Re: [gentoo-project] Date-of-birth in developer applications

[Rich Freeman]

On Wed, Jun 20, 2018 at 9:06 AM Ulrich Mueller <ulm@g.o> wrote:
>
> >>>>> On Wed, 20 Jun 2018, Rich Freeman wrote:
>
> > The "underlying need" is what I'm getting at.  Do we REALLY need to
> > track developers post-retirement?  If we do, is DOB really the best
> > way to do this?
>
> I would presume that we do, if we need to clarify copyright or
> licensing of any files in our repositories. I could provide several
> examples where I had to contact retired devs because of license
> issues.
>
> But indeed, knowing their date of birth wouldn't have helped there.

Past developers may not be reachable, cooperative, or even alive.

If we need information or assurances from them, we should obtain it
BEFORE we accept commits, not try to chase it down years later.

I'd be interested in any cases where we felt this was necessary.  I
know that a lot of work was done recently to try to figure out the
license history of the tree, but honestly I'm not convinced it was
necessary, and legally digging into messy situations can sometimes
even be harmful.  In general I think forward-looking solutions tend to
be best unless there is a clear legal duty to look backwards.


>
> > And what are we going to do when some retired developer asks us to
> > forget about them?  I don't think legally we need to go retract
> > published info, but that DOB seems very much the sort of thing that
> > would be risky to hold on to if somebody explicitly told us they don't
> > want us to retain it.  We'd probably need justification to do so.
>
> The only justification I can think of is that we may need to know if
> a developer was of legal age when committing any code. But that seems
> very theoretical, since we don't even verify anybody's identity.
>

Even if we did verify somebody's identity, we could document that this
was done, and not retain any personally-identifying info.

Ultimately it comes down to what constitutes reasonable care, and that
largely depends on why we're doing things in the first place.

I could elaborate a lot more, but IMO in a copyright case, Gentoo's
liability is going to come down a lot more to what Gentoo is doing
than what the developer from 10 years ago did.  Did Gentoo exercise
reasonable care and this is innocent infringement (which is NOT
without substantial liability, it just avoids the completely insane
statutory provisions in US law  cf. 17 USC 504(b) and (c)2)?

I'm actually pressed to think of how the testimony of the committing
dev could actually help us in a defensive copyright case as the burden
of proof is on our side when it comes to proving ownership, and if the
plaintiff can prove ownership I don't see how the testimony of a dev
would overturn that.  It might help more in an offensive one, but in
that case we can pick code for our lawsuit where the committing dev is
readily available, assuming we ever resorted to an offensive action.

-- 
Rich