Software Freedom Conservancy

The next $37,033 of support we receive will be matched thanks to Private Internet Access and an anonymous donor! Support Conservancy today!

We've matched $37,966.62 of $75,000 so far!

[RSS] Conservancy Blog

ContractPatch, step 1: Everything Is Negotiable.

by Fred Jennings on August 4, 2016

About a year ago, I got talking with some friends in the tech industry about contracts. And it began to sound like something was very, very wrong.

Working informally through personal networks of engineers, project managers, freelance designers, and many more, I ended up with a small horde of employment contracts, offer letters, work agreements, and all manner of other documents that fall under that umbrella term, “contracts.”

And almost all of the contracts were bad.

Not badly written, though some were. Not legally unenforceable, though some were.

They were bad for the people who signed them.

They waived important legal rights, gave the employer ownership of ideas and projects it had no reason to take, or imposed serious limits on future work.

And people often didn’t realize how bad these were, the risks they’d agreed to, or what rights they’d given up.

Among the few who did, most didn’t realize they could negotiate these terms. Others did, but weren’t sure how to start. Several assumed their employer wouldn’t enforce the more onerous terms.

Nobody should bet their future on that assumption. Doing so is to build one’s career on a house of cards.

But that won’t change until enough people speak up and push back, and have the tools to do so.

That’s where this project began for me.

About a month ago, I sat down over lunch with friends from Software Freedom Conservancy, and learned they’d embarked on a similar project at around the same time. In fact, Karen Sandler recently spoke on the subject as OSCON 2016.

We’re calling it ContractPatch. The idea is to provide strategy and legal knowledge to workers, along with some sample language for better contract terms.

But let’s start with the first step:

Everything is negotiable. Keep repeating that until it sticks.

Merely knowing that is an edge. Companies know it, but often don’t want their employees or potential hires to realize it. Some employers even structure their hiring, renewal, and termination processes to discourage negotiation. This can halt inexperienced negotiators, especially those from historically underrepresented groups who face widespread employer prejudice that can undermine their perceived ability to negotiate. Everyone will enter a negotiation with different leverage, different goals, and unique needs and strengths.

There are no magic words, but anyone can learn the techniques and strategies to approach contract negotiations. Like any other skill, it may not be easy at first. Also like any other skill, it can be broken down into steps, practiced, and will become easier over time.

And we’re here to teach.

In the coming months, we’ll write about legal and strategic points in contract negotiation strategies, pre-negotiation prep and practice, methods for negotiating, and we’ll provide information on your legal rights around contracts.

Down the road, we’ll look at specific contract provisions — especially those that impact tech workers the most, such as non-compete agreements and intellectual property assignment clauses. This will go hand-in-hand with a Github repository with forkable sample language for key contract provisions, such as payment terms, benefits, non-competition and non-solicitation agreements, and intellectual property assignment clauses.

But let’s walk before we run. The first step is knowing you can negotiate. Next, we’ll discuss the balance of power in hiring agreement negotiations, and how to self-evaluate your position before a negotiation begins. After that, we’ll cover timing and strategies around contract renewals, raises, and other opportune moments to renegotiate.

Whether it’s an employment offer, a mid-project contract renewal, or a termination agreement, its terms can be pushed on. Often, they can be changed. And getting there gracefully is an art, more dance than declaration.

And we want you to know as much as you can before your next dance starts.

Tags: conservancy, ContractPatch

The Importance of Following Community-Oriented Principles in GPL Enforcement Work

by Bradley M. Kuhn and Karen M. Sandler on July 19, 2016

The GNU General Public License (GPL) was designed to grant clear permissions for sharing software and to defend that freedom for users. GPL'd code now appears in so many devices that it is fundamental to modern technology. While we believe that following the GPL's requirements is neither burdensome nor unreasonable, many fail to do so. GPL enforcement — the process to encourage those who fail to correct problems and join our open software development community — is difficult diplomacy.

Our community learned together over the last 20 years how to do this work well. Last year, Conservancy and the FSF published the concise but comprehensive Principles of Communited-Oriented GPL Enforcement. The Principles are endorsed by Conservancy, FSF and gpl-violations.org — the three historic community-oriented GPL enforcement organizations, as well as other non-enforcing organizations such as OSI. Recently, these principles were also endorsed by the Netfilter team, a core and essential group of Linux developers. However, despite our best efforts, we have been unable to convince all enforcers to endorse these Principles. Here, we express our concern and desire to ameliorate that situation as best we can. Furthermore, we also bring some transparency and context where enforcers seem unlikely to ever endorse the Principles.

One impetus in drafting the Principles was our discovery of ongoing enforcement efforts that did not fit with the GPL enforcement community traditions and norms established for the last two decades. Publishing the previously unwritten guidelines has quickly separated the wheat from the chaff. Specifically, we remain aware of multiple non-community-oriented GPL enforcement efforts, where none of those engaged in these efforts have endorsed our principles nor pledged to abide by them. These “GPL monetizers”, who trace their roots to nefarious business models that seek to catch users in minor violations in order to sell an alternative proprietary license, stand in stark contrast to the work that Conservancy, FSF and gpl-violations.org have done for years.

Most notably, a Linux developer named Patrick McHardy continues ongoing GPL enforcement actions but has not endorsed the community Principles. When Patrick began his efforts, Conservancy immediately reached out to him. After a promising initial discussion (even contemplating partnership and Patrick joining our coalition) in mid-2014, Patrick ceased answering our emails and text messages, and never cooperated with us. Conservancy has had no contact with Patrick nor his attorney since, other than a somewhat cryptic and off-topic response we received over a year ago. In the last two years, we've heard repeated rumors about Patrick's enforcement activity, as well as some reliable claims by GPL violators that Patrick failed to follow the Principles.

In one of the many attempts we made to contact Patrick, we urged him to join us in co-drafting the Principles, and then invited him to endorse them after their publication. Neither communication received a response. We informed him that we felt the need to make this public statement, and gave him almost three months to respond. He still has not responded.

Patrick's enforcement occurs primarily in Germany. We know well the difficulties of working transparently in that particular legal system, but both gpl-violations.org and Conservancy have done transparent enforcement in that jurisdiction and others. Yet, Patrick's actions are not transparent.

In private and semi-private communications, many have criticized Patrick for his enforcement actions. Patrick McHardy has also been suspended from work on the Netfilter core team. While the Netfilter team itself publicly endorsed these Principles of enforcement, Patrick has not. Conservancy agrees that Patrick's apparent refusal to endorse the Principles leaves suspicion and concern, since the Principles have been endorsed by so many other Linux copyright holders, including Conservancy.

Conservancy built a coalition of many copyright holders for Linux enforcement so that we as copyright holders in Linux could share with each other our analysis, strategy, plans and diplomacy. Much like Linux development itself, enforcement functions best when copyright holders collaborate as equals to achieve the desired result. In coding, Linux copyright holders seek to create together the best operating system kernel in history, and in an enforcement coalition like ours, we seek to achieve proper compliance in the best possible way for the community. (More collaboration is always better for various reasons, and we always urge copyright holders in Linux, Debian, Samba, and BusyBox to join our coalitions.)

Nevertheless, Conservancy does not object to individual copyright holders who wish to enforce alone; this is their legal prerogative, and with such limited resources for (and political opposition against) GPL enforcement on Linux, everyone who wants to help is welcome. However, Conservancy must denounce anyone who refuses to either endorse the Principles, or (at least) publicly explain why the Principles are not consistent with their efforts to advance software freedom.

There are few public facts on Patrick's enforcement actions, though there are many rumors. That his enforcement work exists is indisputable, but its true nature, intent, and practice remains somewhat veiled. The most common criticism that we hear from those who have been approached by Patrick is an accusation that he violates one specific Principle: prioritizing financial gain over compliance. Meanwhile, some who criticize Conservancy's enforcement efforts ironically believe we are “too nice” — because we don't seek to maximize financial gain, and therefore we ultimately fund some license compliance work with donations from the general public. Despite that criticism, and the simple fact that Conservancy's settlement funds from GPL enforcement usually fail to cover even the staffing costs associated with our enforcement efforts, we continue to abide by the Principle that compliance is paramount over monetary damages. While we sympathize with those who wish GPL enforcement would fund itself, we also see clear problems if an enforcer prioritizes financial gain over compliance — even if the overarching goal is more comprehensive enforcement in other areas.

Conservancy does all our enforcement specifically through a USA 501(c)(3) charity, precisely because that makes us transparently financially accountable. The IRS requires that our work benefit the general public and never bestow private inurement to anyone. Success in enforcement should never personally benefit one individual financially, and a charity structure for GPL enforcement ensures that never happens. Furthermore, the annual Form 990 filings of charities allows for public scrutiny of both enforcement revenue and expenditure1.

Conservancy, as a charity in the center of GPL enforcement, seeks to make enforcement transparent. We devised the Principles in part to clarify long-standing, community-accepted enforcement procedures in a formalized way, so that violators and GPL-compliant adopters alike can discern whether enforcement behavior is acceptable under community norms. We welcome public debate about any enforcement action's compliance with the Principles (i.e., its meta-compliance with the Principles). We encourage all those who enforce GPL to come forward to either endorse the Principles, or publicly propose updates or modifications to the Principles. (We've created the mailing list, principles-discuss, as a public place for that discussion.) We urge developers to state that they support enforcement undertaken in a principled manner, including litigating only as a necessary last resort and to never prioritize financial gain.

We chose the phrase “meta-compliance with the Principles” carefully. Applying the Principles themselves to compliance with those Principles seems apt to us. For example, we publicized the concerns about Patrick's enforcement only after two years of good-faith attempts to discuss the problems with him, and we waited for more than a year before publicizing the problem, and only after both ample warning to Patrick, and discussion and coordination with the Netfilter team. Just as we would with a GPL violator, we exhausted every path we could find before making this statement publicly.

Thus, we now call on Patrick to endorse the Principles or publicly engage in good faith with the community to discuss proper methods of enforcement. We further welcome anyone who does not currently abide by these Principles to join us anew in our coordinated community-oriented GPL enforcement work.

In conclusion, to contrast GPL enforcement with the much more common proprietary software litigation, violators should always have a simple and solid method to quickly resolve the rare legal action around the GPL: compliance. GPL enforcers should always seek compliance as the primary and paramount resolution to any enforcement matter. In this manner, where community-oriented enforcement exists and thrives, the risk for danger from lawsuits diminishes. Today's violators can then become tomorrow's contributors.

Finally, if you are in a situation where you are unsure what your obligations are under GPL, we urge you to read and study the Copyleft Guide to learn more about how to properly comply with GPL and other copyleft licenses.


1 Looking at Conservancy's Form 990s, you can see by examining Page 2 (Part III) (in FY 2011, see Page 25, Schedule O, for continuation) each year how much revenue Conservancy received from enforcement settlements, and how much Conservancy spends on license compliance activity. Most notably, Conservancy has not received a single dollar in GPL enforcement revenue since FY 2012.

Tags: conservancy, Filings, GPL

Comments on OpenChain Specification

by Karen Sandler on June 6, 2016

Today I submitted comments to the OpenChain specification. OpenChain is a working group formed under the Linux Foundation by companies to collaboratively come up with standards and shared materials around compliance. As community-oriented GPL enforcers, we applaud efforts to improve compliance and have been following the effort with interest to the extent we can with our limited resources. The working group recently put out a public call for comment on the OpenChain specification, which is open until June 17. We encourage people to take a look, perhaps echo our comments if they agree, and even join the calls if they are interested (there's a call today).

Here are the comments I submitted:

  • I think text should be added in the introductory section about the value of compliance, generally. Perhaps something like: Complying with the terms of the free and open source licenses used in industry is not only important for minimizing risk to individual companies, but is also a necessary step towards the preservation, collaboration and improvement of the software infrastructure we all rely on.
  • Text should also be added to clarify that completely following the spec does not guarantee full compliance and that the (obvious) intention is that companies need to tailor the guidelines to their own procedures. I think this would fit well in the second to last paragraph on page 3 and perhaps should also be added to G6.1.
  • In the definitions, I think the term OpenChain Compliant is confusing, and can be fixed by using a term other than compliant. We don't want people to think that following these recommendations is any attestation as to actual compliance (though of course I agree that they will help if followed fully). Calling it OpenChain Conforming or OpenChain Accordant would work, for example.
  • G4.1 should refer to complete and corresponding source code instead of just source code.
  • Also in G4.1, a bullet point should be added saying scripts used to control compilation and installation, as per GPLv2 Section 3 and GPLv3 Section 1 (we may also want to include some reference to this in G3.2, along with a reference to complete and corresponding source code as well). Even though scripts are included in CCS under GPL I think it makes sense to give this its own bullet point to highlight the requirement which is sometimes overlooked. GPLv2 and GPLv3 ensure not only that users receive software freedom in the abstract, but have the technically necessary information to make practical use of those freedoms. Ability to rebuild the binaries from source code, and knowing that everything necessary to produce the binary are present is what matters most in copyleft compliance (this is why, for example, copyleft and security go hand in hand).
  • In G5.2, it may be appropriate to recommend considering a Code of Conduct for a company's participation in any community (right now the language is weak anyway and says might include). This is becoming increasingly common in companies, as I understand it, as a way to limit liability for inappropriate communications by employees in the public and is something they should actively consider.

These comments, like all contributions to OpenChain, are under Creative Commons CC0 1.0 Universal license.

Tags: conservancy

Reporting on OSCON 2016

by Karen Sandler on May 28, 2016

Last week was OSCON 2016, and the first year that the conference was held in Austin, Texas. OSCON has always been an important conference for Conservancy and for me personally. In 2011, it was the first conference I ever keynoted (I was also on a keynote panel in 2008, which was the closest I'd gotten before then), and where I really started talking about my heart condition and medical devices. OSCON was also the conference where we had the first Conservancy booth and debuted Conservancy t-shirts and stickers.

Austin seems to really suit OSCON. The feel of the conference was comparable to Portland, but there seemed to be a lot of new local participation resulting in a much more diverse conference. I met a lot of great people for whom it was their first time at the conference and made a lot of good connections. Conferences, and OSCON in particular, are always short on time and often I was in a dead run from one thing to the next.

I participated in two sessions on Thursday. One was a talk I gave on employment agreements. I outlined basic issues to look for in signing an employment agreement but my main point was that employment agreements can often be negotiated. Companies have standard contracts that they use for all employees, but in many areas they may be prepared to edit the agreement as part of an onboarding negotiation. After you receive your offer, but before you sign the employment agreement, you are likely to have more power in the relationship than you will again. The company has expended resources in recruiting and interviewing you, and has come to the decision that you're the best person for the job. Just as you negotiate your salary and other important terms of employment, some of the contractual provisions are also likely to be flexible. I've seen a lot of agreements over the years, and every time I've talked to someone about this issue they've been able to get *some* change.

Because of this, and because it's so hard to know what to ask for if you're not a lawyer like me, Conservancy is working on a project of standard employment agreement provisions that could be worth asking for. If many prospective employees ask for this, some companies may start to give this as a perk to attract top talent.

The second session was a panel about free and open software foundations. Moderated by Deb Bryant, the panel discussed issues around foundation formation, fiscal sponsorship and revenue models. I was really excited that multiple people in the session recommended Conservancy as a nonprofit home, and also encouraged audience members to become Supporters of Conservancy! There are a lot of great organizations in free and open source software and it was so interesting to see how many roles the panelists serve in them.

Conservancy had a booth, so I spent most of the rest of the time there. It was great to be in one of the nonprofit areas with so many other awesome nonprofits in our field. It was also the first time we had multiple stickers, including the very first Outreachy stickers.

KarenBooth stickers

I was also able to catch a panel on patents that Bradley was a part of, eloquently reminding everyone how deeply problematic software patents are.

Lastly, it was great to meet with other Outreachy organizers! We don't have a chance to meet in person very often and we always have so much to discuss.

outreachy-team

After the conference ended on Thursday, we had a chance to relax and talk about the conference with Conservancy Supporters at our pool party. I'm always struck by how impressive our Supporters are. While walking around the party, I caught conversations about the future of free software, copyleft, enforcement, patents, conferences and even one where we recruited someone great to apply for the GNOME Executive Director job! I was so excited by the enthusiasm of our Supporters. Aside from the financial aspect, which is critical for us, with such a small staff it would otherwise be impossible to do all of our work and tell people about it without their help. While it's taken me all week to recover from the conference and try to catch up on the backlog of work that piled up, I feel reinvigorated and recharged!

Tags: conservancy, supporter

Next page (older) » « Previous page (newer)

1 2 3 4 5 6 7 8 9 10 11 12 [13] 14 15 16 17 18 19 20 21 22 23 24 25 26

Connect with Conservancy on Mastodon, Twitter, pump.io, Google+, Facebook, and YouTube.

Main Page | Contact | Sponsors | Privacy Policy | RSS Feed