenty of other funding models/sites out there, the trick is finding one that really fits how your FOSS project works:

https://fossfunding.com/#how-are-individual-projects-or-main...

I have a general explainer about the OCF shutdown (not the OC, or OSC, or OSE, or OSNV!) over here, where I include more links to software foundations that might also act as fiscal hosts, like Conservancy, SPI, or NumFocus.

https://communityovercode.com/2024/02/open-collective-founda...

What we really need is a lawyer/accountant/tax person to write a focused guide for collectives and how to move their money. US tax law means that generally, 501(c)(3) public charity organizations can't just transfer the money anywhere - it'll most likely need to be another 501(c)(3) or equivalent. That's going to trip a lot of people up who want to go to OC (for-profit) or OSC (a 501(c)(6) business leage), because neither will qualify for accepting fund transfers (I think).

Also, if you have any offinity for Europe, look at the OCE - they are a charity, and they sound like they're seeing if they could accept fund transfers from OCF for projects that fit their model. https://opencollective.com/europe/updates/regarding-the-anno...

The OCF shutdown will not affect the OC, OSC, OCE, OCNZ, or Social Change Nest UK operations, so this is only about the 600 collectives at the US public charity OCF.

If those acronyms sound confusing, read my explainer: https://communityovercode.com/2024/02/open-collective-founda...

And keep hitting refresh on the Dissolution FAQ noted elsethread the OCF is updating: https://docs.opencollective.foundation/

Important clarifications: - The announcement is only about technology, there's no "partnership" between the ASF and GitHub. The ASF is vendor-neutral about all of it's operations. In particular, there is an expectation that Apache project communities continue to do much of their community and release management on ASF servers, not solely on GitHub. - Many Apache projects asked to use GitHub. It took a while, but Apache infra now allows that, as long as the repos are in our organization. Many projects still use our Subversion repo(s) too. - The ASF hosts it's own Git repos with all auditable history. So GitHub is merely one way that Apache projects can choose to allow users to contribute. If GitHub went away overnight, the ASF would still have all our own code and could keep working with our own build tools and plain old `git`. The ASF didn't decommission it's own git repos, just some of the tooling we used to mirror between our repos and GitHub.

Lars elsethread brought up a useful ASF blog post: https://blogs.apache.org/foundation/entry/the-apache-softwar...

And yes, https://github.com/apache is the ASF.

Just to address the last sentence: the Apache Software Foundation would never adopt Commons Clause. It's antithetical to the ASF's entire licensing strategy, which is to give stuff away for the public good, with as few restrictions on users and redistribution as is legally practical.

Personally, people can use whatever license they want for their copyrighted works; that's cool. But the other important issue is: don't call it the "Apache-whatever license", because it is NOT the #Apache-2.0 license. Call it the "Redis License" or whatever else you want, just don't bring the ASF's name into it.

You have to have a license to attract contributors. https://choosealicense.com/ and github make it easy; there's zero excuse to not have a license.

Permissive licenses attract the broadest range of contributors, so if you're looking to build a large community, they are the way to go. GPL tends to have a smaller overall, but very strong pool of contributors, so if copyleft makes sense for your technology, by all means use it.

Just use a license, please.

I've been blogging on the facts, with sources wherever possible:

https://communityovercode.com/2017/11/legal-issues-software-...

And previous posts on the basics and a timeline. It's complicated - both because trademark law is complicated, and because there are clearly personalities involved who have a long history together.

Still developing story, but this shows reason #67 why trademarks are more important than most devs think.

Another interesting discussion is on LWN: lwn.net/Articles/738046/

Just a general comment about the whole thread: trademark law is far more complicated and particular than you know (unless you're an IP lawyer; then you might appreciate it). Not only are developers used to problems that can have provable or obvious answers, trademark law really hasn't caught up with the speed of the internet, especially the instant and global reach that a domain name has.

- The only thing you can say about a trademark dispute like this, given the information that's public, is that "it depends on the specific situation as well as the perception of a large enough user base who might get confused".

- Trademark owners can ask (or C&D demand) just about whatever they want. What they could actually force you to do in a court is far, far less than what they typically ask.

USPTO Trademark Pro Tip: search links are session specific. Use the blue TSDR button's link instead:

https://tsdr.uspto.gov/#caseNumber=86930821&caseType=SERIAL_...

Indeed, Hormel once sent nastygrams about their trademark to the ASF over our Apache SpamAssassin software. Trademark owners can ask everyone to use or not use their own names. Actually going to court - or actually winning - is far far rarer.

Good question. Under something like GPL or Apache, npm (or anyone, really) would have a clear legal reason to continue using and redistributing the code; there's nothing the copyright holder can do about that (unless you actually violate the license terms). Under WTFPL, that's certainly the intent of the license, but I haven't heard any court declaring a case based on WTFPL, so you don't actually know what the courts would make of it. But in general, yes, I'd bet a court would let people do what the f* they wanted once they got some code under WTFPL.

The separate question is: ethically or business-wise, do they want to continue publishing code from an author who explicitly tells them not to? Legally they (almost certainly) could, but as a FOSS business, would they want to?

Software Licenses are pretty easy for the basics - after you read the whole thing.

Trademarks: even more understood to modern programmers than C++ multiple inheritance.

Trademark owners - especially registered ones - can ask you to treat their mark any way they like. Legally, they can only try to enforce the basics of trademark law, but trademark litigation is typically expensive and risky.

USPTO Pro Tip: links to their search are session-specific. You have to use the blue TSDR link to share:

https://tsdr.uspto.gov/#caseNumber=86930821&caseType=SERIAL_...