Harmony Project Pushes Lawyers Off FOSS's Back

Julie188 writes "Harmony is an effort that was begun and shepherded by Amanda Brock, the general counsel at Canonical. The intent was to create a small collection of consistently-worded contribution agreements (both licenses and assignments) for free and open source projects to use to reduce the friction such agreements can cause when they're encountered for the first time by corporate counsel unfamiliar with FOSS licensing. Version 1.0 of the documents have launched. As court cases involving software copyrights and patents continue to sprout forth, we don't have the liberty of ignoring the changes brought on by the law. Neither do we get to follow Dick the Butcher's suggestion in Henry the Sixth, and kill all the lawyers."

Comments

Don't set your goals too low

[Anonymous Coward]

Neither do we get to follow Dick the Butcher's suggestion in Henry the Sixth, and kill all the lawyers.

WRONG! It's just a matter of attitude and motivation. Don't set your goals too low!

Irony

[Roachie]

Trouble at Harmony.

There, I said it. Got that out of the way... now we can move on.

Contribution for what return?

[Bruce Perens]

Having a standard set of contribution agreements does not push lawyers off of the backs of FOSS developers. It just helps them give up all of their rights for nothing, without the counsel of a lawyer who might tell them that's not a smart thing to do. Where is the covenant to developers in return for their contribution? There is none.

I provided strategy for the contribution agreement for the project of very large company, on a project that is about to be presented to developers. The company covenants to the developer that they will keep their work on the project in Open Source for a period of several years, or will remove the contribution from the non-Open-Source version of the work.

Another alternative is to pay the developer for their work.

Signing your contribution over to a for-profit enterprise without any quid-pro-quo is just crazy. You're making yourself their unpaid employee.

Re:Contribution for what return?

[pthisis]

I think the idea is that if you work at company X who uses open source project Y, these agreements have a standard wording for contributing changes made back to project Y. It's to encourage corporations to contribute back--many places I've worked have been theoretically willing to do so, but didn't want to put in the legal time to figure out the details.

You as an employee are doing the same work in either case, though if you do get things accepted back upstream it may save you a little maintenance work. And you may build some modest reputation capital if you contribute meaningful code.

Re:Contribution for what return?

[Bruce Perens]

Even corporations should be concerned about the prospect of their work being taken private - the project being removed from Open Source and made commercial-only - shortly after their contribution. After all, corporations have to account to their stockholders, and a contribution that can go private quickly would indicate a lack of due diligence or poor negotiation, that could potentially result in lost money, time, and resources.

Re:Contribution for what return?

[maxume]

You are looking at the world through Bruce colored glasses.

Their use case is clearly one where the developer has a desire to contribute to the project and trusts the management of the project:

http://harmonyagreements.org/use.html

(and as you say, why would anyone give away rights for no reason...)

Re:Contribution for what return?

[Bruce Perens]

What is going to happen here is what happened with Creative Commons: a lot of different IPR policies get bundled under the same name so that the uninitiated will not be able to distinguish one from the other. Some of those policies are harmless, and some quite harmful.

Re:Contribution for what return?

[bug1]

Of the tens of thousands of open source projects, by guess is the vast majority of them are not run by a corporation.

I havent seen anyone of note stand up for these Harmony Agreements, are they so bad that even small non-profits should avoid them ?

I thought having copyrights centralized helped enforcement, opens the door for open source developers to get damages from corporate exploiters who violate the license, isnt that a good thing ?

Re:Contribution for what return?

[DragonWriter]

Even corporations should be concerned about the prospect of their work being taken private - the project being removed from Open Source and made commercial-only - shortly after their contribution. After all, corporations have to account to their stockholders, and a contribution that can go private quickly would indicate a lack of due diligence or poor negotiation, that could potentially result in lost money, time, and resources.

Often, for corporations, the reason to contribute to open source is to foster an open source community which provides some extra maintenance and development for the project at no cost to the corporation. If that community exists, it doesn't necessarily hurt the corporation if others use the code in closed projects, as long as the open project continues to thrive.

Re:Contribution for what return?

[rtfa-troll]

Bruce is 100% right here. There are two kinds of contribution agreement; those which promise to continue distributing the software on the same terms as you distributed it to them and those that cheat you. Canonical's agreements are the type which cheat you, whilst the agreements of the Fedora project, the FSF and most other FOSS projects are not. Groklaw has already done some serious investigation of Canonical and project harmony and that's probably the place to start.

What you want to watch out for is groups which take your code and establish a special advantage for themselves. Apart from the article above you might find the article "How to Tell When an Open Source Foundation Isn't About You" very useful. There are many examples of this danger, Oracle's recent mess being the latest. If a project won't accept your contribution then import it into Gitorious and fork it. Provide your changes as a patch and look for others doing the same. Eventually, when the project closes up you will have the basis of a free fork. Contributing to Canonical really looks like a thing to avoid unless it's really clear it's going to save you lots of effort and it's clear that someone else is maintaining a separate archive of the software ready to fork.

Re:Contribution for what return?

[Bruce Perens]

You can still sue for copyright infringement even if you don't own a majority of the copyrights. And you can sue on behalf of multiple copyright holders. All existing court enforcement of Open Source licenses has been for projects that did not have a unified copyright - did you know that?

FSF has a good reason to keep the copyrights, they are a non-profit (which is really important) and they want to change the license as the law develops. In contrast, companies are getting a lot of power from that unified copyright. I'm not saying not to contribute, I am saying that you should make sure that you get something back, at least in the form of the company making a covenant about keeping the development Open Source for some years after your contribution. Then, you get some of their work contributed to the community, reliably, in return for yours.

I guess it's the one-sidedness of these things that really bothers me.

Re:Contribution for what return?

[bug1]

Yes i do realize individuals can sue for enforcement. But the opinion ive heard is that if all copyright holders can act in unison, then it makes greatly increases their ability to settle for damages.

To me open source to me is about "working together", and our leaders are now telling us not to work together in a legal sense.

It is important to protect ourselves from exploitation, but ny concern is that all the negative publicity covering these harmony agreements will not only prevent corporations exploiting individual coders, it will also prevent individual coders working together. We are "cutting of our nose despite our face"

Re:Contribution for what return?

[jedidiah]

No. I'm looking at the world through a corporate mindset that has trust issues with other companies.

The GPL was created not because RMS had a political agenda but because some corporation chose to take advantage of the community. His contributors rightfully objected to the situation and held him responsible.

Any collaboration framework needs to work as intended even in the worst case scenario. You can't just engage in "wishful thinking" with business entities. You will just get taken advantage of.

Re:Contribution for what return?

[Bruce Perens]

We don't really want damages, we want to get whoever it is to comply with the license. We actually have enough force to do that without big damages, because we can block imports, etc.

Re:Contribution for what return?

[maxume]

How is "(and as you say, why would anyone give away rights for no reason...)" related to wishful thinking?

The really weird part here is that the business entities involved here would likely be companies paying developers to work on projects external to that entity, a business entity running their own project is going to have their own lawyer-approved contribution agreement.

Re:Contribution for what return?

[BitZtream]

Bruce ... you of all people should know better than to spread this sort of FUD.

You and I both know that you can't put OSS back in the box after its out there.

The worse that can happen is that you contribute a bit of code to an OSS project which then goes closed source so you don't get newer versions, nothing at all stops you from getting the version you contributed to, unless someone magically deletes every copy in existence.

It doesn't matter than Samba 3 or 4 are now close sourced, I still have the source to the version I can contributed too and several revisions after that.

They can't 'take your work private', all they can do is stop making their own contributions public and available to you, which is entirely different than 'taking it private'.

You've been hanging around RMS too long, you're losing your ability to make rational statements.

When they 'take it private' ... what exactly do you lose? Nothing that you already have, only what you might possibly get in the future. 'take it private' is exactly the same as 'dropped off the face of the earth/went out of business/abandon the project' for all intents and purposes OTHER than a silly FUD campaign based on falsehoods.

Your patch ... which changed a pre-increment to a post-increment ... doesn't entitle you to endless updates from the people working on the project till the end of time. I realize that your contributions are more often than not far larger than moving a couple pluses around, but the point remains the same, don't you think?

I suppose there may be some weird license/agreement out there that someone considers to be OSS that retroactively revokes your right to use old versions or something but those don't fit into any definition of OSS that anyone here would use, certainly none of the OSI 'approved' licenses.

Re: Contribution for what return?

[Anonymous Coward]

I'll paraphase the same things here that I said to Bruce and Bradley Kuhn on the post itself. I agree that any individual developer (i.e. not protected in their participation/contribution to the FOSS licensed project by an employer) needs to consider what they're about to do. But there's a corollary to Tim O'Reilly's version of freedom 0: It is up to any contributor to understand the terms under which they are contributing to a FOSS project.

I understand why some people feel that assignments and contribution licenses can be a barrier. I also know that as VP, R+D at Softway and then a PUM at Microsoft, I happily assigned code to the FSF for our gcc changes, and paid a contracting company with a committer to get the changes back upstream as a more efficient way than attempting to negotiate each change into the set across diverse gcc projects without the depth of reputation.

The Harmony core team have tried to provide a set of agreements that are very simple in what they state and the language used to state it, as well as the supporting guidance and FAQ, so developers that encounter them will hopefully have a better chance of understanding what they're signing regardless of whether they choose to involve counsel or not.

We live in a world where well run FOSS projects are transparent. Organizations that choose to abuse trust in the FOSS world generally get caught out and punished by a lack of participation. I still believe the Harmony documents are a better solution to the narrow problem they attempt to solve than the free-for-all we currently enjoy.

My participation in Harmony was very much as a foundation. Outercurve is a 501(c)(6) and not a (c)(3). Many of the companies and universities I engage with do still care about a legally "stricter" environment. Yes - it's a perception, but I need to work with it regardless. I can't just educate them all past their perceptions any more than we can educate everyone to support the idea of software freedom. If the Harmony agreements are a tool for me to improve the situation as I work with corporate counsel less familiar with the breadth and history of FOSS IP management, then I'm a supporter.

Not open source

[Anonymous Coward]

If it's not public domain it's just licensed bullshit. Man up and go public domain or keep taking it up the ass from The Man.

Re:Not open source

[TarMil]

I'd quote Sam Hocevar here: "There is no such thing as “putting a work in the public domain”, you America-centered, Commonwealth-biased individual."

Re:Not open source

[bky1701]

Yeah, put it out there in the public domain, free to be included in whatever non-free, DRMed POS Microsoft or Apple is putting out.

Software licenses exist largely to abuse the insane and immoral copyright laws to actually help society at large. Public domain, these days, helps only Disney.

Disappointing headline.

[camperdave]

I saw "Harmony Project Pushes Lawyers Off..." and started to get excited.

Then I read "FOSS's Back" and realized that lawyers weren't being pushed off anything.

I am not supporting any project...

[paulsnx2]

...that precludes the killing of all the lawyers.

Re:I am not supporting any project...

[macraig]

So my project to kidnap and torture lawyers with waterboarding and sexual humilation for five years won't get your vote of approval, either?

Re:I am not supporting any project...

[Anonymous Coward]

I must point out that, in Henry VI, Dick said, "The first thing we do, let's kill all the lawyers" as the first step toward overthrowing the legal government and instituting a new monarch. The lawyers were the representation of order and the implementation of law as opposed to mob rule, and thus needed to be dispensed with as an impediment to the revolution. Would you really like Cade as your all-powerful ruler?

Re:I am not supporting any project...

[Anonymous Coward]

No it's to tame. Where is the fun in a plan that does not include a brief flight with a nice sudden stop at the end, and possiby a rather large explosion?

you just don't have the imagination needed for this job

better than nothing?

[decora]

if i am giving contributions to some obscure non-profit project on github i think it would be nice to have some official-ness to the copyright status of my patches... right now its kind of in limbo yes?

Re:better than nothing?

[Bruce Perens]

Your own work (not work for hire) is your property, and is fully copyrighted the moment you write it. Nothing in the agreement would strengthen the status of your copyright. You choose to place it under a license and contribute it to a project. If they remove your attribution, you have legal grounds to sue them.

A contributor agreement doesn't really get you anything you wouldn't already have, and is likely to remove rights you do have.

Re:better than nothing?

[rtfa-troll]

What Bruce said; but with a comment. The Free Software Foundation will accept contributions to many projects. You can write your code and agree to assign it to them. There may not be much benefit to you, but for others it may help with understanding the status of the code. There may also be some legal benefit for you in that you in that you will have less responsibility for the code. As ever, ask an expert lawyer to find out :-)

Re:better than nothing?

[Anonymous Coward]

> You choose to place it under a license and contribute it to a project

And they choose to accept it only under a contributor agreement so you can't gum up their works with your custom license that doesn't jibe with theirs, or get to come back and veto a change in terms because you contributed a ten line patch six years ago.

If they don't accept it, you get to fork it and go your own way and never get your patch merged upstream.

Everyone gets a choice.

err so the EFF, the ACLU...

[decora]

virtually every case of court precedent that involves the first amendment. . .

the vast body of Freedom of Information Act cases....

the FOIA itself, which was caused to exist, by lawyers...

the public defenders who fight for the rights of whistleblowers?

i kind of like lawyers.

Re:err so the EFF, the ACLU...

[Anonymous Coward]

Have you tried them barbecued? I hear they taste like chicken.

Re:err so the EFF, the ACLU...

[jedidiah]

The idea of lawyers standing up to defend the rights of the despised is something that goes way back. It didn't just start with the ACLU or EFF. Patriots were doing it even when we still thought of ourselves as British subjects. It's part of the rule of law. Although this sort of thing has been disparaged as of late.

Re:err so the EFF, the ACLU...

[Anonymous Coward]

That's because if the little guy is convinced the lawyers aren't on his side, then he's really got no recourse in our litigous society. Lots of big players (Microsoft, MAFIAA, the feds) like it that way.

thanks

[decora]

for the warning!

Remember when ubuntu wasn't a democrazy?

[Requiem18th]

Basically Canonical is asking for about the same rights the FSF ask for, but nobody ever questions the FSF because they have an irreproachable reputation. As the makes of Ubuntu, Canonical should have gotten such level of trust and while there are true ubuntu believers, the fact that enough people distrust it to the point that it is even an issue is just... sad. Everything just because of Canonicals recent misbehaving and general better than thou attitude they have gotten out of late...

Re:Remember when ubuntu wasn't a democrazy?

[rtfa-troll]

The FSF contracts require that the FSF always release the software under licenses which are substantially similar to the one you released it under. That gives the FSF no possibility to close the source. Canonical's agreements aren't the same at all since Canonical gets the right to release the code under any license they like. That's unfair and rediculous. If Canonical wants to do that then they should be paying you since you are essentially working 100% for them.

Re:Remember when ubuntu wasn't a democrazy?

[Anonymous Coward]

You're full of shit. Even the self-professed "troll" in the other response to your comment is telling it more truthfully.

Re:Remember when ubuntu wasn't a democrazy?

[wisty]

So what? It's always easier for a project if they can re-relicense the code.

Imagine if you pick a popular license (say, the BSD license), then find it's not compatible with the latest GPL (as is the case with the old BSD license). Do you track down every contributor, and ask them to relicense their code, or just be stuck with the limitations your license has?

I guess the solution is to use the GPL, as it can be "upgraded" without contributor permission. But the GPL is not everyone's cup of tea.

So if you don't want to go GPL, you may be best getting permission to "do whatever I want" with the code.

We can have a troll-war over GPL vs copy-center vs left-of-the-GPL licenses that prevent people from wrapping it in an XML web interface to circumvent the viral nature of the license; but the reality is that different projects have come to different conclusions.

Re:Remember when ubuntu wasn't a democrazy?

[rtfa-troll]

So what? It's always easier for a project if they can re-relicense the code.

We aren't discussing what's easy for Canonical here. We are discussing what should Canonical contributors do. The point, here is dead simple. Don't give your contributions to Canonical; there are many alternative organizations which will take your contribution on many different licenses and offer many different arrangements which are beneficial to you. Examples include the Apache foundation, the Free Software Foundation, The Gnome Foundation etc. etc. Other examples also include commercial organisations like Red Hat who will give you promises about how they will re-license your code. Canonical is not one of these.

Imagine if you pick a popular license (say, the BSD license), then find it's not compatible with the latest GPL (as is the case with the old BSD license). Do you track down every contributor, and ask them to relicense their code, or just be stuck with the limitations your license has?

The MIT license is pretty much compatible with anything. If a license is not compatible with the MIT license then it will be easier to change that license. This means there is a simple out.

I guess the solution is to use the GPL, as it can be "upgraded" without contributor permission. But the GPL is not everyone's cup of tea.

So if you don't want to go GPL, you may be best getting permission to "do whatever I want" with the code.

We can have a troll-war over GPL vs copy-center vs left-of-the-GPL licenses that prevent people from wrapping it in an XML web interface to circumvent the viral nature of the license; but the reality is that different projects have come to different conclusions.

I think you are confused about the issue here. It's not copyleft vs. other. The Apache foundation I listed above, for example, is pretty much explicitly anti-copyleft. This is about who gets the right to relicense your code and what terms they do that under. If you give your code to Canonical then you are giving it to an organisation which has a mixed record of delivering "open core" software instead of FOSS and at the same time the agreement they use seems to have very suspicious flaws. At this stage it is best not to contribute and to tell them that explicitly since it seems that whilst there is competition in play there is a real chance of persuading Canonical to change.

P.S. If you do use the GPL please remember that it's the exact terms you put in your source code which allow the license upgrade. It's really worth while to explicitly allow the license upgrade.

Critiques from experts

[ciaran_o_riordan]

Some negative reviews of the project's concept:

* Richard Fontana: http://opensource.com/law/11/7/trouble-harmony-part-1
* Bradley Kuhn: http://ebb.org/bkuhn/blog/2011/07/07/harmony-harmful.html
* David Neary: http://blogs.gnome.org/bolsh/2011/07/06/harmony-agreements-reach-1-0/

99% of the lawyers give the rest of us a bad name

[bussdriver]

99% of the lawyers give the rest of us a bad name.
-Steven Wright

Apache

[allenw]

Harmony is an effort that was begun and shepherded by Amanda Brock"

To some of us, Harmony is the name of Apache's Java implementation. Sort of surprising that this naming clash wasn't considered given the context. Heck, TFA even mentions Apache HTTPD.

Re:Apache

[The Original Yama]

To me, it's the toolkit designed to replace Qt. Frankly, I think the nomenclature is overused.