Linus Adopts Enhanced Tracking Process

millette writes ""Under the enhanced kernel submission process, contributions to the Linux kernel may only be made by individuals who acknowledge their right to make the contribution under an appropriate open source license. The acknowledgement, called the DCO, tracks contributions and contributors. The DCO ensures that appropriate attribution is given to developers of original contributions and derivative works, as well to those contributors who receive submissions and pass them, unchanged, up the kernel tree. All contributors are called upon to "sign off" on a submission before it may be considered for inclusion in the kernel." From the press release. Also seen in the New York Times"

Comments

Oh boy.....

[wpiman]

Software methodology comes to open source.... Mind as well can the project now.....

Re:Oh boy.....

[dotz]

Well, it surely comes, but only to *Linux*, not opensource. And, while we're at operating systems: *BSD projects use both CVS and bug tracking system from a long, long time. It's Linus "dislike of versioning systems" (or perhaps, being resistant to good advices), which made Linux-SCO claims as easy. With FreeBSD Web CVS interface, you can do usual things you can do with CVS. For example, review all commits to /README in FreeBSD (just click here) in the last 9 years. Responsible people, commit dates, commit messages. SCO claiming they did the changes? Don't think so. How about Linux? Yes, Bitkeeper repository. Since when? 2.4.x, if I remember correctly... and the code was already above 20 MB tgz by that time. Pretty late. Well, better late, than never. I'm waiting to see Linux kernel having a "core team", and a central bugzilla... not the mailing list with patches.

Re:Oh boy.....

[joeljkp]

But the kernel already has a central bugzilla: bugzilla.kernel.org

Re:Oh boy.....

[dotz]

Hmm, I wonder if should I reply rather with "Ignorance is strength!" or "See? I've told ya!". Well, thanks for pointing out the link... good to see Linux getting better and better. PS: perhaps I wouldn't comment this article such way (by comparing Linux to BSD), if not all those nice people, that called me a troll each time I've pointed out, that having no version control system & developing entire OS basing only on patches submited on mailing list is... well.... unwise :)

Great idea

[l0wland]

Hmm, did the toothfairy whisper this in his ear last night?

Re:Great idea

[l0wland]

You had too much coffee today kids, it was just a joke....

Re:Great idea

[jlp2097]

Don't get it? Look here.

Re:Great idea

[ZioCantante]

Do you really mean toothfairy didn't invented linux?
I simply can't believe it. She's such a cute girl

Are you saying that Santa Claus did the most of the work?

Re:Great idea

[Patrik_AKA_RedX]

Damn, I should have known the toothfairy was cheating on me. Collecting childrens teeth at night, right. I should have known she was lying.

You just can't trust fairies these days...

Re:Great idea

[vijaya_chandra]

It's a sad thing in a way

Because from now onwards Santa Cruz err... Santa Claus would have to move around with a bag full of DCOs instead of the gifts for children

Speed vs. SCO-secure

[tfbastard]

I wonder how this will affect the speed of the development process.

Re:Speed vs. SCO-secure

[pheared]

And I wonder who will play Record Keeper with all of these DCOs. Kernel development is currently very distributed, but this calls for a single entity who can track the DCOs and be sure that they will never disappear.

Re:Speed vs. SCO-secure

[Anonymous Coward]

Linux kernel sooner or later will catch up with the rest of unix kernels. The issue here is that, open source model is based on stealing others' codes. People with religous minds were stealing their employers' source code and were submitting to the open source projects. In the SCO case, even a corporation like IBM was doing it. FSF was subpoened for this, but they refuse to cooperate.

This is great news for the open sources, sooner or later they had to stop people stealing and taking everything for free. IP laws are important.

Re:Speed vs. SCO-secure

[Stephen Samuel]

The intention is that it does not cause a big impact on the development process. It simply requires that anybody making a contribution claim responsibility for it. That way, you have something of an electric paper-trail for Linux.

The timing of this actually ties nicely with the SCO/IBM trail shenanigans. IBM has just made a request that the Court certify that It's use of Linux (and, in effect, anrybody's use of Linux does not violate any of SCO's purported copyrights. This would apply to pretty much everything contributed up to SCO's last disclosure in court (which would be, I think, sometime mid-April).

Given that the UNIX code base (read: SCOX) is the biggest threat to the legal cleanliness of the Linux, having a responsibility trail for everything that gets added in from here on in is a good fit. It only leaves about a one month hole in the documented cleanlines of Linux -- which shouldn't be that hard to close.

The groklaw article about the (proposed) change in the Linux submission process tries to explain (among other things) some fof the legal and technical implications of the change.

Re:Speed vs. SCO-secure

[iabervon]

The idea is that each patch will contain a set of headers with the names of everyone who passed it along. The DCO is always the same, and essentially amounts to stating "It is legal for me to pass this on and to license it to the recipients under the GPL". As the applied patches get archived, the headers get archived with them, so that the information is kept. People who keep their own trees keep the headers for the patches they applied, so that they can figure out where the patches came from, even if Linus doesn't pick up the change.

Re:Speed vs. SCO-secure

[iabervon]

This has been discussed somewhat on the mailing list. The process is really simple. You add a single line to your message when you send your (or someone else's) patch:

Signed-off-by: {you}

If the patch already has some, you include those as well. If you're merging patches, you include all of them. If you get a patch without this, you point the person at doc/SubmittingPatches, which will say to do this along with all of the other guidelines. The DCO is in the docs, and explains what it means it put this header on something; it's a pretty straightforward claim that you are legally permitted to license your contributions and sublicense contributions not your own and that you are doing so.

It shouldn't take much thought for people who move patches (if it wasn't true, people shouldn't be sending patches). It shouldn't be a large volume of data (one line/patch per step in the path). It should be easier to get people to remember than some of the other things already in SubmittingPatches. It should fit well with companies that do release management of their patches (the person authorized to release stuff signs off on it, possibly without listing other people, if that's the company policy).

There are nice side-effects: each patch which Linus commits will have the names of all of the contributors. If a contributor wants, it's therefore easy to track whether their patch got in, even if it got modified beyond grep's ability to track. People have often had a hard time figuring out if the patch they submitted to a maintainer actually got into mainline and when. Aside from the legal reasons to want the information, it's actually useful information in many situations, and it's trivial to provide, so it might actually speed up development.

Re:Speed vs. SCO-secure

[mhyden]

People with religous minds

Like, televangelists?

Re:Speed vs. SCO-secure

[cwernli]

Who will play Record Keeper with all of these DCOs[..]?

The next SCO.

They'll have to deal with all the contributor's legislations in their part of the world. There will be [no more|a lot less] "It's my idea, stupid".

The question is: will it be maintained in Bitkeeper or Ideamonger(tm) ?

Re:Speed vs. SCO-secure

[SphericalCrusher]

I don't see how it would slow down huge, commercial distros... but the smaller, lesser known ones, maybe.

I don't see a problem with this though, as long as it's free and we are acknowledged for our efforts in the development of the Linux kernel.

Another question though... does that mean we have to sign that if we just want to make our own personal distro? Even if it is for personal use? Hm, hopefully it's still open-source, ha..

DCO?

[havaloc]

The name is kind of ironic, yes? You say DCO, I say SCO, let's call the whole thing off.

Re:DCO?

[JosKarith]

Ironic, or a well-aimed dig.
I guess the only guy who really knows isn't telling.

Re:DCO?

[Anonymous Coward]

The name is kind of ironic, yes? You say DCO, I say SCO, let's call the whole thing off.

Maybe it's short for DeSCO :-)

Re:DCO?

[Anonymous Coward]

Should've been the

Source Code Origin Simple and Understandable eXplanation!

Then again, didn't Apple's developers get sued over something like that...

Like building a plane

[vchoy]

Reminds me of a documentary called "Why Planes Fall" which shows how planes are built. Each part, component and the tool used is logged to a person who created/assembled it. The system logs the tester/auditors which sign off on the work. It's amazing!

The only think I see different from this Linux process is that whoever created the code is not liable for anything that happens when you use the operating system. I see the 'auditors' of the Linux process are those that signoff on the code that are written by authorised contributors. There is no 'finger pointing' as so to speak when something goes wrong.

Re:Like building a plane

[Anonymous Coward]

The only think I see different from this Linux process is that whoever created the code is not liable for anything that happens when you use the operating system

Hmmm... I guess until they start using Linux on airplanes :-)

Re:Like building a plane

[femto]

> ...whoever created the code is not liable...

Is this something that will change? With improved contribution tracking, will the next SCO/liability/whatever suit be directed against individual developers?

What if someone uses Linux in a 'mission critial' situation and it fails due to a bug? The bug is then traced back to an individual developer who is sued. There are countries where 'denial of liability' is a weak defence. Can the fact that a developer didn't get paid, so there was no transaction between teh developer and user act as a defence?

Just playing devils advocate.

Re:Like building a plane

[nharmon]

So are you saying we need EULAs in Linux? Scary thought.

Re:Like building a plane

[tfbastard]

Wouldn't the users living in countries that doesn't acknowledge 'denial of liability' already have sued the living daylights out of every major software corporation by now?

Not that it's not a scary thought, just wondering how it would work.

Re:Like building a plane

[Anonymous Coward]

Linux already has a EULA, it's called the GPL.

Re:Like building a plane

[kpansky]

There already is a EULA. Its called the GPL.

Re:Like building a plane

[prisonernumber7]

Not needed. Because you do not have a right to use Linux as well as its accompanying utilities, the GNU tools - and if you don't have a right to use something, you can hardly sue somebody because that something did misbehave.

Except of course if you agree to the GNU General Public License, which the software is licensed under. Then you can use it. Obviously only under the terms of the GPL, which explicitly state that you must not hold the author liable for any damages caused.

Also interesting: In most countries of the world (such as my country, Austria), EULAs are not enforcible because the user does not get any more rights granted than what he got anyways when he bought the software. The GPL, in contrast, is enforcible.

Re:Like building a plane

[mattyrobinson69]

there's a GPL EULA in mandrakes install, part of the GPL is that there is no warranty and all that.

If that part of the GPL is invalid, then you should beable to do the person who's trying to claim from this on copyright infrigement (standard copyright law)

Re:Like building a plane

[x-router]

The GPL protects you for this sort of thing.

NO WARRANTY

11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.

12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Re:Like building a plane

[iamcadaver]

Kinda like building a bullet too.
US Marines fire marine built bullets, which is auditable.

-dan

Re:Like building a plane

[Minna Kirai]

There already is a EULA. Its called the GPL.

No. No. No! For the last time, moron, the GPL is not an EULA.

GPLed programs never demand the End User to Agree to a License before using the software.

Re:Like building a plane

[Narkov]

> What if someone uses Linux in a 'mission critial' situation and it fails due to a bug? The bug is then traced back to an individual developer who is sued.

Probably the same day gun makers get done over for someones suicide. ie. never.

Re:Like building a plane

[Minna Kirai]

Except of course if you agree to the GNU General Public License, which the software is licensed under. Then you can use it.

Wrong wrong wrong. If somebody gives you software, you can use it from then on. Once the files are in your possession, you can use them, unless you've somehow signed a specific prior contract promising you won't. The only things you can't do with software you possess is break other laws- primarily copyright, which in most countries prohibits you from copying (or redistributing copies) of a program without explicit consent from the author.

If you don't plan to give out copies of the program, you have no need to agree to the GPL, or even read it.

Now, I don't know Austrian law, but if there is something unique about it that requires specific permission from software authors before you can run their programs, you should've said so.

Obviously only under the terms of the GPL, which explicitly state that you must not hold the author liable for any damages caused.

Wrong. Go read the GPL before lying about it anymore. The GPL mentions there is NO WARRANTY, but just a statement of fact- reminding you that if you thought an author had offered a warranty, that no, she really didn't. It contains no "agreement" of the form "If you decide to use this, you give up all consumer-protection rights and can never sue me"

Re:Like building a plane

[Shimbo]

The GPL protects you for this sort of thing.

It does not. It just says that the warranty provided and liability are the minimums local law permits. In some places, that may be just meaningless legal boilerplate; ask a local lawyer.

However, I can't see individual developers being held liable by any sane judge for anything short of deliberately malicious coding.

Re:Like building a plane

[femto]

1. ... TO THE EXTENT PERMITTED BY APPLICABLE LAW.

12. ... UNLESS REQUIRED BY APPLICABLE LAW ...

So if local law doesn't recognise denial of liability, you're liable?

Given this condition, a claim for liability would seem (to me) to be allowed under the GPL. Thus one couldn't even declare the GPL to have been violated, claim the user was using your code without permission, and countersue for copyright infringement.

Re:Like building a plane

[xchino]

Well if you read the license that comes with the software you would see that it provides no gurantees and no warannty. If someone uses it in a mission critical environment and it fails, liability would fall on the person who implemented it. If you don't want to take that responsability use software that takes it for you, like QNX.

Re:Like building a plane

[xchino]

No, GPL is a license to DISTRIBUTE, not a license to USE. You may use GPL software any way you see fit, the only restrictions are on distributing it.

Re:Like building a plane

[femto]

However, I can't see individual developers being held liable by any sane judge for anything short of deliberately malicious coding.

Good point. It leaves me feeling a little uncomfortable though, as it would still require a defence in court.

I would think that if the developer did not accept compensation (money) for their code that might remove any liability under consumer law, as no 'transaction' ever took place?

There is also the curly question of professional indemnity. What if the developer is a professional, coding for free on the side? The judge might then rule that he/she should have known what he/she was doing and so find him/her liable for mistakes?

Re:Like building a plane

[defile]

So if local law doesn't recognise denial of liability, you're liable?

Sweeping "default liability" laws in this case would realistically limit the copyright holder's liability to whatever amount you paid them. Where free software is concerned, the amount is usually $0.

Of course, there are plenty of abusable laws out there, this is just a guess.

Re:Like building a plane

[femto]

This sounds like an answer!

So my strategy in writing free software should be to

1. write code though a limited liability company, or
2. write code and refuse to accept any form of compensation for the code.

Think I'll stop playing devil's advocate now, though I'm still a little uncomfortable with the possibility of a professional indemnity claim in the case of a professional coding for free 'on the side'. Might a judge rule that a professional cannot escape their professional obligations under any circumstances, including writing free software?

Re:Like building a plane

[julesh]

GPLed programs never demand the End User to Agree to a License before using the software.

You haven't used much Windows based GPL software, have you? A lot of them have installers that force you to agree to the GPL before it will install.

Rather pointless, if you ask me...

Re:Like building a plane

[prisonernumber7]

Wrong wrong wrong. If somebody gives you software, you can use it from then on. Once the files are in your possession, you can use them, unless you've somehow signed a specific prior contract promising you won't.

If you download software, then you are actively seeking to acquire that software. Nobody gives it to you. The software is at most being made available to you, but it is not given to you.

As a metaphor: If I leave my front door open anybody can go in and take stuff from my house. That does not mean that they may do so though. Since software is meant to be used that's a chewing gum point however, but let's get to that in a second:

If you don't plan to give out copies of the program, you have no need to agree to the GPL, or even read it.

From the GPL FAQ, on the question whether users have fair use rights on a GPLed program: "Yes, you do. "Fair use" is use that is allowed without any special permission. Since you don't need the developers' permission for such use, you can do it regardless of what the developers said about it--in the license or elsewhere, whether that license be the GNU GPL or any other free software license.

Note, however, that there is no world-wide principle of fair use; what kinds of use are considered "fair" varies from country to country."

So fair use is nothing generic and nothing you can count on. If there are liability problems you have a case that is beyond fair use in any event. In this case you must agree on the GPL to get what the license gives you in terms of warranty - which is, as you rightly point out, no warranty at all.

Wrong. Go read the GPL before lying about it anymore.

*shrugs*. So strong words. For the sake of clarity, "no warranty" can be considered to also mean "not liable for damages" (of course, it means other things too). Can you stop trolling now puh-lease?

Re:Like building a plane

[dustman]

For the last time, moron

Wow, that's a great way to talk to people.

the GPL is not an EULA.
GPLed programs never demand the End User to Agree to a License before using the software.

Yes they do. It is called the "GNU Public License", after all...

Before you can use any GPL'ed piece of software, you have to agree to the terms of the GPL. (If you don't, you don't have the right to copy the software, under copyright law).

The terms of the GPL are very "generous", but they are still terms that you must agree to before you are allowed to use the software: you have to agree that if you distribute the software (or derivatives) to others, you will also give them the source code.

Even though you are probably not making and distributing derivatives of the software, does not change the fact that you have agreed to these terms.

Re:Like building a plane

[schon]

A lot of them have installers that force you to agree to the GPL before it will install.

No, they don't. They may display the GPL, and present a button labeled "I agree", but (if you actually _READ_ the GPL) the GPL contains this text:

5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works.

So they do not "force" you to agree to anything.

Just because something is presented as an EULA, by someone who doesn't know what an EULA is, does not make it an EULA.

Re:Like building a plane

[runderwo]

Before you can use any GPL'ed piece of software, you have to agree to the terms of the GPL. (If you don't, you don't have the right to copy the software, under copyright law).

No, you're absolutely wrong. The person who made the copy FOR you had to agree to the GPL in order to copy the software. But there is absolutely nothing that you must agree to in order to use that copy that was distributed to you. At your option, you can reject the terms of the GPL, and you have the same copying rights that default copyright law gives you - the right to make one backup copy for personal use only.

Re:Like building a plane

[Anonymous Coward]

So you reject the license it was distributed under, and still expect support? Maybe I'm mistaken but I don't think that'll get you alot of rights.

Quickshot

Re:Like building a plane

[ErroneousBee]

Are you willfully misunderstanding the GPL?

The GPL only comes into effect when you distribute the software.

You may do what you like with the software, including modifying it. Only when you take a copy of the software or your modifications and pass them on to someone else does the GPL come into effect.

You may reject the GPL, you can still get support from someone who has accepted it (and hence is allowed to distibute).

Re:Like building a plane

[Sloppy]

The GPL protects you for this sort of thing.

Only if the user is using the software under the terms of the license. Most of the time, that isn't the case.

Re:Like building a plane

[dustman]

No, you're absolutely wrong. The person who made the copy FOR you had to agree to the GPL in order to copy the software. But there is absolutely nothing that you must agree to in order to use that copy that was distributed to you. At your option, you can reject the terms of the GPL, and you have the same copying rights that default copyright law gives you - the right to make one backup copy for personal use only.

Sorry, but I think you are wrong here... If a friend of mine burns a copy of Windows XP, he has violated copyright to do so, and MS could pursue him for copyright infringement.

But, under your argument, I might say that I am allowed to use this copy of Windows XP, and make a backup copy.

This is obviously not allowed, here's why:

All of computer software copyright hinges on the concept that copying the software from your permanent storage to your computer memory in order to run it counts as copying the work. Unless you agree to the terms of the GPL, you are not allowed to make this copy, necessary to run the software.

(link) (link) (link) (link)

Re:Like building a plane

[Minna Kirai]

All of computer software copyright hinges on the concept that copying the software from your permanent storage to your computer memory in order to run it counts as copying the work.

Wrong- unless you happen to live in Britain. If so, then you are correct, but you should've qualified your remarks as only applying to that one country, and not used the word "All".

Otherwise, in the USA for instance, people are allowed to make temporary copies of anything as necessary for normal use of a product. When you play a CD or DVD, for example, the machine copies chunks of data off the disc into memory buffers. But you don't need to agree to anything to play it.

Re:Like building a plane

[Minna Kirai]

How odd... you quoted me, and then wrote some stuff after it that had nothing at all to do with what I said. Why did you decide to do that? I'd think you had accidently replied to the wrong post, except that you actually pasted in my own words.

I mean, "fair use"? What's fair use got to do with anything?

Re:Like building a plane

[anshil]

Your absolutely right, I'm no expert in the american/british law system, but from the european one I know a bit.

There are everywhere exceptions for "openhanded" transcations (oneway). However it is still a transaction in legal sense.

Some points include:

* The receiver has no legal right on a faultless "object" whatsoever (most important)

* In cases of ambiguous interpretations in the contract of transaction it is always ruled for the giver. It is assumed the giver wants to give less. (For example if I present my purse to you, is the content of it also part of the transaction or not. In a generous transaction it would be of course ruled for me, in a give-and-reive transaction against me since I used the ambigous part),

* The giver may step back from the transaction in case of a misconception in motive. (I wanted to give it under certain assumptions which proved not to be true) (in normal transaction this is of course not possible).

and so on and so on

Re:Like building a plane

[Minna Kirai]

But, under your argument, I might say that I am allowed to use this copy of Windows XP, and make a backup copy.

No, unless you think you can keep a car that your friend gave you after he stole it. Even if "reciept of stolen property" wasn't a crime on its own, the police would still want things returned to their owners.

Naturally, once an illegal action occurs, most everything which derives from it is also illegal.

(link) (link) (link) (link)

Why did you post links that undermine your position? All of those links disagree with your statement, except for one of them which only applies to Australia (which I suppose would naturally have laws similar to Britain). They do however show that some lawyers are ready to argue for anything, even if they know it's wrong.

Here, I'll paste in the first 2 sentences from one of those links, to help you out:

1. In the opinion of the United States federal courts, digital software embodied in a computer's Random Access Memory (RAM) is sufficiently fixed to constitute a "reproduction" under the Copyright Act.1 As a reproduction, the creation of the RAM embodiment, or the loading of software into RAM, is a potential copyright infringement. However, a close reading of the Act and its legislative history reveals that a digital work embodied in RAM should not be considered a reproduction of the work.

This lawyer-stuff can be tricky, but you have to read a whole 2 sentences, and not just the first one.

Some of the other links support the idea that RAM copying might be illegal reproduction, but they do so weakly, and only contingent to the software having been licensed in the first place, which is not the case with typical GPL distribution.

The last paragraph of the Wikipedia page is also pretty interesting- although I can't respect that article too much, as the first paragraph is blatantly (and politically) wrong.

Re:Like building a plane

[E_elven]

>>the GPL is not an EULA.
>>GPLed programs never demand the End User to Agree to a License before using the software.

>Yes they do. It is called the "GNU Public License", after all...

You also forget that the EU in EULA is for 'end-user'. An end-user does not distribute the code further, and end-user uses the code and that's not what GPL addresses.

Re:Like building a plane

[Anonymous Coward]

"Fair use" is the basis of what you use a GPLed program under if you are not willing to use it under terms of the GPL.

Re:Like building a plane

[kasperd]

What if someone uses Linux in a 'mission critial' situation and it fails due to a bug?

How would that ever make individual developers liable? The developer did not build the mission critical system. And the developer did not intend his code to be used in that way. If you are liable for anything you made being used by somebody in a way it was not intended to be used, there is no end to liability. What if somebody connected a lot of rubber bands and used it for bungee jumping. Would the rubber band manufacturer be liable?

Re:Like building a plane

[runderwo]

Sorry, but I think you are wrong here... If a friend of mine burns a copy of Windows XP, he has violated copyright to do so, and MS could pursue him for copyright infringement.

But of course.

But, under your argument, I might say that I am allowed to use this copy of Windows XP, and make a backup copy.

Absolutely. You cannot be prosecuted for copyright infringement unless it can be shown that you willingly received an illegal copy. However, if you did know beforehand that the copy was illegal, you are then liable for conspiracy or contributory infringement.

This is obviously not allowed, here's why:

It would be less "obvious" if you would actually consult the copyright codes that you are handwaving your way around. http://www4.law.cornell.edu/uscode/17/117.html:

( a) Making of Additional Copy or Adaptation by Owner of Copy. -

Notwithstanding the provisions of section 106, it is not an infringement for the owner of a copy of a computer program to make or authorize the making of another copy or adaptation of that computer program provided:

(1)

that such a new copy or adaptation is created as an essential step in the utilization of the computer program in conjunction with a machine and that it is used in no other manner, or

(2)

that such new copy or adaptation is for archival purposes only and that all archival copies are destroyed in the event that continued possession of the computer program should cease to be rightful.

Re:Like building a plane

[Mike Hawk]

So EULA's are aggressive and the GPL is passive-aggressive. Its still an EULA if the End User has to Agree to a License to do something like "Modify...the Program or its derivative works."

Re:Like building a plane

[Minna Kirai]

Its still an EULA if the End User has to Agree to a License to do something like "Modify...the Program or its derivative works."

Still wrong! The key letter in eUla is U for User. To Use a GPLed program, you don't have to agree to ANYTHING. Microsoft claims that unless you agree to their eUla, you can't Use Excel at all.

The second-most important letter is E for End. "End" means you're the end of the line. The software stops here- you don't pass it along to anyone else. (You can't even resell it on ebay) But of course, the GPL gives you permission to be not just an End User, but an Intermediate Developer.

Re:Like building a plane

[defile]

Might a judge rule that a professional cannot escape their professional obligations under any circumstances, including writing free software?

Architects can be held personally liable if the structures that they design ever collapse. EVER.

Maybe we should do the same to programmers. Of course, how do you define "collapse" where software is concerned?

Existing source code?

[Ianoo]

Is this going to be applied to the existing kernel sources or just new submissions? I think it'd be quite a job to track down all the people who still have their names at the top of kernel files after all these years. Especially those who have died (there must be at least one) or companies that no-longer exist (quite a few).

Regardless, I wonder whether this will slow down kernel contributions? Here's hoping it won't. People will still be able to create unofficial patch sets (like mm, ck and love sources) to test their ideas before actually contributing modifications to the authoritative source.

Re:Existing source code?

[Anonymous Coward]

This process is really just a formalisation of what was already happening. It's more for the benefit of outsiders who don't understand how this currently works, and want a simple formal process. From a practical perspective very little will change.

Reference to original posting

[hussar]

This article seems to just confirm that Linus did what he said he was thinking of doing.

The original /. posting is here.

I'm not a legal expert, but

[denisdekat]

I keep saying this, and I am so surprised this is not broguht up more often, but if folks donate code to the project, are they not liable rather than the users of the project? I know I am talking about SCO, yes, it just seems so silly that anyone takes them seriously. Maybe this is a terrible metaphor, as I am only just starting to intake the coffee... but I sometimes thnk of this as if I gave someone a book, but inside the book there was tickets to a show. Then after giving the book I say to the person, by the way, I did not realize my tickets were there, can you pay up please? Sorry to rant, now back to the grindstone...

Re:I'm not a legal expert, but

[spungo]

Exactly! Thank you! With the SCO case I couldn't help thinking that even if IBM did bung some SCO-owned code into the linux kernel, any subsequent dispute is between SCO and IBM - users of that code - or anyone exposed to that source haven't done anything wrong and so deserve no legal retribution.

Bottom line - if you are a proprietary code outfit and somehow you have let slip some of your source to the World - tough sh*t!! You should have been more careful.

Re:I'm not a legal expert, but

[Anonymous Coward]

Anyone who knowingly copies copyrighted stuff without permission is liable.

Once someone like SCO has given fair warning (including sufficient evidence...), then people who persist in using their code without permission become liable.

Horay!

[91degrees]

Now all I need to do, is get hold of some code, claim it's mine, and I'm now officially the owner!

Now, what is this "Linux" thing? Does it run under Windows 98, or will I need to upgrade to XP?

"R.I.P.: The Counterculture Aura of Linux"

[Anonymous Coward]

NYT comes out of nowhere with this idiotic, inflammatory headline. It's disheartening that mainstream technology journalists are still attributing anarchy, punk rock and anti-establishment to Open Source.

DCO is a wonderful idea. Steve Lohr, on the other hand, needs to get his head out of his ass.

Re:"R.I.P.: The Counterculture Aura of Linux"

[mumblestheclown]

NYT comes out of nowhere with this idiotic, inflammatory headline. It's disheartening that mainstream technology journalists are still attributing anarchy, punk rock and anti-establishment to Open Source.

Yes, it's hard to figure out where they get their ideas, given the well-thought-out and mainstream ideas on copyright (not to mention perhaps-rarer but still around anti-GUI rants we see every so often) we see on slashdot every day. Yes, slashbots spend more time blathering about (as I am doing now) than writing code, but, like it or not, this is seen as a major orifice of the OSS community.

Re:"R.I.P.: The Counterculture Aura of Linux"

[Hektor_Troy]

Yes, slashbots spend more time blathering about (as I am doing now) than writing code, but, like it or not, this is seen as a major orifice of the OSS community.

And those of us in the know, know which end that orifice is located ...

Re:"R.I.P.: The Counterculture Aura of Linux"

[glazik]

NYT comes out of nowhere with this idiotic, inflammatory headline.

Yeah. It's particularly stupid since the tone of the article was positive, laden with Linus' quotes about how DCO will strengthen Linux, it's a good thing, etc. etc.

Re:"R.I.P.: The Counterculture Aura of Linux"

[Tough Love]

NYT comes out of nowhere with this idiotic, inflammatory headline. It's disheartening that mainstream technology journalists are still attributing anarchy, punk rock and anti-establishment to Open Source.

Translating into NYT-speak, it's a backhanded compliment: Linux is thus judged to be more suitable for the folks they write for. Of course there's the obligatory swipe about Linux being forced into this, but what the heck, if he needs to share his pain, let him.

The way I see it, it's nice that we've got the NYT trained so that every time Linux farts, NYT writes an article.

Is that third option missing something?

[Quantum Jim]

That is a pretty interesting certificate; I may end up using it too. However, the second and (esp.) third options seems a little unspecific: Shouldn't it require the contributing developer to name the origional work and its author(s)/entity(ies)? That way the lead developer could independently confirm that there are no copyright problems, if needed.

Re:Is that third option missing something?

[Anonymous Coward]

However, the second and (esp.) third options seems a little unspecific: Shouldn't it require the contributing developer to name the origional work and its author(s)/entity(ies)?

No. Read the third option carefully: "The contribution was provided directly to me by some other person who certified (a), (b) or (c) and I have not modified it." [emphasis mine].

Basically, the third option is geared towards people who maintain certain parts of the tree and get patches sent their way rather than straight to Linus. There will be a separate certificate provided to the maintainer.

The second option contains the phrase "as indicated in the file", which means that the origin is already recorded.

Re:Is that third option missing something?

[Quantum Jim]

Basically, the third option is geared towards people who maintain certain parts of the tree and get patches sent their way rather than straight to Linus. There will be a separate certificate provided to the maintainer.

Good points. It was always ingrained into me (as an engineering major) to document my sources for anything remotely borrowed. So it seems instinctually wrong not to require the contributor to cite explicitly his code's references. I considered that a sloppy developer could use the wrong source by mistake and infringe on someone else's copyrights. I'd feel a little easier if the intent of the certificate as well as each passage was explained in a preface like the GPL uses. It's always a good idea to be paranoid about copyright, I say. ;-)

The second option contains the phrase "as indicated in the file", which means that the origin is already recorded.

I interpreted that as saying that the license was in the file, not the original author's name or contact info. There could be cases where the copyright info changed or stripped such as the rumors of BSD code copied into Linux without proper attribution and vice versa. A "paper trail" could be used as defense against such accusations.

What this is not about

[The Pim]

1. This is not about a chain of trust. Nobody is expected to verify the identity or trustworthiness of anyone else.
2. This is not about preventing unauthorized submissions. There is no process for checking the provenance of code.
3. This is not about marketing. I'm sure Linus doesn't care if this helps some manager sleep at night.

What is it about? It's about putting information that was already mostly available (by scrounging in mail archives) in a structured form. So that the next SCO doesn't waste so much developer time, and (as a bonus) so that Linus can figure out which maintainer sent some code when debugging.

Not "attribution", but ACCOUNTABILITY.

[mumblestheclown]

First, it's pretty sad when the NYT scoops slashdot on a major piece of linux news like this.

But, more importantly, you have to realize--this has nothing to do with giving (positive) "props" to the kernel authors and everything to do with identifying sources of blame when it all goes to hell.

Forget whether or not you like software patents for a moment; the fact is that right now they exist. Previously, you could in theory contribute some patented or even copyrighted (direct copied) source into the kernel and it might go unnnoticed for years. Now, the theory goes, once the infringing bit is noticed, IBM or Autozone can't be sued as easily anymore--rather, what they will do is say "no, look - this piece of code came from monkeyboy332, a programmer in serbia".. sue him instead!

In short, this is a nice way for large companies attempting to wash their hands of responsibility for a linux kernel that they arguably have access to because it's open. In simpler terms still, this is corporate welfare by linus to try to win wider adoption of linux. It's not a bad strategy, but accept it for what it is.

It has nothing to do whatsoever with giving authors "credit." That is already well handled by other mechanisms.

Re:Not "attribution", but ACCOUNTABILITY.

[Thoguth]

First, it's pretty sad when the NYT scoops slashdot on a major piece of linux news like this.

for what it's worth, NYT didn't scoop it the first time slashdot posted this story.

Re:Not "attribution", but ACCOUNTABILITY.

[311Stylee]

First, it's pretty sad when the NYT scoops slashdot on a major piece of linux news like this.

Slashdot is a blog. The meaning of the word blog defines how slashdot operates: slashdot links to (mainly user submitted) news stories and webpages.
Therefore, it is the nature of a blog to always be "scooped".

Furthermore, slashdot is a bunch of geeks and nerds getting together on the internet... there is not much sadder than that to any "normal" people although I'll be the first to admit journalists may not fit that definition.

Re:Not "attribution", but ACCOUNTABILITY.

[LMCBoy]

Now, the theory goes, once the infringing bit is noticed, IBM or Autozone can't be sued as easily anymore

Except that neither IBM nor Autozone have been sued for using alleged "infringing" code in Linux...in fact, no one has.

Seems to me that this kind of "paper trail" will only be useful against a hypothetical litigator that points to a piece of code in Linux and said: "this code here, this infringes on my IP". It's not so useful against a SCO-like "we own it all, so pay up" FUD blitzkrieg.

Re:Not "attribution", but ACCOUNTABILITY.

[Rupert]

This is not a defense against software patents. If the compiled code infringes a patent, it infringes a patent, and the patent holder can stop anyone they wish from using it. It doesn't matter who contributed the code. The kernel infringes, and you need permission from the patent holder to run the kernel.

*That's* one reason why software patents are so evil.

Re:Not "attribution", but ACCOUNTABILITY.

[mcc]

Seems to me that this kind of "paper trail" will only be useful against a hypothetical litigator that points to a piece of code in Linux and said: "this code here, this infringes on my IP". It's not so useful against a SCO-like "we own it all, so pay up" FUD blitzkrieg.

Yes, but the thing is, the former is an actual, real legal threat, and the latter is legally harmless and only a threat in the PR sense.

The former is definitely worth protecting against. Yeah, so it's never happened before, that's OK, all the more reason to get prepared for this sort of thing now BEFORE a problem arises. And maybe there will be some small PR benefit side-effects as a result anyway.

Re:Not "attribution", but ACCOUNTABILITY.

[Tokerat]

...but you don't need permission from the patent holder to remove the code so that only one release version is affected at all. That is why SCO is so evil, they make these claims and refuse to show us the offending code (even though it's a copyright suit, not patent).

Under this system, you can also point the company at the true guilty party, instead of all of the Linux kernel contributors looking like a bunch of thieves thanks to some greedy-ass corporate fucktard looking to make a quick buck and even quicker market penetration by converting their business to a law(suit)firm, they can now say "Look, Bob Smith from this company contributed the code himself! Hey, wait, isn't he the one suing us?"

Re:Not "attribution", but ACCOUNTABILITY.

[millette]

I'm not too surprised to see slashdot getting scooped. I even started a category on my weblog called Slashdot ESP, for my Extrasensory perception skills. Of course, this time I cheated a little since I submitted this story myself...

Enhanced tracking process?

[Anonymous Coward]

Great. Just what we need. A way to track a specific category of spam.

Talk about feature creep...

SCO

[jb.hl.com]

Isn't this just like admitting that Linus has no idea what's in the kernel and SCO code could be in there?

Re:SCO

[Killjoy_NL]

No, to me this more sounds like a preventative measure, to make sure something like the whole SCO debacle doesn't happen again.

It could also provide a more improved structure for linux, but I'm not a programmer, so I don't know what the heck I'm talking about.

Re:SCO

[Hard_Code]

"admitting that Linus has no idea"

Yes. But the difference is now you can track who CLAIMED what was put in there. As long as the code is good and doesn't have any license patent issues, who cares if Linus knows. All we need is a way to backtrack and say: "Ok, you claim this code is bad? Well Bob over here signed it with this disclaimer so either you are wrong or Bob is wrong, but either way, Linux in general is not liable"

Re:SCO

[dylan_-]

No, though SCO are trying to spin it that way. It's what Linus said: they tracked down where all the code came from by searching through old mailing lists. It worked, but it was difficult and time consuming. This will make the whole process easier if they need to do it again...

Who would have thought anything useful could have come out of this whole charade...? ;-)

Re:SCO

[Anonymous Coward]

But that means Linus and co. didn't care before SCO if source code coming in was stolen or not. SCO's case is looking stronger and stronger now. Glad I'm using OS X, a system that accepts no "open source" contributions at all, thank god.

Re:SCO

[Killjoy_NL]

OH NO A MAC ZEALOT WHATEVER SHALL I DO I'm glad you are enjoying OSX, it looks like a good OS. I think that whatever happens, SCO will lose the case and will go down in flames :D

It's all in the timing.

[Artifakt]

The timing on this being formally announced is a bit unfortunate, in that it comes so soon after the new De Toqueville Institute article, but the whole procedure is a measured response to older situations (SCO), and has been carefully evaluated by a pretty sharp legal team.
Unfortunately, one of the basic doctrines of modern warfare is that you win battles by maneuvering within the decision making radius of the enemy. Right now, Linux is facing the problem of responding through the legal system, which produces such delays they end up looking like they are still fixated on fighting the last war. A good military-style strategy here would be to respond in some totally unexpected way, so that their detractors have to slow the pace of operations while they evalueate the new situation.
Such options are limited. For example, Linus could escalate by seeking criminal charges for defamation on the De Toqueville article, but the chance he could make it stick is what should determine whether that's worth persuing, and not just whether it would make 'them' blink.

Legal implications to coders

[wimbor]

Although I'm not an expert in law (and certainly not US law since I live in the EU with different laws regarding to this), my gut feeling says I would never, never, nerver ever sign a document like that even if my work would be 100% original and not copied.

Just the mere fact that you sign a document that proves you wrote part of the Linux code, makes you liable for litigation. If any company thinks its rights are violated by a Linux component they can easily sue the contributors of this (and more) components personally. Given the track record of US litigation, I would never sign it.

Signing the document means that the author of the code will have to seek expenive legal support in case a lawsuit is started. Even if he can prove in court the code is original and written by himself, the bill for legal advice can be quite substanstial. If an author programmed in his spare time, this means he personally is liable... personally as in 'with your own personal assets'...

As an employee of a software firm (or worker at any other firm), your work is done "acting as a part of the company". Hence the company itself and not the individual employee is (financially) responsible for his/her mistakes. In case of litigation the company will have to seek legal council and incurr the damages. In my country the company could try to sue the employee for the incurred damages afterwards, but it will have to prove very extensively that the employee made very serious professional errors. And even then, companies rarely do so.

But a private author is personally responsible with his own assets (wage, house, car, ...) for any damages. Since most of the programmers probably do not have their assets split between their personal property and some form of 'company property' this might get dangerous. Please excuse me for not knowing the correct legal terms for 'private property' and property as part of an "inc." or "ltd.".

Re:Legal implications to coders

[Anonymous Coward]

Even if he can prove in court the code is original and written by himself, the bill for legal advice can be quite substanstial.

Given the Linux community's track record, I would think it likely that many people would donate money to a caase such as this if the code was clearly original.

I'm sure there would be comparable yelling and screaming about an individual being targeted by a company as has been the case with the SCO debacle.

Re:Legal implications to coders

[pe1rxq]

Just the mere fact that you sign a document that proves you wrote part of the Linux code, makes you liable for litigation. If any company thinks its rights are violated by a Linux component they can easily sue the contributors of this (and more) components personally. Given the track record of US litigation, I would never sign it.


Signing a document aknowledging that you wrote it doesn't make you more liable...
Wheter you sign or not doesn't change the fact that you wrote it.
If you are liable after signing you were liable before. The signing just makes it a little bit easier for the other party to find you.
Unless you posted all your patches to linux-kernel as anonymous coward this doesn't change anything at all.

Jeroen

Re:Legal implications to coders

[jyristys]

That's an interesting point, but I think you are wrong.
People who sign their code with the new system are still not liable for any damages. You just give your code away for anyone to use, and that's it. So if someone doesn't like your code, they can find out who wrote it, but how are they going to sue you, what's your crime?
Writing bad code is not a crime, neither is giving it away. You are are only liable if you make malicious code on purpose.

Re:Legal implications to coders

[wimbor]

Jeroen,

You are indeed correct that writing and attributing the code is of course the fact that could get you in trouble. Whether or not you sign a document. As you said it is only easier to find you (which is more or less uncomfortable), but the real difference is also that your signature of the DCO makes you vow that you are responsible for the code, that the code is yours in the making. If another party thinks this is not the case, they can also attack you on specifically that: the fact that you knowingly lied about the contents of the code... I would think this is an additional disadvantage...

Apparantly the GPL does metion that the author does not guarantee the software. But, alitigator can still sue you, and lose... but the legal costs are still there...

Re:Legal implications to coders

[wimbor]

You are correct of course that you did nothing wrong. But having to prove that in court can cost huge amounts of money. Let's say as an European I'm sued in the USA for infringement on someone's rights, the legal bill is very substantial:
- foreign attorney's
- foreign payments of fee's
- another legal system with different habits which would only add to the expenditure in this case because you need more counseling
- maybe even travel or plane ticket to be in court in person
- time you need to spend on this
- ....

I'm just guessing right now, but I think you can see my point that it could be an expensive venture. Since you do not have the protection of a legal entity as a company (inc., ltd., ...) your own personal assets can be at risks to defend yourself...

Maybe the only solution is that Linus founds a non-profit company, and all the developers become unpaid workers at this company so that they at least benefit from the protection of such a organisation

Re:Legal implications to coders

[curator_thew]

"Just the mere fact that you sign a document that proves you wrote part of the Linux code, makes you liable for litigation. ..."

Duh! This is the whole point: it makes everyone individually accountable. It makes sure that people can't "submarine" Linux as much as it makes sure that individual contributers wake up and think more clearly about how (say) their day job coding employment contract may cover Linux work they produce in the evenings. So it's to the benefit of Linux overall. I'm sure there are plenty of F/OSS contributers who've never properly looked at whether the terms of their employment contract may create issues for their contributions. In fact, I'm quite surprised there have been so few problems so far.

"But a private author is personally responsible with his own assets ... Since most of the programmers probably do not have their assets split between their personal property and some form of 'company property' this might get dangerous. ..."

This is what it means to be individually accountable. Otherwise, who foots the bill? Either companies like red hat, etc or Linux development overall (e.g. backing out some infringing code ...). As a matter of civil duty to the rest of the community, you should take some responsibility, and that includes the possibility of loss. If you aren't up to the challenge, go back to playing in the garden.

Re:Legal implications to coders

[wimbor]

You're right. I'm not saying that it shouldn't be like that. I'm merely making an observation here that it could be more dangerous than most people realise.

And I'm certainly not against Linux or the philosophy behind it!

But, we must be realistic. Linux IS being used more frequently in commercial ways now than before when it was mostly a university/non-profit/private thing. (ok, i'm generalising, but you know what I mean).

Hence you enter the business world... and I'm afraid it means that Linux will have to play the game differently and take more care about legal issues and consequences. I agree that the SCO thing is bad... very bad.. and shouldn't happen. But this is the real world.... it is imperfect and Linu(s)(x) should be ready for it.

Either you have a decent system where coders are protected against misbehaving users/competitors and you try to capture the commercial market (and let us be honest, we want Linux to grab a bit of market share of Windows, as is being done now). Or, you do not protect coders and just keep on working as before, but then I see no other alternative than to remain a system that cannot be commercially used, unless the business world (and SCO) suddenly decides to play it more fairly.

I know. It is a dim view of the world...but maybe more realistic... Linux simply isn't untouchable anymore... how much we would like it to be the ideal community it was before... it is confronted with other forces now... I'm not saying I have an answer... I'm just saying we need to think about this...

Ps. I'm not a coder myself :-)

Re:Legal implications to coders

[Doppleganger]

your signature of the DCO makes you vow that you are responsible for the code, that the code is yours in the making.

No, it vows that you either have rights to that code, or you got it from someone else who said they have rights to it.

That's nothing new. When you submit code to the kernel, you're saying you have rights to it.. if you don't have rights to it, then you're doing something illegal whether you make that vow or not. This just makes the statement of "I am not violating someone else's rights" explicit, rather than the unspoken declaration that comes with publishing something with your own name on it.

Re:Legal implications to coders

[mcc]

Some open source projects, for example all GNU projects, already require you to sign over your copyright to the code.

I cannot imagine that signing these DCOs would open you up to any sort of liability that a formal copyright transfer would not, since obviously when doing the latter you imply you own the code you are transferring.

While projects that require copyright transfer do tend to grow slower, liability does not seem to be a significant reason why.

And if there actually is some kind of legal difference from a liability standpoint between the DCO process and a copyright transfer, then I'm sure some kind of system would be set up whereby the legally skittish could, for example, sign their copyright to the code over to the FSF, who then submits it to the Linux with the DCO filled out in such a way the FSF is the liable party.

Anyone else notice?

[space77pup]

That this article was on the front page of Google News in the Sci/Tech section? Perhaps it'll still be there. Google News Sci/Tech

Re:Anyone else notice?

[fuzzix]

That this article was on the front page of Google News in the Sci/Tech section? Perhaps it'll still be there.

It's there alright, as well as this one from this morning - linked due to the attractive photo I think... :)

Re:Anyone else notice?

[E_elven]

Here is the Google news partner link: http://www.nytimes.com/2004/05/25/technology/25lin ux.html?ex=1086062400&en=2ff98cb3d0e6ed96&ei=5062& partner=GOOGLE

Is this really a great idea?

[Anonymous Coward]

Wuestion is will this be ammo for SCO ... "look the previous process was bad and allowed our code through ..thats why they changed it"

Yes ..a rational person would laugh, but highly paid attorneys versus dumb judges and jury.

Re:Is this really a great idea?

[pe1rxq]

Yes ..a rational person would laugh, but highly paid attorneys versus dumb judges and jury.

Luckely most of SCO's legal papers seem to be written by an child, the judges don't seem to like them that much and there isn't a jury yet....

If Linux hadn't changed a thing they would have found a reason why it was bad aswell....

Jeroen

Re:Is this really a great idea?

[Stephen Samuel]

If it is, it may not be for long... Remember that IBM has moved to get SCO's copyright infringement claims thrown out. If that works, it pretty much vindicates the old method... That having been said, the changes are simply designed to make it easier to track where any new pieces of code come from without seriously impacting the speed of development

I can imagine some subversive ways of sneaking in

[shoppa]

I understand that nothing is foolproof, especially when someone tries malicious tricks.

For example, you could imagine a SCO-wannabe taking their commercial code (that nobody is buying anymore but which they for some reason believe has real IP value), and putting one line (seemingly innocuously, effectively no-op'ed by some never-happens if cases) in an obscure kernel module (maybe a driver for some crufty ancient device). Then repeat (possibly under the guise of a different developer). Soon the module is working, with all the sleeper code inside. Then submit a patch that gets rid of all the intervening lines and voila, a big chunk of proprietary code is in the kernel and nobody noticed.

There are probably simpler ways to sneak stuff in if you want to be malicious. Maybe I've been watching "The Manchurian Candidate" too often!

When do we see such a thing on slashdot ?

[heytal]

Slashdot Comment Submitter's Certificate of Origin 1.0

By submitting a comment to this slashdot story, I certify that:

(a) The comment was created in whole or in part by me and I have the right to submit it under the copyright laws; or

(b) The comment is based upon a previous comment from a dupe story, and to the best of my knowledge, is covered under an appropriate copyright law and I have the right to submit that comment with modifications, whether created in whole or in part by me; or

(c) The contribution was provided directly to me by some other person who certified (a), (b) or (c) and I have not modified it.

scary

[Anonymous Coward]

Doesn't this create a dangerous precedent ?
Around the next corner some authority may start
to require kernel maintainers to CHECK contributors credentials,
then later at the next crossroad, Open Source maintainers may be held responsible for each and
every bit that they "could have checked".

And this way we end up getting patent searches as a mandatory part of OS dev., effectively handing over all the software control to nuisance patenters and (in the best of times) doing OS stuff at the temporary mercy of some big benefactor like IBM...

scary!

Re:scary

[Anonymous Coward]

mod parent up! (see alse A Bad Precexent)

Re:scary

[vijaya_chandra]

Yes
Mod parent up

Devils advocate reply

[vchoy]

This system would be excellent for situations against SCO/liability/whatever suits. The beauty is that the code in question can be tracked. SCO or whoever who decides to sue can't just say "Hey...[the whole of] Linux is ours!"
With tracking, the code written by the author can be reviewed and resolved if necessary!

Mission critical: Well buy mission critical support from Redhat/Suse/Mandrake etc... Don't like that? Signup and offer patches or fixes to contributors.

As said previously, this process is not a 'finger pointing process'. Its a process that helps the development of linux to enable it to progress to new heights! If code needs modification/optimisation, communicate and help the contributor! If you find a particular component is really helpful or beneficial, write to the contributor and thank them, or you may even paypal or donate..etc.etc.etc.etc!

Have fun.

Re:Devils advocate reply

[femto]

Here's one from the Devil's advocate:

Redhat/Suse/Mandrake back up their mission critical support with insurance. One day, they get a big failure and their customer makes a claim against the XYZ insurance company.

XYZ insurance company, in common with most insurance companies, is run by a group of low lifes who would kill their grandmother for a dollar and don't give a damn about the principles of free software. In true insurance company style, XYZ tries to pass the liability and recover its costs by suing the developer who wrote the buggy code.

Despite the best intentions of the free software community, we now have defenceless developer vs. rich insurance company. How to stop this?

Re:Devils advocate reply

[Echemus]

But that does not really make sense, it is an extreme situation. Certainly from my reading is that the insurance company would have to prove that the person writing the code did not take due diligence when writing it, which is not really all that simple or cut and dried.

Additionally, the insurance company would have to prove that the software fault was the sole cause of the problem, again, that is not always that simple. (catastrophic failures aren't always attributable to say, a few lines of code, they could be the fault of the user by not using the software correctly, etc)

The developer only has to prove that there is doubt in the argument that they are liable for the loss caused, the insurance company has to prove beyond doubt that the loss was caused by that particular piece of code - which is a lot more complicated.

At least, that is the situation in the UK, other parts of the world may be a little different, but I would imagine the principles are similar.

A bad precedent?

[Petronius]

This is a very bad precedent: the OSS community now has to follow processes that in the past, only large corporations could afford: audit trail, overkill documentation, etc. The fact that SCO/MS has managed to move Linus on *their* turf and make him play by *their* rules alas without their resources makes me really nervous: whoever gets to frame the debate always has a disproportionate advantage. What's next? More FUD campaign to fuel the fire, more hoops we'll have to jump through. While OSS people have to play lawyers, they don't write any code.

Re:A bad precedent?

[Anonymous Coward]

Well, it was inevitable that lawyers and such were going to come into the game. This isn't some apocalyptic happening, just a move to get closer to the defendable position that the FSF already had. Which has been doing such things for decades already.

Quickshot

Re:A bad precedent?

[Petronius]

Yes, lawyers will always exists and the FSF is a very good thing.
My point was: by doing this, we start letting MS/SCO set the agenda, not us. Why should we have to sign & publish all kinds of documentation when they don't even want to show a line of their code? OSS developpers should be able to keep doing what they're doing the way they were doing it before, i.e. code freely (as in speech/beer/whatever).
*Developers* are getting drawn to a space (Law) where they're ill-equipped and very unproductive.

Re:A bad precedent?

[10am-bedtime]

one mark of maturity is when you do/recognize/appreciate people and things for the worth you find inherent in the action/observation, rather than for the worth others may find/pubblicize/evangelize in the same deed.

if you feel being organized to be helpful, then be organized! you also have the ability to re-evaluate this feeling later, and change your mind.

it's ok to be immature and muddy the waters w/ imprecise thinking, too -- that's the choice you make. when you see it as a choice rather than an imposition, you will know what i'm talking about.

Re: A bad precedent?

[SwashbucklingCowboy]

It's actually a good and necessary precedent. There are liability issues surrounding the use of code which should not have been contributed to a project. My company contributes to an open source project where we've recently been discussing this very issue. As a consequence I've had to spend a fair amount of time with the company lawyers :-( It's unfortunate that it's come to this, but our society does have property rights. And open source projects need to protect themselves from those that might abuse those rights.

Re:A bad precedent?

[SwashbucklingCowboy]

This issue has nothing to do with free speech. It has to do with protecting the Linux kernel and protecting IP rights.

Re: A bad precedent?

[Anonymous Coward]

Like the phrase "open source" you're missing the point. Those rights are abused by government that makes "property" of things "intellectual." Just put your project server in a free country.

"The only winning move is not to play the game" -- War Games

Re: A bad precedent?

[Petronius]

USE CASE #1:
- Did you download the latest version of X?
- no, my lawyer tells me it might contain some stolen, copyrighted code. It could be a huge liability for us.
- uh?
- yeah, they don't have very good audit trails of the commits on their website. Some patches were even submitted anonymously. Right now, we can only use open source software for which the audit trail is well documented, etc. etc. I think there's only a handful of projects out there that we can use. That open source stuff, it's very risky.

etc.

*THIS* is what they've started.

Re: A bad precedent?

[SwashbucklingCowboy]

Yep, that's exactly what's going to happen. You view it as a bad thing, and in a sense it is. However, in the world where there are IP rights it's a good thing. It sounds like you may want to do away with IP rights.

Linux External Auditing

[Stormcrow309]

By creating this paper trail of responsibility, the work on Linux will be externally auditable. This will help reassure big business that they will not legally shaft themselves.

Sincerely, Stormcrow309

Remember, free is only free when you consider support and hardware costs.

Liability

[jrj102]

Does this mean that an individual writing code would now get sued by the SCOs of the world instead of companies that deploy Linux? Is this a good thing?

Re:Liability

[vijaya_chandra]

Perhaps that is what the developers want the big companies out there to think
and adopt linux

BSD?

[Anonymous Coward]

How does this compare to BSD's processes?
Or Apache's?

Will this be a growing trend across open-source projects, to push accountability down to the contributors?

Copycat

[Fizzl]

Slashdot Comment Submitter's Certificate of Origin 1.0

• By submitting a comment to this slashdot story, I certify that:

• (a) The comment was created in whole or in part by me and I have the right to submit it under the copyright laws; or
• (b) The comment is based upon a previous comment from a dupe story, and to the best of my knowledge, is covered under an appropriate copyright law and I have the right to submit that comment with modifications, whether created in whole or in part by me; or
• (c) The contribution was provided directly to me by some other person who certified (a), (b) or (c) and I have not modified it.

(mu)

Re:Copycat

[kabloom]

I see it further up in the list of comments. Looks like you chose to certify (c) on this comment of yours.

Re:Copycat

[Fizzl]

No, it was definately (mu).

who gave linus the authority ?

[cinnamon colbert]

If it is truly open source, can't anyone do anything they want and call it a kernel ? Computing power grows out of the barrel of a fork !!

Re:who gave linus the authority ?

[BCW2]

Linus has the final say on anything included in the kernal. If it doesn't pass him it will not be included in any official kernal release. That is the standard the community has set. If you don't like it, try to get MadDog to change it with the board.

Re:who gave linus the authority ?

[Zoolander]

Well.. yeah? Anyone can (and many have) make a fork of the official Linux kernel. Check out the mm and ac branches on kernel.org, for example.

SCO did some good and didn't even know it.

[Quila]

The Linux kernel process is now better, and it probably wouldn't have happened if not for SCO, or at least not this soon.

Yea This makes ILLEGAL opensource more likely

[Deliveranc3]

You heard me!

I want an mp3 codec included! I want some P2P software included!

I want a pirated copy of office included.

Where's my fat32 where's my NTFS!

Bring me the head of Bill Gates!

Freedom of coding?

[Maljin Jolt]

All contributors are called upon to "sign off" on a submission before it may be considered for inclusion in the kernel.

I don't say it currently is, but in future it *may* be a step towards elitarian class establishment, as well as political control tool for technology. How well-defined should be an identity of a GPL project contributor?

When signing on will be obligatory for contribution, a simple rejection to sign on a person for some "external" reason may have such political consequences. For the first, I believe it is in direct contradiction to the spirit of GPL.

Example: what about potential kernel developpers from countries politically inacceptable in United States?

Currently, it is not possible for major distro releasers from the new continent to export a linux technology to the Iran, Lybia or Northern Korea. Does the U.S. government violate the GPL license? Yes, it does.

What if some kernel contributors will actually become from these countries? Should be all farsi and arabic localisation contributors to the any of the sourceforge projects be perlustrated for not actually being an al-Quaeda operatives?

Re:Freedom of coding?

[happyfrogcow]

what are you talking about? why bring politics into the Linux kernel at all?

Currently, it is not possible for major distro releasers from the new continent

what is this "new continent" you speak of?

is there any instance where a technically acceptable patch was rejected based on political ideology?

Re:Freedom of coding?

[Maljin Jolt]

what is this "new continent" you speak of?

I mean that continent, which is drawn on our geographic maps for no longer than 512 years up to day, sorry if it hurts your pride some way.

is there any instance where a technically acceptable patch was rejected based on political ideology?

As you can reread, I wrote "I don't say it currently is, but in future it *may* be". To pinpoint on a dangerous possibility.

***********
To your question, I have an answer: YES. You cannot find a tibetan language localisation, nor nls tables in the linux kernel, because of political oposition of chinese government. Because of their denial of existence of tibetan nation and language at all. Same happend in Unicode project, as I remember.
***********

Of course, I can foresee both negative and positive politisation of contributions.

In linux kernel, there is a Cryptographic API buried. According valid laws in some countries, pure presence of cryptography routines makes linux technically illegal for civilian use in France, Russia, China. While these laws are silently ignored now, it may change in the future. Also it is just this API making any linux distro unexportable from USA to Iran.

Imagine some government agency would be wanting a kernel patch to provide a back door to that cryptography api. It may even be forced by law in that country. I can easy imagine USA and China will be the first ones, exactly in that order.

So kernel maintainers may reject such a "contribution" but they probably will be manipulated to accept it. Just like cell phone makers, just like Microsoft, just like WiFi hardware makers, just like many other producers of controlled technology from other industries.

Linux is dangerous to any political establishment because currently they can't control it, because nobody can. It's unlike any other technology.
So, for the first establishment wants to centralize (done) and de-anonymize the decisioning about linux with hope they could take it over later. Software patenting falls in that category too.

Then, anything may happen, if the idea of freedom, joy and voluntarism will be replaced by legality, bussiness and politics. I expect repressions. Because current changes in information technology are so revolutionary, that they can cause some shifts in power in the future. One big "danger" percieved by the current political establishment all over the world is the free information technology enables direct democracy, as oposing to deputy-representative based oligocracy.

So, a denial of technology is a political tool.

Re:Freedom of coding?

[happyfrogcow]

I mean that continent, which is drawn on our geographic maps for no longer than 512 years up to day, sorry if it hurts your pride some way.

Just because your ancestors didn't live here doesn't mean my ancestors didn't. calling it a "new continent" is about as backwards as anything i've heard in the last year, ignoring all the history that occured prior to Columbus "discovering" it.

yes, I am part native american. 1/64 if you want to trace it back. about as much as any other blood I have in me. I'm the proverbial melting pot.

To your question, I have an answer: YES. You cannot find a tibetan language localisation, nor nls tables in the linux kernel, because of political oposition of chinese government. Because of their denial of existence of tibetan nation and language at all. Same happend in Unicode project, as I remember.

and you are sure that it's because the Chinese government doesn't want it? What influence does the Chinese government hold over Linus? I think he'd laugh at the notion. Rather it's possible that it's either not production quality, or there aren't human resources to implement it.

Even if it *we're* rejected from the official source tree, you have all the power in your own self to release a patch for users to download and install. If you are in China, and they are repressing you and your technological developments, hopefully you can get yourself and the word out.

Imagine some government agency would be wanting a kernel patch to provide a back door to that cryptography api. It may even be forced by law in that country. I can easy imagine USA and China will be the first ones, exactly in that order.

How exactly can you have an effective back door in a Free Software project? Maybe in a binary only distribution... that doesn't distribute source code... But that isn't Free, and that doesn't describe Linux.

in any case, i fundamentally agree with you that technology can be tossed around like political tool. it shouldn't be, but I have to believe that those that are on the front lines of development are there to promote Good. mostly just Good Technology.

NYT Bias

[beforewisdom]

The New York Times article is interesting.

It is written in such a way that it reads like SCO does own what it claims to own and that IBM took an extra liberty under some sort of agreement.

Quite the opposite tone and bias from the tech journals ("what is SCO smoking??!!").

Given that most business people are more likely to read NYT then Slashdot or Groklaw I can now understand why SCO got as far as it did with its stock scam.

Steve

mod parent up!

[Anonymous Coward]

this is too important to be ignored, most comments here are of the humorous kind,
few address the slippery slope issues that will now gradually entangle Open Source

Nice straw man

[Anonymous Coward]

Care to address the points that were really presented, instead of some irrelevant straw man?

Sad, but true

[smoking2000]

Especially those who have died (there must be at least one)

Unfortuatly you are right, Manuel Estrada Sainz died recently in a car accident together with Andrés García while returning from a Free Software conferenc in Spain.

The announcement on debian-announce

May they rest in peace.

Duh, what's a precedent?

[anthonyx]

The plan is to make this very light-weight, and to fit in with how we already pass patches around--just add the sign-off to the end of the explanation part of the patch. That sign-off would be just a single line at the end (possibly after other peoples sign-offs), saying:

Signed-off-by: Random J Developer <random@developer.org>

-- Linus

You seem to disagree with Linus as to how much work is involved in this kind of tracking.

I dissagree with you about what turf and rules belong to "SCO/MS".

Lawyers may care a lot about precedent, but I don't know any programmers who do.

Read: CVS for the poor

[Anonymous Coward]

Are they *that* stupid, or what?

Well, the thing is

[mcc]

I don't say it currently is, but in future it *may* be a step towards elitarian class establishment, as well as political control tool for technology. How well-defined should be an identity of a GPL project contributor?

The thing is, these DCOs or whatever only apply to submissions to the main kernel tree. Thanks to the GPL, you can still fork the Linux kernel and distribute it on your own website and legally do what you like with your own copy of the code without ever actually having to talk directly to the lkml people.

5 years in the future

[Anonymous Coward]

LINUS: Hello, Alan. What's happening? Um... yeah. We need to talk about your DCO reports. We have sort of a problem here. Yeah. You apparently didn't put one of the new coversheets on your DCO reports.

ALAN: Yeah, the coversheet. I know, Andrea talked to me about it

LINUS: Yeah. Uh, did you get that memo?

ALAN: Yeah, I got the memo, and I understand the policy. The problem is, I just forgot the time. I've already taken care of it so it's not a problem anymore

LINUS: Yeah. It's just that we're putting new coversheets on all the DCO reports before they go out now. So I'd really appreciate it if you could just do that. Right. Remember to do that from now on. That'd be great.

war!?!

[vijaya_chandra]

This isn't a war. A war would be among equals.

You can't call the barking of a dog at an elephant as war.

and I hope Mr.Torvalds and co. won't have to waste any more time on such crap in the future

No (major) changes

[kasperd]

The submission of patches is supposed to continue like it has always done. It is all about two things, people passing the patch on putting their name on it, so you can see the path. And certifying that you are allowed to submit the patch, which you were already implicitly stating by submiting it. The orignial message is on the mailing list. The media have blown this news up completely out of proportion. If just the media had something like this we could track who made this feather into five chickens. I doubt all the media covering this, actually read what Linus wrote.

should read: Linus wakes up to revision control

[Anonymous Coward]

Linus stubbornly held out for years that using no version control at all was better than using CVS. Looks like he was wrong. Records? We don't need no steenkin' records!

A Precedent?

[Pan T. Hose]

This is a very bad precedent: the OSS community now has to follow processes that in the past, only large corporations could afford: audit trail, overkill documentation, etc.

This might be a precedent in the Open Source community, but certainly not for the Free Software community. Don't you know how has The GNU Project been working for years?

True Hackers

[RichiP]

would write a script to let their system for patch submission automatically add the required line. In marketspeak, a highly-customizable, integrated subsystem for tracking submission versions and is totally compatible with the DCO protocol.

Parent Overrated

[Anonymous Coward]

I would have left it alone, but a +5 informative is 5 points too much for the parent.

What shoppa is talking about is impossible. No maintainer would accept one-line patches that didn't do anything useful. Nor would the maintainer blindly pass through some new functionality without looking to see what it does. The premise that the maintainers are incompetent is, to put it one way, itself uninformed.

Mod the parent down.

GNU has required this all along.

[Repran]

Why is everyone getting all upset now that Linus is following suit? Am I the only one that realizes this? Go read http://www.gnu.org/copyleft/why-assign.html for details. Copied text below: Why the FSF gets copyright assignments from contributors by Professor Eben Moglen, Columbia University Law School Under US copyright law, which is the law under which most free software programs have historically been first published, there are very substantial procedural advantages to registration of copyright. And despite the broad right of distribution conveyed by the GPL, enforcement of copyright is generally not possible for distributors: only the copyright holder or someone having assignment of the copyright can enforce the license. If there are multiple authors of a copyrighted work, successful enforcement depends on having the cooperation of all authors. In order to make sure that all of our copyrights can meet the recordkeeping and other requirements of registration, and in order to be able to enforce the GPL most effectively, FSF requires that each author of code incorporated in FSF projects provide a copyright assignment, and, where appropriate, a disclaimer of any work-for-hire ownership claims by the programmer's employer. That way we can be sure that all the code in FSF projects is free code, whose freedom we can most effectively protect, and therefore on which other developers can completely rely.

New Standards for Kernel Contributors

[mophab]

There is some more detail including legal views from one of the FSF lawyers here.

I have a question...

[perlchild]

Does the settlement even include any clause that says Microsoft can't do it again? *shady overtones of the antitrust settlement, in which they promised not to do it again, and whose premise was practically laughable*