Understanding Conservancy Through the GSoC Lens
byon September 11, 2014
[ A version of this post originally appeared on the Google Open Source Blog. ]
Software Freedom Conservancy, Inc. is a 501(c)(3) non-profit charity that serves as a home to Open Source and Free Software projects. Such is easily said, but in this post I'd like to discuss what that means in practice for an Open Source and Free Software project and why such projects need a non-profit home. In short, a non-profit home makes the lives of Free Software developers easier, because they have less work to do outside of their area of focus (i.e., software development and documentation).
As the summer of 2014 ends, Google Summer of Code (GSoC) coordination work exemplifies the value a non-profit home brings its Free Software projects. GSoC is likely the largest philanthropic program in the Open Source and Free Software community today. However, one of the most difficult things for organizations that seek to take advantage of such programs is the administrative overhead necessary to take full advantage of the program. Google invests heavily in making it easy for organizations to participate in the program — such as by handling the details of stipend payments to students directly. However, to take full advantage of any philanthropic program, the benefiting organization has some work to do. For its member projects, Conservancy is the organization that gets that logistical work done.
For example, Google kindly donates $500 to the mentoring organization for every student it mentors. However, these funds need to go “somewhere”. If the funds go to an individual, there are two inherent problems. First, that individual is responsible for taxes on that income. Second, funds that belong to an organization as a whole are now in the bank account of a single project leader. Conservancy solves both those problems: as a tax-exempt charity, the mentor payments are available for organizational use under its tax exemption. Furthermore, Conservancy maintains earmarked funds for each of its projects. Thus, Conservancy keeps the mentor funds for the Free Software project, and the project leaders can later vote to make use of the funds in a manner that helps the project and Conservancy's charitable mission. Often, projects in Conservancy use their mentor funds to send developers to important conferences to speak about the project and recruit new developers and users.
Meanwhile, Google also offers to pay travel expenses for two mentors from each mentoring organization to attend the annual GSoC Mentor Summit (and, this year, it's an even bigger Reunion conference!). Conservancy handles this work on behalf of its member projects in two directions. First, for developers who don't have a credit card or otherwise are unable to pay for their own flight and receive reimbursement later, Conservancy staff book the flights on Conservancy's credit card. For the other travelers, Conservancy handles the reimbursement details. On the back end of all of this, Conservancy handles all the overhead annoyances and issues in requesting the POs from Google, invoicing for the funds, and tracking to ensure payment is made. While the Google staff is incredibly responsive and helpful on these issues, the Googlers need someone on the project's side to take care of the details. That's what Conservancy does.
GSoC coordination is just one of the many things that Conservancy does every day for its member projects. If there's anything other than software development and documentation that you can imagine a project needs, Conservancy does that job for its member projects. This includes not only mundane items such as travel coordination, but also issues as complex as trademark filings and defense, copyright licensing advice and enforcement, governance coordination and mentoring, and fundraising for the projects. Some of Conservancy's member projects have been so successful in Conservancy that they've been able to fund developer salaries — often part-time but occasionally full-time — for years on end to allow them to focus on improving the project's software for the public benefit.
Finally, if your project seeks help with regard to handling its GSoC funds and travel, or anything else mentioned on Conservancy's list of services to member projects, Conservancy is welcoming new applications for membership. Your project could join Conservancy's more than thirty other member projects and receive these wonderful services to help your community grow and focus on its core mission of building software for the public good.
Why Conservancy's Kallithea Project Exists
byon July 15, 2014
Eleven days ago, Conservancy announced Kallithea. Kallithea is a GPLv3'd system for hosting and managing Mercurial and Git repositories on one's own servers. As Conservancy mentioned in its announcement, Kallithea is indeed based on code released under GPLv3 by RhodeCode GmbH. Below, I describe why Conservancy chose to serve as non-profit home to an obvious fork (as this is the first time Conservancy ever welcomed a fork as a member project).
The primary impetus for Kallithea is that more recent versions of RhodeCode GmbH's codebase contain a very unorthodox and ambiguous license statement, which states:
(1) The Python code and integrated HTML are licensed under the GPLv3 license as is RhodeCode itself.
(2) All other parts of the RhodeCode including, but not limited to the CSS code, images, and design are licensed according to the license purchased.
Simply put, this licensing scheme is — either (a) a GPL violation, (b) an unclear license permission statement under the GPL which leaves the redistributor feeling unclear about their rights, or (c) both.
When members of the Mercurial community first brought this license to Conservancy's attention about ten months ago, the first focus was to form a formal opinion regarding (a). Of course, Conservancy did form such an opinion, and you can probably guess what that is. However, I realized a few weeks later that this analysis really didn't matter in this case; the situation called for a more innovative solution.
Indeed, I recalled at that time the disputes between AT&T and University of California at Berkeley over BSD. In that case, while nearly all of the BSD code was adjudicated as freely licensed, the dispute itself was painful for the BSD community. BSD's development slowed nearly to a standstill for years while the legal disagreement was resolved. Court action — even if you're in the right — isn't always the fastest nor best way to push forward an important Free Software project.
In the case of RhodeCode's releases, there was an obvious and more productive solution. Namely, the 1.7.2 release of RhodeCode's codebase, written primarily by Marcin Kuzminski was fully released under GPLv3-only, and provided an excellent starting point to begin a GPLv3'd fork. Furthermore, some of the improved code in the 2.2.5 era of RhodeCode's codebase were explicitly licensed under GPLv3 by RhodeCode GmbH itself. Finally, many volunteers produced patches for all versions of RhodeCode's codebase and released those patches under GPLv3, too. Thus, there was already a burgeoning GPLv3-friendly community yearning to begin.
Like with any Free Software codebase fork, acrimony and disagreement led to Kallithea's creation. However, as the person who made most of the early changesets for Kallithea, I want to thank RhodeCode GmbH for explicitly releasing some of their work under GPLv3. Even as I hereby reiterate publicly my previously private request that RhodeCode GmbH correct the parts of their licensing scheme that are (at best) problematic, and (at worst) GPL-violating, I also point out this simple fact to those who have been heavily criticizing and admonishing RhodeCode GmbH: the situation could be much worse! RhodeCode could have simply never released any of their code under the GPLv3 in the first place. After all, there are many well-known code hosting sites that refuse to release any of their code (or release only a pittance of small components). By contrast, the GPLv3'd RhodeCode software was nearly a working system that helped bootstrap the Kallithea community. We're grateful for that, and we welcome RhodeCode developers to contribute to Kallithea under GPLv3. We do note, of course, that RhodeCode developers sadly can't incorporate any of our improvements in their codebase, due to their problematic license. However, Conservancy extends again our offer (also made privately last year) to work with RhodeCode GmbH to correct its licensing problems.
Thoughts on the IRS Review of Free Software Nonprofits and Why I'm Not Worried for Conservancy
byon July 2, 2014
At the Texas Linux Fest three weeks ago I gave a keynote called “Identity Crisis: Are we who we say we are?”. I talked about the different ways people contribute to free and open source software. I discussed how confusing it can be to understand where the for-profit interests in the software and the nonprofit ideological movement begin and end. The details of my talk were covered on LWN last week. Most importantly, we in this community all face conflicts that can impact the decisions we make and how we are perceived by others. In my talk, I specifically mentioned the IRS, because I sympathize with the difficulty the IRS faces in comprehending what makes a legitimate 501(c)(3) free software public charity. They are new to our complex field. When I was a lawyer at the Software Freedom Law Center I regularly applied for tax exemption for organizations and answered the IRS's questions. I was one of the lawyers who initially worked on Yorba's responses, though I left the work to my capable colleagues when I left to become Executive Director of the GNOME Foundation. Yorba was recently denied tax exempt status, and you can read Jim Nelson's well written post with his reaction to the news.
One point that the IRS examiners all made very clear to me on multiple occasions was that these determinations had no bearing on any existing organizations. This was a question I asked frequently as I was quite troubled by the strange questions they asked and the delays that they were introducing. As a lawyer, I can't give legal advice in a blogpost. I won't opine on what Yorba's letter means for other organizations. But I can take a step back from the rejection and worry less about existing exempt organizations knowing that the rejection does not directly impact us. While the IRS may change its rules with respect to existing nonprofits, the rejection of another organization does not impact them. And a different IRS examiner may have come to a different decision when looking at those facts.
When joining Conservancy a few months back, I looked at our tax exemption application again (the Form 1023 — which I was the primary author of all of those years ago!) and, in particular, the part that described what we intend to do. I was relieved to be reminded that we really described what we do and how we do it accurately. And that the way that we conduct our activities is true to our charitable mission.
I think it can be hard to sort out the corporate interests from the passionate work to make the work better through software freedom. A lot of for-profit companies and trade associations talk a great game about social good. Of course, for-profit companies are committed to shareholder value, and trade associations are required to prioritize a common business interest. Which is why Conservancy as a public charity has an Evaluation Committee that reviews in detail all applications we receive and a staff that oversees the way resources are used, monitoring for corporate control. We have a Conflict of Interest Policy that not only applies to our directors but also to all of our Project Leadership Committees.
must be exclusively devoted to the development of Open Source and Free Software, and that the project must operate in accordance with the with the Conservancy's tax exempt purposes. When projects request admission to the Conservancy, an extensive diligence review is conducted by a committee devoted to this purpose.
Conservancy was founded to be a home for nonprofit free software projects so that they don't have to have lengthy discussion with the IRS, file a lot of paperwork, or take care of a lot of nonprofit corporate minutia, at least not alone. We designed our structure and oversight processes to address many of the worries articulated by the IRS about free software organizations.
It's been nerve racking to watch IRS applications stack up — some have made it through recently and some have not. But I think that if we as a broad community understand our conflicts better (not to mention how a trade association is different from a charity) we'll do a much better job at explaining ourselves to others. If you missed my Texas Linux Fest keynote, please attend my talk at OSCON 2014 later this month, on a similar topic. I'll be sure to leave extra time in the Q&A so we can discuss some of these issues.
Conservancy Now Developing Our Corporate Policies in Public via DVCS
byon June 30, 2014
Everything Conservancy does comes back to our charitable mission: to promote, improve, develop, and defend FLOSS. Our member projects are well-known — and rightly so — for developing of some of the best freely-licensed software available today. And, we have a responsibility to match our projects' standard of excellence in all other aspects of the organization. For example, we have prioritized developing a FLOSS application for non-profit accounting, with the goal of developing a first-rate solution that can benefit the entire non-profit community.
As such, when one of our volunteer software developers recommends that we publish our corporate policies in a public repository, we listen. Earlier this month, Conservancy transitioned to developing our corporate policies in public via a distributed version control system (DVCS). Conservancy's conflict of interest policy, document retention policy, travel and expense policy, and whistle-blower policy are now available for inspection in a public Git repository1.
We believe that developing our corporate policies in public via DVCS will have several benefits. For one, we're now working in a format immediately familiar to the software developers who contribute to our member projects. We expect that our policies will get more attention from a wider pool of volunteers, which will result in greater buy-in and fewer misunderstandings about policy interpretation. We also expect to receive more suggestions — in the form of patches or merge requests — that will result in stronger, better-written corporate policies.
We also expect and welcome input from the public at large. Conservancy's policies will be maintained by Conservancy's Board, who will have final say over all changes to our policies; however, we look forward to receiving comments, suggestions, and "bug reports" from anyone interested in non-profit corporate governance — as it relates to FLOSS or in general.
As a publicly-funded charity, Conservancy also has a responsibility to our donors and to the public at large to strive for transparency whenever possible. Now, as an attorney, I've been trained to always prefer keeping my cards close. However, I believe that our donors will appreciate that our policies are available for public inspection, and that we are therefore committed to holding ourselves publicly accountable to the standards we've articulated.
Lastly, we're pleased to announced that all of Conservancy's policies in the repository are now dedicated to the public domain under the Creative Commons CC0 license. We encourage our fellow charitable organizations to review and adopt some or all of our policies as they see fit.
So, we invite you to visit our corporate policies repository and review our policies. Scrutinize them, critique them, and submit merge requests. Treat it like a FLOSS project, roll up your sleeves, and get involved. We look forward to working with any and all contributors on strengthening the policies that help us pursue our charitable mission.
1Conservancy is the non-profit home for three DVCS projects: Darcs, Mercurial, and Git. We love all of our member projects equally, but we felt that hosting our policies on all three platforms simultaneously would be overkill. We had to pick one.