Re: Overview of copyright issues

[Graham Percival]

Mao, I missed the flamewar.  I'm very disappointed that this
happened without me.  :(


On Wed, Sep 09, 2009 at 06:04:17PM +0200, Joseph Wakeling wrote:
>    (3) Individual code files contain copyright notices but not licensing
>        notices.  It's not clear if these notices have been maintained
>        beyond updating the date -- have author names been persistently
>        added where appropriate?

No.

>    (4) Individual documentation source files (.itely files) in general
>        contain neither copyright notices nor licensing notices.

The manuals include the FDL, so I'd argue that it's clear that the
sources are under the same license.  I'd argue the same about the
source files, actually.

>    (5) We have a full list of contributors to Lilypond but need to have
>        PAPER documentation giving their permission to change the license
>        of the code/documentation they wrote.

Yes.  Including people for whom we lost contact 10 years ago, and
including the heir(s) of Rune Zedeler, who passed away last year.

Are you offering to track down those people?  And write to his
family to find out who owns his software (I'm sure they won't
know), and ask for their permission?  How good's your German, by
the way?  I have no clue if his family speaks English well enough
to understand the nuances of GPLv2 vs. GPLv3.  Or at least the
notation of changing a software license, where both licenses
essentially say the same thing[1].

[1]  yes, you and I know the differences, but normal people have a
hard enough concept with "I'll share this software with you if you
share it with others".

>           (i) a Debian copyright file for the package, apparently last
>               updated in 2004, stating that Lilypond is 'v2 or later'

Mispresenting a license is a serious issue, but evidently the
Debian maintainer is aware and is fixing it.

>          (ii) the fact that the Lilypond COPYING file, while describing
>               the licensing situation accurately, does so in non-
>               standard language (people expect to see the statement
>               recommended in the GPL appendix, which allows for
>               unambiguous distinction between 'vN or later' or 'vN')

Really?  Line 22 says "Version 2, June 1991" to me.  How exactly
do you propose to change the COPYING file?

>           (v) the link on the main page which (still) points to the
>               text of GPLv3 on gnu.org (and has ever since v3 was
>               released -- the first message pointing out this
>               discrepancy was sent to the -devel mailing list over
>               2 years ago!).

This is fixed on the new website.


> In addressing this there are several policies that can be put in place NOW:
> 
>    (1) All new files added to the code or docs must contain an
>        unambiguous copyright AND licensing notice: I suggest in this
>        case GPLv2 or later for code, and the GFDL 1.1 or later for docs.

I really don't see why we MUST do this.  Is there any legal
requirement that every single file contain the license?  I'm not
aware of any.  Material is copyright by default.

>    (2) Contributors of new material to existing files should add
>        copyright/licensing notices *for their contributions*, again with
>        appropriate 'or later' bits.

That's going to get ridiculous.  We should add a name for each
one-line bugfix?

> Questions:
> 
>    (1) How well have the copyright notices for individual files been
>        maintained?

Not.

>  Do they refer only to original authors of files
>        or all authors over that file's history?  (More precisely: is
>        there not just a list of who contributed to LP but also who
>        wrote exactly what?)

Original authors of files.  Look at the git log for more details.

>    (2) Is there a preference for transferring copyright to some third
>        party (either the FSF or some LP-dedicated organisation)?  If
>        not, it seems a good idea for future contributions to LP to be
>        'or later', as it avoids a repeat of this issue in the future.

This has been discussed privately, and might occur if the
copyright-fixing issue is undertaken seriously.


> OK, I think that's the lot.  Thoughts/disagreements/comments anyone?

Yes, I disagree.  You've done a lot of demanding.  Tracking down
everybody, especially getting informed consent from the families
of deceased contributor(s), will be a huge amount of work.

I repeat what I said to somebody (maybe you) on -user a day or two
ago: are you prepared to do something like 50 hours of work on
this?  Or are you just blowing smoke?  If you're willing to spend
the time to organize everything, then I'll do my part.

This will be a long, hard, painful process.  First you need to
figure out how contributed stuff.  After doing the obvious stuff
from git and old CVS changelogs, you'll probably start asking
various people for email addresses.  I'm willing to look for
those, but I'm not going to treat it as a priority -- I have at
least 50 lilypond-related emails to process that are more
important (to me), and another 100 or so lower down on my list.  I
know that you'll be excited, or at least determed, to do this
task, but I'm not going to rush to keep up; it might take me a
week to get around to it.  This will, of course, be somewhat
demoralizing.

Now, many people have changed email addresses.  To pick a random
name, can you find Erik Sandberg's current email?  He did a lot of
work on lilypond in the past while he was a student, but I would
guess that his student email address is no longer valid.  It might
take a bit of work to dig it up.  You might have to do this for
10-20 contributors.


If I sound like I'm discouraging you from the project... well, yes
and no.  I think it would be *great* if we could clear this up.
But it will be a huge, demoralizing task.  I'd be amazed if it was
finished this year.  And what do we get at the end of it?  A few
legal geeks and wannabe lawyers (myself included) will have a nice
fuzzy feeling.  Honestly, no previous contributor is going to sue
us.  In some ways, this is just inventing a problem.

And the most frustrating thing about this project is that it's an
all-or-nothing affair.  If somebody refuses to agree to GPL2+ or
GPL3+ or assigning copyright to a LilyPond Foundation, the whole
thing is screwed.  If you can't find somebody, the whole thing is
screwed.  If you get frustrated after spending 10 hours trying to
find Chris Jackson's current email address (random contributor
from 2002) and give up, the whole thing is screwed.  If you think
there's any chance that you'd want to give up after starting the
project, then it would be better for me to de-motivate you before
you start.


Well, "screwed" other than three possibilities, with various
degrees of seriousness.

1)  We pretend to be an American company.  (see Flight Club: "if
there's a flaw in my company's products, then we measure the
expected settlements from being sued, vs. the cost to fix the
flaw.  If the legal costs would be lower, then we leave the flaw"
(paraphrased))
In other words, we just switch the license without consent from
everybody, and hope that nobody sues us.  Hey, US companies
(including Microsoft!) include GPL software in closed-source
applications all the time; they only care if they get caught!

Of course, this email (in a public, archived format) would be
pretty good evidence of "bad faith" in this regard.  Hopefully
you'd sufficiently document your efforts to reach those people
such that the courts might consider it "good faith" to counter-act
the bad faith I just bought us, if we actually use this option.


2)  We pretend to be wikipedia.  Hey, they changed from FDL to
Creative Commons after a vote.  If they can get away with
something as blatantly illegal as that (I mean, there's almost
10,500,000 registered users, so I would guess that a least 10
million account-holders didn't give permission for Creative
Commons.  Ok, that probably only means 1 million people... but
still, surely we can get away with ignoring the rights of 5 or 10
people?  ;)

Of course, I'm not aware of any legal term for "but mommy, HE did
it first!".  And come to think of it, this didn't really help me
when I was a kid, either.


3)  If we can't find some people, or if they don't agree to
whatever relicense/assignment, then we eliminate their patches and
rewrite that material.

This could involve a non-trivial amount of extra work, but at
least it's legally sound.  This also gives you an order to ask
people -- identify the most active / biggest contributors, and get
them on board first.  If 95% of the code+docs is covered, then
it's more feasible to undertake the project.  I mean, if worst
comes to worst, we can just rewriting the stuff from the missing
people.

Cheers,
- Graham