licensing

Contributor Agreements Considered Harmful

Eric S. Raymond — Mon, 08 Jul 2019 11:30:00 +0000

Why attempts to protect your project with legal voodoo are likely to backfire on you.

I have a little list (they never will be missed) of stupid things that open-source projects should stop doing. High on this list are CLAs (Contributor License Agreements) and their cousin the mandatory CA (Copyright Assignment).

In this article, I explain why CLAs and CAs are bad ideas and what we ought to be doing instead. In obedience to custom, at this point I issue the ritual disclaimer "I am not a lawyer", but one does not have to be a lawyer to understand the law and game out the ways CLAs and CAs fail to achieve their intended purpose. And, I have researched these failure modes with both lawyers and executives that have literally billions of dollars at stake around IP violations.

I've made a distinction between CAs and CLAs; we can make a further one between ICLAs (Individual Contributor License Agreements) and CCLAs (Corporate Contributor License Agreements). While all are about equally useless, they have slightly differing failure modes.

First, let's consider the ICLA. Some projects require that you sign one before being allowed to submit changes to their repository. Typically, it requires you to assert that (a) you affirmatively choose to license your contributions to the project, and (b) you have the right to do that.

Here's the problem. If you are employed, you almost certainly cannot make claim (b), and the project you are probably trying to help is only setting itself up for trouble if it behaves as though you can. The problem is that most employment contracts define any software you write on working hours or even off hours in connection with your job as "work for hire", and you don't own the rights to work for hire—your employer does.

CAs, such as the Free Software Foundation requires, have exactly the same problem. You don't own the copyright on a work for hire either. Therefore, you can't assign it. I'll get to the case of individual developers not in a work-for-hire situation in a bit.

The CCLA exists as an attempt to address the problems with ICLAs. It's not an agreement that you sign, it's an agreement your employer has to have pre-negotiated with the project to which you want to contribute. You then have to offer the project an identity that it can associate with that CCLA so it knows your contributions are covered.

That at least sounds like it might be useful. Why isn't it? To understand this, we need to do a bit more threat modeling. What is it that open-source projects hope to prevent using CCLAs?

Go to Full Article

Time for Net Giants to Pay Fairly for the Open Source on Which They Depend

Glyn Moody — Mon, 05 Nov 2018 13:00:00 +0000

by Glyn Moody

Net giants depend on open source: so where's the gratitude?

Licensing lies at the heart of open source. Arguably, free software began with the publication of the GNU GPL in 1989. And since then, open-source projects are defined as such by virtue of the licenses they adopt and whether the latter meet the Open Source Definition. The continuing importance of licensing is shown by the periodic flame wars that erupt in this area. Recently, there have been two such flarings of strong feelings, both of which raise important issues.

First, we had the incident with Lerna, "a tool for managing JavaScript projects with multiple packages". It came about as a result of the way the US Immigration and Customs Enforcement (ICE) has been separating families and holding children in cage-like cells. The Lerna core team was appalled by this behavior and wished to do something concrete in response. As a result, it added an extra clause to the MIT license, which forbade a list of companies, including Microsoft, Palantir, Amazon, Motorola and Dell, from being permitted to use the code:

For the companies that are known supporters of ICE: Lerna will no longer be licensed as MIT for you. You will receive no licensing rights and any use of Lerna will be considered theft. You will not be able to pay for a license, the only way that it is going to change is by you publicly tearing up your contracts with ICE.

Many sympathized with the feelings about the actions of the ICE and the intent of the license change. However, many also pointed out that such a move went against the core principles of both free software and open source. Freedom 0 of the Free Software Definition is "The freedom to run the program as you wish, for any purpose." Similarly, the Open Source Definition requires "No Discrimination Against Persons or Groups" and "No Discrimination Against Fields of Endeavor". The situation is clear cut, and it didn't take long for the Lerna team to realize their error, and they soon reverted the change:

Go to Full Article

Lights, Camera, Open Source: Hollywood Turns to Linux for New Code Sharing Initiative

Gabriel Avner — Fri, 14 Sep 2018 13:08:08 +0000

by Gabriel Avner

Software has permeated all industries, bringing us technologies to help create fantastic products and even works of art.No longer confined to sectors whose products are software-focused, everyone from the automotive to the medical industries are writing their own code to meet their needs, some of which may surprise you.

In looking to code smarter, faster and more efficiently, developers across the globe and industries are turning to open-source components that allow them to add powerful features to their work without having to write everything from scratch themselves. One of the latest groups to embrace the Open Source movement is the entertainment industry.

Similar to many other initiatives that have come together in recent years to support the sharing of code between companies, a number of key players under the umbrella of the Academy of Motion Picture Arts and Sciences (AMPAS) have teamed up with The Linux Foundation to establish the Academy Software Foundation (ASWF). Members include companies like Disney, Google, Dreamworks, Epic Games and Intel, just to name a few.

Facing the Reality of Open Source

The drive for these entertainment industry players to team up with The Linux Foundation comes after a two-year study by the AMPAS’ Science and Technology Council into how the sector was using open source. Their survey found that some 84% were using open source in their work, specifically in the fields of animation and visual effects.

However, even as these actors understood the benefits of using open-source projects that were being developed by others, maintaining an ecosystem of sharing software between often competing interests proved to be a challenge. Issues of governance, licensing, multiple versions of libraries and siloed development by individual companies proved to be significant pain points.

According to information available from the ASWF, they are providing much of the infrastructure for the projects, including running their CI server on Jenkins where code can go through the build, test and eventually release for use by the members. Using a centralized system, developers at the various member companies can upload their code to the ASWF repository and CI where it is then available to the other teams.

They note that along with support for Linux, their CI infrastructure will offer service for Windows and Mac desktops and servers, an important requirement in an industry with a high level of Apple usage.

Go to Full Article

Copyleft Terms May Become Unenforceable in 11 Countries under CPTPP

Jack Burton — Wed, 13 Jun 2018 17:35:26 +0000

by Jack Burton

The Comprehensive and Progressive Agreement for Trans Pacific Partnership (CPTPP) is an enormous (roughly 6,000-page) treaty between Australia, Brunei, Canada, Chile, Japan, Malaysia, Mexico, New Zealand, Peru, Singapore and Vietnam that was signed in Chile on March 8, 2018. So far, only Mexico and Japan have ratified it. CPTPP is almost identical to the original TPP, which included those 11 countries plus the United States. In early 2017, the US withdrew from the treaty, which its President had previously described as a "terrible deal".

CPTPP has many provisions of concern to the FOSS industries and communities in those countries. Open Source Industry Australia (OSIA) has raised a number of those issues with an Australian Senate committee's inquiry into CPTPP (see "CPTPP could still destroy the Australian FOSS industry" and "Submission to the Senate Standing Committee on Foreign Affairs, Defense & Trade regarding the 'Comprehensive & Progressive agreement for Trans Pacific Partnership'"). The figure below shows the likely consequences of one such provision, Art. 14.17 in the Electronic Commerce Chapter, which deals with transfer of or access to source code.

Linux Journal readers may be particularly concerned about one of those consequences: FOSS authors in the 11 CPTPP countries may lose the ability to use the courts to enforce the copyleft terms in licences such as the GPL.

To what extent that happens will depend on how each country decides two questions of legal interpretation: first, whether FOSS licences constitute "commercially negotiated contracts"; and second, how significant the omission of "enforcement" from the list of conditional actions in the provision may be.

At least some adverse consequences of Art. 14.17 are likely in any countries that ratify CPTPP regardless of the interpretation taken, and the risk of the more severe consequences in those countries seems grave.

Go to Full Article

Do I Have to Use a Free/Open Source License?

VM Brasseur — Wed, 21 Mar 2018 14:28:26 +0000

by VM Brasseur

Open source? Proprietary? What license should I use to release my software?

A few weeks ago I ran into a neighbor, whom I'll call Leo, while he was out taking his dogs to the park. Leo stopped me to ask about some software he's developing.

"Hey, you do open source stuff for companies, right?" Leo asked.

"Yeah, that's my freelance business. Do you need some help with something?"

"Well", he said, "I'm getting ready to release my software, and it's time to start thinking about a license. Which open source license should I use if I want people to know it's okay to use my software, but if they make money from it they have to pay me?"

I blinked, stared at Leo for a moment, then answered, "None of them. No open source licenses allow for that."

"No, you see", he continued, "this guy told me that there must be plenty of licenses that will let me do this with my software."

"Plenty of proprietary licenses, maybe", I explained, "but no open source ones. According to Item 6 in the Open Source Definition, no open source license may prevent someone from making money from software released under it. That's what you're suggesting, and it's not possible to do with an open source license."

Leo did not seem pleased with this answer. "So what you're saying", he fretted, "is that I can't release my software at all!"

"No, no!" I assured him, "You definitely can release and distribute your software. You'll just have to get an intellectual property lawyer to help you write the proprietary license you want, and maybe to help you release it under a dual license (one open source and one proprietary)."

He nodded (not altogether happily), and headed off to the park with his now very impatient dogs. I continued my walk, pondering what I'd just experienced.

The thing is, Leo was not the first person I've spoken to who assumed that software had to be released under an open source license. I've had multiple conversations with different people, all of whom had mentally equated "software license" with "open source license."

It's easy to understand why. Of all software pursuits, only free and open source software is defined purely in terms of its licenses. Without that license, a piece of software cannot be either free or open. This leads to a greater focus on licensing than for other types of software, which then itself gains a lot of mindshare. The larger intellectual property concept of "licensing" becomes so closely associated with "open source", and is often the only context in which someone hears of licensing, that people understandably start to assume that all licenses must therefore be open source.

Go to Full Article

It’s Here. The March 2018 Issue of Linux Journal Is Available for Download Now.

Carlie Fairchild — Tue, 13 Mar 2018 15:08:24 +0000

by Carlie Fairchild

Boasting as many pages as most technical books, this month’s issue of Linux Journal comes in at a hefty 181—that’s 23 articles exploring topics near and dear to everyone from home automation hobbyists to Free Software advocates to hard-core hackers to high-level systems architects.

Besides making the magazine bigger overall with more articles in each issue on a wider range of topics, we’ve also added a new feature that explores a given topic in-depth: the Deep Dive—think of it like an ebook inside each magazine. This month contributing editor Petros Koutoupis dives deep in to blockchain. He explores what makes Bitcoin and blockchain so exciting, what they provide, and what the future of blockchain holds. From there, he describes how to set up a private Etherium blockchain using open-source tools and looks at some markets and industries where blockchain technologies can add value.

Subscribers, you can download your March issue now.

Not a subscriber? It’s not too late. Subscribe today and receive instant access to this and all back issues since 2010. Alternatively, you can buy the single issue here.

Go to Full Article