Kuhn: It Matters Who Owns Your Copylefted Copyrights
As a result, in debates about copyright ownership, discussions of what policy contributors want regarding the fruits of their labor is sadly moot. Without a clear, organized mitigation strategy to assure that FOSS contributors keep their own copyrights, a project (such as GCC or glibc) that switches from a standing “(nearly) all copyrights assigned to a charity” model to a plain Developer Certificate of Origin (DCO) or naked inbound=outbound contributor arrangement will, after a period of years, mostly likely to have copyrights that are primarily held by the employers of the most prolific contributors, rather than by the contributors themselves.
Posted Jul 1, 2021 18:12 UTC (Thu)
by JoeBuck (subscriber, #2330)
[Link] (2 responses)
Posted Jul 2, 2021 19:58 UTC (Fri)
by randomguy3 (subscriber, #71063)
[Link]
Posted Jul 3, 2021 19:16 UTC (Sat)
by jejb (subscriber, #6654)
[Link]
This is a false dichotomy. there are several fairly simple techniques developers can employ to keep ownership of their own copyrights:
https://blog.hansenpartnership.com/owning-your-own-copyri...
The problem is these aren't very well known, so they're not widely used. Perhaps publicising how developers could retain ownership would be more profitable than debating the lesser of evils between foundations and employers.
Posted Jul 1, 2021 19:23 UTC (Thu)
by nathan (subscriber, #3559)
[Link] (57 responses)
Posted Jul 1, 2021 20:58 UTC (Thu)
by bkuhn (subscriber, #58642)
[Link] (56 responses)
Regarding (a): As I said in my “lengthy missive” (🤣, LWN, it's funny 'cause
Overall, I think the two comments so far here have missed my main point: I'm
An unenforced copyleft is indistinguishable from a non-copyleft FOSS license.
Posted Jul 1, 2021 21:05 UTC (Thu)
by madscientist (subscriber, #16861)
[Link] (15 responses)
Some people may not believe raw numbers without names but at least we'd have some kind of basis for discussion which would be a huge improvement.
Posted Jul 1, 2021 21:48 UTC (Thu)
by bkuhn (subscriber, #58642)
[Link] (14 responses)
I also generally think giving a sense of how much time is spent by the org and explaining the strategy is more important and useful than raw numbers of violation reports and open matters and closed matters. The most important reason for that is that often, a single large successful enforcement action against a powerful company, or a lawsuit, quickly changes behavior of many other companies in a period of just a few months. To use an example that's old enough that it's easy to talk about the details: So, if you look back to the history of enforcement (let's consider the BusyBox enforcement in the late 2000s that Conservancy did), I suspect you'd see a huge spike in violation reports over a period of 2004-2008, yielding 100s of active reports, but Conservancy was at the time working on only about 15-20 of those matters. Then we filed the lawsuit, and then we saw lots of really good compliance come about, even among companies that weren't sued (because they realized the stakes were real and didn't want to be sued next). So, if you read a stats snapshot that right before Conservancy's lawsuit in early 2009, you'd see hundreds of pending violation reports and Conservancy working only 17 of them. You'd probably have said seeing those numbers at that time that we were doing a bad job! But, we were carefully curating a list of defendants that were the right mix to file the suit, which we then leveraged to assure others who weren't sued came into compliance.
It's no secret that GPL enforcement is grossly underfunded, and that means leverage must be used to assure compliance. If we had 10x the resources for enforcement, absolutely there are other great strategies that would be possible.
Posted Jul 2, 2021 0:52 UTC (Fri)
by pabs (subscriber, #43278)
[Link]
For the violations I have seen, there have been both BSD and GPL violations, on Linux based routers, mostly violating Linux/busybox/samba. In addition, during my work on the Debian derivatives census I saw violations on the entirety of a typical Debian based distribution.
Posted Jul 2, 2021 8:16 UTC (Fri)
by fredrik (subscriber, #232)
[Link] (8 responses)
Granted, funding for copyright violations may primarily come from grants from organizations who are better informed. Still, publicity drives awareness.
So, here's another vote for collecting and regularly publishing reports about the number of violations found overall. Isn't that something the SF Conservancy could do? Add to that the number of hours/staff spent by the Conservancy during that period and you'd have something newsworthy enough for a spot on the LWN feed, at least on a quarterly basis.
Posted Jul 2, 2021 23:32 UTC (Fri)
by JanC_ (guest, #34940)
[Link] (4 responses)
Posted Jul 3, 2021 9:09 UTC (Sat)
by fredrik (subscriber, #232)
[Link]
Still, I agree that collecting and publishing the data may consume precious time for the Conservancy. On the other hand, whoever does it would have to have some level of both credibility and notability, otherwise the work may not be known and few will provide those necessary external incident reports. A bit of chicken and egg problem.
Posted Jul 3, 2021 16:58 UTC (Sat)
by Trelane (subscriber, #56877)
[Link] (1 responses)
A regular count of "incidents we couldn't pursue due to lack of money/staffing/other" would be interesting to find interested in donating but unsure of the impact is their donations.
Posted Jul 7, 2021 18:01 UTC (Wed)
by JanC_ (guest, #34940)
[Link]
Posted Jul 15, 2021 22:20 UTC (Thu)
by mrugiero (guest, #153040)
[Link]
Posted Jul 3, 2021 2:15 UTC (Sat)
by mathstuf (subscriber, #69389)
[Link] (2 responses)
Posted Jul 4, 2021 0:44 UTC (Sun)
by pabs (subscriber, #43278)
[Link] (1 responses)
Posted Jul 4, 2021 0:57 UTC (Sun)
by mathstuf (subscriber, #69389)
[Link]
Posted Jul 2, 2021 22:45 UTC (Fri)
by ceplm (subscriber, #41334)
[Link] (3 responses)
Posted Jul 2, 2021 23:29 UTC (Fri)
by JanC_ (guest, #34940)
[Link]
Posted Jul 3, 2021 0:48 UTC (Sat)
by pabs (subscriber, #43278)
[Link]
Posted Jul 17, 2021 12:27 UTC (Sat)
by fgrosshans (guest, #35486)
[Link]
Posted Jul 1, 2021 22:12 UTC (Thu)
by rodgerd (guest, #58896)
[Link]
Apparently the FSF have other priorities.
Posted Jul 1, 2021 23:39 UTC (Thu)
by Sesse (subscriber, #53779)
[Link] (33 responses)
Posted Jul 2, 2021 12:30 UTC (Fri)
by khim (subscriber, #9252)
[Link] (32 responses)
Exactly. I'm yet to see even one time where FSF have pulled the nuclear option: forbidden some sleazy organization to use some GPL-based software because of violation of GPL (doesn't matter which one: readline library and binaries linked with readline would be a good choice) and refused to reinstate permission to use it till expiration of copyright (decades in the future). We need such a precedent — otherwise GPL is, basically, indistinguishable from “BSD with some money set aside for lawyers” (which may not be all that bad, ultimately, but if want to say that GPL is new BSD then that needs to be done explicitly if that's what we and FSF want).
Posted Jul 2, 2021 12:36 UTC (Fri)
by pabs (subscriber, #43278)
[Link] (29 responses)
https://www.fsf.org/licensing/enforcement-principles
Posted Jul 2, 2021 13:31 UTC (Fri)
by khim (subscriber, #9252)
[Link] (28 responses)
Really? Please read the GPLv3 then: If you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation. Yes, GPLv3 very explicitly says that accidental violations are not a problem. But I'm not talking about that. I'm talking about prevailing attitude in the industry. Where no one even thinks about GPL compliance before they are contacted by FSF or some other copyright holder. GPL is treated the same as BSD, just with some small risk that you may need to spent some money on lawyers… later… maybe. If some company would lose rights to use some GPLed software permanently (well forever less one day) then we may start finally talking about fundamental difference between GPL and BSD.
Posted Jul 3, 2021 0:01 UTC (Sat)
by pabs (subscriber, #43278)
[Link] (26 responses)
The primary goal of their enforcement is to bring compliance, once that is achieved it does not does not serve the FLOSS community to permanently punish an organisation that has started on the path towards becoming a positive part of the community, contributing upstream, sponsoring development, conferences etc.
A threat of that as a tactic within a last-resort lawsuit, maybe, but actually doing that to an organisation that has got the message and come into compliance seems heavy-handed, unethical and also probably strategically suboptimal.
Posted Jul 3, 2021 9:41 UTC (Sat)
by khim (subscriber, #9252)
[Link] (25 responses)
In that case passing copyright to it makes no sense. If that's true then GPL is dead and we should stop pretending otherwise. The whole GNU story started with the infamous debacle about the printer driver. Remember? The one, where Stallman couldn't fix the bug. If company is a positive part of the community, contributing upstream, sponsoring development, conferences… yet sells devices without accompanying sources… then what's the point? Android with permissive licensing works just as well. LLVM with permissive sources also have paid developers and conferences. Depending on your goals, I guess. If your goals are “conferences” and it's perfectly Ok to flaunt decades of violations if you sponsor these then not only GPL but also a copyright assignment are superfluous. Once upon time FSF was very proud when it got G++ front-end. Today FSF ignores violations by vendors which violate GPL to keep information about their products secret (like MCST). Essentially the same thung AFAICS. If that's “fine” and “not a big deal”, then why do we need GPL, FSF, copyright assignments and all that circus?
Posted Jul 3, 2021 18:36 UTC (Sat)
by Wol (subscriber, #4433)
[Link] (24 responses)
Please re-read the post you replied to. ESPECIALLY the bit you quoted. The GPL is the stick that forces the company into compliance. Find a *bad* company, use the GPL to beat it over the head with and persuade it to *become* a good company, and then yes you do want to say "fine, all is forgiven".
If a company says "up yours!", then they deserve all they get, and their GPL licence will be revoked - by their own actions! Hell is the inevitable consequence of your own selfish actions, and you condemn yourself. It's not our place to condemn them - we will condemn ourselves too. But if that is their choice, then we cannot save them, and shouldn't bother trying.
Cheers,
Posted Jul 3, 2021 18:57 UTC (Sat)
by khim (subscriber, #9252)
[Link] (23 responses)
Let's consider a very concrete example. Here is the company which sells GPL software with FSF copyright and without sources. For more than five years. They talk about maybe making sources available, but claim they couldn't do that because of secrecy (they are providing binaries to Russian government and fear source may contain some secrets which they couldn't reveal). Now, you say that they license is “revoked - by their own actions”… but what does that mean? So they can still sell all the FSF-copyrighted goodies but now should feel bad about themselves? Is that it? What an achievement! How can you be sure they would even feel bad about it? Seriously? You mean: the whole hoopla, the whole debacle about GPL and all that… and the real goal is just to make some “bad people” to treat GPL as if it were BSD license and wait till God would do something about them? Sorry, but I'm not sure it would really work in a real world.
Posted Jul 3, 2021 23:48 UTC (Sat)
by pabs (subscriber, #43278)
[Link] (22 responses)
If you have concrete evidence of violations by a particular company, please report them to the appropriate parties.
Please donate to FSF or Conservancy, earmarked for compliance actions. At least Conservancy has been willing to bring lawsuits in the USA in the past and they have plans to do that again in the future, within the IoT firmware space:
https://sfconservancy.org/copyleft-compliance/firmware-li...
I'm not aware of any organisation doing GPL enforcement actions in Russia, is there a local Free Software organisation (like FSFE/FSFLA) in Russia?
Posted Jul 4, 2021 0:06 UTC (Sun)
by khim (subscriber, #9252)
[Link] (21 responses)
In XXX century, I assume? Would interview where marketing director quite explicitly says “source codes for the company's products are not yet available either for independent download or upon request, but the company intends to open them soon” (that's for something that they offered as binaries for five years at this point) count? Two years more passed after that interview, BTW. They still offer no sources AFAIK. I don't know, really. I have come to accept the fact that GPL just doesn't work and that's it. Just kinda found it funny to discuss how is it great to give FSF the right to enforce GPL when it clearly doesn't work.
Posted Jul 4, 2021 0:28 UTC (Sun)
by pabs (subscriber, #43278)
[Link] (19 responses)
That interview does sound problematic. The usual standard of evidence is that a person who was able to receive the binaries, tried to receive the complete corresponding source, build and install it but was not able to do so. Then that person documents what happened and presents it as evidence.
The GPL works, but only if (as Bradley points out in the essay) it is actively enforced against violators:
> Copyleft licenses are not magic pixie dust. Copyleft is not a legislatively-mandated regulation (e.g., pollution regulations) — which are enforced by government staff. Ultimately, an entity — most commonly the copyright holders themselves — must proactively enforce GPL. This entity can be an organization, an individual, a group of individuals, a group of organizations, or a mix of all of those. Someone must enforce the rules; so-called “spontaneous compliance” is a myth promulgated by those who oppose copyleft.
I too would like to see the FSF, Conservancy and other Free Software copyright holders do more enforcement actions, but I don't have the revenue stream to back up my desires.
So if you want more enforcement, make copyright holders aware of violations, convince them that enforcement is needed, ensure that they have enough resources to bring enforcement actions and encourage them to pursue legal action, as a last resort.
The relative lack of enforcement actions is down to two things:
The number of Free Software copyright holders that agree that enforcement actions are appropriate. As well as the ostensibly Free Software companies that Conservancy highlights in the essay, there are unfortunately parts of the Linux kernel community that do not agree with enforcement actions.
The human and financial resources that those copyright holders have and their prioritisation of those resources towards enforcement actions. FSF/Conservancy do not have much of either of these and most individual developers probably don't have enough time/money to bring cases.
Posted Jul 4, 2021 0:45 UTC (Sun)
by khim (subscriber, #9252)
[Link] (5 responses)
If that's the case and enforcement doesn't work today, then where the assertion that continuing on that course would bring substantially different results in the future? The whole story about lack of funds for enforcement process is also quite laughable. If music industry can ask for $62,500 for a single downloaded song then why FSF or Conservancy couldn't do the same? Believe me, if you would actually squeeze similar sum from violators you would be able to afford to hire lots of lawyers. Because they want to be perceived as “nice guys”? Well, then just admit that GPL wouldn't work and stop using it. At some point you have to decide what you want to do. Yes, many groups (including GCC and others) want to drop copyright assignments and yes, this would make enforcement much harder, but the rationale is obvious: currently enforcement doesn't really work anyway — so why bother continuing with that circus which is supposed to help it?
Posted Jul 4, 2021 1:00 UTC (Sun)
by pabs (subscriber, #43278)
[Link] (1 responses)
Posted Jul 4, 2021 13:25 UTC (Sun)
by khim (subscriber, #9252)
[Link]
Seriously? Why? Have they actually tried to squeeze money from the copyright violators? Patrick McHardy was quite efficient at doing that — and he only owns a bit of Linux, not that much. FSF owns copyright for everything in some products. Note that, technically speaking, to become “fully compliant” violators have to find and present sources for all versions of all FSF-owned GPL software they have ever shipped. For most of them it's just not possible: they couldn't provide sources because they don't have them and companies which provided binaries no longer exist. For most of them it's still a huge hassle, even if it's technically possible. Paying certain sum for every known violation would just be easier and cheaper for them. And if the number of violations is measured in thousands (which is probably true) then this activity should be able to pay for itself. Technically yes, but many companies which assault torrent users in Germany and elsewhere actually pay for that privilege. With penalties for a single willful copyright violation measured in thousands of dollars that's not very hard. Kinda. With all copyrights passed to FSF copyright enforcement should be easier (that's what article which we are discussing here claims and that's true), but, in turn, FSF becomes the only entity which may do that. If it's still not done, then… why spend so much effort doing the hassle of copyright assignments and everything else?
Posted Jul 5, 2021 0:00 UTC (Mon)
by bkuhn (subscriber, #58642)
[Link] (2 responses)
Conservancy has spent substantial time and resources over the last five years working and considering every possible approach to improve the efficacy of copyleft enforcement. We have some ideas, and we're working to execute on them. The grant from ARDC talked about on our website allowed us to dig in our ideas and get seriously started, but it's just a start. See https://sfconservancy.org/news/2020/oct/01/new-copyleft-s... for more details.
> If music industry can ask for $62,500 for a single downloaded song then why FSF or Conservancy couldn't do the same? Believe me, if you would actually squeeze similar sum from violators you would be able to afford to hire lots of lawyers.
I mean this respectfully, but I must be frank: that's a naïve prima facie analysis. If you'd like to dig deeper, definitely research the questions about statutory and actual damages under copyright law, and you may want to look at the dockets in Conservancy's 2009-era BusyBox cases to understand how this plays out in a “real world” copyright infringement case.
The funding problem for enforcement is huge; doubly so when not only is it hard to fund enforcement (as pabs has talked about in many of his replies in this comment thread), but *also* we have rather aggressive anti-enforcement work being funded to create FUD and political barriers to further enforcement action.
To be frank on another part of this that I've observed from the front lines: The FSF has historically avoided the “hard cases”, seeking to work on easier violations that are quickly resolved and they ignore violation reports (admittedly, that usually come from me personally) where companies are intransigent, which in my view are where the rubber meets the road with GPL. The true value of GPL will historically be judged by whether we were able to succeed in achieving compliance in the cases where violators purposely ignored their GPL obligations for a business advantage. At this point in my personal GPL enforcement career, I am really only interested in those violation cases because those being addressed and resolved will show the GPL has the appropriate power to assure software freedom and rights in cases where companies plot to take them away.
> Patrick McHardy was quite efficient at doing that — and he only owns a bit of Linux, not that much.
First of all, Patrick's “successes” have been grossly exaggerated by those who wish to portray enforcement as a huge threat to FOSS business. The main political use of Patrick's behavior has been to rally companies to oppose enforcement by reputable organizations like Conservancy, so it's in their interest to exaggerate how much money has actually flowed to Patrick. Second, note that Patrick makes absolutely no effort (that I am aware of) to get either injunction or compliance from violators (the two things that help/protect downstream users). What Patrick tries to do is catch small companies in violation, quickly get them to agree to a settlement agreement that creates a regular revenue stream if they continue to not comply, and then he collects regular payments. In other words, because of some weird quirks in the German legal system, he's been able to turn his relatively small amount of Linux copyright holdings into a passive revenue stream from some small companies who will never comply with GPL. (Big companies fought him and court and beat him, so only small companies actually ended up paying him.) I find that abhorrent and corrupt. I'd never recommend a legitimate FOSS organization take that tact, *even if* their stated goal was to roll that money into more useful enforcement. I don't believe the end justify the means.
> in “how many useful lines of source code have we got in the end”?
Rob just had this wrong, and Rob ultimately agreed with me that he (and some Linux upstream developers) had a different goal for the GPL than the GPL's original intent. The GPL is a license chosen by the copyright holders to benefit those downstream. As Wol pointed out, OpenWrt wouldn't exist if not for GPL enforcement. Initially, nothing from OpenWrt went to the upstream projects; now, much does. OpenWrt was downstream of BusyBox, Linux, etc.: their goal was getting the source code working *on their own devices*, which is something that the upstream developers who original chose GPL may or may not care about, but I would hope they care about their users' rights in the end. This essay from my colleague might help on this point: https://sfconservancy.org/blog/2021/mar/25/install-gplv2/
Unrelated, Quick note on some other parts of this thread: in any regime where there is a high degree of corruption, any sort of activist-based extra-governmental legal tool, which is what GPL is, will face a difficult battle. GPL enforcement is possible in the USA and Europe because the levels of corruption is substantially lower (only speaking RELATIVELY here, to be clear) than other places.
Posted Jul 9, 2021 20:38 UTC (Fri)
by ecree (guest, #95790)
[Link] (1 responses)
Each developer doubtless has their own motives, but Linus, at least, has been pretty clear that he chose the GPL for reasons of developer reciprocity, rather than anything about "users' freedoms". See https://yarchive.net/comp/linux/gpl.html#28
And I think history shows that a lot more people care about the 'commons' of open source code than about the 'rights of software users', and that the GPL has been successful precisely because both groups can coöperate under it in a way which furthers both sets of goals. It is churlish of the latter group to now complain about this as it applies to projects which only chose the licence in the first place because of it.
> This essay from my colleague might help on this point: https://sfconservancy.org/blog/2021/mar/25/install-gplv2/
I cannot help but consider the linked essay deeply disingenuous. I think the proverbial 'reasonable man' would consider "the scripts used to control compilation and installation of the executable" to refer to Makefiles, configure.sh, and suchlike; that is, scripts that are a part of the _software Work_, and which have to do with placing the various components of the Work in proper relation to one another so that they may function together as a whole. To suggest that they cover also the relation of the Work to a particular hardware platform, and tools thereof which are not in any meaningful sense a derived work of the Work, is to stretch the licence's influence beyond the normal reach of copyright law. The GPLv2 explicitly places no restrictions on the running of a covered Work, only on its "copying, distribution and modification"; and a hardware product is not a 'literary work' so cannot be a derived work of the Work (rather, it is merely a medium by which object code of the Work is being distributed).
Indeed, the FSF implicitly conceded this by attempting to change it in GPLv3 (the storied "anti-tivoization clause"). No-one at the time suggested that that part of v3 was an attempt to clarify an existing implication of the licence; it was very clear that all concerned saw the clause as a substantive change. Sadly, it appears as though Mr Gingerich is sufficiently disappointed by the limited uptake of the GPLv3 that he is now attempting to retroactively redefine GPLv2 so as to apply that clause to the works of developers who chose to stick with v2.
Posted Jul 9, 2021 23:26 UTC (Fri)
by pabs (subscriber, #43278)
[Link]
https://en.wikipedia.org/wiki/Debian_Free_Software_Guidel... http://people.debian.org/~bap/dfsg-faq.html https://en.wikipedia.org/wiki/Freedom_of_association
Posted Jul 4, 2021 0:59 UTC (Sun)
by khim (subscriber, #9252)
[Link] (12 responses)
If you really want to do that then it's trivial: open the distribution page and look for the links to Yandex.Диск (yadi.sk). There are ISO with modified binutils and gcc - they are needed to cross-compile things for E2k. Of course there are no sources. Would be interesting to see how they explain the refusal to offer these this time, though. Their tune changed over time, but the one thing that remained constant was constant refusal to give anything without NDA (which is not really compatible with GPL, is it?). I'm not really interested with digging up these changes to GCC, I just find it funny when something like that is ignored for years and then, when GCC guys stop asking for copyright assignment, Kuhn starts preaching dangers of the world without them. Sure, FSF wouldn't be able to efficiently assert GPL… but it doesn't do that anyway, so what would change?
Posted Jul 4, 2021 1:34 UTC (Sun)
by pabs (subscriber, #43278)
[Link] (11 responses)
Posted Jul 4, 2021 13:56 UTC (Sun)
by khim (subscriber, #9252)
[Link] (10 responses)
Yes, it but it makes many other things easier. And if copyright is dying anyway (like Rob Landley predicted years ago), then what's the point? What good have we got from these enforcements efforts? Not in a form of “how many companies were brought to compliance”, but in “how many useful lines of source code have we got in the end”? Does it still makes sense to assign copyrights to FSF if ROI is so low? Or maybe it's actually high and we just don't know it? If the latter is true then a bit more publicity about what we have got from these compliance efforts and how that source was actually useful for someone would help. Because we know about lots of cases where potential contributions are rejected because authors don't want to pass copyright to FSF. To offset that issue we, naturally, have to show some goodies which have come from that valuable “enforcement” that FSF is doing. So… where is it? What is it? Why it's not something described in article on LWN?
Posted Jul 4, 2021 15:11 UTC (Sun)
by Wol (subscriber, #4433)
[Link] (9 responses)
The big example is OpenWRT or whatever it's called, and of course ObjectiveC, but they're about the only big ones.
As for money, I believe part of the deal is the company pays the FSF's costs, plus a bit more.
And how much NEW code have we received, from companies in compliance? We'll never know.
At the end of the day, do you want to punish and drive away companies who've been sold an illegal product, or do you want them to become legal and good contributors. I think you need to read "how to win friends and influence people" or whatever the book's called - you seem to care more about brutal enforcement and don't worry about the damage - that German guy you referenced basically turned linux into a toxic dump with his antics.
Cheers,
Posted Jul 4, 2021 20:58 UTC (Sun)
by khim (subscriber, #9252)
[Link] (8 responses)
You've got your answer, you just don't want to accept it: If companies are becoming “legal and good contributors”, but don't bring anything good to the table then what's the point of having them as friends? Decades ago, when free software was novelty and companies often violated copyright out of the ignorance (and when G++ was donated to FSF after similar tuffle, you are seemingly forgot about it) situation was different. But these times are long in the past. Today companies start with knowledge about how copyleft work and they just willingly ignore it. They put their valuable code into separate modules to make sure that even if they would be forced to do what GPL demands — community would get nothing. And that's exactly what happens. What's the point of pulling the punches in an environment like that? Yet somehow Linux is still used by more companies that any other kernel. I think, again, that you know the answer, just refuse to accept it: We will never know and we shouldn't even care. Companies which are developing stuff without playing shady games with sources wouldn't be target of lawsuits, obviously, and, as you have pointed out, companies which are brought to compliance kicking and screaming don't contribute anything valuable.
Posted Jul 4, 2021 22:18 UTC (Sun)
by pizza (subscriber, #46)
[Link] (7 responses)
To quote Matthew Garrett some five years ago: [1]
"[contributions are] what you care about. That's not what your users care about. They care about code *availability*, not contribution. They don't care whether their vendor participates upstream. They just care about being able to fix their shitty broken piece of hardware when the vendor won't ship updates. "
[1] https://lists.linuxfoundation.org/pipermail/ksummit-discu...
Posted Jul 4, 2021 23:01 UTC (Sun)
by khim (subscriber, #9252)
[Link] (6 responses)
Do they get this? From what I'm observing usually even if source is extracted from lazy vendor there are not enough developers to fix anything. And if something is actually developed and is useful then it's not because FSF kicked sources for yet another shitty webcam's firmware, but because someone managed to get sources for the Linux kernel or, quite often, just reverse-engineered binaries. And Linux is, ironically, project which is adamantly against copyright assignments and all other things Kuhn proposes.
Posted Jul 4, 2021 23:41 UTC (Sun)
by pizza (subscriber, #46)
[Link] (5 responses)
With the source code, there is at least a _possibility_ of a "developer" being able to fix something. And for someone actually becoming a "developer" to begin with. Without source code availability, that is frankly never going to happen.
> And if something is actually developed and is useful then it's not because FSF kicked sources for yet another shitty webcam's firmware, but because someone managed to get sources for the Linux kernel or, quite often, just reverse-engineered binaries.
It's useful for folks that actually own those shitty webcams. Isn't empowering users the entire point of this "free software" thing?
Posted Jul 5, 2021 0:14 UTC (Mon)
by khim (subscriber, #9252)
[Link] (4 responses)
Sure. That's interesting theory but how well does it work in practice? It's not 1985th, GPL and it's enforcement happen for more than quarter-century. Again: interesting theory which is thoroughly refuted in practice. Look on popular games and bazillion addons/patches/hacks made by enthusiasts. Most of them don't ever see the source code for the games they are fixing. And while many fixes are trivial (like endless ammunition or the ability to pass through walls) some are quite elaborate (include whole new chapters in some games and new effects and many other such things). Source code, by itself, is not worth much if there are noone who may want to tinker it. Sure. “Free software”, that almost dead movement, is all about “empowering users”. “Open source” software is all about getting contributions back — and if some users get “empowered” as a result then it's nice side benefit. RMS wrote large essay on subject… and it's as correct today as it was when he wrote it. With one caveat: when RMS wrote that essay significant percentage of GNU software developers were actually attracted to “free software” and the idea of “empowering users”. Today… they are tiny minority. Most developers (me including) are very firmly in the “open source” camp. I don't really care about getting some source dumps which noone wants or needs. It I can get something to improve my code… that is something which I value, sure. “Free software” guys are not my enemies and if their efforts don't make my life worse then I can, probably, help. But if all these copyright assignments and enforcement wouldn't help me, then I'm not sure why I should bother. That's the stance of majority of developers out there. If FSF can not accept that and can not adapt to that situation then it would just slowly but surely become irrelevant. Developers would move on and it would just remain a footnote on the Wikipedia.
Posted Jul 5, 2021 0:16 UTC (Mon)
by pabs (subscriber, #43278)
[Link]
Posted Jul 5, 2021 0:29 UTC (Mon)
by pizza (subscriber, #46)
[Link] (2 responses)
If you don't care, then respectfuly, STFU and don't belittle the efforts of those who do care.
> I don't really care about getting some source dumps which noone wants or needs. It I can get something to improve my code… that is something which I value, sure.
Just because *you* do not care does not mean that folks using the derivatives of your code don't.
Posted Jul 5, 2021 15:03 UTC (Mon)
by Wol (subscriber, #4433)
[Link] (1 responses)
> If you don't care, then respectfuly, STFU and don't belittle the efforts of those who do care.
Agreed.
> > I don't really care about getting some source dumps which noone wants or needs. It I can get something to improve my code… that is something which I value, sure.
> Just because *you* do not care does not mean that folks using the derivatives of your code don't.
And again, agreed.
Times have moved on. Back then there was little difference between developers and users. RMS's printer story is an excellent example - he was both. Nowadays, the problem with the Free Software crowd is they don't seem to have realised that developers and users are two almost separate sets. That difference should be RESPECTED, not, as here, where developers seem to be abusing users for not understanding the freedom they are being given.
It's like that American quote I hate about sacrificing freedom for security. Freedom has a cost, and that cost isn't always worth paying. For *today's users*, the cost of code freedom often isn't worth paying, and that needs to be respected.
Cheers,
Posted Jul 6, 2021 14:25 UTC (Tue)
by pizza (subscriber, #46)
[Link]
The entire point of the Free Software crowd's "complete corresponding source code" principle is to ensure "users" don't have to rely on specific "developers" -- with the source code, users can become developers themselves, or choose different developers instead. Without the source code (and the legal right to utilize it)Developers are users too... you'll forever be dependent on that original developer.
Sure, most users might as well be on a different planet when it comes to being able to do something with the source code, but.. so what? The same could be said about pretty much any other specialization in society. Should we also dismiss the plights of farmers because we get our food from supermarkets?
Meanwhile, the only disrespect evident in this discussion has been one set of developers abusing another set of developers for being idealistic, non-pragmatic, and/or naive for believing in "user freedom" because it doesn't result in short-term gains for the original developer (and/or their codebase)
> It's like that American quote I hate about sacrificing freedom for security. Freedom has a cost, and that cost isn't always worth paying. For *today's users*, the cost of code freedom often isn't worth paying, and that needs to be respected.
In this analogy, who is (not) paying what cost, for whose freedom?
Posted Jul 4, 2021 0:49 UTC (Sun)
by ilammy (subscriber, #145312)
[Link]
Just as OP said, legal enforcement is done within a legal framework of a certain country, so FSF being a U.S. company does not really have a strong say in copyright matters in countries other that U.S., without having a local subsidiary.
This whole thing with U.S. copyrights being “scary” is based on the assumption that companies would be afraid to violate them if they want access to this juicy U.S. market, with its customers and investments, without risking costly legal action in U.S. But if a company does not care about that market, they can just do whatever and you can’t do anything about it, except for kicking them out of U.S. market if they do enter there. I don’t know what it would take to turn a license violation into a political incident so that it leads to more than that.
P.S. It seems you have forgot to close your <b> tag, and now the rest of the page is too bold :)
Posted Jul 15, 2021 22:25 UTC (Thu)
by mrugiero (guest, #153040)
[Link]
Posted Jul 2, 2021 13:13 UTC (Fri)
by ecree (guest, #95790)
[Link] (1 responses)
It really wouldn't; that would open a can of worms that the FSF desperately wants to keep shut. See https://lore.kernel.org/lkml/20031206153845.GA8552@thunk....
Posted Jul 2, 2021 13:42 UTC (Fri)
by khim (subscriber, #9252)
[Link]
I was not even proposing to open that particular can of worms. Just some small fringe GPL library which would be made permanently (well… forever less one day, of course) unavailable to
“serial violator” (some company which very explicitly says they wouldn't provide sources and have no plan to provide sources ever… like Elbrus Linux). Readline is not available to you, please stop distributing it since you no longer have the rights, thanks. How would you distribute Bash or other programs which expect to be linked with GPL is your choice. Just remember that one day you may lose rights to distribute them, too. If that will actually happen then I would even understand why I would want to assign copyright to FSF: to make sure violator couldn't muddy the water and claim that FSF have no right to speak for other copyright holders. But with the state of compliance enforcement as it is now… where it's obviously cheaper for any violator to ignore the GPL initially and only start thinking about it when FSF contacts them… what's the point of all that farce?
Posted Jul 5, 2021 20:19 UTC (Mon)
by mtaht (subscriber, #11087)
[Link] (4 responses)
Posted Jul 6, 2021 8:21 UTC (Tue)
by geert (subscriber, #98403)
[Link] (3 responses)
Posted Jul 7, 2021 2:10 UTC (Wed)
by pabs (subscriber, #43278)
[Link] (2 responses)
https://mjg59.livejournal.com/126865.html?nojs=1
Posted Jul 7, 2021 11:28 UTC (Wed)
by nye (subscriber, #51576)
[Link] (1 responses)
Posted Jul 8, 2021 0:28 UTC (Thu)
by pabs (subscriber, #43278)
[Link]
https://mjg59.livejournal.com/129815.html?nojs=1
It seems it worked out in the end, from the last link: "so while things may have taken a little longer than I'd have liked I think everything has worked out for the best".
Posted Jul 1, 2021 21:20 UTC (Thu)
by tchernobog (guest, #73595)
[Link] (1 responses)
Posted Jul 2, 2021 0:30 UTC (Fri)
by pabs (subscriber, #43278)
[Link]
https://sfconservancy.org/copyleft-compliance/#debian
IIRC there is also the option of people retaining their copyrights but agreeing to delegate enforcement to Conservancy.
Posted Jul 1, 2021 21:51 UTC (Thu)
by scientes (guest, #83068)
[Link] (18 responses)
Kuhn is not discussing the reasons for this, which is that the USA, unlike Europe, had always been a business-run enterprise, and this concept that your employer always owns your copyrights *by default* is almost as stupid as the butt-crack idea that healthcare should be linked to your employeer.
But as long as that sulfuric corrosion of personality stands then his point is valid: it would be preferable that organizations with a clear definition, rather than centered around the massive lie that is the stock market, hold the copyrights.
Posted Jul 1, 2021 22:26 UTC (Thu)
by dvdeug (guest, #10998)
[Link] (10 responses)
Posted Jul 2, 2021 2:14 UTC (Fri)
by mpr22 (subscriber, #60784)
[Link]
(Small point of order: while certainly not part of the proletariat in the conventional sense, the educated salariat are not, generally speaking, part of the petite bourgeoisie :)
Posted Jul 2, 2021 9:04 UTC (Fri)
by oldtomas (guest, #72579)
[Link] (8 responses)
Kind of makes sense. OTOH, in the US, there seems to be enough contractual leeway for companies to claim the fruits of your free time's labour. They pretend to own *you* (old traditions, perhaps?), and seem, contractually, to get away with it (most of the time? some of the time? I don't know exactly).
It's... complicated. For some random sample:
Posted Jul 3, 2021 0:13 UTC (Sat)
by NYKevin (subscriber, #129325)
[Link] (7 responses)
More pragmatically, software engineering is a creative industry, and it is impractical to force a creative person to always and only think about work during working hours. If a SWE comes up with some clever new idea in their free time, and that idea is reasonably related to the employer's business, then the employer has a reasonable expectation that they get to own the resulting patent.** It would be quite silly if the employee could patent the idea in their own name, and then turn around and try to sell it to their own employer (or worse, a competitor). It's not that great a leap to "what if the employee actually writes working code in addition to thinking of an idea?" - and then you get all-hours copyright assignment, for precisely the same set of reasons.***
The real problem**** here is that "reasonably related to the employer's business" is a very blurry line. IMHO employers should be expected to explicitly lay out with exhaustive clarity the exact set of things that they consider to be "related" to their business. My own employer, Google, has the unfortunate-in-this-context property of having numerous unrelated lines of business, any one of which might potentially want to own any of the code I write. As it happens, Google does have processes for dealing with issues that arise here, but this should really be an industry standard or law, not something that each company figures out by itself on an ad-hoc basis.
With regards to open source, IMHO the question of whether an employer should be allowed to own an open source contribution is heavily context-dependent; if your employer is specifically paying you to write Linux (kernel) code, then that's a very different thing from the case where you write Linux code in your spare time, and your employer retrospectively decides to own it.
* Ideally, if this "extra work" is a real job requirement, you should get some kind of on-call compensation or the equivalent. This varies dramatically by company.
Posted Jul 3, 2021 0:43 UTC (Sat)
by pizza (subscriber, #46)
[Link]
*every* employer I've worked for in the past twenty years (save one) has had an "we own everything copyrightable you create during the period of your employment" clause. The last one relented when I made it clear I would explicitly be notifying them of (and requesting a formal release for) *every* *single* email/sms/IM, forum comment, photo/video, napkin doodle, etc etc I created that was not within the scope of my employment.
> IMHO employers should be expected to explicitly lay out with exhaustive clarity the exact set of things that they consider to be "related" to their business.
As you pointed out that's often not practical, especially for larger organizations, but one process I've seen that is reasonably effective is declaring up front what F/OSS projects you are materially active in, and it's on them to object up front, with mutual notification if something changes.
Posted Jul 3, 2021 2:25 UTC (Sat)
by mathstuf (subscriber, #69389)
[Link] (3 responses)
Hey, not everyone is salaried in the US; I'm hourly. Still exempt, so there's no overtime multiplier, but we track hours pretty explicitly. We also don't have ridiculous stock options though…but we are employee-owned now which I find a way better option than offering up to rabid honey badgers playing in the stock market.
> then the employer has a reasonable expectation that they get to own the resulting patent
What if the employee files it as prior art to the USPTO nullifying any attempt to patent it? I forget the official name for it, but it basically publishes into the database that patent office reviewers have to search within when reviewing applications.
Posted Jul 3, 2021 6:08 UTC (Sat)
by Cyberax (✭ supporter ✭, #52523)
[Link]
Posted Jul 3, 2021 22:12 UTC (Sat)
by NYKevin (subscriber, #129325)
[Link] (1 responses)
That is illegal (in the US). The Fair Labor Standards Act says that an exempt employee must be paid "on a salary basis" to qualify for the exemption. It is possible to give the employee a fixed weekly amount and *supplement* that with *additional* hourly pay, but that fixed amount must be high enough to qualify as a "salary" under the FLSA all by itself.
In other words, one of the following is legally required to be the case:
1. You are paid a salary, and not hourly.
There is simply no such thing as an hourly-exempt employee in the US.
Posted Jul 4, 2021 0:28 UTC (Sun)
by mathstuf (subscriber, #69389)
[Link]
> The employee must be compensated either on a salary or fee basis (as defined in the regulations) at a rate not less than $684* per week or, if compensated on an hourly basis, at a rate not less than $27.63 an hour;
[1]https://www.dol.gov/agencies/whd/fact-sheets/17a-overtime
Posted Jul 3, 2021 9:29 UTC (Sat)
by mjg59 (subscriber, #23239)
[Link]
During my time at Google, as an employee in California, I wrote (on my own time, on my own hardware) a Linux driver for the CD drive in the Commodore CDTV - a device that was last manufactured in 1991, by a company that went out of business in 1994. Google, a company founded in 1998 (and who has, to the best of my knowledge, never shown any business interest in the Commodore CDTV), asserted that this driver was related to their business. In this case I don't think the problem is that the company has numerous unrelated lines of business, I think it's that they feel entitled to assert that all software falls within their claims.
Posted Jul 9, 2021 19:39 UTC (Fri)
by ecree (guest, #95790)
[Link]
The sad part is that there is (imnsho) a much more equitable _and_ judicable line that those contracts could use instead: "in the course of your employment". That is to say, if I'm working on some piece of code in order to meet a specific objective given to me by my management chain (e.g. boss says "make our new hardware work on Linux" and I decide to add a feature to kernel subsystem XYZ in pursuit of that), then that's work-for-hire. Whereas if I have an idea that doesn't relate to any of the stuff I'm working on, even if it happens to overlap with another part of the employer's business that I'm not involved in, I don't see why the employer should reasonably expect to have any claim on that idea at all, except inasmuch as it may derive from company-internal know-how to which I may have been exposed.
My usual example of this is: I work for an FPGA company, but as a network driver developer. I have almost no contact with the people who work on, say, Place-And-Route algorithms, and I've not seen any of their code, or technical papers, or patent submissions. So if tonight while lying awake in bed I suddenly have a brilliant idea of how to make a better PAR, I think that is a fundamentally different situation from if I have an idea about network device queue allocation.
Of course there are still grey areas — a good SWE doesn't require detailed direction from management, so they could just be told "work on stuff you think will be beneficial to the business" in which case "reasonably related" comes back in by the back door. But in practice managers don't let us on _quite_ that loose a leash, so it's usually possible to distinguish between work and non-work. (If you're telling your boss at the team stand-up "I wrote a patch to $foo to make it betterer" so that it doesn't look like you've accomplished nothing all week, then even if that was on your own initiative without the boss asking for it, $foo is probably 'work' ;-)
Posted Jul 1, 2021 22:43 UTC (Thu)
by bkuhn (subscriber, #58642)
[Link] (2 responses)
I had a footnote drafted that addressed the USA vs. European issue specifically, but as LWN pointed out, the missive was already lengthy and I didn't want to make it longer. TL;DR on that point, IANAL and TINLA and Conservancy's isn't a law firm, but from my understanding from many conversations with European lawyers: (a) highly typical that in most European countries that your employer gets an exclusive explotative rights in their employee's copyrights in most situations (i.e., for the exploitative right, the situation isn't all that different from the USA) (b) employees *do* keep their moral rights in the copyright but (c) no is really sure how exactly to enforce the GPL on moral rights alone. If a European lawyer wants to verify those details for me and response, that would be appreciated of course.
But I agree with you that the system is broken, and the USA is largely to blame as we've exported so much of our bad copyright system around the world. But, I had nothing to do with it other than being born here, so I apologize for my country and assure you I've never voted for any candidates who were involved with such policies. Conservancy, as mentioned, works on the Contract Patch project to try to assist people in fighting this system.
Posted Jul 2, 2021 2:57 UTC (Fri)
by clugstj (subscriber, #4020)
[Link] (1 responses)
Then you've never voted for any candidate!
Posted Jul 2, 2021 13:29 UTC (Fri)
by bkuhn (subscriber, #58642)
[Link]
… not a major party candidate for federal office, anyway. (Please note that any political views are my own and not necessarily the views of my employer.)
Posted Jul 2, 2021 10:23 UTC (Fri)
by pgeorgi (guest, #74838)
[Link] (3 responses)
Since Europe doesn't have a single unified copyright law I'll take German copyright law because I'm most familiar with that (but IANAL): https://www.gesetze-im-internet.de/englisch_urhg/englisch... (non-binding english translation):
§69a UrhG specifically disclaims all the "regular" remuneration rules once software is involved.
§69b UrhG is a specific rule on software to disenfranchise employed software authors unlike any other author: You draw the blueprints of a building as employee or on commission: Your copyright. You write software in the same circumstances: Their copyright.
This doesn't extend to work done in your spare time[0], and it doesn't touch on moral rights[1], but "USA bad, Europe reasonable" seems a bit of a short cut...
[0] Although there are provisions that employees must offer their spare time inventions to their employer first and can only exploit them themselves once the employer rejected the offer, so there's some overreach here, too. (ArbnErfG §18-§19, https://www.gesetze-im-internet.de/arbnerfg/BJNR007560957..., doesn't seem to have an english translation). Given the BPMA's (German patent office) and especially EPO's (European patent office) habit of trying to extend patentability by simply handing out patents on whatever people send in, that might create issues for spare time programming down the road...
[1] I've seen attempts to reject the idea of moral rights on software altogether, using §69a UrhG to reason: "No other criteria, especially qualitative or aesthetic criteria, shall be applied to determine its [the software's] eligibility for protection", and therefore if there's no impression of the author's self on the work, there's no ground for protecting the author's moral standing.
Posted Jul 2, 2021 12:06 UTC (Fri)
by kleptog (subscriber, #1183)
[Link] (1 responses)
I think this is where the major difference is. Employment contracts here in NL tend to include clauses stating that they own your work-product. The thing is that what you do in your free-time is simply out of scope of your employment contract. They're not paying you for your free-time. This extends to other things, like whether they can call you when stuff breaks, etc, etc...
Now, of course it gets fuzzy if you start writing products in your spare time which are direct extensions to what you're doing at your work. But that's more trade-secret related than anything else. If you're building accounting software at your day-job and write computer games at night, your employer is going to have a very hard time claiming that. They might complain that you're spending so much time on it that it's impacting your day job though.
Now the US is its own patchwork of laws, but my impression is that employment contracts are much more intrusive there.
Posted Jul 3, 2021 10:00 UTC (Sat)
by nilsmeyer (guest, #122604)
[Link]
> I think this is where the major difference is. Employment contracts here in NL tend to include clauses stating that they own your work-product. The thing is that what you do in your free-time is simply out of scope of your employment contract. They're not paying you for your free-time. This extends to other things, like whether they can call you when stuff breaks, etc, etc...
I would think that if the employer claims ownership of any work you performed in your spare time with your own resources they would at least have to pay you and likely run afoul of labor laws like the maximum number of hours worked.
> Now the US is its own patchwork of laws, but my impression is that employment contracts are much more intrusive there.
A more charitable reading would be that the parties have a lot more freedom in how they set up their contracts. Corporations often act like they are the party with more negotiation power, very often though that's just posturing.
Posted Jul 4, 2021 14:56 UTC (Sun)
by tzafrir (subscriber, #11501)
[Link]
Posted Jul 2, 2021 0:03 UTC (Fri)
by Cyberax (✭ supporter ✭, #52523)
[Link]
I honestly can remember only DD-WRT firmware as the best known success. I can't remember anything else that is similar to that in scope.
Meanwhile, dealing with the the CLA is a major PITA for contributors.
Posted Jul 2, 2021 0:33 UTC (Fri)
by pabs (subscriber, #43278)
[Link]
Posted Jul 2, 2021 10:23 UTC (Fri)
by bluca (subscriber, #118303)
[Link]
Speaking as someone currently in the middle of such bureaucratic nightmare, I can't really help but tend toward the "get rid of this" side.
Posted Jul 2, 2021 10:35 UTC (Fri)
by bredelings (subscriber, #53082)
[Link] (6 responses)
I guess this is another example of fallout from the same system where employment contracts include forced arbitration and non-disparagement agreements. For non-FOSS projects, maybe employer-owned copyrights are fine, but for FOSS projects, it seems ... problematic.
Assuming that the developer DOES retain copyright, somehow, is it possible to have the conservancy or FSF fight copyright infringement on your behalf without giving them the copyright?
Posted Jul 2, 2021 12:23 UTC (Fri)
by ms-tg (subscriber, #89231)
[Link] (4 responses)
I’m surprised at the “somehow” above. I had been under the impression that retaining individual copyright to open-source contributions is as simple as obtaining a signed form letter from the employer’s legal dept disclaiming ownership of individuals contributions to the project (e.g. gcc)?
I must be mistaken, but I had also thought that this was often covered by Developer Certificates of Origin?
Asking large companies such as IBM and Google for blanket disclaiming of employee GPL contributions to specific projects would be even easier to manage, would it not? Or is that naive?
Posted Jul 3, 2021 0:40 UTC (Sat)
by josh (subscriber, #17465)
[Link] (1 responses)
That's not even remotely simple, in most cases.
Posted Jul 4, 2021 19:20 UTC (Sun)
by NYKevin (subscriber, #129325)
[Link]
Posted Jul 6, 2021 20:21 UTC (Tue)
by bfields (subscriber, #19510)
[Link] (1 responses)
See https://en.wikipedia.org/wiki/Developer_Certificate_of_Or...
The DCO is compatible with the (common) case where your employer holds copyright in the code you wrote, but your employer gives you permission to contribute it under the GPL.
Posted Jul 8, 2021 11:10 UTC (Thu)
by kpfleming (subscriber, #23250)
[Link]
Posted Jul 2, 2021 12:29 UTC (Fri)
by pabs (subscriber, #43278)
[Link]
Yes, they have a standard agreement for that, it is available at minimum to Linux and Debian folks, search for "enforcement agreement" here:
Posted Jul 2, 2021 13:08 UTC (Fri)
by ecree (guest, #95790)
[Link] (4 responses)
Just as I would never* sign over the rights on my free-time code to my employer, so I would not contribute my own code to a project that insists on a copyright assignment; that betrays a deep lack of faith in the GPL itself, and in fact potentially harms the GPL's sustainability in court: https://web.archive.org/web/20210420181853/http://esr.ibi...
If the infringing distribution includes code you wrote on your own time or a derived work thereof, then you have standing to bring a GPL enforcement case. If it doesn't contain code you wrote, then it's none of your business whether the people who did write it want to enforce the licence or not, and to complain about that is to express a desire to become a parasite. One hopes that the FSF have higher goals than parasitically using others' code to push their politics.
There is, for instance, no danger that your rights over your (personal) contributions to a GPLed project will be annulled by another contributor declining to enforce. Either their contributions were a derivative work of yours, in which case any distribution thereof is subject to your original licence grant (see e.g. §6 of the GPLv2) and thus you have legal standing to enforce; or their contributions were _not_ derivative of yours, in which case you have neither legal _nor moral_ standing to do anything more than whine on your blog about how not everyone in the world is willing to expend their own resources towards the advancement of your personal and particular goals.
And if you wrote the code at work, and were paid for it, then most likely part of what you were paid for was the right to determine how that code may be used (subject to preëxisting constraints such as the licence on any upstream code of which the code you wrote was derivative), and if you think the amount you were paid wasn't enough to buy that right, then go to your boss and demand a raise (or an alteration to your contract, I guess. Personally, the rights over copylefted code I produce at work aren't worth as much to me as they are to my employer, so I'm happy to take the money and run; ymmv).
In summary: Bradley is cross that major & successful open-source projects are unwilling to let themselves be used as weapons in the FSF's moral crusade — which is reason enough not to assign your copyrights to the FSF.
* FWIW, I did find some ContractPatch resources useful when $dayjob tried to get me to sign a new contract with just such an over-broad IP grant (it took 18 months of wrangling but I won). So I don't want to give the impression that I hate Bradley or the Conservancy; they do a lot of good work, they're just dead wrong on this particular point.
Posted Jul 2, 2021 13:36 UTC (Fri)
by bkuhn (subscriber, #58642)
[Link] (3 responses)
I said nothing of the sort! My main point, which many on this thread have pointed out, is that developers who write the software should make the decision for themselves, and that giving the fruits of their FOSS labor over to their employers is in my view *worse* than giving it over to a charity that works for the public good.
If the above is your summary conclusion of what I wrote, then you didn't read carefully my original essay and my comments here. I realize both were quite lengthy. They're lengthy *because* there is a tremendous amount of nuance on this issue. Reducing it to “copyright assignment BAD” or “copyright assignment GOOD” ignores the complexity of the issue.
Posted Jul 2, 2021 13:54 UTC (Fri)
by ecree (guest, #95790)
[Link] (2 responses)
Sorry, that was uncharitable of me. Cynical snark is just so _fun_ to write that it's hard to resist sometimes. Which is a shame, since it seems to have distracted from my substantive and rather more nuanced point, which is that enforcement rights correctly follow derivative works and therefore the existence of bigcorp ownership of someone else's contribution in no way impacts your ability to protect the freedom of *yours* and all that derives from it.
> giving the fruits of their FOSS labor over to their employers
Yes, that would be bad. Selling those fruits as part of an exchange of value where it is their considered intention to do so, however, is fine.
Posted Jul 3, 2021 17:53 UTC (Sat)
by bredelings (subscriber, #53082)
[Link] (1 responses)
Hmm... not completely sure if I agree... But in any case, it seems like the question is partly about whether there is, in fact, "considered intention to do so".
You have said that it took you 18 months of arguing to avoid signing a new contract that would give them copyright over your "free-time code". Since not everyone would put in 18 months of legal argument to avoid this, it sounds to me like many programmers would end up giving in to their employer WITHOUT "considered intention to do so".
Even more problematic, though, is what happens when someone who is a volunteer contributor to, say, glibc gets a job offer at Red Hat/IBM. Is your point that, since such future contributions to glibc would no longer be "free-time code", the the employer has a moral right to the copyright?
In practice, it might take even more than 18 months of legal arguing for the volunteer-turned-contributor to retain the copyright, not because they have a "considered intention" to give the copyright to their employer, but because it is hard to fight employer-friendly aspects of employment contracts.
Posted Jul 5, 2021 12:05 UTC (Mon)
by ecree (guest, #95790)
[Link]
Ahh now this is where I'm a firm believer in the principle of revealed preference. If someone signs a contract in full knowledge of what it contains, not under duress, then we have to assume that it was their considered intention to accept the exchange as a whole. We can try to convince people that such an exchange is worse than it looks, or (by helping them to negotiate) reduce the costs associated with altering it, but we should be careful not to deny them agency.
> Is your point that, since such future contributions to glibc would no longer be "free-time code", the the employer has a moral right to the copyright?
My point is that there are two possible arrangements in that case; one where IBM pays them $X to "just keep doing what you're doing, under your own copyright", and another where it pays them $Y (where Y >> X) to "do similar work but as a work-for-hire". As long as it's clear upfront which one they're offering, both cases are morally valid; it's up to the parties involved to decide on their own valuations for X and Y, and to converge on whichever solution maximises their joint value.
Moreover, if we live in a world where Y is frequently picked, then the effect of requiring copyright assignment for glibc contributions would be to reduce the funding available to glibc developers and thus the quantity and quality of work done on the project. And all for an extremely nebulous benefit: the developer, having retained the copyright of his previous volunteer contributions, would (absent copyright assignment) still have standing to bring GPL enforcement cases over the project regardless of the copyright status of later contributions. Whereas under copyright assignment, only the FSF would have that standing, which regardless of the FSF's probity and integrity is an undesirable concentration of power and responsibility on general principles.
Posted Jul 2, 2021 14:04 UTC (Fri)
by karim (subscriber, #114)
[Link]
Posted Jul 2, 2021 15:27 UTC (Fri)
by Karellen (subscriber, #67644)
[Link] (3 responses)
I think a part of the problem is the large numbers of non-charitable entities with non-copyleft projects who want copyright assignments so that they can re-license your work under their own terms and collect all the benefits. Contributors should express disgust and annoyance at pressure from those projects to relinquish their rights. Moreover, because there are a lot of commercial entities with this development model who will elicit this response, and because most small FOSS projects don't request assignments, and because most large FOSS projects started out as small FOSS projects which don't request assignments, the majority of requests for copyright assignment come from these types of entities. Because of that, the response of being disgusted and annoyed at a copyright assignment request becomes Pavlovian. FOSS developers learn to distrust those requests, because 99% of the time that's the correct response. So when the FSF asks for a copyright assignment, something feels off. And, as you point out, there's the complexity and annoyance of the paperwork. Even if that complexity and annoyance is small, it's real and non-zero. But also, it can be used as a rationalisation for that disgust and annoyance that the contributor is instinctively feeling from the history of assignment requests that they've been subjected to before. I think that's why it's more of an uphill battle than it probably should be.
Posted Jul 5, 2021 4:46 UTC (Mon)
by developer122 (guest, #152928)
[Link] (1 responses)
Suddenly assigning all the rights to every open source project to a single entity doesn't seem like such a bright idea.
Posted Jul 13, 2021 19:00 UTC (Tue)
by mstone_ (subscriber, #66309)
[Link]
I just realized that when we first started arguing about the GFDL the FSF was 14 years old, and that was more than 20 years ago.
Posted Jul 8, 2021 11:21 UTC (Thu)
by kpfleming (subscriber, #23250)
[Link]
All the rest, including the open-source-in-name-only projects (run by for-profit companies) mentioned here, require broad CLAs which grant licenses, but do not assign copyrights. The terms of those CLAs may be so broad as to grant the recipient permission to do nearly anything they wish with the contributions, but that does *not* include copyright ownership, and the licenses are never exclusive (which I believe based on comments from lawyer friends is an intentional choice in order to avoid some pitfalls in US law).
CLAs are their own special hell, and we should revise Dante's 'Inferno' to include them, but *at least* they do not assign copyrights, and the creators of the code in question are still free to make use of it as they wish.
Kuhn: It Matters Who Owns Your Copylefted Copyrights
That's fair, but this line from Bradley's post is relevant:
Kuhn: It Matters Who Owns Your Copylefted Copyrights
if I have to chose between the strict dichotomy of: (a) copyrights held by the FSF (which has the possibility of recovery in the future and restoration to an organization that actively enforces the GPL) vs. (b) copyrights held by companies — many of whom are known to oppose enforcement of the GPL, I would still pick the FSF
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
we've reached the moment where “strict confidentiality” for GPL violators as
part of the Principles of Community-Oriented GPL Enforcement should be
reconsidered. As recently as a few years ago, a threat to publicly criticize
a company for violating GPL was leverage to get quicker compliance, but I
admit that I haven't seen that work in a few years. I'll start a thread on
the Principles mailing list about this issue next week.
it's true), I only recently (like, two months ago recent) learned that GCC
and glibc developers were not aware of how common violations on their
software is. I guess that I'd just assumed someone else was keeping them
briefed on that? Anyway, I am totally willing myself to talk to any
developer a major GPL'd codebase to discuss what I know about violations on
their code. While I still don't support any organization making the entire
database of all known GPL violations public, I do think folks who write the
code deserve to know if they want to.
not actually arguing strongly for any specific approach for GCC and glibc to
take. What I believe is that these decisions are being taken far too
quickly, and the most important issue about copyrights in copylefted software
— where the power to enforce lands, and whether that enforcement will be
improved or reduced due to the change — is just not being discussed! What
I'd like to see next is actual engagement on this question. While I get
nathan's point that developers didn't have full information and JoeBuck's
point that there is a loss of trust in the existing system, but in my mind
that simply means a bigger discussion about what the copyright can do for
software freedom of GCC's and glibc's users and how the plans should be
structured to assure that ought to be the center of the discussion.
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
FWIW, they didn't do it out of greed or anything, it just wasn't worth it because the application was to niche and the clients non-technical: the modified code wouldn't have been of any use to anyone outside the company.
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
https://sfconservancy.org/copyleft-compliance/principles....
> the promise to apply the GPLv3 termination/cure provisions for GPLv2 projects would preclude that action
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
> Under the principles, I would expect FSF/Conservancy to always reinstate permissions, either via (b) or via explicit reinstatement.
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Wol
> If a company says "up yours!", then they deserve all they get, and their GPL licence will be revoked - by their own actions!
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
> Under the principles, companies that have their violation pointed out and then refuse to come back into compliance will be the target of legal action, as a last resort.
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
> The human and financial resources that those copyright holders have and their prioritisation of those resources towards enforcement actions. FSF/Conservancy do not have much of either of these and most individual developers probably don't have enough time/money to bring cases.
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
> but FSF/Conservancy rely on donations in order to do enforcement actions,
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
(cf: the quote from Matthew Garrett being quoted downthread here.)
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
> The usual standard of evidence is that a person who was able to receive the binaries, tried to receive the complete corresponding source, build and install it but was not able to do so.
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
> Preventing enforcement actions or making them less likely just puts a larger barrier in front of enforcement actions.
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Wol
> At the end of the day, do you want to punish and drive away companies who've been sold an illegal product, or do you want them to become legal and good contributors.
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
> "[contributions are] what you care about. That's not what your users care about…They just care about being able to fix their shitty broken piece of hardware when the vendor won't ship updates.
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
> With the source code, there is at least a _possibility_ of a "developer" being able to fix something.
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Wol
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
So can we convince customs to confiscate them when entering the country, like they do with counterfeit goods?
</evil grin>
Kuhn: It Matters Who Owns Your Copylefted Copyrights
https://mjg59.livejournal.com/124426.html?nojs=1
https://lwn.net/Articles/404450/
https://lwn.net/Articles/397411/
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
https://mjg59.livejournal.com/130174.html?nojs=1
https://mjg59.livejournal.com/130815.html?nojs=1
https://mjg59.livejournal.com/132810.html?nojs=1
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
** Personally, I believe that software should not be patentable in the first place. But that's an entirely separate discussion.
*** Therefore, the question of "should software be patentable?" is irrelevant to this discussion. But I can pretty much guarantee that at least one commenter will respond to it anyway...
**** If any company is actually claiming to own the copyright to all code, without regard to whether it is related to their business, then that would also be a problem. But I'm not aware of any company actually making such a claim. In my experience, there is nearly always some kind of "related to the business" carve-out.
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
"Defensive publication"
Kuhn: It Matters Who Owns Your Copylefted Copyrights
2. You are paid a salary, and also hourly on top of the salary.
3. You are paid overtime.
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
>
> Yes, that would be bad. Selling those fruits as part of an exchange of value where it is their considered intention to do so, however, is fine.
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
commonly, contributors express disgust or annoyance at the pressure from the project to give away something that should be rightfully theirs.
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights
Kuhn: It Matters Who Owns Your Copylefted Copyrights