<story><title>Octotree – Proprietary Firefox extension contains AGPL-licensed code</title><url>https://github.com/christianbundy/octotree/issues/1</url></story><parent_chain><item><author>julianlam</author><text>It seems like the problem here stems from the project owner taking the source code as-is and essentially re-licensing it as proprietary, which is a big no-no.&lt;p&gt;For context, when NodeBB faced this possibility, we simply contacted every single contributor and asked nicely if they&amp;#x27;d assign over their ownership of their contribution to us (note the use of the word &amp;quot;assign&amp;quot;, not &amp;quot;license&amp;quot;, a license is revocable, an assignment is not).&lt;p&gt;Future contributions by new parties required signing of the same Contributor Assignment Agreement.&lt;p&gt;Here&amp;#x27;s the CAA if you&amp;#x27;re interested in reading legalese: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;cla-assistant.io&amp;#x2F;NodeBB&amp;#x2F;NodeBB&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;cla-assistant.io&amp;#x2F;NodeBB&amp;#x2F;NodeBB&lt;/a&gt;&lt;p&gt;All in all it took us under a week to secure the assignments, and any who did not sign we simply rewrote their lines of code, or we would have, but everybody signed.&lt;p&gt;The bar of effort to clear is so low to avoid this kind of controversy!&lt;p&gt;Reason we went this route: we wanted the flexibility to deliver a proprietary version of NodeBB for those clients that needed it. We get asked often whether there&amp;#x27;s a difference between the proprietary version and the open source version, but there isn&amp;#x27;t, it&amp;#x27;s just for legal reasons.</text></item></parent_chain><comment><author>simias</author><text>&amp;gt; All in all it took us under a week to secure the assignments, and any who did not sign we simply rewrote their lines of code, or we would have, but everybody signed.&lt;p&gt;I&amp;#x27;ve always heard about this possibility but I wonder how one would rewrite code, should the need arise. Wouldn&amp;#x27;t it be hard to do without effectively making a derivative work?&lt;p&gt;Suppose that you remove the code, reimplement it but end up with something that&amp;#x27;s extremely similar to the original (which is very likely since after all you&amp;#x27;re doing the same thing). Couldn&amp;#x27;t the original author argue that it&amp;#x27;s still their code? How do you prove that you did the work and just happened with the same code because that&amp;#x27;s just the most straightforward way to do it?&lt;p&gt;It seems like the only way to avoid the problem altogether would be to have some sort of clean room design:&lt;p&gt;- Dev A reads the code to be removed, writes a spec for the functionality.&lt;p&gt;- Dev A removes the code.&lt;p&gt;- Dev B takes the truncated code and the spec and implements the feature.&lt;p&gt;But that seems very painful to do cleanly, in particular one could argue that B should be a third party who is not intimately familiar with the codebase, otherwise it could be argued that they knew the previous code.</text></comment>
<story><title>Octotree – Proprietary Firefox extension contains AGPL-licensed code</title><url>https://github.com/christianbundy/octotree/issues/1</url></story><parent_chain><item><author>julianlam</author><text>It seems like the problem here stems from the project owner taking the source code as-is and essentially re-licensing it as proprietary, which is a big no-no.&lt;p&gt;For context, when NodeBB faced this possibility, we simply contacted every single contributor and asked nicely if they&amp;#x27;d assign over their ownership of their contribution to us (note the use of the word &amp;quot;assign&amp;quot;, not &amp;quot;license&amp;quot;, a license is revocable, an assignment is not).&lt;p&gt;Future contributions by new parties required signing of the same Contributor Assignment Agreement.&lt;p&gt;Here&amp;#x27;s the CAA if you&amp;#x27;re interested in reading legalese: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;cla-assistant.io&amp;#x2F;NodeBB&amp;#x2F;NodeBB&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;cla-assistant.io&amp;#x2F;NodeBB&amp;#x2F;NodeBB&lt;/a&gt;&lt;p&gt;All in all it took us under a week to secure the assignments, and any who did not sign we simply rewrote their lines of code, or we would have, but everybody signed.&lt;p&gt;The bar of effort to clear is so low to avoid this kind of controversy!&lt;p&gt;Reason we went this route: we wanted the flexibility to deliver a proprietary version of NodeBB for those clients that needed it. We get asked often whether there&amp;#x27;s a difference between the proprietary version and the open source version, but there isn&amp;#x27;t, it&amp;#x27;s just for legal reasons.</text></item></parent_chain><comment><author>ThePhysicist</author><text>If you wrote most of the code yourself and received only minor contributions (which is common for most OS projects) it is possible to remove those contributions and rewrite them, legally it would be hard to challenge.&lt;p&gt;We almost had to do this once for our own proprietary codebase as we discovered during due diligence that we didn&amp;#x27;t have a proper copyright transfer agreement from several of our interns. Fortunately we were able to resolve this with them (by paying them some extra money to sign a CLA), if it wouldn&amp;#x27;t have worked we would&amp;#x27;ve removed and rewritten the code instead. It&amp;#x27;s silly but legally it&amp;#x27;s doable.&lt;p&gt;Of course this strategy doesn&amp;#x27;t work if a large part of your codebase originates from third-party contributors, but from my experience Github projects receive mostly small&amp;#x2F;cosmetic PRs from non-core developers (not saying that those contributions are not valuable btw).</text></comment>