Re: DCO

[Mark Wielaard <mark@klomp.org>]

Hi Gwen,

On Mon, Jan 27, 2025 at 02:22:57PM -0300, Guinevere Larsen wrote:
> On 1/27/25 12:55 PM, Bradley M. Kuhn wrote:
> >My position is nuanced: copyright assignment to a trusted non-profit is a
> >really good tool for defending users' rights, but it has to be weighed
> >against the convenience and ease of contribution, and that calculation is
> >very hard to do.
> 
> There is another factor that you did not include in your
> calculation, which is the user actually finding the FSF a trusted
> non-profit. Regardless of any personal opinions I can have on the
> matter, I know that several programmers don't think that, and some
> of them are potential contributors to the GDB project (a personal
> acquaintance of mine has said so explicitly, and more than one
> implicitly).
> 
> By only having the copyright assignment we are implicitly reducing
> the pool of contributors to those that trust the FSF.

Thanks for bringing up the elephant in the room.  I think you are
right and I agree that the FSF has not shown itself very
trustworthy. Personally I struggle a lot with this. The FSF should be
there for all GNU developers, contributors and maintainers. But in
practice they are protecting someone who harasses anybody who even
dares to say they feel abused or theatened by him or the people around
him.

https://gnu.wildebeest.org/blog/mjw/2021/03/24/fsf-associate-membership/

While that issue hasn't been dealt with I don't think we can require
anybody assigning their copyright to the FSF. So we do need some other
way to increase the pool of contributors. Maybe that is some kind of
DCO, or finding another organization that people can trust to assign
copyright to.

I do hope that the FSF being willing to at least discuss this issue
now is a first step to reconciliation.

> Another option for relaxing the need for CA could be that, if a user
> is doing contributions in their free time and unrelated to any work,
> they could use DCO, while someone contributing in a professional
> capacity would need to sign the CA. This would be enforced through
> emails: If it is something that looks professional (ie something
> that looks like email<at>company<dot>TLD) we'd know this goes
> through their employment, while something that looks end-user (ie,
> something like whatever<at>gmail/yahoo/university<dot>com), DCO
> would suffice, and for emails that we can't be sure, we could just
> ask the user.
> 
> This would lower the bar immensely for students or unemployed
> people, while not allowing for-profit companies to have most of the
> copyright of the project. We should still incentivize people who are
> employed but contributing in their free time to talk to their
> employer, but I think it isn't standard practice for employers to
> have copyright over things you do in your free time (at least not in
> Brazil), so I would think that DCO would still be acceptable in that
> case.

Sadly it is standard practice for employers (and even universities) to
claim rights over their employers or students even when done outside
"work hours". This isn't actually legal in various jurisdictions. And
then you might win if the company sues you. So it would be much better
if you just talked to your employer about what you are going to do,
even if it is outside "work". That way there is no confusion and your
Signed-off-by really means that it is your own work and there are no
other people making claims on you work.

I do think we should trust people making such a statement. But we
should also make the text of the DCO (explanation/example) really
clear that we expect someone to have had that difficult conversation.

Cheers,

Mark