Re: Signed-off-by and aliases

[Joao Eduardo Luis <joao@suse.de>]

On 08/12/2015 01:51 PM, Loic Dachary wrote:
> 
> 
> On 12/08/2015 12:54, Gregory Farnum wrote:
>> I won't be merging any code with obvious aliases for exactly the
>> reasons John mentions. Obviously IANAL, but I think you'll find law
>> proceedings in the USA would look much less kindly on accepting
>> obvious aliases versus having a real name policy — which we do, even
>> if it's not diligently checked. 
> 
> It would be more accurate to say it is not checked at all. And it is the same for the Linux kernel.
> 
>> Keep in mind that we generally have a
>> background on our contributors to track them down even if they are
>> using a non-obvious alias.
> 
> As of today the Ceph repository has 427 contributors and 96 of them authored more than 10 commits. I would not be surprised if one of them was an alias. The only background check we do is when asking a new contributor about his affiliation to an organization (see http://tracker.ceph.com/projects/ceph/wiki/Ceph_contributors_list_maintenance_guide). 41 contributors declared that they are not affiliated to any organization and we did not investigate further. Nor do I think we should.
> 
> You have a point: we know the vast majority of contributors, one way or the other. It is a small world :-) If a contributor you know insisted on contributing using an alias, for ethical reasons, would you turn her/him down ? Wouldn't it be better for you to be able to vouch for her/him somehow ?

Call me paranoid if you must, but if we were considering liability
exposure of the project in case of IP violation, then this could be bad
for the one person merging the code knowingly a given contributor was
using an alias.

Say this contributor did contribute something that he shouldn't have. If
he did ask someone to use an alias instead, and this someone went on
with 'okay, let's do this' and merged the code, I can't stop wondering
whether a lawyer would not take advantage of it, arguing the developer
performing the merge was complicit in the IP violation. He did know this
one person was under an alias, he did know who this person was, made
sure this person was not identified - "he most certainly knew something
bad was happening, AND DID NOTHING!"

Also, what would the developer be expected to do if a court asked him
who was the real author of a merge containing patches that violated
someone's IP rights? Lying to protect the integrity of an alias doesn't
seem like the obvious choice.

If someone is indeed interested in contributing under an alias, they
should just get a sensible alias that would be assumed to be the real
deal. And everyone can go on with their lives without having to be
exposed, at some point, to the nastiness of IP litigation if things go
sower, or having to lie to cover someone else's track if they cannot
avoid being exposed to it.

  -Joao

> 
> Cheers
> 
>> -Greg
>>
> 

--
To unsubscribe from this list: send the line "unsubscribe ceph-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html