Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
GNU is Not Unix Government Programming The Courts

Insuring Contributed Code is Legal? 71

Posted by Cliff from the not-swallowing-the-poisoned-pill dept.
WanderingGhost asks: "Suppose you start a free software project and have people from all over the world wanting to contribute (hey, that's good eh?) How can you tell if they actually have the right to contribute at all? Contributors may live in different countries and work for different companies, and that means different laws and different contractual agreements. Aside from asking the person (I've found that this doesn't always work), what else would you do? Is there some place where you can find all information about IP laws of different countries (for example Japan, India, China, Russia) just so you can tell what would be the 'default holder of copyright' if a work contract says nothing about IP rights?"
This discussion has been archived. No new comments can be posted.

Insuring Contributed Code is Legal? More

Insuring Contributed Code is Legal?

Comments Filter:

  • Not quite... (Score:5, Informative)

    by asklepius ( 456552 ) * on Saturday December 02, 2006 @04:30AM (#17078806)
    I think you mean ENsuring.

    This grammatic lesson brought to you by the letter, "e".
    • Maybe a grammar checker should be added to the next firefox update...
    • Well done, 'editors'...

    • Re: (Score:1)

      by maxume ( 22995 )
      Perhaps ensure is better style, but insure is fine grammatically.

      See:

      http://www.answers.com/topic/insure [answers.com]
      http://www.answers.com/topic/ensure [answers.com]
      http://www.answers.com/topic/assure [answers.com]
      • "You are a stupid fuck," is fine grammatically, too, but it doesn't mean the same as "What a nice young slashdotter that maxume is."

        I'm sure if I used these interchangeably, you'd be understandably upset.

        While answers.com says they supposedly mean the same thing, I don't know anyone (besides the submitter and /. editors, of course) who actually uses "insure" in this way.

        • Re: (Score:2, Insightful)

          by maxume ( 22995 )
          If nit picking is going to be done, there is something to be said for worrying about correctness while doing it...I completely agree that ensure is a much better fit, but the error was anything but grammatical.
          • Well, fair enough, but I'd say from my extensive experience with the English language, that about.com's definition is incorrect.
            Although Webster online agrees with about.com, there is an extra statement in the definition of "ensure" that ensures that your sentence means what you think it means (see what I did there?...)

            "but ENSURE may imply a virtual guarantee <the government has ensured the safety of the refugees>,"

            • Re: (Score:1)

              by maxume ( 22995 )
              We just need to go to a better authority:

              http://en.wiktionary.org/wiki/ensure [wiktionary.org]

              (which strikes me as actually being wrong...)

              I hadn't ever really looked at wiktionary before, but the synonym as definition of synonym stuff is a poor idea.
              • Actually, I know what the problem is, now.....

                2. (US) to insure.

                "Ensure" is only synonymous with "insure" in the US. I'm not in the US, so this seems to me to be the same as Americans not being able to spell "humour" and "colour".
                Although, having said that....have you ever heard a Canadian say "Detroit"? That's the worst mangling of phonetic pronunciation I've ever heard......

                • Re: (Score:1)

                  by maxume ( 22995 )
                  We do other strange things too, like avoiding organ meat and blood pudding, and going to the dentist. Zing!

                  Being from Michigan(you should hear the fun people have trying to make up a word for that; Michiganian, Michigander, Yooper, Go back to Ohio/Indiana/Illinois), I have certainly heard Detroit said in many ways. I think they are probably using a French 'i', which makes a bit of sense if you look at the history and so forth.

      • Re: (Score:2)

        by Intron ( 870560 )
        Feel free to use "insure" in a contract with someone. When it doesn't happen, you will find out if you are financially liable. That should give you the answer better than a random page on the internet.

        • Re: (Score:1)

          by maxume ( 22995 )
          Which would be a legal thing, not a grammatical thing, which is the nit I was picking with the initial nit picker. There is no doubt in my mind that ensure should have been used, but the error wasn't 'grammatical'.
    • This grammatic lesson brought to you by the letter, "e".

      Also brought to us by the outstanding editors of Slashdot.

  • I assume it's legal... (Score:1, Funny)

    by Anonymous Coward
    I mean, you can get insurance for just about anything. I assume that goes for contributed code...
    • Insurance is really just a form of gambling. If you've seen Rat Race you'd know that people will gamble on anything. ;)
  • Before allowing commit access to your repository, or accepting patches from someone, have them submit a signed affidavit specifically stating that they will not contribute any code they do not have the rights to. This is likely to result in less developers offering to contribute though as many folks can't be bothered to go through the hassle. Solves both your problems the way I see it (too many developers and legal liabilities.)

    IANAL, but I did sleep in my own bed last night. (Tis a joke and a serious sta
    • I suppose you mean I should get him to GPG-sign a letter?
      That seems interesting.

      Something like: the contributor signs a statement *and* the key he'll use
      to commit to the repository (because my CVS doesn't use GPG keys). If anything
      goes wrong, then I have his letter stating that everything is legal, and if he
      didn't have the right to do that, he's in trouble and I'm not.

      But does that always work? regardless of what he claims, if the code is not his,
      it may belong to someone. And I may need to revert the commit
      • "because my CVS doesn't use GPG keys"

        I meant, "my VCS, Monotone, uses a key that is not compatible with GPG"

      • Re:Signed affidavits are the answer! (Score:5, Interesting)

        by julesh ( 229690 ) on Saturday December 02, 2006 @08:45AM (#17079610)
        I think the idea is to get contributors to send you something, signed, on a piece of paper. This is what the FSF does, and a few other large projects have followed their lead. In FSF's case, the piece of paper is also a copyright assignment, which you probably don't want as it puts a lot of potential contributors off. What you want to do is check out something like the following with a lawyer:

        I hereby certify that the work I have submitted to is my own work, which I am entitled to licence under the provisions of , and that I am not aware of any patents or other legal issues that may prevent its use in . I hereby grant a licence to distribute the work under the terms of (attached).

        You possibly also want to include a similarly phrased paragraph to cover future submissions by the same contributor, if you expect any.

        What this does is (again, IANAL, so this isn't legal advice, check it with a professional, actual facts may vary from jurisdiction to jurisdiction):

        1. Means you've performed "due diligence" before accepting the work. You've got a signed statement from somebody stating that there wouldn't be any issues. If you do have legal expenses insurance (and I'd recommend it; at least where I live it isn't expensive) your insurers will almost certainly want to see something like this before they'll agree to defend you in a court case. In a court case, I think it would be enough to show that you hadn't knowingly infringed any copyrights, which may be enough to prevent any damages being awarded against you. You'd have to cease distribution, of course, but in the end it would probably not actually cost you anything. It's probably not as good in the case of a patent infringement, where I believe strict liability rules apply, but that's substantially less likely to affect you, fortunately.

        2. Means you've got a clear, easy to prove licence to distribute, so your contributor can't turn around and sue you. Yes, this is unlikely, but it's great to cover all angles.

        A GPG-signed e-mail may be adequate, but check with a lawyer. In my jurisdiction, I believe it would be iff I could prove the key belonged to the person I believe it to, which can be a quite tricky proposition. In yours, it might not be acceptable at all. Check everything. A signed fax may be better than an e-mail. This is the kind of knowledge you pay a lawyer for.

        • Re: (Score:2)

          by julesh ( 229690 )
          I hereby certify that the work I have submitted to is my own work, which I am entitled to licence under the provisions of , and that I am not aware of any patents or other legal issues that may prevent its use in . I hereby grant a licence to distribute the work under the terms of (attached).

          Ahem.

          I hereby certify that the work I have submitted to [project] is my own work, which I am entitled to licence under the provisions of [licence], and that I am not aware of any patents or other legal issues that may p

        • Re: (Score:1)

          by Raenex ( 947668 )

          A signed fax may be better than an e-mail. This is the kind of knowledge you pay a lawyer for.

          It's really insane for people to have to seek out a lawyer and pay for legal advice for common issues such as this. This is where the internet and sharing information should help. I'd say asking on Slashdot is a good start. I'm sure if he keeps poking around he'll find some good advice by others who were faced with the same problem.

          Besides the money, the other problem with hiring a lawyer is that you may

          • Re: (Score:2)

            by julesh ( 229690 )
            The problem with asking something like this on a site like slashdot is twofold:

            1. Armchair lawyers. Sure, I'm one of 'em. I like to think I'm better than most, but it's very hard to tell who's reliable and who isn't.
            2. This kind of thing varies from place to place. You need somebody local.

      • Re: (Score:2)

        by svunt ( 916464 )
        my CVS doesn't use GPG keys
        That looks like the result of a virulent strain of dyslexia. CVS, VCS? PGP, GPG? God damn, we're running out of acronyms that don't make my brain hurt.

    • Re: (Score:2)

      by Fastolfe ( 1470 )
      Unfortunately this isn't as tidy a solution as you probably would like, but it's the best one can do, IMO. If it's found that infringing code is in your project, you're still technically infringing their copyrights. Even though you can point to someone else and say, "It's their fault!", you're still on the hook if they don't get what they want out of the other guy. (Of course, you'd have a really good case against the other guy if you end up losing, but if he has no money, you still might be SOL.)

      It's all

    • Re: (Score:1)

      by daybot ( 911557 ) *
      > Before allowing commit access to your repository, or accepting patches from someone, have them submit a signed affidavit specifically stating that they will not contribute any code they do not have the rights to Best ensure they're insured, too...
  • The only thing you know for sure is that you never know anything for sure.

  • Universal Problem (Score:3, Informative)

    by Anonymous Coward on Saturday December 02, 2006 @05:13AM (#17078944)
    Scroll to A Brief History of Windows NT/2000/XP [cs.vu.nl] by Andrew Tanenbaum. This is a problem regardless of software license. The unique problem that open source faces is that people do it as well as working at the same time.

    If it's a small project I wouldn't worry too much in any case. Otherwise, make the programmers agree to some statement before you'll accept their work (it could be an "informal" email). And always remember that estoppel is your best friend.

    IANAL, but my key fear with using any copyrighted material is authors being able to revoke a license. Copyright and licensing laws are quite strong after all.

    • Re:Universal Problem (Score:4, Interesting)

      by WanderingGhost ( 535445 ) on Saturday December 02, 2006 @07:03AM (#17079266)
      Scroll to A Brief History of Windows NT/2000/XP by Andrew Tanenbaum. This is a problem regardless of software license. The unique problem that open source faces is that people do it as well as working at the same time.

      I see your point...

      If it's a small project I wouldn't worry too much in any case. Otherwise, make the programmers agree to some statement before you'll accept their work (it could be an "informal" email). And always remember that estoppel is your best friend.

      The problem is that the contributor himself may not fully understand what he can and what he cannot do. And then after something comes up, I'd have a big company telling me to shut down my project (because it may not be possible to revert a big, findamental patch, for example).

      IANAL, but my key fear with using any copyrighted material is authors being able to revoke a license. Copyright and licensing laws are quite strong after all.

      Not in the case of the GNU GPL, as far as I understand. I have asked a lawyer about this once (last year I guess).

      • Re: (Score:3, Interesting)

        by julesh ( 229690 )
        And then after something comes up, I'd have a big company telling me to shut down my project (because it may not be possible to revert a big, findamental patch, for example).

        I don't think this is avoidable, unfortunately. If you have to remove a fundamental piece of code due to copyright considerations, that's going to effectively mean reverting your codebase to the point it was added and starting again from there. Code added after it was may be a derivitive under copyright law, so you probably can't use

    • Re: (Score:2)

      by Kjella ( 173770 )
      IANAL, but my key fear with using any copyrighted material is authors being able to revoke a license. Copyright and licensing laws are quite strong after all.

      Authors can't revoke licenses unless they put it in the license agreement, period. What could be reason for concern is that contributor never had the right to license it in the first place, like for example an employee doing a work for hire, in which case the copyright defaults to the company. They could come after your project and demand that you remo

    • Re: (Score:2)

      by darkonc ( 47285 )
      It's just as much a problem with Proprietary projects 'accidently' including GPL code as it is GPL code accidently including proprietary code. The unique advantage that GPL code has (and also it's achiles heel) is that there's no hope of keeping the illicit code secret. This means that people are less likely to try to sneak something in.

      This also provides a probable protection against a wilfull violation accusation. If the donor honestly believed that (s)he had the right to donate and the recipient pro

  • Go ask a solicitor. If you can't pay for one, then put a disclaimer "I assume all your contributed code is legal blah-blah".

  • misspelling may provide the answer! (Score:5, Funny)

    by plasmacutter ( 901737 ) on Saturday December 02, 2006 @05:21AM (#17078968)
    insuring your project against copyright lawsuit might "ensure" you get to keep contributed code..

    well.. it was just a thought..

  • Copyright assignment (Score:3, Interesting)

    by martinde ( 137088 ) on Saturday December 02, 2006 @08:32AM (#17079560) Homepage
    Isn't this one of the reasons why the FSF requires all contributors to assign their copyrights to the FSF explicitly? I believe this puts the responsibility onto the authors, and not the FSF, to make sure they have the right to contribute.

    More info here [fsf.org].
    • Requires isa misnomer. They prefere you to give them the copyright but it isn't neccesary.

      If you do give it to FSF, then they pretty much decide which version of the GPL it is distributed on wereas if you keep the copytight you make that decision. It would come in handy if your one of those that don't think the GPLv3 is in the same spirit as the GPLv2. It won't be long and the GPL comunity will be fractured, confused, and most likley dead (like BSD) so I guess it is just a minor point anyways.

  • Using the Linux kernel model (Score:1, Interesting)

    by Anonymous Coward
    Isn't 100% foolproof. Go slpunk about in the 2.0.36 kernel and you 'll see where one submission took FreeBSD, removed the FreeBSD copyright notice and bragged about it.
    RedHat 6 used the BSD lp code and didn't fufill the 'advertising clause' (same with Microsoft and NT)
    And somewhere on slashdot you can find out all about the ATA code issue.

    You are just going to have to keep detailed records of who submitted what, and have 'em agree to a contract to sign over the code AND agree that it wasn't code taken fro

    • Re: (Score:3, Informative)

      by RAMMS+EIN ( 578166 )
      ``RedHat 6 used the BSD lp code and didn't fufill the 'advertising clause' (same with Microsoft and NT)''

      Assuming that BSD lp is copyright the University of California, that shouldn't be a problem, because they scrapped the advertising clause (I think even if the license still includes the clause, it isn't valid anymore).

      • Re: (Score:1, Informative)

        by Anonymous Coward
        Assuming that BSD lp is copyright the University of California, that shouldn't be a problem, because they scrapped the advertising clause

        Kinda slow on the uptake. Back when they didn't include the statement 'portions copywrite University of California' is WAS still part of the licence.

        Not shocking you were upmodded - pro-linux stuff always gets upmodded.
      • Agreed, if they used UCal/Berkeley sources, the advertising clause was deleted by the Regents of California/Berkeley some years ago, and all software owned by them was relicensed under the terms of the "new BSD" license. This isn't true of all of the BSD code used in Microsoft Windows; if you check here:

        Microsoft license [microsoft.com]

        ...you'll find that Microsoft lists a number of BSD licenses and authors, such as Luigi Rizzo, who wrote the IPFW firewall now used as part of Windows (as well as in MacOS X, FreeBSD, N

  • There are companies that offer a service to scan code for known open source code so that propietary code doesn't get caught by GPL and other license issues. But you can't scan the other way around since propietary code is not always published.

    The only thing you can do is verify the real identity of the contributers so they can be prosecuted if they do something bad and hope that serves as a deterrent.

    This problem isn't exactly original with software. Plagiarism has affected publishing almost from the

  • No one will help anyways unless it's a huge successful project, at which time you can have the foundation explore all that.

  • Slashdot . . . (Score:4, Informative)

    by Dausha ( 546002 ) on Saturday December 02, 2006 @12:45PM (#17080974) Homepage
    "Is there some place where you can find all information about IP laws of different countries (for example Japan, India, China, Russia) just so you can tell what would be the 'default holder of copyright' if a work contract says nothing about IP rights?"

    You go to /., of course.

    I'm in my last few days of law school, but IANAL, so this is not legal advice. However, I wrote a paper last year on what happens when the contract regarding an IP project is silent regarding the final holder of the IP (US specific). If you are an employee of the recipient of the IP, then you are not the IP holder, your employer is. When you're the independent contractor, then things get tricky. Depending on the amount of control the contractee has over your work (e.g. it tells you what to do more like an employer than a client who approves the final product), then at best you have the copyright, but the contractee has a non-exclusive license to do what it likes with the product. In 77 suits on the subject, an independent contractor tried to protect its IP rights and lost in all but a handful of cases owing to the non-exclusive license (which is governed by state contract law not IP law as Congress has excluded non-exclusive licenses by negative inference). The only trend I saw was that the larger the market capitalization of the infringing defendant, the greater likelihood that the court would find for the defendant.

    The worst case was an architectural firm who drew up plans for a shopping mall development with intent to be the sole-source provider of architectural services. The plans were never on file with the city, but the plans were approved and the developer sold the project to another company. The other company hired its own architectural firm to redo the plans. The other firm erased all references to the original firm, made a few changes, and then submitted the plans as its own. Naturally, the first company sued, and the 9th Circuit said "you lose." The copyright was non-exclusively licensed to the original company through complete silence of the original contract, and so that license was transferred to the other company and finally to the other firm. The implication was that the architectural firm "intended" the other, competing firm to profit from its work---which is nonsense as no firm would want a competitor to turn its product into its own and profit without any compensation or acknowledgment.

    Always, always, always get it in writing. Silence can be deadly.
  • You cannot avoid, nor if the project is proprietary. I think you can only sue them, by means of a contract or some type of disclaiming.
  • Were this post a piece of code, it should be in the daily wtf for so many reasons. Seriously, do you even *care* about how patents/IP/contracts affect OSS? Why, because OSS is not affected by such in any significant way. Proven offending code was added to an OSS project, it would be straight out removed. It can range from an annoyance to a broken project in the short term, because of the loss of functionality, but in the mid term that resumes to nothing, as the blank left by the offending code is filled in

Slashdot Top Deals

The use of money is all the advantage there is to having money. -- B. Franklin

Close