Slashdot Mirror

← Back to Stories (view on slashdot.org)

Properly Contributing to Open Source While on Company Time?

Posted by Cliff on from the avoiding-the-SCOrn-of-your-superiors-isn't-a-WASTE-of-time dept.

egeorge asks: "I was wondering what kind of paperwork/policies developers have at their jobs concerning contribution to open source projects. I develop software at a company that derives almost its entire revenue from software. Some software is licensed to customers, some is run internally in a service model, but the software is our whole business. We have recently been doing more and more modification and customization of open source products, and we would love to give some of this back. As developers, though, some of us are a little hesitant to just start flinging code that technically still belongs to the company out into the world. We want to make sure we get clarification about what is or is not covered by our NDAs. So, what kind of procedures do other developers have to go through to get adequate coverage for Open Source submissions? I would like to suggest a policy to my superiors, and could use a few good suggestions."

56 of 400 comments (clear)

  1. Simply put: I don't. by Vengeance · · Score: 4, Interesting

    I'm a consultant, paid for my time and the IP I develop. I would not dare to risk cross-contamination by doing anything more than downloading and using open-source packages at the office.

    --
    It was a joke! When you give me that look it was a joke.
  2. Copyright by krisp · · Score: 4, Insightful

    As I understand it, as far as the copyright law goes, if you create it at work on your companies' computer, the copyright belongs to them.

    1. Re:Copyright by spazoid12 · · Score: 4, Interesting

      It has nothing to do with copyright law.

      What you state is true most of the time, but not all, because of company policy.

      And...I hate it.

      They always pull the old "we own the computer, therefore" line. It's the same reason given for why they feel justified in reading your emails and such. Well, they own the phones, too, but they cannot legally record your calls without notice.

      A friend and I were talking about this a while back. We were allowed to play games at work from time to time, and so sometimes I did. He teased me that I played games on company time. Technically, that can't be said...because we were salaried employees. An extreme analogy would be: make me an hourly employee, and put a timeclock on my desk. I might clock-in and clock-out at intervals of only 10 seconds here and 2 minutes there. A salary employee is essentially doing that, but without the physical timeclock on the desk...just as a mental exercise. Therefore, a salary employee never plays games on company time... and, possibly, might always be free to develop his own ideas which might still belong to him... aside from the fact that he used the company-owned PC at the time.

      I'd better check with the carpenters that built my house... it's possible that they own the house, and not me, because they owned the hammers and saws used to build it!

    2. Re:Copyright by Spazmania · · Score: 5, Interesting

      Yes and no.

      If you are an actual employee, paid a salary or paid hourly where they withhold taxes and social security and what not, then any work done within the reasonable scope of your employment is considered work made for hire, thus the copyright vests in the employer rather than in you.

      However, in almost every other circumstance, the copyright vests in you and must be explicitly transferred. This means that if you're a consultant, you own the work. Or if you're paid by the job, you own the work. Or if the work isn't reasonably within the scope of your employment, you own the work.

      Some examples:

      You are a janitor at the local school. While at work, you go into the computer lab and write the next Microsoft Windows. Who owns the work? You do. Although done on your employer's time and facilities, it was not within the scope of your employment. (Note however that the school can fire you and sue for misuse of facilities.)

      A local ISP pays you $1000 to write a spam filter. Who owns it? You do. You were not an employee of the ISP.

      A local ISP pays you $1000 to write a spam filter. You sign a contract which says, "I agree to write a spam filter and the copyrights belong to the ISP." Who owns it? You do. You can't assign rights to a work that hasn't yet been created.

      A local ISP pays you $1000 to write a spam filter. After writing the software you sign a contract which says, "I assign the rights to this software to the ISP." Who owns it? The ISP does. You did first, and then you assigned the rights.

      Here's a tricky one:

      You work (as an employee) for a company writing accounting software. You sign an employment contract which says, "All software I write while employed by the company belongs to the company." In your spare time you write a spam filter. Who owns it? You do. A court would find that the actual fact was that accounting software was the scope of your employment. The only software that's work made for hire (whose copyrights vest in the employer) is the software written within the scope of your employment. And, as previously mentioned, you can't assign copyrights for something you havn't written yet.

      What if you wrote the next Lotus 123? Then the company would own it. A spreadsheet is reasonably accounting software which was within your actual scope of employment.

      Here's a trickier one:

      You work (as an employee) for a company writing accounting software. You sign an employment contract which says, "I will assign rights to the company to all software I write while employed." In your spare time you write a spam filter. Who owns it? You do. That's right, you do. BUT, you have a valid contract with your company which compells you to write a document which says, "I assign the rights to this software to the company." If you fail to do so, you are in breach of contract.

      What about when the contract said, "All software I write while employed by the company belongs to the company?" Are you in breach of contract if you don't assign the rights? You are not. There was no requirement to assign the rights, on an element stating that the rights belong to the company. That element in the contract is contrary to the governing law. If your contract allows it (most do), that element would be severed from the contract. Otherwise, the entire contract would be voided.

      --
      Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
  3. before the brainless GPL zelots jump on him.. by autopr0n · · Score: 5, Insightful

    keep in mind the GPL allows for internal use of modified software without releasing the source code.

    --
    autopr0n is like, down and stuff.
    1. Re:before the brainless GPL zelots jump on him.. by dubious9 · · Score: 5, Informative

      Yes, but its in your best interest to release your changes back to the communtiy so you won't have to manually merge code in later versions.

      When our company needed to use some open source, we had a meeting with the legal department. Basically what they said is that if it didn't contain any proprietary information relating to our line of business then we could release it. Since the project just converted xsl to rtf then we didn't have to worry about it and got a green light.

      Since we've put it into production and release the changes we made back to the community there have been 3 releases that we don't have to maintain ourselves. The whole thing probably saved us about a man year.

      --
      Why, o why must the sky fall when I've learned to fly?
  4. Are you modifying/shipping Open Source? by stevew · · Score: 4, Insightful

    The first question that needs clarification in my mind is - Is your company distributing open-source code that they have modified?

    If that is the case - then if it is GPL'd code, you need to release it according to the license. If it is a BSDish license that isn't the case.

    Probably the best piece of advice - get your company to emit a policy on the subject. You may not like the results, but at least it will be a definitive answer.

    --
    Have you compiled your kernel today??
    1. Re:Are you modifying/shipping Open Source? by wbattestilli · · Score: 4, Informative

      This is not actually true of the GPL.

      If they are making programs for internal use then they are obligated to release nothing.

      If they are distributing the code to another party, then they have to make the source available to that party.

      They GPL never says that they have to release the code to the public, however; the party receiving the above mentioned code would have the right to release it to the public under the GPL.

    2. Re:Are you modifying/shipping Open Source? by Zathrus · · Score: 5, Informative

      If it's true GPL code and they're distributing it to outside customers, well, they're idiots. Because they now either have to remove the GPL code entirely or release the entire application under the GPL.

      If it's LGPL then they need only release any modifications to the library or other LGPL'd code they did. Or, again, remove the LGPL code -- presuming they're distributing it at all.

      If it's BSD or similar it's irrelevant, as you said, as long as they keep the copyright notices, etc. in tact.

      Essentially, check the license before you use the code and know what it means. We use a great deal of LGPL, BSD, and public domain code in our products. We stay away from GPL though -- we don't have any intentions of distributing at this point, but if we did we'd rather not have that problem.

      As far as remitting work back to the community - talk to your managers. If your managers are decent then they'll understand the issues involved. It may take some time, but most likely you'll be given the OK. After all, think about what you've modified in the code -- does it give any advantage to your competitors? Does it reduce the value of your product to your customers? Are the changes bugfixes or new logic that's only applicable to your company?

      Actually, we do have one GPL program that we've modified... vsftpd. Again, no plans on redistributing it, but if we did it'd be no problem submitting the changes. They're deeply specific to our company and our usage and would utterly screw up anyone else who used them (things like automatically assuming paths on puts and gets so our customers don't have to do cd, and automatically moving files on completion of transfers (which might be useful)).

      Do not work on OSS during company time though, not without explicit written consent. And many companies are now claiming anything you work on, even outside of work, to be their IP (which is on somewhat shaky grounds)... so if you want to work on OSS outside of work, check your contract and get a release from management if needed. Don't just do it -- in the worst case you're really, utterly screwing the project to the point where it may have to be removed from the net (at least officially). Most companies won't give a crap, as long as you're not doing it on company time and it's not competing with them.

  5. Justin Frankel by Transient0 · · Score: 4, Insightful

    I think Justin Frankel would tell you that you can't ever be sure that you have any creative control over what you are doing on company time.

    The only ways to remain certain that you have complete control are to either work on your own or with a small group in a small company and then leave as soon as they get bought out by the big guys.

    --
    lysergically yours
  6. Charge for it. by Zaphod+B · · Score: 4, Informative

    Remember that open-source is not necessarily free-as-in-beer. Your company can charge for the source code and the binaries if it wants, it just needs to use an open-source license (insert heavily-compressed flamewar here).

    Also you can make quite clear that you will only support YOUR version of the product and that if they choose to modify the source they're on their own.

    If you're just talking about donating code snippets, well, then you need someone with more experience in that than I.

    --
    Zaphod B
    When duplication is outlawed, only outlaws will have /bin/cp
  7. Why Open Source is bad for you by NoCoward · · Score: 3, Interesting

    Please read the following before committing your IP and company to Open Source:

    Open Source Doesn't Make Economic Sense For Most

    The open source organization has presented a few cases that supposedly explain why OS works economically. However, if you examine the cases objectively you will find that the cases are flimsy and non-specific and do not address any specific concerns. They attempt to bolster their case by pointing out a few "successes", among which Caldera and Red Hat are displayed as shining examples.

    The real economic question of the OS model is how is money made, and who is making the money. Who is being rewarded financially for the enormous development effort? The open source initiative claims that there are at least four different models that allow someone to reap rewards. Oddly, it is not mentioned that it is not necessarily the people who did the development work that gain financially.

    The four primary business cases mentioned by OS proponents are "Selling Support", "Loss Leader", "Widget Frosting" and "Accessorizing."

    The first case proposes that money can be made via selling support for the free software product. This is by far the strongest case and is proven to work, for a few small companies. The two companies that are shown as positive examples of this business model are Red Hat and Caldera, who distribute and support the Linux operating system. What is never mentioned is that neither of these two companies has contributed significantly in relative terms to the Linux development process. Its important to note that using this business model, the people that make the money are usually not the ones who have invested in the development process. So much for the strongest case.

    The second case is based on the idea that you give away a product as open source so you can make money selling a closed source program. This also can work, but it should be noted that the money is being made off the closed source product and not off of the open source. An example of this model would be Netscape, who gives away the source code of their client browser so the OS community can do development, but keeps their "cash cow" products completely closed. Obviously, this case may only work if you have a software product that lends itself to this sort of "give away the razor and make money on the blades" system. The truth is that the vast majority of software is monolithic. So much for the loss leader case.

    The third case, "Widget Frosting", sounds completely practical. The premise that hardware makers produce open source software so that the OS development community will work for free to produce better drivers and interface tools for their hardware products. It sounds great on the surface, especially for the company that produces the hardware: they get free drivers and do not have to pay for expensive developers. The OS community wins by getting presumably stable drivers and tools. What is not mentioned is the reason hardware makers usually don?t do this is because they do not want to reveal trade secrets regarding their hardware design. Production of efficient drivers requires an intimate knowledge of the hardware the driver is for. It is almost always the case that it is in the hardware developers? best interest to keep their hardware secrets close to home. This also brings up the question of why isn?t hardware "open"? So much for the frosting case.

    The final case, "Accessorizing", is similar to the first, but throws in the idea of selling books and complete systems with the open source software, and other accessories as well. It is obvious that selling books qualifies as support, and that it really belongs in the first case. The idea of selling computer systems, T-Shirts, dolls, again begs the question: "Who is making the money?" As with the first case, it is not necessarily the people who have done the development work. Additionally, the question of how much money can be made selling books, t-shirts, mugs, etc, is never answered. O?Reilly Associates is frequent

    1. Re:Why Open Source is bad for you by BrynM · · Score: 3, Insightful
      THIS DOCUMENT CAN BE RECOPIED AND REDISTRIBUTED WITHOUT RESTRICTION, HOWEVER ADDITIONS/MODIFICATIONS/CORRECTIONS SHOULD BE LABELED AS SUCH WHERE THEY OCCUR.
      So are you saying that this document is Open Source/Public Domain? By your standards, I shouldn't have wasted my time reading it then and someone shouldn't have wasted their time writing it. Though it may have very important points, the stance of the document reeks of FUD.

      By the way, who is "The open source organization"?

      --
      US Democracy:The best person for the job (among These pre-selected choices...)
    2. Re:Why Open Source is bad for you by ThogScully · · Score: 4, Insightful

      I feel like a fish catching a hook, but I'll reply for a bit. First off, this is off-topic. This story is about someone using opensource software in business services and wondering how to contribute changes/improvements back to the community while keeping his company's IP separated.

      Second, open source models for profit are not based on the sale of the software, so since opensource companies don't sell their software, don't assume they aren't profitable. You don't credit Red Hat and Caldera with any development, but they most certainly do contribute and make their money off of both support and the package they sell their OS in. They prepare everything for a user to have a complete OS and that requires many tweaks to everything for uniformity and integration. They also develop and maintain OS updates as patches become available so their users can update their systems.

      Your discussion against why opensource software is not better than commercial is only in talking about how gcc is not up to par with commercial compilers, but you haven't proven that point. As a cross-compiler, I'll bet gcc is probably one of, if not the, best out there. I guess it won't compile as well for a P4 as an Intel designed P4 compiler, but those details are tough to notice and not so applicable. Then your argument here trails into how there aren't enough qualified contributors in the opensource world to make competitive software, while I would suggest that there is more qualification in the opensource world. Since you didn't support your argument, I won't support this to save space and at least match the convincing-ness of your argument.

      You say that opensource software was not responsible for the internet's success, but open protocols were. The first step was open protocols with clear definitions. The next was software to implement them, which is still largely opensource. Apache, BIND, sendmail are always at the top of the list and I promise if you turned off every Apache, BIND, and sendmail server right now, you wouldn't bother trying to use what's left of the internet.

      By the way, how does Netscape's contributions to opensource help them make a profit? I've never felt inclined to buy Netscape's enterprise servers simply because I use Mozilla.

      And this document won't be recopied or redistributed by me, as I'm not as willing to make a fool of myself like you have. But then again, I did bother to write this long reply.... oh well.
      -N

      --
      I've nothing to say here...
  8. Re:Simply put: I DO by pubjames · · Score: 3, Interesting

    Well, sometimes I will be working with a OSS software package and I see a way to make a little change to make it better, or fix a bug. Why should any employer/client worry about that?

  9. A quick list by Anonymous Coward · · Score: 5, Funny
    • Don't ask for permission. What they don't know, can't hurt them!
    • Be like Nike; Just Do It! Need to write a routine for the internal process? Just slap the GPL on top and release it on Sourceforge.
    • Make use of the resources available. Do you not have enough time to work on your own projects? Just circumvent the firewall and telnet to your home machine. The office is more comfortable, anyway.
    • It works the other way you know. Need a routine for an internal project? Just use it and release the changes.
    • If all else fails; lie. Claim it wasn't you. Cover your tracks. Call the BSA if you need a diversion in a hurry.

    Thats what I did when I was at SCO, anyway!
  10. And in other news... by Anonymous Coward · · Score: 5, Funny

    ...How to run an ebay business selling your company's items

  11. Government Copyrights by agentZ · · Score: 4, Informative

    Not always. As an employee of the US Government, my work is not eligible for copyright protection in accordance with 17 USC 105.

    Thus, the programs I've written and been allowed to distribute are available as public domain. You can check out my programs for computer forensics and system administration, foremost, and md5deep, on Sourceforge.

  12. Well by drinkypoo · · Score: 4, Insightful
    IANAD (Developer) but it seems to me that you need to have a contractual agreement with your employer to allow you to contribute code written on company time back to the particular projects on a case by case basis. You are most likely to succeed if you go to them and say, "I have been downloading, customizing, and using these GPL packages, these are the nature of my customizations (...) and I would like to contribute the code back so that it can be reviewed and improved upon by others rather than by me."

    Ultimately, anything you've done on company time is owned by the company, and you have no rights to it whatsoever, NDA or no. Your contract may grant or revoke various rights, of course, where not prohibited by law. But I would definitely go in assuming that all that code belongs to the company and you have no right to distribute it without formal written permission.

    --
    "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
  13. This question... by jmu1 · · Score: 4, Informative

    gets asked a lot around here. And the answer is always the same: Talk to your legal department. There isn't anything else you can do.

  14. Come up with a patch list by DeRobeHer · · Score: 4, Informative

    When we're modifying open source programs for use in our environment, we try to come up with two different types of patches; patches that enhance the package wether they be with new features or bug fixes, and patches that are only there to support local conventions and tools. We rarely submit the local patches back to the development team of the package, but if we feel that the enhancement types of patches will help out the project, we'll submit them back.

    --
    Donald Roeber
    Generating 2048 Bits of Randomness...
  15. Re:Simply put: I DO by dreamchaser · · Score: 4, Insightful

    Because you are doing it on their time, not your own.

  16. terms of employment agreements by Anonymous Coward · · Score: 3, Informative

    the company i work for has a term of employment agreement that i had to sign upon hire. it specifies that the employee is forbidden (except by written arrangement) from participating in activities that conflict or compete with the company's business. Example would be contributing to open source software that competes with your company's product.

    these kinds of agreements is probably common practice.

    if in doubt, you can ask for permission. if you aren't granted permission, then you have a decision to make.

  17. on your company's computer? by brlewis · · Score: 3, Informative

    According to title 17, an employer owns the copyright to "a work prepared by an employee within the scope of his or her employment." I don't know the case law myself, but I wouldn't expect this to be measured by whether you're using the company's computer, any more than I'd expect they would hold copyright to all phone conversations made on company phones.

  18. Re:Simply put: I don't. by Ngwenya · · Score: 3, Insightful
    I'm a consultant, paid for my time and the IP I develop. I would not dare to risk cross-contamination by doing anything more than downloading and using open-source packages at the office.

    Clearly that is your right - but I would venture that you are losing (or at least lowering) one of the essential values of Open Source: the ability to lower support, development and maintenance costs by having them amortized amongst the various businesses that to whom you might consult.

    Moreover, I have yet to see a reputation tarnished by having contributions accepted to high calibre projects in a peer-reviewed manner.

    When you mention cross-contamination, do you mean that you fear that you might put a client's IP into software which you subsequently release? Surely your client would have the right to refuse publication rights for the code (since the IP wasn't yours to give away)? Speaking flippantly, is it that you figure Open Source stuff would get you found out more quickly than a release of closed source kit? :-)

    --Ng

  19. Forgiveness easier to get than permission? by Saucepan · · Score: 5, Interesting
    From past experience I've found that asking upper management for permission to contribute code results in them hemming and hawing, thinking about it for six months, and eventually just saying "No" when pressured for an answer.

    This makes sense when you think about it from their risk-averse perspective: releasing even small pieces of otherwise-useless specialized code is all downside and no upside.

    On the plus side you might might improve goodwill with a small number of open source developers. But on the minus side you might be exposing the company to liability, accidentally revealing sensitive information, or inadvertantly helping your competitors. Plus, management always has to worry about shareholders second-guessing them -- possibly resulting in a shareholder lawsuit -- if the IP you give away is later perceived to have been very valuable.

    Given all this, a dangerous but more pragmatic idea might be to just go ahead and contribute at least the small stuff like your patches and bugfixes. As long as you have no official policy forbidding this you can point out that it's just the standard way things are done when working with open source tools.

    Let me be clear that I am not actually advising anyone to do this. More just.. thinking aloud.

  20. What! by PS-SCUD · · Score: 4, Funny

    I'd never do something so dishonest as to develop OSS on company time. I just look at pr0n and DL some music on Kazaa ;-)

    --


    "Much work is lost, for the lack of a little more." -Edward H. Harriman
  21. Government Copyrights in Canada by IncohereD · · Score: 5, Funny

    Lucky bastard....Her Majesty the Queen of England of all people holds the copyrights on MY code. :)

    1. Re:Government Copyrights in Canada by GoofyBoy · · Score: 3, Funny


      But in exchange, you get full rights and privliages as a loyal British citizen!

      --
      The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
  22. A cautionary tale by Anonymous Coward · · Score: 5, Interesting

    I'm posting AC for my own safety. I made changes to an open source package for my employer. Since the changes were for an internal package (we didn't release binaries to the public) I was told by my boss that submitting the changes to the package maintainer would be a violation of my NDA. I discovered after I left the company that my changes were eventually submitted to the package maintainer, and that my boss had taken credit for them.

    The moral of the story: get the company policies in writing before you start making changes to an open source package.

  23. Re:Simply put: I DO by Anonymous Coward · · Score: 3, Interesting

    but if what your doing is only helping you to perform your job better, what's wrong with that?

  24. Do the Right Thing by hobbs · · Score: 4, Interesting

    Of course, defining the Right Thing will in the end be up to your managers, but influencing their opinion is important.

    First off, do they realize what value they are already getting from open source, or was that snuck in the door? The former would make life easier (for everyone, since more PHBs will realize the value of OSS).

    One thing you don't want to do is to sneak behind your boss' backs and contribute what is unarguably company IP back to OSS without their permission. This can cause headaches down the road that could have been avoided.

    Setting criteria for contributing back to OSS that you are enhancing is much easier than releasing OSS in the first place (IMO), and, yes, I have worked for enlightened companies that blended both well. It all depends on what your company does (industry focus) and where it values its IP. Generally though, if you have just enhanced OSS, returning those enhancements should be a no-brainer (and required by some OSS licenses). Again, that is really a no-brainer only if management knew you were using OSS in the first place.

    For major enhancements, try to value it from your company perspective. If you were (eg) a video codec software company and had just made changes to a BSD video codec that gets 10x compression improvement with no quality loss, is it really worth your while to release that back immediately? I know some will argue that all software must be free, but how many of them are gainfully employed based solely on the free software that they develop (read: I don't think the model for just selling support sustains itself). IOW this isn't intended to start religious wars, just to make you think about what IP really has value to your company, and what you should be more readily willing to share.

    Completely new software that you might want to release under and OSS license is similar to the above. First off, if you company isn't OSS aware, make them. Then discuss what things you don't want to release for core IP reasons, and what is good to release.

    Remember that just releasing code doesn't raise the jollies of most corporate types. It usually has to have a purpose, and company brand awareness is a large part of that. Making or enhancing OSS software can be very good guerilla marketing for a company. It's perhaps not the same as dot.bomb hype levels, but it still has value for brand awareness, recruiting, etc.

  25. Re:Simply put: I DO by Ngwenya · · Score: 5, Insightful
    Well, sometimes I will be working with a OSS software package and I see a way to make a little change to make it better, or fix a bug. Why should any employer/client worry about that?

    Vicarious liability, for one reason. Your employer (in most jurisdictions) is at least partly responsible for your actions whilst you are in their employ, and on their time. It hardly seems fair for them to be expected to assume liability without having the capacity to mitigate it, does it?

    And all the disclaimers in the world won't help you if a case can be made for malicious code being deliberately released - your company would still be accountable.

    --Ng

  26. Get it in writing! by tundog · · Score: 4, Informative

    We want to make sure we get clarification about what is or is not covered by our NDAs

    IANAL but here goes...

    This one is kind of obvious to me, but an NDA is an Agreement between two or more companies that basically says 'I'll show you mine if you show me yours' and legally binds each party not to tell anyone else about it. I try to avoid these because I'm always paranoid that the other company will tell me something I'm already working on and later try to stake a claim on what's mine.

    Simple answer to your question: Before you send ANY code into the public domain get your boss to sign off on EXACTLY what you are releasing. Otherwise, even if you get the OK you could be in hot water later if your boss backs out on you.

    --
    All your base are belong to us!
  27. Merging by EnglishTim · · Score: 4, Insightful

    I would have thought the best approach is to suggest that you submit the patches so that you won't have to go through the pain of merging your changes in every time you want to get a new version of the software. If you phrase it as something that will help your productivity, I'd have thought they'd be much more likely to agree.

  28. Re:Simply put: I don't. by Vengeance · · Score: 4, Interesting

    It's not that I am charging for my IP. It's that the terms of my contractual agreement dictate ownership of work I create during my paid business hours.

    I personally do not have a moral or ethical quandary with opening up my development process, busting a hole in the firewall to allow CVS or at least SSH access, and making wholesale changes to open source projects on company time. I just don't want to be the subject of a 'Your Rights Online' story here.

    --
    It was a joke! When you give me that look it was a joke.
  29. Repost by Anonymous Coward · · Score: 5, Informative
    It seems you've posted this article (from 1998, not 1999) a few times already.

    Do you work for Microsoft?

  30. Re:Simply put: I DO by 1u3hr · · Score: 3, Insightful
    And all the disclaimers in the world won't help you if a case can be made for malicious code being deliberately released - your company would still be accountable.

    Legally sound, but immoral and practically insane. The same argument could be made for preventing you from doing almost anything you don't have to do, regardless of how public spirited.

    And in particular, when in the history of this world, has "malicious code [been] deliberately released" as part of an OSS?

    The upside for the company is an increase of good will, which transates into sales.

  31. Advice from the HA-Linux list by Medievalist · · Score: 5, Informative

    Alan Robertson, who maintains the heartbeat package and works for IBM, recently posted to the ha-linux list on this subject.

    Alan does not accept patches to the heartbeat code that were developed on company time unless he receives a disclaimer from somebody at the company.

    This is obviously spoofable, but it's probably a good way to legally protect the code -- Alan can honestly say he received it in good faith, which keeps IBM's lawyers' from breathing down his neck. It's kind of weird for me, though, I have to send a disclaimer giving myself permission to send in a patch....

    So, to answer your question: explain to your CEO why helping the OSS community helps you to help your company, and get her/him to sign off on a policy that allows you to do so. Ask for legal authority to be delegated to yourself (or your boss) to license or assign corporate intellectual property to open-source projects. Then have HR propagate the policy to your co-workers.

  32. Re:Simply put: I DO by GoofyBoy · · Score: 3, Insightful


    Then you should have no problem in formally writing up to them what you plan to return to the Open Source project.

    Outline exactly what you intend to send the maintainer and why it benefits your job/the company.

    Just don't do it because you can't see why you shouldn't. Your boss might have a different opinion.

    --
    The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
  33. Careful! by Austerity+Empowers · · Score: 3, Interesting
    When I joined my present employer I had to sign a big page of legal nonsense about not joining competing companies for 3 years after I quit/get-fired. I also had to sign away that every single thing I do (including this post) while employed here is company property. At work, at home, all times of the day... To legally release open source code I would have to write it, convince our legal department that it's useless to the company. After about a year or so of fighting very unintelligent executives I may be given permission to own my work, and thus release clean, GPL code.

    So if anyone wonders why nothing good ever gets done from our company, this is why.

  34. Been thre, done that - some advice by Samrobb · · Score: 5, Informative

    Where I'm working right now (TimeSys), I've been involved in contributions to Eclipse and Cygwin. Here's some advice:

    ASSUME THAT YOU ARE NOT ALLOWED TO RELEASE ANYTHING WITHOUT PERMISSION.

    If there's no clear policy already in place, ask. You probably don't have the authority to act as an agent of the company with regard to making decisions about IP. (If you don't know for sure whether you have that authority or not, you should assume not until someone tells you otherwise.) Keep pushing the suggestions/requests up the chain of command until you reach someone who has the authority to say "yea". They may still tell you "nay", but at least you'll be getting a decision on the matter instead of an "I can't make this decision, I don't want to bother my boss, so I'll just say no" response.

    START WITH SOMETHING SMALL.

    In my case, it was getting permission to submit patches to correct bugs - very small, very simple, very non-threatening things. The argument was that we could submit the patches, or go through the pain of developing the same patches again with each new release of the software we were using. That's a good way to get the foot in the door: show that there's a benefit to submitting patches that outweighs any perceived risk. If you can show that you spend X days out of every release cycle generating the same ol' patches again and again, it's an even more convincing argument.

    DON'T PUSH TOO HARD.

    For some companies, this is a big step to take. Let the folks who make the decisions think about the idea, answer their questions honestly, and be persistent without harassing them every day about the issue. You don't want to have them tell you "no" just so you'll quit bugging them.

    BE HAPPY WITH WHAT YOU GET.

    I don't mean that when you get the first "no", you should give up. You need to be reasonable in your expectations - IMHO, submitting patches for bug fixes is fairly minor, and the reaction to that request should give you an idea of how receptive your maangement might be towards the idea of more substantial work & contributions.

    My employer lets us submit bug fix patches freely for one project, at the developer's discretion. Minor feature additions in the same project require approval, which is generally easy to get. Other projects require management approval for all patches, no matter waht. Some projects that require copyright assignments are still in the "we're considering it" phase, and may never be approved. We've contributed at least one large chunk of original code to a project, and are considering doing it for a couple of others, as well, because while we want the software to have feature X, we don't want to have to maintain feature X. That's a pretty good argument to try if you're trying to get approval to submit a patch that adds a feature or functionality to an existing project :-)

    --
    "Great men are not always wise: neither do the aged understand judgement." Job 32:9
  35. I added an explicit OSS clause to my contract by phamlen · · Score: 5, Informative

    I'm also a consultant, working for a not-for-profit, and I added a specific contract clause allowing me to contribute to OSS.

    The big code issue for my client was that they wanted explicit ownership of the code. They didn't want partial ownership, or to give me the rights to reuse the code, etc. I wanted the right to reuse what I developed elsewhere. We ended up compromising with a clause that allowed me to contribute any "fixes or improvements" to open source code back to the community. Interestingly, they were quite willing to accept this clause at contract time.

    So I actually have an explicit contractual clause that allows me to contribute back. It makes me happy. :)

  36. Re:Simply put: I don't. by Chibi · · Score: 4, Insightful

    What's the problem here if you are paid for your time?

    Just bill for the time you put in on submitting patches to GPL/Open Source software.

    It's a reasonable expense and you offer a more "standard" industry solution than a near worthless one man spagetti job of code that has no community or testing infrastructure (i.e. many eyeballs)



    Try explaining to a client how you just charged them to add some functionality to something that will be used by others for free. It's great karma, but most suits aren't too interested in karma...

    Another problem is that most people are more interested in short-term costs. Look at all the publicly-traded companies that will lay off people in order to boost their stocks in the short-term. The only people that really care about long-terms costs are either people in direct ownership or people with some level of perspective. Most grunts these days are probably figuring they won't be around at a specific company for long (whether it's their choice or the choice of someone else). And the best way to look good quickly is lowering short-term costs...

    --
    If all you have are silver bullets, everything looks like a werewolf.
  37. Re:Simply put: I DO by dreamchaser · · Score: 4, Insightful

    Not in my experience. Some do, some don't. Many people don't even have contracts, but company policies usually exist regarding IP that is produced while employed at said company.

    In some cases those restrictions even extend to one's free time. If you work for a company that develops software and decide to write some OSS on your own time, you could very well be putting your job at risk.

    The moral: read the fine print before signing and/or going to work someplace.

  38. Get it in writing by kjs3 · · Score: 3, Interesting
    Having spent lots of money with lawyers over this sort of thing...


    First let me say that there is a distinction between "what is right" and "what is legal". Many things that are not legal are right, and vice versa. I'm not interested in getting into a lot of "but that's not right!" arguments; I'm simply relating what the legal realities are as I understand them.


    The only way to really be safe is to write down exactly what it is that you intend to contribute and get an officer of your company (or other superior who clearly has the authority to commit the company) to sign off acknowledging that the company will make no claims against your contribution. Stick to what has been agreed to, and get written addendums if there is "scope creep" on your open source project.


    If they won't sign off in writing, you can assume that they will take action of some kind against you if you decide to do it anyway. As my lawyer used to say "contracts aren't for when people are happy with one another". Might be a good idea to look at other options (of employment, if you're committed is to your OSS project).


    I would also note that unlike some wildly misguided people I've heard recently, you cannot simply take something you don't own (in the legal sense), release it with a GPL notice on top, and be free and clear legally. Sure, that code can't be "called back", but you (and people who use your code assuming you had the right to apply the GPL to that work) might very well find yourself in court. Ownership of the code (and thus who has the right to determine the license) is determined by the contract you entered into, and the courts will decide your fate based on that.


    Be aware that some employment contracts state things to the effect that anything you do "in the field" can be claimed by your employer. Thus, just because your contribution is done on your own time with your own equipment, you still could be liable for action. Know exactly what your employment contract says (hopefully you did that before you signed it). Have a laywer (your own laywer) explain it to you if you aren't very familiar with contract language.


    Also note that simply not signing an IP agreement does not automatically absolve you of its terms. Look for other employment paperwork that says things like "by accepting employment you implicitly agree to all our required employment contracts". I've definately seen people bit hard by this. If your employer has an IP agreement, then negotiate the terms you want and sign that so that all is tidy and legal. Again, consult your own lawyer to know exactly where you stand.


    Know your rights under state law. Different states have wildly different interpretations of the strength of employment agreements. Contract language which would bind you up in one state might very well be tossed out as onerous in another. Consult a lawyer.


    You do not want to litigate over this; you want to avoid putting yourself in that position. Even if you win, it's generally very expensive, annoying, frustrating and you'll often as not loose the job as a result. Don't sue "on principle" unless you know you have enough money, time, etc., to survive the process (including the possibility of loosing...no matter how strong you think your case is, the legal world is bizzarro world, and outcomes are not always deterministic). Special Fact - generally, if you sue your company (e.g. to claim ownership), and they decide to countersue you (say, for breach of contract), you won't be able to drop your suit (even if you run out of money), unless the other party agrees to it. Hint - they won't unless you back down.


    Lastly...do not simply take your managers verbal word that there will be no problems. Get it in writing. There is a doctrine of "verbal contracts" (I suppose "implied authority" also plays here) under the law, but they are difficult to make stick, especially if the other side is determined to invalidate it. OTOH, "Paper has a perfect memory", as one of my old biz partners used to say.


    N.B. - I can speak only for the U.S. There are different subtleties elsewhere...

    N.N.B. - IANAL, nor do I want to be...

  39. Re:It's simply a matter of paranoia and caution by sharekk · · Score: 4, Informative

    This only works so well though. Many companies have small print that they basically own your brain while you work for them. Even IBM, which pays people to work on open source code has some paperwork for you if you want to work on your own projects. I believe it's fairly straightforward as long as you're not making money off something that looks a lot like your job but you Do have to fill it out. It does make sense from the company's perspective - they don't want to pay you to work on some propriatary code and then have you go home and use the expertise they paid you to gain to apply the same features to a free product that's their competition. Sadly I don't know the actual process one has to go through so I can't be of any help to whoever asked this.

  40. there are many factors to consider by sir_cello · · Score: 3, Informative


    * you mention that you are currently customising open source software, does this mean that you are legitimately honouring the licenses associated with that software ? if not, then that should be your first step. the choice here is simple: either honour the license, or don't use the software. this may require you to make available your modifications.

    * you really need to write up a business case: why is in the companies interest to do this ? will it be "pr" ? will it cost ? will it cause legal (liability) issues ? will others run with the software and turn it into something better (free labour for you) ? does the work required (to package, make available, etc) outweigh the costs ?

    You need to answer these questions in an intelligent and reasoned way before someone else (i.e. your engineering manager / etc) is going to allow this to occur.

  41. Re:Simply put: I don't. by mcrbids · · Score: 4, Interesting

    I'm a consultant, paid for my time and the IP I develop. I would not dare to risk cross-contamination by doing anything more than downloading and using open-source packages at the office.

    As a fellow consultant, I have a few questions for you:

    1) Do your clients require that *you* wrote it, or that the thingamajig works?

    2) Do your clients mind if sections of their codebase that aren't part of the core deliverable (libraries and the like) improve with time without further investment on their part?

    3) Do you read the licenses for the stuff that you develop in proprietary software to ensure that "contamination" is not happening there, too? Some of the EULAs for compilers and IDEs can be quite frightening when you actually READ them.

    I use *alot* of GPL and LGPL stuff in my work. The key is to ensure that the GPL stuff is called as an external process, (so it's effectively its own program) and the LGPL stuff sits in its own, separate file.

    I contribute changes and improvements constantly.

    --
    I have no problem with your religion until you decide it's reason to deprive others of the truth.
  42. you're so fired by joe_bruin · · Score: 4, Insightful

    if you were my employee, and you wasted your time writing 'md5deep', you'd be fired. this is a 5 minutes shell script.

    md5deep, reimplemented in shell, for your benefit. not tested, i'm sure there are some bugs. yes, it could use refinement, but this is a one minute job.

    recursion:
    $ find . -type f | xargs md5sum

    time estimation:
    #on my machine i get about 40 megs per second
    #using md5sum (openssl is faster)
    echo "`du -sk | cut -f1` / 40000" | bc

    1. Re:you're so fired by gurudyne · · Score: 3, Informative

      And, the shell script for Windows is????

      --
      Hey, Mom! Is it beer, yet?
  43. Re:Simply put: I DO by ClippyHater · · Score: 3, Insightful

    The moral: read the fine print before signing and/or going to work someplace.

    Or, in my case, thank GOD! that someone FINALLY called me for an interview and hired me: sign nda/what-have-you, and begin working and being paid (hurray!!) again after 18 months. It's a tough job market for some, and we can't be too choosey in what we'll accept in an nda/what-have-you.

    But if you want to keep your job, definitely talk over everything that even BARELY seems questionable, even things you consider non-questionable.

    Until there's another tech bubble, I'm super-gluing my butt in my cube. I'll retire the day they find my bleached white bones slumped over my keyboard.

  44. Your own time by msobkow · · Score: 4, Informative

    Clauses about owning what you do on your own time don't usually hold up in court, and I've yet to run into a client who wasn't willing to stroke that section out of the contract when I explain why it's an issue for me and my career.

    The two places I've worked that leveraged OSS were good about posting their enhancements, one works directly with the developers for a key OSS product they use. (It's been a big benefit to both -- the OSS developer has been adding features they need, and they've been providing him a "real life" debug environment with a highly skilled team and solid feedback.)

    I've always specifically steered clients away from GPL libraries, as their business IP isn't worth risking when there are LGPL (or equivalent) libraries that do the same job. Rah-rahs for the GPL and all that, but banks and financial companies aren't even going to consider putting their internal processing systems out as GPL software, and don't qualify for internal-use-only exceptions in most cases.

    --
    I do not fail; I succeed at finding out what does not work.
  45. I hope this guy doesn't work for IBM! by Jboy_24 · · Score: 3, Informative

    With the current SCO hub-bub, I think every developer who thinks about submitting code developed at work and every developer accepting new code from outside developers realize that the code you are submitting is the property of the company you work for!

    Ultimately its there decisicion, if you feel like doing it without permission to 'Help' the open source community you are actually hurting the project and community almost beyond repair.

    Unless you get writen signed off permission from someone who can give permission, 5-7 years from when you submitted the code, your company can still claim ownership to that data. Right now your boss may say "go for it!", 5 years from now, you and him are probably gone and forgotten, yet the company can still sue the project you submitted to because it contains their property.

    Please, please if your not sure, don't submit!

  46. Contributing work-derived ideas to OSS? by raw-sewage · · Score: 3, Insightful
    This is slightly off-topic, yet somewhat related... What about contributing ideas or concepts to open source that were developed at your place of work?

    A co-worker and I were having this discussion with regards to the SCO vs IBM case: say I'm developing some technology at work, a state-of-the-art journaling filesystem for example. Now I go home at night and work on an open source journaling filesystem. All the code between work and open source projects is separate (i.e. absolutely no code sharing). However, there are certain concepts and ideas that I will inevitably borrow from my work project and put in the open source project.

    Now we have a potential SCO vs IBM situation on hand: my company finds out that there is some open source using very similar technology (to their own patented or copyrighted work). My company is going to want royalties for this!

    Although a lot of us open sourcers are taking the SCO vs. IBM situation lightly, if it does happen to go in SCO's favor (either by court decision or settlement), it's sets a precedent for companies to go scouring all open source code for possible IP infringement. This will scare corporations away from open source in a heartbeat.

  47. Re:Simply put: I DO by Narcissus · · Score: 3, Insightful

    I guess that all depends on the situation. I work in a relatively small IT company (150 - 200 employees) and we started using an OS project inhouse.

    We started to make changes and were wondering about what to do with them. Not a problem, I emailed our department manager and the CEO and told them what we wanted to do.

    I now have an email direct from my CEO allowing me to release any code I see fit for that project.

    I figured that it would be easier to get permission beforehand than trying to explain it all once someone questioned it...