Re: [gentoo-project] [RFC] GLEP 76: Copyright Policy [v4]

[kuzetsa]

On 09/27/2018 09:43 AM, Rich Freeman wrote:
> On Thu, Sep 27, 2018 at 9:08 AM kuzetsa <kuzetsa@×××××.com> wrote:
>>
>> in this case, the GCO (or the DCO from which it borrowed it's ideas)
>> should explicitly state its purposes, rather than relying on the
>> assumption that a person can be tracked down if the license was is ever
>> in doubt.
>
> While I'm all for having background, I don't see how it actually
> changes the situation.
>
> Also, there is no need to track people down, ever.  The purpose of the
> GCO/DCO is to make the contributor liable for their contributions, and
> this is already accomplished.  If the true copyright holder wants to
> try to track them down that is their problem.

This suggests the "real name" requirement from GCO / DCO could be
enforced, but isn't. Even if name alone was all that is truly required,
without a way to tie a specific name to a specific person who has the
same name, the legal meaning is moot due to "real names" not being a
unique identifier.

> If somebody provides us evidence that they are the true copyright
> holder and ask us to remove their code, we simply have to remove their
> code.  No stack of licenses/certificates/attestations/etc will ever
> change that.
>
> It is like buying a house.  If you buy a house from somebody, and it
> later turns out that they never owned the house, then the owner is
> going to be able to take his house back from you free of charge.  It
> doesn't matter how many documents the "seller" signed in the process -
> it was never their house to sell.  However, those documents CAN place
> some liability on them for such things, or provide you with due
> diligence / reasonable care so that it shows that you acted in good
> faith and the owner won't go after you beyond just getting back their
> house.  You're still out the house either way.

Nobody is proving their name or where they're located. In this metaphor,
I believe gentoo is the one buying a house without verifying the
identity of the seller. (see above)

> I believe this is the basic principle behind these kinds of documents.
> It is basically an affirmation of compliance, which is a form of
> showing reasonable care on the part of the recipient.
>
>>
>> people can and do physically relocate from time to time, and if they're
>> no longer a contributor there's no way to track them down, should the
>> need arise for any legal or ethical questions (the kind of purpose which
>> the policy makes no mention of: a way to reach the contributor)
>>
>
> See above.  Tracking down the contributor is unlikely to really get us
> far, and it really makes no sense.  The purpose of the DCO is to
> collect the affirmation of compliance up-front so that we don't have
> to try to get it later.  It doesn't change who owns copyright.  If it
> turns out somebody lied to us then bad things will always happen, but
> they just won't be as bad as they could have been.
>

It's true that affirmation of compliance would be helpful, but if gentoo
doesn't ask for that diligently, relying on the presumed validity of a
name (and no other significant metadata) is little use to anyone's legal
injury which could've been prevented be a more rigorous policy.

-