How to handle contributions from anonymous?
Hi all, I got a PR from a contributor who prefers to remain anonymous. The person created new files and instead of putting a real name, the person added just initials. I am talking to the person to see whether they can be convinced to give a real name. Any advice on how to handle this? My feeling is that a copyright notice without a real name is illegal. I could publish the code in my name, but then a documented transfer of copyright from the contributor to me is missing, which then puts me in a vulnerable position. Any thoughts? Best regards, Hans
On Sep 26, 2019, at 8:06 PM, Hans Dembinski via Boost
Hi all,
I got a PR from a contributor who prefers to remain anonymous. The person created new files and instead of putting a real name, the person added just initials. I am talking to the person to see whether they can be convinced to give a real name.
Any advice on how to handle this? My feeling is that a copyright notice without a real name is illegal.
Maybe not. Surely, a copyrightable work with no copyright notice at all isn't illegal (and some messages to this list would qualify). As I see it, a copyright notice provides partial legal standing to sue for infringement, and also doubles as attribution. Your contributor clearly doesn't seek the latter, and couldn't pursue the former while remaining anonymous -- and the Boost license leaves little room for infringement anyway. An attribution notice also informs users who they might come to with complaints (which might be why I once saw a manual for an OEM device marked, verbatim, "Copyright 1996 This Company"). This isn't a problem here, since the maintainers aren't anonymous. The biggest issue I see is corporate Boost users concerned about the "provenance of the code" (as one Microsoft engineer put it). As a named individual, your reputation is at stake should you misrepresent your claim in what you contribute, so you're under pressure not to. But what stops an unnamed actor, and how do you verify? An anonymous gift, to the paranoid, could have come from anywhere, including a copyleft-licensed project known for pursuing violations. Personally, I wouldn't have a problem adding the code with a non-copyright attribution notice affirming the license to one of my own projects, but then again, I don't have Microsoft as a user. Josh P.S. I'm not a meta-lawyer, and I can't advise you on whether or not this constitutes legal advice.
On Fri, 27 Sep 2019, 02:06 Hans Dembinski via Boost
Hi all,
I got a PR from a contributor who prefers to remain anonymous. The person created new files and instead of putting a real name, the person added just initials. I am talking to the person to see whether they can be convinced to give a real name.
Any advice on how to handle this?
Marshal experienced similar in Boost.Array, See discussion here https://github.com/boostorg/array/pull/9#issuecomment-519663402 IMHO, such contributions should be rejected. Best regards, Mateusz Loskot, mateusz@loskot.net (Sent from mobile, may suffer from top-posting)
Gesendet: Freitag, 27. September 2019 um 02:06 Uhr Von: "Hans Dembinski via Boost"
Any advice on how to handle this? My feeling is that a copyright notice without a real name is illegal.
Pretty sure that is not the case - at least not in the U.S. "Do I have to use my real name on the form? Can I use a stage name or a pen name? There is no legal requirement that the author be identified by his or her real name on the application form. For further information, see FL 101, Pseudonyms. If filing under a fictitious name, check the “Pseudonymous” box when giving information about the authors." https://www.copyright.gov/help/faq/faq-register.html https://www.copyright.gov/fls/fl101.pdf https://law.stackexchange.com/questions/10910/how-to-express-copyright-when-... Of course that doesn't invalidate the other concerns mentioned by Josh and Mateusz. Imho, at least the legal side should/could be clarified by boost steering / legal. Best Mike
-----Original Message----- From: Boost
On Behalf Of Hans Dembinski via Boost Sent: 27 September 2019 01:06 To: Boost Devs Cc: Hans Dembinski Subject: [boost] How to handle contributions from anonymous? Hi all,
I got a PR from a contributor who prefers to remain anonymous. The person created new files and instead of putting a real name, the person added just initials. I am talking to the person to see whether they can be convinced to give a real name.
Any advice on how to handle this? My feeling is that a copyright notice without a real name is illegal.
I could publish the code in my name, but then a documented transfer of copyright from the contributor to me is missing, which then puts me in a vulnerable position.
Any thoughts?
Boost long established practice is to require a named author making a copyright claim. (A reason for this is to avoid the (admittedly tiny) risk of someone later claiming copyright and then accusing Boost of abusing their copyright and causing big trouble with all users lawyers). We have no way of knowing if an alias is real? https://en.wikipedia.org/wiki/William_Sealy_Gosset is an honorable example 😉 But an email kept by you transferring copyright from 'anon' to you might be a way of keeping the author anonymous? That may still leave 'anon' vulnerable if he wants to keep his contribution secret from his employer (who prohibits publication without their authorisation) , for example, but in practice it would be OK. For a PR, I'd be tempted to just put your name on the copyright claim. FWIW Paul Paul A. Bristow Prizet Farmhouse Kendal, Cumbria LA8 8AB UK
Thanks, Paul, Mateusz, Mike for your answers. For anyone interested, there are more comments on this topic on the boost channel on cppslack.
On 27. Sep 2019, at 11:07, Paul A Bristow via Boost
wrote: But an email kept by you transferring copyright from 'anon' to you might be a way of keeping the author anonymous?
Possible, but cumbersome.
That may still leave 'anon' vulnerable if he wants to keep his contribution secret from his employer (who prohibits publication without their authorisation) , for example, but in practice it would be OK.
If it is indeed case that the code was written while anon was under contract to do something else, then this would be a strong reason to not accept the code.
For a PR, I'd be tempted to just put your name on the copyright claim.
The problem is that I started to think seriously about this and now I cannot just stop. Putting my name on the copyright claim leaves me open to be sued by anon for copyright infringement unless there is a proper written contract that legally transfers the copyright of the code to me. Of course we could write down something and I could keep it forever in a drawer, but I don't want to complicate my life with this. I sympathise with Mateusz' view. For the future, I will make sure that potential contributors cannot contribute anonymously. Perhaps I have to rewrite the feature that anon provided from scratch. Let's see. Best regards, Hans
participants (5)
-
Hans Dembinski
-
Josh Juran
-
Mateusz Loskot
-
Mike
-
pbristow@hetp.u-net.com