Creative Commons License Violations on Examples

[calebfoss]

I recently communicated concerns regarding attribution for the examples on this site. The public side of that conversation took place on #386. Most recently, I opened #412 as a temporary solution.

I realized, however, that there could potentially be an issue with the license on the legacy site repo, and I do not know if my PR would solve it. I have a difficult time understanding the legal language of licenses, and I wanted to raise the question for anyone who better understands licensing. My understanding is that with Github's inbound=outbound policy, contributors' work on the legacy site would be licensed under the same license as the repo and therefore also copyrighted. Because their code is now in this repo but with their authorship removed and replaced with a different author and because this repo does not currently include the required copyright notice or license, I am wondering if that is a violation of the legacy repo license.

[calebfoss]

I am seeing a similar issue with the Reference. I do not see a way to trace that writing back to its authors.

For the sake of open source contributors in general, I hope that the MIT License does require attribution for the authors (via copyright notice I expect). Even if not, however, I would strongly advocate for attribution regardless. STF project workers like me were compensated and will be acknowledged in a planned social media post on site launch, but my understanding is that much of the work we were building off of was uncompensated with no plan to acknowledge those authors for the new site.

[Qianqianye]

We initially planned using the same MIT license as the legacy website repo. I have been doing research on this and will get back on this issue after I gather more suggestions from previous contributors.

[Qianqianye]

Hi @outofambit @stalgiag, just to double check, are there anything we need to aware about licensing from Bocoup's perspective (the main developer team of the new website)? Thanks.

[calebfoss]

Thank you for the update, @Qianqianye! In the meantime, I opened #425 to add attribution links to each example's description. This replaces the placeholders I opened in #412. I briefly described my process in the PR.

You could follow a similar process for the reference. It would be a bit more complicated, since it would involve matching up the JSdoc from the p5 library. It took me longer than I expected to get the example attribution together, so I'm going to pause there for now. I'm happy to answer questions about my process!

[stalgiag]

To my knowledge, which is admittedly not fresh, there is no code in this repo that is from the legacy repo other than content such as reference which is directly consumed from the GitHub repos of p5 libraries where the licenses travel with it. When contributors contribute to that library they are contributing to the p5 library project with its MIT license. This library is an entity separate from the individual author. My understanding is that the individual authors do not have attribution requirements or the ability to make demands and this is what is meant by the inbound=outbound. You are licensing your contribution with the same license including its attributions.

Additionally, this is a situation where pieces of the text, like the JSDoc comments that become reference sketches, are often modified over time by many authors, some changing just a single word or punctuation. One author may make an update that changes the wording of an original author thus completely removing any single word written by them but that original author's impact is still there. These kinds of attribution issues become boundless quite quickly and this is why I've never heard of any license or attribution requirements for open source being as exacting as to try to track and update all of the contributors that modify individual sections of documentation. This can sometimes be done for parts of documentation that change rather infrequently and in these cases the first author of the example is typically attributed (I believe Threejs used to do this).

This is why the contributor's list has historically been maintained separately and given subject area attributions, any other upkeep would quickly become burdensome.

[calebfoss]

As an example, here is the snowflakes example on the legacy repo, here it is on the legacy site, here is the Attribution-NonCommercial-ShareAlike 4.0 International license displayed below it, and here it is on the new site.

[stalgiag]

I don't have any comment on attributions or how it should be handled. My sense is that is an ongoing conversation that I have not been part of. If attributions at the level of the website are introduced then that is new, done voluntarily on behalf of p5 stewards, and should be done to further the effort (that has been in place since these projects started) to ensure that contributors feel recognized. In my opinion, that should be done without creating a boundless attribution problem for a project that undergoes constant changes across many different workstreams and any suggestions otherwise are not constructive.

As far as license, there are no license violations because the license holder of the legacy website repo is the Processing Foundation and the same license is used here. If there are concerns about losing track of historical work, my suggestion is to keep the legacy website up as a github repo.

[Qianqianye]

Thank you all for your input. Like I mentioned in this comment in PR #425, I'm still waiting for some previous contributors' feedback on this issue and their suggestions on license for this new website repo, the legacy website repo, etc.

We will revisit this issue after we get more responses from other previous contributors who are not currently actively on GitHub. Thanks for your patience.

[outofambit]

@Qianqianye There are no licensing concerns from Bocoup's perspective beyond the general expectation that it would be an open source license of course. I generally agree with what @stalgiag said above and will add that the MIT license does not require any individual attribution.

If we want to add a copyright notice to the footer of the new website, that can be an straightforward task for someone to pick up.

[calebfoss]

As far as license, there are no license violations because the license holder of the legacy website repo is the Processing Foundation and the same license is used here.

The MIT license under which the examples were committed (before the update a few weeks ago) does not mention the Processing Foundation.

The Attribution-NonCommercial-ShareAlike 4.0 International license displayed on each example on the old website includes under its terms:

Attribution — You must give appropriate credit , provide a link to the license, and indicate if changes were made . You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use.

The license defines "appropriate credit" as:

If supplied, you must provide the name of the creator and attribution parties, a copyright notice, a license notice, a disclaimer notice, and a link to the material. CC licenses prior to Version 4.0 also require you to provide the title of the material if supplied, and may have other slight differences.

Regarding these points:

These kinds of attribution issues become boundless quite quickly and this is why I've never heard of any license or attribution requirements for open source being as exacting as to try to track and update all of the contributors that modify individual sections of documentation. This can sometimes be done for parts of documentation that change rather infrequently and in these cases the first author of the example is typically attributed (I believe Threejs used to do this).

This is why the contributor's list has historically been maintained separately and given subject area attributions, any other upkeep would quickly become burdensome.

Circling back to the original concern I raised, git maintains a record of who committed what automatically, so I proposed maintaining that history. I responded to feedback from project leadership, who expressed agreement with wanting to give credit to people who worked on the examples, with possible solutions to the issues raised.

In addition to the all contributors list, the Processing Foundation gives individual attribution to many people, including me and others on this thread. My opinion is that those who have worked on examples also deserve visible credit for their work, and my goal here was to help make that happen on the new site.

@Qianqianye, once you determine a path forward from the discussions with previous contributors, something else I can offer is that I can further revise the Adding Examples doc I worked on in the spring to include instructions on how contributors can credit themselves for new and edited examples.

[xinemata]

Hi @calebfoss, @stalgiag, and @outofambit, thank you for your attention to this issue. I'm taking over this particular license/copyright related issue from @Qianqianye and will work on determining the next steps. As I'm new to this problem, I appreciate your patience while I get up to speed in the upcoming months.

[calebfoss]

@xinemata - supplementing my reply to your email, I wanted to share a proposal that would resolve all of the concerns that have been brought up in this discussion.

1. Modify Add attribution links to each example description #425
   1. Fix the formatting issue causing it to fail a test.
   2. Include contributors who have worked on each example but are not listed in the blame. This would resolve the concern raised in this comment that the impact of one contribution may be obscured by a later edit. Far from boundless, this would add a few names to some of the examples.
   3. Add a link to the Attribution-NonCommercial-ShareAlike 4.0 International license on each example, as required in the license's terms.
   4. Include a short statement for each example indicating that they have been edited and revised, linking the version on the old p5 site, fulfilling the license's requirement to indicate that changes have been made.
   5. Add a link to the relevant Processing example for the few remaining examples that were originally ported. This would resolve this concern raised in this comment.
2. I will open a PR to add the Adding_Examples doc with instructions for contributors to add attribution for themselves, as I offered in this comment. This would resolve the concern raised in this comment that crediting contributors would be burdensome.
3. Amend the commit message on 37e3d66 to include all example contributors as co-authors. This would resolve the concern in raised in this comment that when re-adding credit in the git history, someone could accidentally erase someones else's contribution, as amending a message could not have that impact.

To clarify, I opened this issue to check if my temporary solution, #412, would fulfill license requirements. The current state of the site most certainly does not fulfill license requirements, and it therefore violates contributors' intellectual property rights.

Having looked into this more, #412 does not fulfill all the legal requirements. My opinion, however, is that until those requirements can be fulfilled, #412 is better than nothing in terms of recognition of contributors' work.

[xinemata]

@calebfoss, thanks for your patience as I work through this issue with an open-source expert. Here are our responses to your suggestions:

1. We have added a link to CC BY-NC-SA 4.0. and credited p5.js Contributors and the Processing Foundation under every example page.
2. We’ve updated the copyright and acknowledgment page to invite contributors to add themselves explicitly.
3. We hear your concern about wanting to be credited in a particular way, but we do have an existing approach to crediting individual contributors on our contributors page. Here are a couple of reasons behind the approach:
   1. The p5.js project has always been a huge communal effort. We follow the all-contributors specification and do our best to ensure we don’t accidentally exclude people who contributed in ways that did not involve pushing code.
   2. Historically, every webpage involved contributors who copy-edited, created illustrations, and organize files on a shared drive, but that’s not reflected in GitHub commits. In this context, counting the number of commits to quantify the volume of contributions is misleading. For example, in the project's early days, p5.js’s creator, Lauren Lee McCarthy, would code a large chunk of the p5.js website before pushing a single commit.
   3. We’re a small team that serves a vast population with various needs, and maintaining our contributors list with a single approach keeps things manageable.
4. Given the long history of the repository and having looked into how authorship could be fairly reinstated, we unfortunately found that it is not technically possible to credit all the p5.js-example repository contributors within commits.
   1. For example, the proposed solution is a temporary solution that erases the authorship attributions of other contributors not included in the more case-by-case, manual approach of that PR. If we merged the history of the example repository and the new website repository, the authorship would then be traced back to the author of the committed examples in the example repository. This would erase authorship prior to your commit, which would not be fair to other contributors, either.
   2. If you are able to find an automated solution fair to all contributors, we would be happy to consider it. However, we cannot consider manual solutions for restoring commit authorship because we believe that the existing all-contributors policy described above is the most inclusive, fair, and maintainable approach to manually crediting all contributors.

I hope that these perspectives are helpful.

[calebfoss]

@xinemata It sounds like there are some major misunderstandings regarding what I am proposing. I am going to try another route to clarify this: a usability test.

The task I will be assessing is to find who created an example. There are a few roles from which I could approach this task including:

• someone interested in publishing this example elsewhere who is citing their source
• an employer evaluating a job candidate who submitted this example as proof of open source contribution, aiming to check the authenticity of the credit

I will use the Snowflakes example, as this one was linked by @limzykenneth in this comment.

Old Site

The description ends with "contributed by Aatish Bhatia"

Pulling up the history for this example in the codebase, I find @aatishb's contributions. Additionally, I see edits from a couple other contributors: @keshavg2 and @katiejliu.

My Proposal

The description ends with

Contributors: Aatish Bhatia, Caleb Foss, Darren Kessner

linking the GitHub profiles of each contributor.

Pulling up the history for this example in the codebase, I find the contributions of each of the contributors listed in the description.

Note: this is a case where the contributors who had made edits on the old site are not visible in the current git blame because those edits have since been further edited. My proposed changes from September 27
would address this by listing all contributors who have ever made commits to the file, whether or not they appear in the current blame. For this example, that would mean adding credits for @keshavg2 and @katiejliu.

Current Site

No one is credited in the description.

I scroll all the way down to the bottom of the example...

I find this information:

Snowflakes by p5.js Contributors and the Processing Foundation is licensed under CC BY-NC-SA 4.0.

I click the p5.js Contributors link, which takes me here:

I scroll down...

and down...

and down...

and down...

and down...

and down...

and down...

and down...

and down...

and down...

I find a list of hundreds names in no particular order. There is no indication of who was involved in creating this example.

Pulling up the history for this example in the codebase, I find that @limzykenneth is the only contributor for this example.

If I were an employer, and a job candidate sent me this example as proof of open source contribution, I would see this as a big red flag, as it would appear that this candidate was plagiarizing @limzykenneth.

Conclusion

As you can see, the new site removes the ability that was available on the old site to find the names of contributors for examples. It cites @limzykenneth as the original contributor for all example code. You mentioned examples written by Lauren Lee McCarthy, and so I wanted to specifically note that all of her examples are now attributed to @limzykenneth.

On the new site, the Tutorials on credit their writers, the Community Sketches credit the creators, and the Libraries are credited to their creators. Why are the examples an exception to this?

As a side note, another major change between the old site and new site is that the new site introduces keyboard traps in the code editors, obstructing users with disabilities who navigate using tab (see #666).

Making my proposed changes from September 27
to #425, merging that, and merging #667 would resolve these issues.

Circling back to the focus of this issue, to confirm for the record, is the Processing Foundation's position that the changes made between the old and new site (as described above) fulfill the requirement for "appropriate credit" in the CC BY-NC-SA 4.0 license?

[ksen0]

Hi @calebfoss,

This is Kit, I’ve started recently as the new p5.js project lead. Thank you for your comment and for raising this concern. I’ll do my best to respond to your questions based on the best of my understanding.

After reviewing the CC BY-NC-SA 4.0 license with our open-source consultant, @xinemata and I believe the changes made to the new site fulfill the attribution requirements as per the license.

The authorship of both the old site and new site is the same (the p5.js contributors), and the all-contributors specification (which is the source of truth for attribution, not the version control history itself) satisfies the attribution requirement of the CC BY-NC-SA 4.0 license.

We also want to emphasize that the attribution obligation is fulfilled by linking to the contributors' list, and there is no requirement to independently determine or display specific contributions for each individual. The all-contributors specification, which is the source of truth for attribution, satisfies the attribution requirements of the CC BY-NC-SA 4.0 license, as the license itself states that a hyperlinked page is an acceptable way to provide attribution.

The main challenge here, as @xinemata pointed out, is balancing the level of detail for attribution with feasibility. The approach of using git blame (which is the basis of #425) adds a level of detail, but it also risks limiting attribution visibility to GitHub activity, which is an imperfect and incomplete record for various reasons. Originating in 2017, the all-contributors specification aims to provide a more inclusive, sustainable, and maintainable solution without getting into the weeds of detailed version history.

The level of detail being proposed would require more manual review and maintenance, and the existing all-contributors policy was adopted because it strikes a balance between inclusivity and maintainability.

That said, we do agree that there is room to improve the visibility of credit on the website itself. Your screenshots highlight areas where the all-contributors approach could be better supported. We are open to ideas on how to make this more prominent—perhaps using a more visible link to the GitHub contributors list, for example.

Additionally, I just saw that multiple contributors mentioned in #425 have not been added to the all-contributors list. I can take on the task of adding those names manually.