Linus Adopts Enhanced Tracking Process

millette writes ""Under the enhanced kernel submission process, contributions to the Linux kernel may only be made by individuals who acknowledge their right to make the contribution under an appropriate open source license. The acknowledgement, called the DCO, tracks contributions and contributors. The DCO ensures that appropriate attribution is given to developers of original contributions and derivative works, as well to those contributors who receive submissions and pass them, unchanged, up the kernel tree. All contributors are called upon to "sign off" on a submission before it may be considered for inclusion in the kernel." From the press release. Also seen in the New York Times"

Comments

Like building a plane

[vchoy]

Reminds me of a documentary called "Why Planes Fall" which shows how planes are built. Each part, component and the tool used is logged to a person who created/assembled it. The system logs the tester/auditors which sign off on the work. It's amazing!

The only think I see different from this Linux process is that whoever created the code is not liable for anything that happens when you use the operating system. I see the 'auditors' of the Linux process are those that signoff on the code that are written by authorised contributors. There is no 'finger pointing' as so to speak when something goes wrong.

Re:Like building a plane

[tfbastard]

Wouldn't the users living in countries that doesn't acknowledge 'denial of liability' already have sued the living daylights out of every major software corporation by now?

Not that it's not a scary thought, just wondering how it would work.

Re:Like building a plane

[prisonernumber7]

Wrong wrong wrong. If somebody gives you software, you can use it from then on. Once the files are in your possession, you can use them, unless you've somehow signed a specific prior contract promising you won't.

If you download software, then you are actively seeking to acquire that software. Nobody gives it to you. The software is at most being made available to you, but it is not given to you.

As a metaphor: If I leave my front door open anybody can go in and take stuff from my house. That does not mean that they may do so though. Since software is meant to be used that's a chewing gum point however, but let's get to that in a second:

If you don't plan to give out copies of the program, you have no need to agree to the GPL, or even read it.

From the GPL FAQ, on the question whether users have fair use rights on a GPLed program: "Yes, you do. "Fair use" is use that is allowed without any special permission. Since you don't need the developers' permission for such use, you can do it regardless of what the developers said about it--in the license or elsewhere, whether that license be the GNU GPL or any other free software license.

Note, however, that there is no world-wide principle of fair use; what kinds of use are considered "fair" varies from country to country."

So fair use is nothing generic and nothing you can count on. If there are liability problems you have a case that is beyond fair use in any event. In this case you must agree on the GPL to get what the license gives you in terms of warranty - which is, as you rightly point out, no warranty at all.

Wrong. Go read the GPL before lying about it anymore.

*shrugs*. So strong words. For the sake of clarity, "no warranty" can be considered to also mean "not liable for damages" (of course, it means other things too). Can you stop trolling now puh-lease?

Existing source code?

[Ianoo]

Is this going to be applied to the existing kernel sources or just new submissions? I think it'd be quite a job to track down all the people who still have their names at the top of kernel files after all these years. Especially those who have died (there must be at least one) or companies that no-longer exist (quite a few).

Regardless, I wonder whether this will slow down kernel contributions? Here's hoping it won't. People will still be able to create unofficial patch sets (like mm, ck and love sources) to test their ideas before actually contributing modifications to the authoritative source.

I'm not a legal expert, but

[denisdekat]

I keep saying this, and I am so surprised this is not broguht up more often, but if folks donate code to the project, are they not liable rather than the users of the project? I know I am talking about SCO, yes, it just seems so silly that anyone takes them seriously. Maybe this is a terrible metaphor, as I am only just starting to intake the coffee... but I sometimes thnk of this as if I gave someone a book, but inside the book there was tickets to a show. Then after giving the book I say to the person, by the way, I did not realize my tickets were there, can you pay up please? Sorry to rant, now back to the grindstone...

Is that third option missing something?

[Quantum Jim]

That is a pretty interesting certificate; I may end up using it too. However, the second and (esp.) third options seems a little unspecific: Shouldn't it require the contributing developer to name the origional work and its author(s)/entity(ies)? That way the lead developer could independently confirm that there are no copyright problems, if needed.

SCO

[jb.hl.com]

Isn't this just like admitting that Linus has no idea what's in the kernel and SCO code could be in there?

Legal implications to coders

[wimbor]

Although I'm not an expert in law (and certainly not US law since I live in the EU with different laws regarding to this), my gut feeling says I would never, never, nerver ever sign a document like that even if my work would be 100% original and not copied.

Just the mere fact that you sign a document that proves you wrote part of the Linux code, makes you liable for litigation. If any company thinks its rights are violated by a Linux component they can easily sue the contributors of this (and more) components personally. Given the track record of US litigation, I would never sign it.

Signing the document means that the author of the code will have to seek expenive legal support in case a lawsuit is started. Even if he can prove in court the code is original and written by himself, the bill for legal advice can be quite substanstial. If an author programmed in his spare time, this means he personally is liable... personally as in 'with your own personal assets'...

As an employee of a software firm (or worker at any other firm), your work is done "acting as a part of the company". Hence the company itself and not the individual employee is (financially) responsible for his/her mistakes. In case of litigation the company will have to seek legal council and incurr the damages. In my country the company could try to sue the employee for the incurred damages afterwards, but it will have to prove very extensively that the employee made very serious professional errors. And even then, companies rarely do so.

But a private author is personally responsible with his own assets (wage, house, car, ...) for any damages. Since most of the programmers probably do not have their assets split between their personal property and some form of 'company property' this might get dangerous. Please excuse me for not knowing the correct legal terms for 'private property' and property as part of an "inc." or "ltd.".

Re:Legal implications to coders

[pe1rxq]

Just the mere fact that you sign a document that proves you wrote part of the Linux code, makes you liable for litigation. If any company thinks its rights are violated by a Linux component they can easily sue the contributors of this (and more) components personally. Given the track record of US litigation, I would never sign it.


Signing a document aknowledging that you wrote it doesn't make you more liable...
Wheter you sign or not doesn't change the fact that you wrote it.
If you are liable after signing you were liable before. The signing just makes it a little bit easier for the other party to find you.
Unless you posted all your patches to linux-kernel as anonymous coward this doesn't change anything at all.

Jeroen

Re:Legal implications to coders

[wimbor]

Jeroen,

You are indeed correct that writing and attributing the code is of course the fact that could get you in trouble. Whether or not you sign a document. As you said it is only easier to find you (which is more or less uncomfortable), but the real difference is also that your signature of the DCO makes you vow that you are responsible for the code, that the code is yours in the making. If another party thinks this is not the case, they can also attack you on specifically that: the fact that you knowingly lied about the contents of the code... I would think this is an additional disadvantage...

Apparantly the GPL does metion that the author does not guarantee the software. But, alitigator can still sue you, and lose... but the legal costs are still there...

Anyone else notice?

[space77pup]

That this article was on the front page of Google News in the Sci/Tech section? Perhaps it'll still be there. Google News Sci/Tech

Is this really a great idea?

[Anonymous Coward]

Wuestion is will this be ammo for SCO ... "look the previous process was bad and allowed our code through ..thats why they changed it"

Yes ..a rational person would laugh, but highly paid attorneys versus dumb judges and jury.

Liability

[jrj102]

Does this mean that an individual writing code would now get sued by the SCOs of the world instead of companies that deploy Linux? Is this a good thing?

BSD?

[Anonymous Coward]

How does this compare to BSD's processes?
Or Apache's?

Will this be a growing trend across open-source projects, to push accountability down to the contributors?

Re:Devils advocate reply

[femto]

Here's one from the Devil's advocate:

Redhat/Suse/Mandrake back up their mission critical support with insurance. One day, they get a big failure and their customer makes a claim against the XYZ insurance company.

XYZ insurance company, in common with most insurance companies, is run by a group of low lifes who would kill their grandmother for a dollar and don't give a damn about the principles of free software. In true insurance company style, XYZ tries to pass the liability and recover its costs by suing the developer who wrote the buggy code.

Despite the best intentions of the free software community, we now have defenceless developer vs. rich insurance company. How to stop this?

Freedom of coding?

[Maljin Jolt]

All contributors are called upon to "sign off" on a submission before it may be considered for inclusion in the kernel.

I don't say it currently is, but in future it *may* be a step towards elitarian class establishment, as well as political control tool for technology. How well-defined should be an identity of a GPL project contributor?

When signing on will be obligatory for contribution, a simple rejection to sign on a person for some "external" reason may have such political consequences. For the first, I believe it is in direct contradiction to the spirit of GPL.

Example: what about potential kernel developpers from countries politically inacceptable in United States?

Currently, it is not possible for major distro releasers from the new continent to export a linux technology to the Iran, Lybia or Northern Korea. Does the U.S. government violate the GPL license? Yes, it does.

What if some kernel contributors will actually become from these countries? Should be all farsi and arabic localisation contributors to the any of the sourceforge projects be perlustrated for not actually being an al-Quaeda operatives?

NYT Bias

[beforewisdom]

The New York Times article is interesting.

It is written in such a way that it reads like SCO does own what it claims to own and that IBM took an extra liberty under some sort of agreement.

Quite the opposite tone and bias from the tech journals ("what is SCO smoking??!!").

Given that most business people are more likely to read NYT then Slashdot or Groklaw I can now understand why SCO got as far as it did with its stock scam.

Steve