<story><title>Octotree – Proprietary Firefox extension contains AGPL-licensed code</title><url>https://github.com/christianbundy/octotree/issues/1</url></story><parent_chain><item><author>julianlam</author><text>It seems like the problem here stems from the project owner taking the source code as-is and essentially re-licensing it as proprietary, which is a big no-no.&lt;p&gt;For context, when NodeBB faced this possibility, we simply contacted every single contributor and asked nicely if they&amp;#x27;d assign over their ownership of their contribution to us (note the use of the word &amp;quot;assign&amp;quot;, not &amp;quot;license&amp;quot;, a license is revocable, an assignment is not).&lt;p&gt;Future contributions by new parties required signing of the same Contributor Assignment Agreement.&lt;p&gt;Here&amp;#x27;s the CAA if you&amp;#x27;re interested in reading legalese: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;cla-assistant.io&amp;#x2F;NodeBB&amp;#x2F;NodeBB&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;cla-assistant.io&amp;#x2F;NodeBB&amp;#x2F;NodeBB&lt;/a&gt;&lt;p&gt;All in all it took us under a week to secure the assignments, and any who did not sign we simply rewrote their lines of code, or we would have, but everybody signed.&lt;p&gt;The bar of effort to clear is so low to avoid this kind of controversy!&lt;p&gt;Reason we went this route: we wanted the flexibility to deliver a proprietary version of NodeBB for those clients that needed it. We get asked often whether there&amp;#x27;s a difference between the proprietary version and the open source version, but there isn&amp;#x27;t, it&amp;#x27;s just for legal reasons.</text></item></parent_chain><comment><author>simias</author><text>&amp;gt; All in all it took us under a week to secure the assignments, and any who did not sign we simply rewrote their lines of code, or we would have, but everybody signed.&lt;p&gt;I&amp;#x27;ve always heard about this possibility but I wonder how one would rewrite code, should the need arise. Wouldn&amp;#x27;t it be hard to do without effectively making a derivative work?&lt;p&gt;Suppose that you remove the code, reimplement it but end up with something that&amp;#x27;s extremely similar to the original (which is very likely since after all you&amp;#x27;re doing the same thing). Couldn&amp;#x27;t the original author argue that it&amp;#x27;s still their code? How do you prove that you did the work and just happened with the same code because that&amp;#x27;s just the most straightforward way to do it?&lt;p&gt;It seems like the only way to avoid the problem altogether would be to have some sort of clean room design:&lt;p&gt;- Dev A reads the code to be removed, writes a spec for the functionality.&lt;p&gt;- Dev A removes the code.&lt;p&gt;- Dev B takes the truncated code and the spec and implements the feature.&lt;p&gt;But that seems very painful to do cleanly, in particular one could argue that B should be a third party who is not intimately familiar with the codebase, otherwise it could be argued that they knew the previous code.</text></comment>
<story><title>Octotree – Proprietary Firefox extension contains AGPL-licensed code</title><url>https://github.com/christianbundy/octotree/issues/1</url></story><parent_chain><item><author>julianlam</author><text>It seems like the problem here stems from the project owner taking the source code as-is and essentially re-licensing it as proprietary, which is a big no-no.&lt;p&gt;For context, when NodeBB faced this possibility, we simply contacted every single contributor and asked nicely if they&amp;#x27;d assign over their ownership of their contribution to us (note the use of the word &amp;quot;assign&amp;quot;, not &amp;quot;license&amp;quot;, a license is revocable, an assignment is not).&lt;p&gt;Future contributions by new parties required signing of the same Contributor Assignment Agreement.&lt;p&gt;Here&amp;#x27;s the CAA if you&amp;#x27;re interested in reading legalese: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;cla-assistant.io&amp;#x2F;NodeBB&amp;#x2F;NodeBB&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;cla-assistant.io&amp;#x2F;NodeBB&amp;#x2F;NodeBB&lt;/a&gt;&lt;p&gt;All in all it took us under a week to secure the assignments, and any who did not sign we simply rewrote their lines of code, or we would have, but everybody signed.&lt;p&gt;The bar of effort to clear is so low to avoid this kind of controversy!&lt;p&gt;Reason we went this route: we wanted the flexibility to deliver a proprietary version of NodeBB for those clients that needed it. We get asked often whether there&amp;#x27;s a difference between the proprietary version and the open source version, but there isn&amp;#x27;t, it&amp;#x27;s just for legal reasons.</text></item></parent_chain><comment><author>ckastner</author><text>&amp;gt; &lt;i&gt;It seems like the problem here stems from the project owner taking the source code as-is and essentially re-licensing it as proprietary, which is a big no-no.&lt;/i&gt;&lt;p&gt;&amp;gt; &lt;i&gt;For context, when NodeBB faced this possibility, we simply contacted every single contributor and asked nicely if they&amp;#x27;d assign over their ownership of their contribution to us (note the use of the word &amp;quot;assign&amp;quot;, not &amp;quot;license&amp;quot;, a license is revocable, an assignment is not).&lt;/i&gt;&lt;p&gt;This is certainly the correct way to do hit. However, in this specific case, it appears that as of the current code, not many external contributions remain.&lt;p&gt;The author of the original issue in the meantime forked the repo and continued to document the issue there [1] as it was being constantly closed, but as is evident from his own `git blame` analysis, most of the contributions are from staff, and the external contributions are basically negligible.&lt;p&gt;There&amp;#x27;s one author with 30 LOC, one with 10 LOC, and the remaining 12 contributors average less then 4 LOC each.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;christianbundy&amp;#x2F;octotree&amp;#x2F;issues&amp;#x2F;1#issuecomment-719981875&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;christianbundy&amp;#x2F;octotree&amp;#x2F;issues&amp;#x2F;1#issuecom...&lt;/a&gt;</text></comment>