Newest Concern on Sun's Open Source Strategy
In my last blog's comments, I had a couple of people raise the issue of joint copyright assignment. The subject was raised with the greatest respect and concern, and I'd like to thank the posters for giving me a chance to talk about it. There continues to be a lingering uneasiness about Sun's new foray into Open Source, so I'll probably be blogging on this and related subjects for the next few weeks.
Joint Copyright Assignment is a fairly standard practice that is being embraced by most major open source concerns. First let's explain how copyright works. As the creator of any peice of work, you by default own the copyright on it, and noone else does. Even if you give it under an existing license (like CDDL, or GPL, or ASL) to an organization, you continue to keep that license.
So far, so good. There's just one problem. Noone else has the copyright on the code you just made. Why can this be a problem? Well, there's a few ways. For one, you can never change the license again, without permission from every copyright holder, which in large projects, can be hundreds of people. Imagine your code worked that way - would anything useful ever get done? Do you beleive licenses are any more free of bugs than code? So, for example, to go to a GPL 3.0, CDDL 1.1, or APL 2.1, it would require to contact every single person and get their permission. One doesn't want to? You can't do it. Can't find one? You can't do it. Then there's the problem of what happens if you end up in court. Only the holder of copyright can usually perform legal operations on behalf of the covered code. If you don't hold copyright on the code, you've got a problem. There's a third issue that Sun faces, and that is that parts of AS PE (and thus GlassFish) find their way into the RI. And Sun's contractually obligated to give the RI to a whole host of companies, including such companies as BEA, and IBM. We aren't going to change that, and even if we could, we wouldn't want to, since that's good for the entire developement community.
And that doesn't even touch on patents, which most licenses don't discuss at all - though CDDL does. So, what's the solution here? Well, one solution is to put a copyright grant right into the license - ASL does this, for instance. But lawyers would make any QE manager proud, they're nervous beasts. They prefer to have a signed peice of paper that actually establishes beyond a reasonable doubt that the original author actually meant to assign copyright. Thus, the SCA is born for our organization, and other similar documents exist for others. It's not a scary document - go read it yourself.
There's been some suggestion that this is a uniquely Sun thing to do. It's not. Other highly regarded organizations do this, for much the same reasons mentioned above. The Apache Software Foundation has been requiring this for some time. The Free Software Foundation has required for as long as I can remember. I've also heard of a number of other groups doing it, but a cursory web search didn't find this information on their websites - they're often less transparent than us, so that's not a suprise.
Still concerned? Let's talk about it below.