How to handle contributions from anonymous?

classic Classic list List threaded Threaded
7 messages Options
Reply | Threaded
Open this post in threaded view
|

How to handle contributions from anonymous?

Boost - Dev mailing list
Hi all,

I got a PR from a contributor who prefers to remain anonymous. The person
created new files and instead of putting a real name, the person added just
initials. I am talking to the person to see whether they can be convinced
to give a real name.

Any advice on how to handle this? My feeling is that a copyright notice
without a real name is illegal.

I could publish the code in my name, but then a documented transfer of
copyright from the contributor to me is missing, which then puts me in a
vulnerable position.

Any thoughts?

Best regards,
Hans

_______________________________________________
Unsubscribe & other changes: http://lists.boost.org/mailman/listinfo.cgi/boost
Reply | Threaded
Open this post in threaded view
|

Re: How to handle contributions from anonymous?

Boost - Dev mailing list
On Sep 26, 2019, at 8:06 PM, Hans Dembinski via Boost <[hidden email]> wrote:

> Hi all,
>
> I got a PR from a contributor who prefers to remain anonymous. The person
> created new files and instead of putting a real name, the person added just
> initials. I am talking to the person to see whether they can be convinced
> to give a real name.
>
> Any advice on how to handle this? My feeling is that a copyright notice
> without a real name is illegal.

Maybe not.  Surely, a copyrightable work with no copyright notice at all isn't illegal (and some messages to this list would qualify).  As I see it, a copyright notice provides partial legal standing to sue for infringement, and also doubles as attribution.  Your contributor clearly doesn't seek the latter, and couldn't pursue the former while remaining anonymous -- and the Boost license leaves little room for infringement anyway.

An attribution notice also informs users who they might come to with complaints (which might be why I once saw a manual for an OEM device marked, verbatim, "Copyright 1996 This Company").  This isn't a problem here, since the maintainers aren't anonymous.

The biggest issue I see is corporate Boost users concerned about the "provenance of the code" (as one Microsoft engineer put it).  As a named individual, your reputation is at stake should you misrepresent your claim in what you contribute, so you're under pressure not to.  But what stops an unnamed actor, and how do you verify?  An anonymous gift, to the paranoid, could have come from anywhere, including a copyleft-licensed project known for pursuing violations.

Personally, I wouldn't have a problem adding the code with a non-copyright attribution notice affirming the license to one of my own projects, but then again, I don't have Microsoft as a user.

Josh

P.S. I'm not a meta-lawyer, and I can't advise you on whether or not this constitutes legal advice.


_______________________________________________
Unsubscribe & other changes: http://lists.boost.org/mailman/listinfo.cgi/boost
Reply | Threaded
Open this post in threaded view
|

Re: How to handle contributions from anonymous?

Boost - Dev mailing list
In reply to this post by Boost - Dev mailing list
On Fri, 27 Sep 2019, 02:06 Hans Dembinski via Boost <[hidden email]>
wrote:

> Hi all,
>
> I got a PR from a contributor who prefers to remain anonymous. The person
> created new files and instead of putting a real name, the person added just
> initials. I am talking to the person to see whether they can be convinced
> to give a real name.
>
> Any advice on how to handle this?



Marshal experienced similar in Boost.Array,
See discussion here

https://github.com/boostorg/array/pull/9#issuecomment-519663402


IMHO, such contributions should be rejected.

Best regards,
Mateusz Loskot, [hidden email]
(Sent from mobile, may suffer from top-posting)

_______________________________________________
Unsubscribe & other changes: http://lists.boost.org/mailman/listinfo.cgi/boost
Reply | Threaded
Open this post in threaded view
|

Re: How to handle contributions from anonymous?

Boost - Dev mailing list
In reply to this post by Boost - Dev mailing list
> Gesendet: Freitag, 27. September 2019 um 02:06 Uhr
> Von: "Hans Dembinski via Boost" <[hidden email]>
>
>
> Any advice on how to handle this? My feeling is that a copyright notice
> without a real name is illegal.
>

Pretty sure that is not the case - at least not in the U.S.

"Do I have to use my real name on the form? Can I use a stage name or a pen name?

There is no legal requirement that the author be identified by his or her real name on the application form. For further information, see FL 101, Pseudonyms. If filing under a fictitious name, check the “Pseudonymous” box when giving information about the authors."

https://www.copyright.gov/help/faq/faq-register.html
https://www.copyright.gov/fls/fl101.pdf
https://law.stackexchange.com/questions/10910/how-to-express-copyright-when-you-use-a-pen-name

Of course that doesn't invalidate the other concerns mentioned by Josh and Mateusz.

Imho, at least the legal side should/could be clarified by boost steering / legal.

Best

Mike

_______________________________________________
Unsubscribe & other changes: http://lists.boost.org/mailman/listinfo.cgi/boost
Reply | Threaded
Open this post in threaded view
|

Re: How to handle contributions from anonymous?

Boost - Dev mailing list
In reply to this post by Boost - Dev mailing list


> -----Original Message-----
> From: Boost <[hidden email]> On Behalf Of Hans Dembinski via
> Boost
> Sent: 27 September 2019 01:06
> To: Boost Devs <[hidden email]>
> Cc: Hans Dembinski <[hidden email]>
> Subject: [boost] How to handle contributions from anonymous?
>
> Hi all,
>
> I got a PR from a contributor who prefers to remain anonymous. The person
> created new files and instead of putting a real name, the person added just
> initials. I am talking to the person to see whether they can be convinced to give a
> real name.
>
> Any advice on how to handle this? My feeling is that a copyright notice without a
> real name is illegal.
>
> I could publish the code in my name, but then a documented transfer of copyright
> from the contributor to me is missing, which then puts me in a vulnerable
> position.
>
> Any thoughts?

Boost long established practice is to require a named author making a copyright claim.

(A reason for this is to avoid the (admittedly tiny) risk of someone later claiming copyright and then accusing Boost of abusing their copyright and causing big trouble with all users lawyers).

We have no way of knowing if an alias is real?  https://en.wikipedia.org/wiki/William_Sealy_Gosset is an honorable example 😉

But an email kept by you transferring copyright from 'anon' to you might be a way of keeping the author anonymous?

That may still leave 'anon' vulnerable if he wants to keep his contribution secret from his employer (who prohibits publication without their authorisation) , for example, but in practice it would be OK.

For a PR, I'd be tempted to just put your name on the copyright claim.

FWIW

Paul

Paul A. Bristow
Prizet Farmhouse
Kendal, Cumbria
LA8 8AB           UK








_______________________________________________
Unsubscribe & other changes: http://lists.boost.org/mailman/listinfo.cgi/boost
Reply | Threaded
Open this post in threaded view
|

Re: How to handle contributions from anonymous?

Boost - Dev mailing list
Thanks, Paul, Mateusz, Mike for your answers.

For anyone interested, there are more comments on this topic on the boost channel on cppslack.

> On 27. Sep 2019, at 11:07, Paul A Bristow via Boost <[hidden email]> wrote:
>
> But an email kept by you transferring copyright from 'anon' to you might be a way of keeping the author anonymous?

Possible, but cumbersome.

> That may still leave 'anon' vulnerable if he wants to keep his contribution secret from his employer (who prohibits publication without their authorisation) , for example, but in practice it would be OK.

If it is indeed case that the code was written while anon was under contract to do something else, then this would be a strong reason to not accept the code.

> For a PR, I'd be tempted to just put your name on the copyright claim.

The problem is that I started to think seriously about this and now I cannot just stop. Putting my name on the copyright claim leaves me open to be sued by anon for copyright infringement unless there is a proper written contract that legally transfers the copyright of the code to me. Of course we could write down something and I could keep it forever in a drawer, but I don't want to complicate my life with this.

I sympathise with Mateusz' view. For the future, I will make sure that potential contributors cannot contribute anonymously. Perhaps I have to rewrite the feature that anon provided from scratch. Let's see.

Best regards,
Hans

_______________________________________________
Unsubscribe & other changes: http://lists.boost.org/mailman/listinfo.cgi/boost
Reply | Threaded
Open this post in threaded view
|

Re: How to handle contributions from anonymous?

Boost - Dev mailing list

> On 27. Sep 2019, at 15:40, Hans Dembinski <[hidden email]> wrote:
>
> Thanks, Paul, Mateusz, Mike for your answers.

Sorry, Josh, I forgot to thank you.


_______________________________________________
Unsubscribe & other changes: http://lists.boost.org/mailman/listinfo.cgi/boost