Re: [gentoo-project] call for agenda items -- council meeting 2019-04-14

[Aaron Bauman]

On Tue, Apr 09, 2019 at 08:46:00PM +0000, Gokturk Yuksek wrote:
> Hi,
>
> Alec Warner:
> > On Wed, Apr 3, 2019 at 10:04 AM NP-Hardass <NP-Hardass@g.o> wrote:

[snip]

>
> I don't doubt people's good faith in proposing this policy and I'm sure
> it's done with the best interest in mind. I apologize for not doing the
> homework for the following question: did the Foundation pay for any kind
> of legal counsel on this matter? I think one thing most of us struggle
> with is that we are not lawyers. It would help to put people's mind at
> ease if the Foundation consulted a lawyer that clearly explained:
>
> - What exactly is the legal liability being addressed here?
> - Have there been any precedent cases of copyright infringement
> (constrained to the context of copyrighted ebuilds, or code of similar
> nature) to make this a more realistic threat for the Foundation?
> - In the case of a potential court case, how is the liability
> distributed among involved parties? Would we be legally required to
> track down the contributor (whose identity we may or may not have
> confirmed yet)?
>

There is precent with the Linux Foundation and the DCO being enforced.
That is why they spent so much time and effort in preparing the DCO...
to guard the Linux Foundation from any copyright cases.  I think it is
safe to say that other precendents wrt copyrights can be seen in recent
things like VMWare (sued in German court), SCO, etc.  There are plenty
of situations out there.

> The reason why I'm suggesting this is because I've talked to a friend of
> mine, who is a software patent lawyer, about the DCO and GLEP. Their
> first impression was that the DCO itself has no clause for requiring a
> legal name, so signing it with a fake name may not violate the DCO
> itself. So the (informal) conclusion is that as long as nobody sues you
> for copyright infringement, there is no legal problem with using a fake
> name to sign the DCO. I know it sounds very obvious but the point is
> that legal people have a better grip of the situation than we do, and
> the community is more likely to take their word and justification for it.
>

Is your friend interested in being retained? :)

No, the DCO does not have an *explicit* clause mandating that a "real
name" be used. I am not going to debate the interpretation of it by
others, but if I *certify* something under a pseudonym or false name
then how can I possibly be held responsible for it?  The very essence of
names are to associate things to someone.  Drivers licenses, passports,
library cards, and the list goes on...

Note: If found to be using a pseudonym to sign the Linux Kernel DCO... I
am quite sure you will be dismissed (I will find the real world example
of that happening).

If someone were too take you to court could you be held responsible
under the guise of a pseudonym or false name?  I am not aware of any
countries that allow such proceedings, but ultimately I believe the
first task would be to *prove* that you were the one involved before
proceeding further.  Of course, that most likely is some sort of
physical attestation that must occur.

This is all circumvented by simply using a "believeable" name and
staying silent.  I could easily submit patches to Gentoo as someone else
and certify the DCO.  Of course, this simply means that Gentoo can claim
some form of ignorance/plausible deniability in the end.  Ultimately,
this would likely result (IANAL) in the false contributor being held
accountable for any potential wrong-doing.

-- 
Cheers,
Aaron