Contribution Agreement Discussion

[oz-linden]

A couple of weeks ago, I posted a Desura news item on the direction we at Desura and Linden Lab would like to take with the Desurium project. In addition to adding development resources and infrastructure support, we'd like to change the distribution license for the project from GPLv3 to the LGPL (version 2.1), which we use now for the Second Life Viewer. This will allow Desurium components to be easily integrated into games, whether open source or not, to provide Desura-based features and services.

In order to make that change, and to clarify the status of both past and future contributions, we would like to introduce a new agreement to be executed by all contributors (Desura has always had a contribution agreement, but not everyone signed it).

We have a draft of that agreement; this issue will serve as a forum for comments and questions about that draft.

I think this agreement is an improvement on both the previous Desura and Second Life contribution agreements (our ambition is to arrive at one agreement for all our open source projects). It already incorporates changes from those earlier agreements inspired by discussions we've had with contributors. It protects the intellectual property rights of the contributors, while empowering the project to go forward and enabling Linden Lab to enforce the terms of the project license. It ensures that the project will remain firmly open source.

A couple of points of clarification I can make preemptively: the agreement refers to "the license(s) which Linden Lab is using for the Work as of the date of this CLA (as reflected below)".

• For the purposes of this discussion, the license we mean is the LGPLv2.1
• The parenthetical comment refers to the date the agreement is signed; it is not a forward reference to some license found below.

There are, alas, a couple of caveats that I have to include in this call for discussion:

1. I will try to clarify where I can, but lawyer-ese is what it is (and that is not always the same as conversational English); the agreement (as it says) is the entire agreement, so what I or any other Linden Lab employee posts here is not a part of the agreement.
2. I am not a lawyer, and most specifically I am not your lawyer; if you want a legal opinion of what the agreement means to you, you should pay a lawyer to get one.

That having been said, I think that all of us have the best interests of the project at heart, and want to see it get better and continue as open source.

[Jookia]

I don't think I can sign that agreement. I'd feel much more comfortable if there was no CA, or if there were, to be something reputable like Project Harmony with licensing. Also, could we get the complete set of changes? '4th draft' is a bit ambiguous seeing as I've only seen one draft besides this?

[oz-linden]

Well, I'm sorry to hear that's the way you feel, Jookia. I hope that you change your mind because it would be shame not to have you continue to contribute.

I don't know how to be more clear... there is going to be a CA. There's nothing unreputable about what we've done - I have not tried, but I'd be willing to bet that I could put together substantially similar using the choices from the Harmony project.

As for seeing the earlier drafts.. even I didn't see one and two, and I can't imagine what you might see in them that would make any difference. Besides, this was developed primarily by combining the Second Life and Desura agreements, and you can see both of those. The previous version of the Second Life agreement is at this wiki page. I don't have an unexecuted copy of the Desura agreement ... perhaps lodle can find one on Monday.

[Jookia]

I have an unexecuted copy of the Desura agreement if you'd like me to post it. As for a CA, all that you want to accomplish could be done using a project harmony license rather than copyright assignment. This is how shops like Canonical can do. Their agreements are much easier to read and have been mulled over by others. That, in combination with a license such as the MPL will allow you exactly what you want.

Edit: You'd be doing the FOSS community a favour by pushing such technologies.

[oz-linden]

It's not my place to tell the lawyers how to do their job - if they think that it's better for us to write a custom agreement, then that's what we do. I asked for and got a number of things that you and others here asked for, but I told them the effect to achieve, not how to do it.

[Jookia]

Do they think it's better for you to write a custom agreement? Have they considered Project Harmony and such a license? Have you acted as if those were constraints rather than 'I'd like this'?

[karolherbst]

some current stuff I noticed in the new CLA

Changes from the 4th draft are:

1. Removed references to 'verbal' and 'communication' from things that can be considered contributions.
2. (b) “Contribution” shall mean any source code, object code, patch, tool, sample, graphic, specification, manual, documentation, email, comment, posting, original work of authorship, communication or any other material, [...], that is or has been intentionally submitted by You to Desura or Linden Lab for inclusion in, or documentation of, the applicable open source projects (as reflected above) owned or managed by Linden Lab, including products formerly owned by Desura (collectively, the “Work”).

So communication still counts as a "Contribution" and is covert by this CLA

[Cheeseness]

Cheeseness quoted all of it, so it's at least still there.

I quoted it when it disappeared as I still had a copy from an email notification.

There's nothing unreputable about what we've done

That's only because unreputable isn't a word.

Stating that you will impose both a licence change and a CLA upon an existing Free Software project under protest from its development community is most definitely a disreputable act.

I hope that you understand that this action will likely reflect badly upon both Linden Lab and the Desura brand and that it will have a destructive impact on what is left of the Desurium development community.

Again, I suggest that if you want to take these actions, your best course will be to re-release the official Desura client under LGP with a CLA and leave Desurium be. This would allow the outcomes that you seem to say will be obtained at any cost, but without the collateral damage - if you're smart, you'll pursue this course instead (the mechanics of how a transition to the sort of state you want the project to be in will impact heavily on how it is perceived by the Desurium development community, the Desurium user community and the Free Software community at large).

[makson96]

I guess that no open source contributor feel happy about signing CA, but on the other hand we will get Linden Lab workforce, which will contribute on LGPL and this will make more source become open. And lets face the fact - Linden Lab owns Desura servers, so we can not live without their support.

That said, I would also feel more comfortable if we chose more liberal license (for example BSD), which allows Linden Lab to do whatever they want with the code, over signing CA.

[oz-linden]

@karolherbst ... the agreement does still have the word "communication", you are correct, but it's part of a whole phrase that restricts its meaning to a quite narrow usage. The key part of it is:

that is or has been intentionally submitted by You to Desura or Linden Lab for inclusion in, or documentation of, the applicable open source projects

In practice, in the Second Life projects, the way we do this is to ask people to explicitly post changes to our Jira problem tracker or to a public code review system, or to create a Bitbucket pull request. We don't ever want there to be any ambiguity about whether or not something is meant to be a contribution, so we interpret the language narrowly.

We don't want to actually write that narrow list of current systems into the agreement, because then we would need to change it when some new better system came along (if we had written bitbucket into the old agreement, we would need to change it to include github). So the lawyers write nice general language with respect to the medium, but qualified with the restriction that your intent is required to be clear.

We removed "verbal" from the agreement specifically because that clarity is hard to determine (and thank you to those of you who pointed that out).

Does that help clarify the meaning of the agreement?

[karolherbst]

@oz-linden I was quite sure, why there is something like that. I was just worried about how it was written there.

But I was more concerned about the fact, that you wrote "Removed references to 'verbal' and 'communication' from things that can be considered contributions.", but in fact, it wasn't. Still anything, which can be considered as a contribution has a reference to 'communication'.

Example: A guy who signed a CLA and sent an email to a linden employee with the intention to report a bug, grants now all the stuff mentioned in the CLA to this email. Linden is now allowed to do nearly everything with this single email. Any other guy, who does not sign a CLA is able to sent an email with exactly the same intention, but linden is not allowed to do anything they want with it, because this email is covered by local IP law (the above by the way, too).

Here linden needs to get the permission to use the second email anway, so a CLA won't help at all.

And by the way, the term "intentionally" is pretty vague, maybe the first guy didn't intented to sent it, but sent it accidentally without noticing. Later linden is using it for public documentation and get sued by this guy, because it wasn't his intention to send it to Linden.

I am not happy with the definition at all, because there are many corner cases, which could be dangerous for linden and the contributors.

[oz-linden]

@karolherbst - in the draft 4 version of the agreement, "communication" was used twice, once in the carefully qualified phrase I noted above, but also a second time earlier in the sentence without those qualifications. It was the unqualified usage that was removed.

The reference to "verbal" communication was in 2(c) and was removed.

Additional note for those of you who would like to know more about how the internal process has worked (as a general rule, we don't talk about how internal decisions are made - you'll find that most companies have the same policy, but I'll make a small exception here).

Some of you pointed out that "verbal" created problems. When I relayed that concern to our legal people, I supported that objection, pointed out that including it created problems for us too, and asked that it be removed. The lawyers readily agreed to the change.

It was the lawyers who generalized from that concern and realized that the unqualified "communication" in the previous subsection had the same problem and removed it.

[oz-linden]

If any of you have a really great idea that you think will make you rich (and maybe happy), don't contribute it to us. Don't share it with us with or without an agreement. Don't share it with anyone else with or without an agreement. Don't count on someone needing to "get your permission" to use it if you've told them about it, no matter what you think the law is or what you think is fair. Implement the idea, work hard, and build a business around it (just as Scotty & company did with Desura). If it involves shared creative activities perhaps Linden Lab will offer to buy your company and hire you (just as we did with Desura and its team), and we'll all be very very happy (and maybe someday rich).

Yes, legal language is, for most of us (me most definitely included), unfamiliar and uncomfortable. Try buying a house or selling a company - you'll encounter much more and much less comfortable language than this agreement, believe me (I've done both). Contracts are an unpleasant necessity - they're an essential part of the mechanisms we've collectively evolved for not settling our disputes with sharp, pointy, or heavy objects applied to our all-to-tender skins. They're not much fun, but they're way better than the alternative.

This isn't a contest to see who can take advantage of whom or who can "win". We're not trying to craft an agreement with the aim of allowing us to steal ideas, we're setting up protections for ourselves and the contributors against future disputes about intellectual property and patent rights because we don't want to spend time arguing about those things - we want to build great products that give people a chance to be creative and share the fruits of that creativity with others (and if they'd like to and are successful, make some money while doing so).

We've made some components of our products open source because open source is a shared creative activity and that fits our company mission. We want to give others a chance to apply their skills and creativity to make those products better so that everyone benefits. Users get products that work better and are available on more platforms, the company gets users that are happier and more numerous.

We don't expect anyone to be delighted about needing a contribution agreement. It would be great if we didn't need one, but that's not the world any of us live in and pretending otherwise won't work. This really is a good agreement. We hope that on balance, you'll agree that signing it and getting back to unifying our efforts to create great software is more fun than this thread.

[ssokolow]

@oz-linden I think the point is that we're reacting to a custom CLA in the same way that companies react when we're ignorant enough to ignore all the shouts of "Don't use a custom license! Use a known one like GPL, BSD/MIT, MPL, etc.!")

Hence why Jookia is suggesting Project Harmony. It's not about being unwilling to read the CLA; It's about not trusting our ability to interpret it while trusting the Internet to have already latched onto all the potential sticking points in big-name CLAs and discussed them ad infinitum.

(In other words, CLAs like the one used by the Apache Foundation are fine because they've already been around the block and gained a good reputation.)

...or, to put it another way, we don't feel qualified to give informed consent on a custom CLA and we know that, if that concern turns out to be true, there's no "Wait! I actually wasn't informed when I consented!" escape clause. (and I'm not saying there should be so please take that purely as an illustration of why we're wary of custom.)

[Jookia]

I don't think there's going to be a resolution here on the kind of terms I'd at least accept. So I've removed myself from the organization (I no longer have repo access) and the Desurium group on Desura. If the channel operator of #desura wants to remove my op abilities, that'd be great. This has been fun guys, keep up the good work.

[Cheeseness]

we don't feel qualified to give informed consent on a custom CLA and we know that

I definitely agree that there are some who find this daunting just because it's new and unknown (in fact, I've spoken to at least one contributor who didn't want to get involved because they don't have the time to dedicate to understanding everything), but I think there are certainly some among us who're capable of understanding what these things represent, but don't agree that there's justification or have specific concerns about certain clauses which do not match with what they feel the project should be about (for example, karolherbst's concerns with regards to the ownership of communication or jookia's concerns with allowing relicencing of code that was contributed in the "spirit" of Free Software).

The decision about whether or not something like that is needed is a subjective decision based on the perceptions and experiences of the people who made it (which is fine - there really are no other ways to make decisions), and as such, won't necessarily align with other subjective opinions about whether or not the decision made has been appropriate.

This project is doubly awkward in that currently its sole reason to exist is to support the services offered through the Desura online store, and it might seem to some that concerns are not important because of that direction.

This has been fun guys, keep up the good work.

I think I'm going to follow Jookia's lead here. I hope that whatever outcome there is is one that respects and looks after contributors, and that the decrease in IRC users and stars here on GitHub since this issue was created is merely a coincidence and not an indication of growing apathy.

Best wishes and luck to everybody in the Desura user community, the Desurium development community, Linden Lab and Desura <3

Anybody who would like to keep in touch with me is more than welcome to.

Cheese

[AlericInglewood]

How about asking people to sign that THEY relicense their contributions to LGPLv2.1? Asking people to get their copyright so YOU can relicenese it to ANYTHING you want (including forking off a closed source version for other commercial purposes) is ridiculous, if not to say criminally deceiving.

[karolherbst]

I will release all my changes and copyright into the public domain from now on. I don't want to claim copyrights on my work on desurium anymore, I simply don't care.

[oz-linden]

@AlericInglewood ... what we're asking for is very clear - no one is trying to deceive anyone here.

A CA not just about getting a particular license; it's about creating a uniform way to manage the intellectual property including copyright, patent rights, and the outbound license for the project.

It's not practical for us to have one license for some bits and different ones for other bits. That leads to errors and misunderstandings.

[makson96]

I would like to say, that I have just sent signed CA. I still think that Linden Lab taking lead of the project will result in more code being developed as open source. I hope that developers who do not feel comfortable with CA will not abandon completely and will help with bug reports, testing and discussion about the project and if they will be happy with Linden Lab way, they will rethink their statement. Best regards,