Slashdot Mirror
Submitting Corporate IP to Open Source Projects?
dannyp asks: "Does anyone have advice and/or references for working with a (very large and cautious) corporate legal department to establish a policy for submitting company-developed patches back to Open Source projects? I work at a large company outside of the technology sector (financial services). As we've succeeded in getting Open Source packages approved for use within the company, we're trying to figure out how to submit patches back to the community. We have to convince management that it makes sense to give this Intellectual Property away, and then (more difficult) convince Legal that we aren't going to get sued for doing it. Any advice?"
they can't bitch. How about posting anonymously?
:::Horrendous Experiences Make Amusing Anecdotes:::
Out of curiosity, to the degree that people all talking about their own experiences and not just running their mouths:
Could you give some examples of what GPL products you've patched and (to the degree you can say) what the patches add or fix?
I'd like to get a sense of how much advantage users really get from having source available.
What I'm listening to now on Pandora...
Regardless of license, point out that you are much more likely to get support from the open source community if you are part of that community (by giving back) then if you are a leech (not giving back).
-- Argel
I don't intend this as a flame-- or FUD, for that matter-- but it almost sounds like you may have inadvertently pulled a bait-and-switch on your company.
You said, "we've succeeded in getting Open Source packages approved for use within the company," and this implies that you yourself-- as part of your group or whatever-- advocated the use of Open Source software inside your company. Did you make it extremely clear to the people to whom you were advocating that Free software is not entirely free?
What I mean is this: when you download GNU SurfWriter from an FTP site, you don't have to pay anybody. You get to use the software for no money. But there's an opportunity cost attached. In using the software, you give up the ability to redistribute it in binary-only form. You give up the ability to incorporate any part of it in a closed-source application. You give up a number of "rights" as part of the "cost" of GNU SurfWriter.
Put yourself in your boss's shoes for a minute. One of your employees came in last month and convinced you to use GNU SurfWriter. It's free, he said. You get the sources, he said, so you can modify it as you need. All good reasons.
Now, just a few short weeks later, that same employee comes in and tells you that you either should or must (depending on the circumstances) release your company's changes to GNU SurfWriter to the public. He never said anything about having to give away company IP when he argued for GNU SurfWriter last month! Bastard! Now you've got to explain this to your boss!
Net result: your boss, maybe your whole company, has a bad impression of the GPL specifically, and Open Source and free software in general.
I'm neither trying to advocate or deride the GPL in this post. I'm just pointing out that that particular license is definitely two-sided, and failure to be very clear about its limitations can be a bad thing. Without knowing it, you yourself may have spread FUD by not telling the whole story.
When I was hired by my current employer, my contract basically stated that anything I do on their time is theirs.
Things get even more complex, when my time is spent representing my company as a subcontractor to another company. During this time, who owns my work is spelled out in the contract between those companies.
Thus, the only real answer to your question is: you have to convince the people who set up your business contracts to include a clause spelling out your rights to submit patches to Open Source projects. However, none of the parties in that contract want to pay a lot of money for you to work up such patches, so it will probably be an up-hill battle for you.
Mainly, I have learned that large bureaucracies, such as those in large companies and governments, tend to stifle such initiatives. Also, you will find that no one in that bureaucracy will be willing to take on any risk for your sake.
Sometimes these bureaucracies are so mind-numbingly stupid that sometimes I just want to go live in the woods for a while and play chess with my squirrel friends. Yes, that would be much better.
Healthcare article at Kuro5hin
We have to convince management that it makes sense to give this Intellectual Property away, and then (more difficult) convince Legal that we aren't going to get sued for doing it.
It doesn't make sense to give the Intellectual Property away. Your company exists to make profit. I highly doubt giving away your IP is somehow going to make you more profit than you lose.
Of course, this assumes that you aren't legally required to give away the IP, in which case it probably is profitible to stop breaking the law.
The QA part is a good seller. If you have only tested your stuff the way that you use it and someone else gets it they may test and use it differently. This helps you QA your stuff.
Only 'flamers' flame!
There are several things to consider before deciding that it would be wise to donate corporate IP back to an Open Source project. These particular decisions can usually be made either way without incurring the wrath of even the FSF:
... to your customers for
First factor:
Are your patches merely bugfixes, or are they
added functions?
If they are mere bugfixes, I can't see where
your management would object to releasing
them.
OTOH, if you have added new and significant
functionality to the program, you might want
to move on to consideration #2.
Second factor to consider:
In the case of new functionality, is there any
reason to distribute it outside your company?
If the modified program only has meaningful
application within the context of a company
similar to your employer do you think it
would be wise to give your work to the
competition?
OTOH, if it is something that you need to
distribute, say
their use, I would agree with the previous
poster who wrote that contributing your
patches back to the project might be necessary
to prevent a lawsuit.
As for protection from a lawsuit for having contributed your patches, I recommend you refer your corporate counsel to the language of the license that covers the package. The disclaimers in most OSS/FS licenses are much more protective of developers/contributors than even Microsoft's EULA is.
Just my US$0.02
utter rubbish
If your company doesn't release the patches, they will have to be reworked into new releases of the vanilla source tree.
However that doesn't mean everybody else will do your work for you. If there's a conflict between your code and someone else's, you might be expected to fix your code. But being in first gives you an advantage.
So, sell patch release as reducing the code maintenance overhead.
None of this from experience, just common sense and observation.
Yours Sincerely, Michael.
Since everyone else is talking about the coding issues I thought I'd talk about the legal issues.
Clauses 11 and 12 of the GPL essentially say "Because this is free, there is no warranty. We
don't even guarantee that it will do what we say it will do. You are reponsible for all damages."
Thus, your Legal department should be ecstatic.
Disclaimer:
I'm not a lawyer, I'm just someone who went through the same thing you did, and had to wait
three months for an answer. But in the end, we
did get permission to release it.
As if licensing and EULA's were not ambigious enough, you have people attaching 'strange' stipulations to their open source code. In my honest opinion, this is not true open source. This is the BEST way to kill the whole project. Since this is new, I will give you all fair warning. Otherwise, remember this post when you are few and far between with others still left to be involved in these projects. Open source is just that, open. If you want to charge, you better make it darn clear. Otherwise you are going to kill this very quickly. 18 year olds with no experience in the industry need no reply to this.
We found a code gen bug in gcc a long time ago on Sparc. We fixed it and submitted a patch. We could have, perhaps, worked around it, but we didn't need to since we had the gcc source.
Incidently, the gcc source is surprisingly easy to read. I've referred to it numerous times to see why something does what it does, what different command line options do, etc.
The guy said he worked for "a large company outside of the technology sector (financial services)."
Financial services companies generally do not sell IP. They are designed to make profits from selling financial services.
Why oil price increase equals economic trouble (Score: Interesti