[Biobiz] using others' code

[Andrew Dalke]

Hey all,

  Slowly working my way through a month of back emails.

  Steven Brenner pointed out at BOSC that a lot of the academic
software is owned by the school, and not by the person who
contributed the code.  Similarly, there are people at
companies who contribute some code which is technically
owned by the company and where that person didn't get legally
valid permission to release it.

  As most of you know, my company provides software and
support for open source/free software in the life sciences.
I'm worried about the legal issues of using and redistributing
software where I don't if the software has been properly
released in the first place.

  The FSF describes some of the legal issues that maintainers
need to observe, at http://www.fsf.org/prep/maintain_4.html
Unfortunately, it doesn't contain all the relevant information.
In brief, it's:
  - must keep track of who contributed what work
  - more than about 10 lines of code needs a *written* copyright
     transfer or copyright disclaimer
  - designed so if the GPL and LGPL are found to be legally
      improper then the FSF can change the license as appropriate
      without going through the impossible of contacting all
      the original contributors.

There is a serious paperwork problem with this approach.  I
once sent in patches to add Python support in automake.  It took
about two months to process the mail, since the FSF doesn't
have much in the way of staff, and it was RMS who handles that
paperwork, and he travels a lot.

OTOH, most other projects are like Python, in that anyone can
contribute code and it's up to the contributor to ensure that
doing so is legal.  That seems to work, in that I've heard of
very few cases where there's been a problem.

The one exception is that several years ago I recall one project
(anon.penent.fi?) which used code from elsewhere, and the
original author didn't like that use, so that contributed code
was rewritten.  I suspect that will be the case for any problems
we may come across.

What I think would be nice is a set of guidelines that say
something like:
  - your universities or employer may own your work
      (give examples of how/why this is so)
  - this includes contributions to the bio* projects, including
      source code, documentation, patentable and marketable ideas
  - we cannot know the copyright and patent policies by which
     you are obligated, so if you contribute anything you must
     ensure that you are allowed to do so
  - if you put someone's contribution into a bio* project you
     must keep track of who contributed it (eg, in the CVS log entry)
     so there is a good record of it in case of future problems

We should also have (someday?) a description of what to do in
case someone claims copyright infringement by one of the bio*
projects.  I doubt that will happen (eg, it hasn't happened with
Python, and there's a lot more people involved in that project),
so this can be defered for some time.  Especially since I can't
think of general purpose guidelines.

                    Andrew
                    dalke@dalkescientific.com