Re: [gentoo-project] Call for agenda items - Council meeting 2018-10-14

[Sarah White]

On 10/11/2018 09:59 PM, Rich Freeman wrote:
> On Thu, Oct 11, 2018 at 9:25 PM Sarah White <kuzetsa@××××××××××.ovh> wrote:
>>
>> assuming "commit authors are copyright holders" shouldn't be
>> trusted blindly (the git log doesn't "solve everything")
>>
>
> Sure, but neither can any other conceivable log, and anything that
> could be put in such a log could also be put in a commit annotation,
> which IMO will track it a heck of a lot better than a random text
> file.
>
>>
>> Does this mean "gentoo authors" will appear in court when
>> there's infringement? This is not a rhetorical question.
>>
>
> Simply being named in a copyright notice creates no particular
> obligation to appear in a court.
>
> If there is some kind of copyright lawsuit, then presumably those most
> associated with the code in question could be called as witnesses,
> assuming whoever is doing the suing can be bothered to track them
> down.
>
> Ultimately though if Gentoo gets sued by somebody, the burden of proof
> is actually on them to prove that THEY owned the copyright.  Gentoo's
> burden would probably be to show that reasonable care was exercised
> over accepting code, and that infractions were dealt with in a
> reasonable manner when brought to our attention.
>
> Really though, that is about the best we can do anyway.  If we want to
> suppose that somebody can make us do more than what is "reasonable"
> then we might as well give up on FOSS.
>
>>
>> This is a very useful notice, because if someone has a snapshot
>> tarball, or other non-git copy of particular source files, the
>> lack of a proper notice is a legal problem (see below)
>
> Just stick it in git.  If somebody wants to know the history, they can
> look it up in git.  If somebody wants to go redistributing snippets of
> the file, then complying with the law is their problem, not ours.
>
>>
>> - This ignores the purpose: copyright notices are to make
>> sure when someone gets "free code", they don't assume it's
>> free for any/all purposes with zero restrictions:
>>
>
> Our notices already make this clear, regardless of whose name is listed.
>
>> the infringer could say the copyright status (copyleft
>> uses copyright law for enforcement) wasn't apparent due
>> to the lack of a clearly formatted copyright notice...
>
> The required format of a copyright noticed under US law is explictly stated:
>
> (b)Form of Notice.—If a notice appears on the copies, it shall consist
> of the following three elements:
> (1)the symbol © (the letter C in a circle), or the word “Copyright”,
> or the abbreviation “Copr.”; and
> (2)the year of first publication of the work; in the case of
> compilations, or derivative works incorporating previously published
> material, the year date of first publication of the compilation or
> derivative work is sufficient. The year date may be omitted where a
> pictorial, graphic, or sculptural work, with accompanying text matter,
> if any, is reproduced in or on greeting cards, postcards, stationery,
> jewelry, dolls, toys, or any useful articles; and
> (3)the name of the owner of copyright in the work, or an abbreviation
> by which the name can be recognized, or a generally known alternative
> designation of the owner.
>
>> ... so something generic like "gentoo authors" can be
>> difficult to enforce - I've not seen case law on this.
>
> Our copyright would be completely enforceable even if we had no notice at all.
>
> However, if Gentoo sued somebody for infringement, then the defendant
> could attempt to claim that the infringement was innocent (ie they did
> not know the work was copyrighted).  IMO that would be an uphill
> battle.  If the court decides our notice complies, then they are
> required by law to not give any credence to such an argument.  If they
> decide that it doesn't completely comply, then they would still weigh
> the argument, and how plausible is it that a court will buy that you
> didn't know it was copyrighted when Copyright 2018 Gentoo Authors is
> on the first line of the file?
>
> And none of this will ever matter at all unless Gentoo files a
> lawsuit.  Right now we can't seem to file our taxes.  How likely do we
> think it is that Gentoo will be filing a lawsuit as the plaintiff?
> The notice doesn't matter at all if somebody sues us.
>
>>
>> I believe licensing is the reason for GCO, not copyright
>> attribution. Language about committer, acked or signed-off,
>> and copyright holder VS licenses and GCO, all within the
>> same
>
> Sure, that is completely true. The GCO/DCO/etc has nothing to do with
> attribution.
>
>> GLEP (#76) adds a lot of confusion because copyright
>> is barely mentioned, and not in a clearly defined way.
>
> What is unclear about it?
>
> It used to be much more prescriptive.  However, that was considered to
> be too inflexible, and other prominent projects (like Linux) don't
> seem to require this.  The importance of a very specific notice also
> did not really seem to be sufficient to create controversies when
> contributors felt they could not comply with a very specific
> requirement.
>
>> Copyright should be treated as a separate issue from GCO.
>
> Well, both deal with copyright, but I agree that the notice is
> separate from the GCO, and they are in fact mentioned separately.
>
>>
>> Do "gentoo authors" file a lawsuit when there's infringement?
>
> You do not need to be listed in a copyright notice to file a lawsuit.
> You merely need to have authorship.
>
>> How does jurisdiction work when the only thing which can
>> be known for certain is: "someone claimed the commit they
>> wrote was FOSS/Libre & they signed-off with a GCO line"
>
> Ultimately anybody wanting to file a lawsuit has to prove the
> underlying facts.  If you want to sue somebody for copyright
> infringement you have to demonstrate to the court that you wrote
> whatever you're suing over.
>
> If we were in the business of selling software and were more likely to
> be suing people regularly, then I'd certainly agree that a lot more
> rigor could be used to capture proof of ownership.  This would
> presumably pay for itself as a cost of doing business.  However, that
> isn't the kind of organization we are in.  Mostly we just want to show
> reasonable care, and to be responsible in general.  That helps keep us
> from getting sued.  I'm skeptical that Gentoo would ever sue anybody.
>
>> Does this mean GCO sign-off lines obligate the contributors
>> to respond whenever FOSS/Libre legal issues come up?
>
> No.  Your obligation to respond to a court is established in your
> local laws.  In many places you can be called as a witness against
> your will if you have knowledge of a case, whether you sign anything
> or not.  I don't think that is particularly likely to happen here, and
> it is especially unlikely outside of your local jurisdiction, and most
> courts do have rules to avoid placing unreasonable burdens on
> witnesses.
>
> IMO signing the DCO/GCO/etc probably reduces the likelihood of being
> called to testify simply because your testimony is already a matter of
> public record (well, maybe aside form some notarized statement
> affirming that you signed it).
>
>> If there was a FLA policy in place, and gentoo formally held
>> itself out to protect (as a fiduciary) any FOSS/Libre interests
>> of the contributors; gentoo needs to hold the copyright, and
>> more importantly: invest in policy and planning to legally
>> protect FOSS/Libre interests when any infringement occurs.
>
> Actually, the FLA as written by the FSFe explicitly does NOT assign copyright.
>
>> the protection should be proper: a real entity. changing
>> the language from foundation to authors and treating it
>> like it's still a copyright assignment is pointless
>> unless the simplified attribution still assigns the
>> copyright to the gentoo foundation hold copyright.
>
> The intent is not to require assignment of copyright.  We were
> actually considering rolling out the FLA in parallel (voluntarily),
> but this was felt to be making the GLEP even more complex.
>
>> GLEP 76 shouldn't try to be an umbrella for multiple things.
>
> I guess we should consider that when we approve it.  Oh wait, it is
> already approved.  I guess when you author the next one you can take
> that into account.  :)
>
> It isn't perfect.  IMO it belongs together.  However, others might
> disagree.  It only took about half a decade to finish.  I'm sure
> somebody willing to put enough time into it will surpass it.  Then
> they can go on to real challenges like filing the Foundation's taxes.
>
> In any case, I'm not convinced that copyright notice is really worth
> THAT much fighting over.  I wasn't a huge fan of "Gentoo Authors"
> either, but in the end I realized that notices are fairly overrated.
> I think that the GLEP accomplishes what it ought to on this front.
> Any requirement you add to it is just going to create another group of
> devs who feel they cannot comply with it.  Heck, the current policy
> basically allows almost any notice that complies with US law and there
> is still some concern.
>

Many of those inline replies are redundant, and seem to be
referring to what I wasn't talking about:

I think the confusion / misunderstanding here is evidence
of exactly what I was referring to. Copyright Notices are
notices that a copyright is held, and GLEP 76 is titled:

"Copyright Policy", and only mentions copyright notices.

To me, that's overly vague for one reason - when I see a
copyright notice, I assume it's valid, because I know what
a copyright notice is: the copyright holder saying:

"this is mine and I will protect it"

The infringement occurs when the copyright holder (the
legal entity / person listed in the notice) has their
copyrighted work misused in some way. In the case of
copyleft, the license is traditionally mentioned in the
same section as the copyright notice, with the (implied)
intent being: "if you violate this license, you've done
something with my copyrighted work, and I must protect my
copyright interests by enforcing my license"

To clarify what I meant:

Do "gentoo authors" file a lawsuit when there's infringement?

That was the main / only thing I was referring to.

"this is mine and I will protect it" - copyright holder

One of the things I pointed out wasn't really addressed:

["copyright notices are not required for
a copyright holder to have a copyright"]

^ as referenced here:

>
>>
>> Does this mean "gentoo authors" will appear in court when
>> there's infringement? This is not a rhetorical question.
>>
>

[...]

>
> Ultimately though if Gentoo gets sued by somebody, the burden of proof
> is actually on them to prove that THEY owned the copyright.  Gentoo's
> burden would probably be to show that reasonable care was exercised
> over accepting code, and that infractions were dealt with in a
> reasonable manner when brought to our attention.
>

[...]

^ The copyright holder (the legal entity or person in the
copyright notice) would be the one to file lawsuit(s) when
there's infringement.

I'm specifically / directly asking:

Is the gentoo foundation the copyright holder?

> Our notices already make this clear, regardless of whose name is listed.

That's not clear. A lot of people see: "this is free, and
the source code is available", and then make assumptions
about what that means:

There's very little documentation about gentoo's procedure
when FOSS/Libre work (copyleft / copyrightable portions of
gentoo OS and related tools) is mistreated, and a copyright
action is needed in order to enforce the licesnse (copyleft
style: because that's why there's copyright notices)

The notion: "GLEP 76 implies what happens in that case"...

... must've been in some other document.

My point was / still is:

What is gentoo's policy when infringement happens?
(when "gentoo authors" are the copyright holder)

If a business entity's name is listed as the copyright
holder, their copyright notice means (at least it should)
that they'll be the ones who show up in court when the
time comes to protect against copyleft infringement:

>
> And none of this will ever matter at all unless Gentoo files a
> lawsuit.  Right now we can't seem to file our taxes.  How likely do we
> think it is that Gentoo will be filing a lawsuit as the plaintiff?
> The notice doesn't matter at all if somebody sues us.
>

An infringement suit is when the copyright holder ("gentoo
authors", and I'm questioning how "gentoo authors" hold
a copyright if listed as the "entity" which holds the
copyright) SUES the infringer, not the other way around.

Copyright notice serves a specific legal purpose.

Not sure what you mean about: "file our taxes".

Was that a joke?

To me, the (main) point of GLEP 76 is to let entities who
are willing/able to file a copyright lawsuit have the
option to do so, partly because gentoo doesn't seem to have
a policy in please for protecting copyleft / copyright.