[jeeyoungk]

I also think CLAs are eerie and goes against the open source spirit, I don't think CLA alone puts a project in "high risk". I'm not sure about the FAANG open source projects that are used as libraries (Guava, React, ...). These projects fundamentally don't jeopardize these company's businesses, and serve to increase the developer goodwill amongst the engineers. Nobody can predict the future but I can't imagine these projects becoming relicensed.

More plausible scenario is them becoming an abandonware, but even in those cases the community can carry the torch.

[8organicbits]

Agreed, and there's a few projects with CLAs that are ranked lower due to mitigating factors, like K8s [1]. I honestly don't get why they have a CLA, anyone know?

The impact of developer good will is difficult to measure, so I don't attempt it. Redis burned community good will so badly with their relicensing that several forks rapidly emerged. Seemed like a predictably poor decision to me.

I also don't want to pick favorite companies, because it's subjective, companies can change strategies or even sell projects off. What if Meta decided to sell React to a patent-troll-like company instead of just abandoning it?

[1] https://alexsci.com/relicensing-monitor/projects/kubernetes/

[jen20]

> I honestly don't get why they have a CLA, anyone know?

There are valid reasons to have a CLA: confirmation that your contributions are not encumbered by an employer contract is a good one. What there is rarely an excuse for is a copyright assignment, which often gets bundled into a CLA.

The only non-nefarious example of copyright assignment that I can think of is the FSF, but only because they have such a strong record on software freedom.