[whoville]

I read that and thought: this is ridiculous. First of all, assigning copyright to FSF or SFC is way way better protection. Also DCO has nothing to do with protecting, the protection is from "inbound = outbound" contributions are under the same license as the project, this is the standard. A DCO is just something a few Linux Foundation lawyers dreamed up in order to help give companies faith in using Linux and is basically irrelevant. More info https://www.fsf.org/blogs/licensing/FSF-copyright-handling .

[wmf]

Inbound = outbound was the standard in the 1990s but CLAs and such have risen since then. I assume most COSS companies are using CLAs or full copyright assignment.