Re: [PDO] Re: PDO 2: Request for Comments

Hi Derick, thanks for your thoughts on this issue.  May I offer some 
responses.

Derick Rethans wrote:
> a CLA can *not* prevent [IP related issues]. 

Right, a CLA is not intended to prevent IP conflicts.  That's the 
responsibility of the contributor, just as in the traditional non-CLA 
process used by PHP.

> An example here is that
> when one of the CLA-signed PHP developers talks at a conference with another person (that did not sign the CLA) on some PDO related issues, the ideas that this other person brings up can not be used as it's not own contribution. 

Not true.  You can't copyright ideas.  If you and I talk about an 
algorithm, or even an API, and then we go home and each of us writes our 
own code implementing it, now we each have our own IP and we can both 
copyright our own work without conflicting with each another.

Likewise, any kind of discussion short of actually writing the code (or 
other IP) is not subject to the CLA.

> can you really rightfully claim it [is]
> your contribution if somebody else suggested it orally? 

Yes, this is fine.  We did this frequently in the Zend Framework 
project.  People would suggest a feature on the mailing list or in the 
issue tracker.  They could simply describe their feature at a high 
level:  "I want to be able to do X."  Or they could write code to 
illustrate desired usage:  "I want to write the following code in my app 
and it should return Y."  If they are reporting a bug, they often 
includes code to describe the steps to reproduce the bug.  These 
contributions are not subject to the CLA.

It is subject to the CLA if they give specific code that they want 
committed to the project.  If they don't sign the CLA, then their code 
cannot be used verbatim, because they aren't offering an assurance that 
it's theirs to contribute and that they grant it freely. 

In the traditional non-CLA PHP community, these are conditions for the 
contribution.  But in the case of PHP, the conditions are implicit, 
based on the culture of that community.  So why is it a problem to put 
these same conditions in writing, making them explicit rather than implicit?

> Another issue here is that we can't really have a public bug tracker for PDO where people can put in patches. 

Not true.  You can have a public issue tracker for a CLA-governed 
project  (for example, http://framework.zend.com/issues/).  People can 
post bugs, feature requests, etc. even if they haven't signed the CLA.

However, patches from non-CLA signers must be treated carefully.  If you 
want to use their code, you can ask the bug reporter to sign the CLA and 
they can grant their patch retroactively.  We did this regularly in the 
ZF project. 

Otherwise you should ignore their code, and fix the reported issue using 
a different implementation.  We did this on occasion too.  Actually, 
more often it was because the patch submitted wasn't a good solution, so 
we wrote original code that solved the reported issue more robustly.  
I'm sure you've done similar things for bugs reported on php.net.  Since 
we didn't use the bug reporter's code, we didn't need to ask them to 
sign the CLA.

> nothing is done to prevent the litigation against individual contributers in case their contribution *was* to be covered by a US software patent. This CLA does not give this protection to the contributors that is mentioned in the FAQ.
>   

The CLA offers no such protection, nor is it supposed to.  You can't 
declare yourself immune from being sued if you truly did use someone 
else's IP without permission. 

The CLA does not say no one can sue you for violating their IP.  It says 
*you* as a contributor agree not to sue other people who use your 
contribution that you granted to the project.

If all the contributions have been made properly, then you can have that 
measure of confidence that no one is coming after you just for using the 
software.  Contributors naturally are also users of the software, so 
they gain this assurance the same as any users do.  This is what's meant 
by the CLA offering benefits to both users and contributors.

> In order to do real good for Open Source, those patents
> should be provided to the Open Source community free-of-charge. 

Yes, that's a great idea!  And not coincidentally, the CLA actually does 
have that effect.

Admittedly, not for the total patent portfolio of the contributor, but 
only for the patents that are relevant to the contribution, and these 
are granted specifically to this project.  It's good to be specific.  :-)

> There have been a few occasions where this CLA prevented people from contributing code. 

We are seeing that the converse is also true:  currently there are some 
people who want to contribute to PDO, but may not be able to do so 
unless all contributions to that project are governed by a CLA.

It's not that they're trying to protect themselves from lawsuits over 
what they contribute; they are pretty sure that they're contributing 
clean IP.  It's that they want to protect themselves from legal exposure 
by using software that *others* have contributed to.

This brings up the question of why is this so important for PDO?  After 
all, these users also use PHP itself, and numerous other OSS projects 
that don't use a CLA.  This is a good question, and I'm not sure the 
answer is clear.

One possibility is that PDO is unique because the vendors who wish to 
contribute are all direct competitors, and their contributions will mix 
together more finely that they would if they were working on separate 
PHP extensions.  So it is understandable that they all like the 
assurance that they're not going to sue each other.

The rest of the PHP community benefits from this too.  Major companies 
have patent portfolios, whereas individual contributors probably don't.  
Thus there's a greater chance of some code related to patented 
technology making its way into a contribution from these companies.  So 
it's reassuring that the vendors are willing to sign something to grant 
such patented technology for free use by the project.  As the vendors 
agree not to sue each other over these contributions, they are also 
agreeing not to sue the rest of us, either.

> This is not what Open Source is about. It's not only about being able to use code freely, it's just as much as making it easy to contribute back. 

This is similar to a point made on another blog yesterday, and I'll 
respond as I did there: 

I don't currently have cvs commit privileges on php.net.  If I ask for 
access purely on the principle of freedom to enhance the code, would I 
be granted those privileges?  Probably not.  So does this mean that PHP 
is not open-source?

However, I'm free to enhance PHP code on my own computer and distribute 
it as my own derived work.  This is allowed by the PHP License, and this 
does satisfy the principle of open-source. 

The same is true for PDO, given its proposed PDO License and CLA.

Regards,
Bill Karwin