Rug pulls, forks, and open-source feudalism

> Projects with CLAs more commonly are subject to rug pulls; projects using a developers certificate of origin do not have the same power imbalance and are less likely to be rug pulled.

Would be worth explaining why: my understanding is that if you sign a CLA, you typically give a right to relicence to the beneficiary of the CLA. So you say "it is a GPL project, my contribution is GPL, but I allow you to relicence my contribution as you see fit".

If the project uses a permissive licence already, honestly I don't really see a big impact with signing a CLA: anyone can just take the codebase and go proprietary with it. However, if it is a copyleft licence, then signing a CLA means that the beneficiary of the CLA doesn't play by the same rules and can go proprietary with the contributions!

If you don't want a rug pull, you should use a copyleft licence and not sign a CLA: nobody can make Linux proprietary because the copyright is shared between so many people.

If you use a permissive licence, then a rug pull is part of the deal.

But what about GNU their projects require signing a CLA and I don't think they will do a rug pull

I think there are two differences there:

FSF wants to be able to relicense as/if the legal landscape evolves, but in a way consistent with the original license aims. I fully support this (and I want to give them this flexibility), but admit that this is based on my trust in FSF more than anything else.

FSF wants a contribution agreement to ensure that it doesn’t have to litigate with 1000s of companies who might claim some contribution that an employee of theirs made was corporate IP*. I also understand this, particularly given the incentive for a company to intentionally cause a “tainted” contribution to get into FSF products.

My willingness to “go along” with an FSF CLA is much, much greater than for a random company who wants to trade on and benefit from the goodwill of the “we’re open-source!!” banner and yet be able to rug-pull later.

* - I think I have exactly one tiny change into emacs from decades ago. It took me way longer to get corporate sign off on the CLA than it did to author the change.

>> My willingness to “go along” with an FSF CLA is much, much greater than for a random company who wants to trade on and benefit from the goodwill of the “we’re open-source!!” banner and yet be able to rug-pull later.

FSF is the only organization that I would trust with a CLA. Everyone else has mixed motives.

As this stuff keeps happening I think the GPL will regain popularity.

For a long while I was using MIT a lot, these days I have started switching to GPL especially for anything significant.

All because of the nonsense and all the rugpulls.

In my experience, the usefulness of any particular license is only as good as your ability to enforce it in court.

It's also a risk for the other side. Big companies wouldn't take the risk to go in court, they'd rather not use your project.

That has not been my experience... instead, they realize that struggling individual developers cannot and do not want to fight for their rights, so they openly abuse them knowing nothing will happen.

Indeed, see for example Vizio (or Tesla) or many other examples.

https://sfconservancy.org/copyleft-compliance/vizio.html

> SFC seeks to confirm in the courts that purchasers of devices running Linux and other software with reciprocal licenses like GPLv2 have a legal right to ask for, and receive, the source code for those devices, so they can adapt the software to their needs, and make practical use of those adaptations by being able to install those changes back onto the devices they purchased.

Specifically the last part of that sentence, unfortunately I'm not very hopeful that it will happen, since v2 does not have the same anti-tivoization clause that v3 does, and Linus has personally said that he wants people to be able to lock down their products.

My own personal experience with SFC, EFF and FSF is also that they will only agree to take on a case for you if they happen to want to do it, and if you sign over all copyright ownership to them, which I think a lot of people are not willing to do.

GPLv2 has the same requirements as GPLv3 around installation of modifications. The GPLv3 also doesn't prevent what TiVo did; breaking the proprietary software when run on modified GPLed software. TiVo didn't prevent installation of modified GPLed software, and didn't think it was legal to do that.

https://sfconservancy.org/blog/2021/mar/25/install-gplv2/ https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t... https://events19.linuxfoundation.org/wp-content/uploads/2017...

Linus doesn't want people to enforce the GPL in general, not just the lockdown case, he has been arguing against that for a long time.

IIRC SFC has a contract option to enforce your copyrights without being the owner of them, I've seen that contract on paper at conferences. They also have limited resources, so can't take on every case.

> GPLv2 has the same requirements as GPLv3 around installation of modifications

I disagree:

> Stallman found this practice (using crypto lock-down to force the proprietary software to fail) illegitimate. He noted publicly that GPLv2 didn't prevent this behavior, and wanted (and wrote, as explained below) a GPLv3 draft that prohibited that behavior.

I think the author is sometimes (but not always) conflating software installation instructions with the ability to actually usefully install different versions of the software.

At one point he specifically claims that GPLv2 required "a functional installation method", but gives no citations of this in any actual clause of the GPLv2, nor cites any court cases where this was argued either way, and even admits that many lawyers believe that a working installation method is not required (and gives no evidence otherwise because saying he personally disagrees).

> there was a clear installation requirement in GPLv2 — the word “install” appears prominently

Except the only time the word "install" actually appears is in this part:

> scripts used to control compilation and installation of the executable

And I would argue that it's going to be entirely up to every individual judge's 50/50 interpretation as to whether "scripts used to control installation" actually implies a working method of installation as well.

Not only that, but TiVo's "forcing the proprietary software to fail" practice is IMO a completely different legal issue from not even having a method of installing different software on a locked-down device in the first place.

TiVo happened to have a method to do that already, but many devices since then (which use Linux kernels) do not have a way to actually modify any software, and for good reason IMO (e.g. safety/regulation such as in aerospace/defense/medical/automotive industries). And they are not getting sued or called out by anyone to my knowledge... but please prove me wrong.