Topic split from https://www.magiclantern.fm/forum/index.php?topic=24548.0
Quote from: nikfreak on September 03, 2020, 11:33:59 PM
Please just sign up for a patreon page to pay the bills. Then let's grab you at least a 5mkiv or whatever your heart wishes to do the magic work. Community will support it.
Well, given the recent evolution of the project (in particular, recent contributions), opening an individual Patreon page doesn't make sense to me. If we will do some kind of fundraising, it has to be for the entire team of developers and contributors, not just for one individual developer. And I think I've found a much better tool for this purpose.
I'm looking at Open Collective (https://opencollective.com/). They offer something similar to a non-profit organization, but without the requirement to incorporate one - they call it a "virtual non-profit". It's fully transparent (https://docs.opencollective.com/help/collectives/budget) (everybody can see how we spend the money), they do all the paperwork for us (for a fee), and it's open to all contributors, not just to one particular person, or to a closed group or core developers. Anyone can submit invoices (https://docs.opencollective.com/help/expenses-and-getting-paid/submitting-expenses) to be reimbursed for project-related expenses, but the core team has to approve them. It even allows paying contributors for their time, as long as they can submit an invoice as a freelancer (but - depending on their country - they may need to register a local business or a sole proprietorship).
In other words, with Open Collective, even if I won't be available for some months (hopefully not years), the project will be able to continue without my direct involvement - as the money from the supporters won't be in my pockets, but available to the entire team of developers/contributors (whoever will still be active in the community). That would be pretty difficult to achieve with Patreon.
Open Collective already offers fiscal hosting for several open source projects - both US-based (Open Source Collective) (https://opencollective.com/opensource) and EU-based (Open Collective Europe ASBL) (https://opencollective.com/europe). Some projects hosted there:
- Qubes OS (https://opencollective.com/qubes-os) (US host)
- Mastodon (https://opencollective.com/mastodon) (US host)
- Vue JS (https://opencollective.com/vuejs) (US host)
- Rada.re (https://opencollective.com/radareorg) (US host)
- Tor (https://opencollective.com/thetorproject) (US host)
- Manjaro (https://opencollective.com/manjaro) (EU host)
- many others
Here's our page on Open Collective (https://opencollective.com/magiclantern) - but it's not functional yet (you can't donate yet).
Also worth reading:
- What is Open Collective & how it works? (https://medium.com/open-collective/what-is-open-collective-how-it-works-c51bacc73d94)
- Open Collective is a New, Transparent Way to Fund Open Source Projects (https://wptavern.com/open-collective-is-a-new-transparent-way-to-fund-open-source-projects)
- Open Collective Docs (https://docs.opencollective.com/help/) - all of them :)
- The Value of Fiscal Sponsorship in FLOSS Communities (https://events.static.linuxfound.org/images/stories/slides/lfcs2013_sebro.pdf) (also covered on LWN (https://lwn.net/Articles/548542/))
I've got in touch with Open Collective in spring 2019, but had to abandon the idea for a while (having several unfinished projects in the pipeline, then pandemic etc). Back then, they were very friendly and open towards our project, so... earlier this week I've decided to resume the application process. They even offered to help with legal advice - will keep you posted once I'll have more details.
We still need to choose between the EU-based host (my personal preference), or the US-based one (which is specifically tailored to open source projects, and - according to OC admins - much better prepared for hosting our project). Last year I would have strongly leaned towards the EU-based host, primarily because of DMCA, but this is no longer a critical issue (https://www.magiclantern.fm/forum/index.php?topic=24827.msg230337#msg230337) (in my opinion for now, to be confirmed).
Assuming this will work out, i.e. if the level of support will allow me to return to the project without risking my ability to pay the bills, I'll do just that - my job still allows some degree of flexibility. Otherwise, if the donations will not be enough to partially cover my costs of living, but if they will exceed the hosting costs, I might be able to reimburse contributors for their project-related expenses (such as high-speed cards, or nonfree documentations, or equipment needed for reverse engineering, maybe a camera or two... depending on the budget).
Of course, in the past, there were voices completely (https://www.magiclantern.fm/forum/index.php?topic=13399.msg129491#msg129491) against (https://www.magiclantern.fm/forum/index.php?topic=6367.msg49861#msg49861) money (https://www.magiclantern.fm/forum/index.php?topic=9296) (very understandable), so if there are any concerns with my proposal, I won't move forward unless consensus is reached. I haven't sorted out the details yet - last year I've got green light from Trammell and g3gg0, which is why they are listed on our Collective page linked earlier.
Finally! Glad you decided to collect some money.
Edit: Didn't know OpenCollective but being fully transparent really suits you as person and the ML project. Chapeau!
Idea: Future builds could be available for donors only. It would motivate more to donate :)
First ML build was also for additional fee (if I remember correctly).
Consensus requires discussion. Or at least an opinion/statement. Don't see much progress here. Status?
I went to the open collective page, but it's not clear if we are 'active' yet.
I'm ready to support :)
Cheers
Garry
patience. No rush.
Indeed, this takes time. However, the latest update from Open Collective left me without many hopes - apparently they are not very comfortable with the legal gray areas. They might have a long answer in 3 weeks or so; until then, I can only speculate.
Their initial reaction was very good though - apparently they already knew about our project before initiating the discussion. Maybe there's still some tiny hope.
Still looking into alternatives.
Status update: as you might have expected, Open Source Collective (US-based) has to be very careful not to put themselves at risk by accepting us, so they had to review our reverse engineering activities. Unfortunately the response wasn't positive.
After a virtual meeting with their lawyer, together with g3gg0 and coutts, where we tried to explain what we do and what are the points we are careful about, things progressed a little. Earlier this week, I've received a small positive sign that there might be a way forward - still waiting for the details.
In any case, one of the biggest roadblocks is the FIR encryption, which might be problematic under DMCA - although we don't distribute any Canon code in our downloads, and we don't publish any encryption tools either. On recent models - since DIGIC 8 - Canon Basic is likely helpful from the DMCA point of view, as there's no encryption to be bypassed. On old models, UART (https://www.magiclantern.fm/forum/index.php?topic=7531.msg188817#msg188817) - which we figured out in 2018 - might also be useful, as there's no encryption to be bypassed there, but one would have to attach wires to the camera.
So, there are some alternatives to FIR encryption - but we didn't know about them before ~ 2018. Now, the question is whether our previous approach of creating fake firmware updates (ML-SETUP.FIR, ROM dumpers) is going to haunt us, and for how long.
Anyway - the lawyer who advised Open Collective told us that one of the preferred ways to make our project acceptable for fiscal hosting would have been to apply for a DMCA exemption for allowing software modifications to digital cameras - unfortunately, the application deadline had passed some months ago...
However, I've recently found about an initiative from EFF, where they ask for an exemption to allow repairing *and* modifying any software-enabled device:
https://twitter.com/EFF/status/1331657954412544002
https://www.eff.org/deeplinks/2020/11/lets-stand-home-hacking-and-repair
Quote
If you have a story about how:
- someone in the United States;
- attempted or planned to modify, repair, or diagnose a product with a software component; and
- encountered a technological protection measure (including DRM or digital rights management—any form of software security measure that restricts access to the underlying software code, such as encryption, password protection, or authentication requirements) that prevented completing the modification, repair, or diagnosis (or had to be circumvented to do so)
—we want to hear from you! Please email us at [email protected] with the information listed below, and we'll curate the stories we receive so we can present the most relevant ones alongside our arguments to the Copyright Office. The comments we submit to the Copyright Office will become a matter of public record, but we will not include your name if you do not wish to be identified by us.
I'm tempted to ask EFF whether they would be interested in our story. Though, I have several reasons to believe our approach regarding fake FIR files, without publishing the encryption tools, is actually safe from the DMCA - but this part is still being reviewed by Open Collective at the time of writing.
If we decide to contact EFF, they would have to submit our story to Copyright Office no later than December 14: https://www.copyright.gov/1201/2021/. Further details available on Discord (https://www.magiclantern.fm/forum/index.php?topic=19361.0) - e.g. if you'd like to help me review the draft e-mail for EFF.
BTW, normally our software is free, but today is Black Friday - you can get it for a reduced price (https://twitter.com/autoexec_bin/status/1332401580449165314) :)
Following. Very interesting.
Shortly after me going into full Donald Trump mode (https://twitter.com/autoexec_bin/status/1332401580449165314) on Twitter, something magic happened.
We have received a reply from Software Freedom Conservancy (https://sfconservancy.org/) - another US-based fiscal sponsoring organization to which we have applied back in 2013. They are also on good terms (https://sfconservancy.org/blog/2020/jul/09/org-proliferation/) with Open Collective. Some relevant projects already hosted on Conservancy (https://sfconservancy.org/projects/current/): OpenWRT (joined September 2020), Wine, Samba, Git, Mercurial, Homebrew, QEMU.
Their reaction was totally unexpected to me - in particular, this paragraph sounds very promising:
QuoteWe turn projects away these days, but only if they aren't a good fit for our mission, but that's not a case for you all — in fact, Magic Lantern is the kind of project we're really interested in seeing apply!
Background: we have submitted an application letter in January 2013, but we haven't received a reply back then. We didn't follow up, because shortly afterwards, we talked to SFLC - which, at that time, I thought it was a related organization, but it wasn't the case - who advised us sharply against taking donations. Their advice wasn't really in disagreement with the advice from EFF, as they also said that making money out of our software could increase our legal risk - but SFLC was a lot more conservative, possibly because of the 1DX/1DC rumour (https://nofilmschool.com/2013/01/canon-legal-team-modify-hack-firmware-1d-x-1d-c), which appeared shortly after we spoke to EFF. That's when we stopped accepting monetary donations, from what I remember. Eventually we calmed down to some extent and started accepting BTC as a workaround.
So, the idea of fiscal hosting is not new for us, but - back in 2013 - we gave up after receiving the not-so-favorable advice from SFLC. OK, Conservancy said they weren't prepared to accept us in 2013 either - but the lack of reply was actually a honest mistake from both sides (bad timing + not following up).
Of course, this does not mean Conservancy accepted us, or that is going to accept us, but they seem to have a genuine interest in figuring out a way forward. We'd still have to go through the same steps as with Open Collective, as they need to know what we are doing, to make sure our reverse engineering activities are not risky for them.
TLDR: now we've got two potential fiscal hosts to work with :)
If you are wondering: "Conservancy does encourage projects to apply to multiple non-profit homes to find the best fit.". Therefore, it is my understanding that discussing our application with both Open Source Collective and Conservancy in parallel shouldn't be an issue.
Awesome, really hope it comes through!
And thanks for sharing.
The story for EFF is coming together, thanks to everybody who reviewed it on the Discord channel!
As it will appear in a public mailing list (https://lists.eff.org/pipermail/righttomod-2021/) and will end up as a public comment, I've shared a link there (https://www.magiclantern.fm/forum/index.php?topic=19361.0), if anyone else would like to take a peek or suggest further edits. I'll submit it once it settles, likely tomorrow or the day after. The timing is short, as EFF would have to review it, to get in touch with us for additional info, and to turn it into a pertinent comment for Copyright Office, all before December 14.
Please note this was written as a response to EFF's request for a story about how DMCA interferes with legitimate tinkering with the software-enabled device you have bought (in our case, the DSLR camera). It's not a request for EFF to help us, so it should probably be kept as readable as possible, for anyone outside our project - that is, it shouldn't get too technical.
https://www.eff.org/deeplinks/2020/11/lets-stand-home-hacking-and-repair
The story for EFF can be considered an extended version of the series of tweets (https://twitter.com/autoexec_bin/status/1332401580449165314) shared earlier. Actually, the tweets were copied and/or adapted from an earlier draft.
Update: I have submitted the story to EFF earlier this week, right before the website went offline; you may read it here (https://lists.eff.org/pipermail/righttomod-2021/2020-December/000016.html) (or the shorter version (https://twitter.com/autoexec_bin/status/1333396821176168450) on Twitter, if you prefer). They got back to me, and we expect to have a virtual meeting with them this Tuesday - together with Trammell and g3gg0.
Both Open Collective and Conservancy reacted positively to our attempt to contact EFF - hopefully something good will come out of this :)
Will keep you posted.
Edit: here's the outcome of our EFF letter :)
https://www.youtube.com/watch?v=QCJkZlZQoUQ
https://www.ifixit.com/News/47696/were-hosting-a-press-call-to-discuss-how-copyright-law-hinders-repair
Update: just received an e-mail from Open Collective, titled: " We can host Magic Lantern! "
Santa arrived early? :)
Next steps: will find out after a virtual meeting with them.
Cool! So what does that mean exactly?
Funding? Full Time Magic Lantern Developers?
Hopefully yes - though, part time would be a much more likely scenario. Some details a few posts earlier (https://www.magiclantern.fm/forum/index.php?topic=24548.msg230929#msg230929). The cool part is - with Open Collective at least - that the funds will be available to anyone in the community who makes significant contributions - not just to me or to a restricted set of core developers. And, of course, anyone will be able to see where the money goes :)
Highly recommended reading: https://docs.opencollective.com/help
Or watch this video - from one of the Open Collective founders:
https://www.youtube.com/watch?v=lyOmToAyvjk
We aren't able to accept money yet; still need to discuss with them and find out the details. But it's a clear step in this direction.
Nice
finally! Great news! 8)
Congrats guys! You earned it a thousand times over!
Oh ! It's getting somewhere !
My wallet is on standby :)
Quote from: a1ex on December 15, 2020, 11:23:39 AM
Update: just received an e-mail from Open Collective, titled: " We can host Magic Lantern! "
In the CHDK forum I once heard the statement that as soon as CHDK became more commercial, Canon could protect its cameras better for debugging. Is that to be expected here too?
No link given and therefore unable to check source.
Q: "Commercial" as in
- Becoming a legal entity (company)?
- Charging people for software and services?
ML project team's step looking for a covering host has nothing to do with that!
And why should Canon wait for any kind of action by ML and/or CHDK to tighten cam software security? They can do it any time and don't have to ask anyone for permission.
Quote from: a1ex on December 15, 2020, 11:23:39 AM
...Santa arrived early? :)
Indeed this is all great progress, @a1ex!
Quote from: c_joerg on December 18, 2020, 08:05:06 AM
In the CHDK forum I once heard the statement that as soon as CHDK became more commercial, Canon could protect its cameras better for debugging. Is that to be expected here too?
They could have done so back in 2012, when we were accepting donations, or in 2013, when we've got a massive popularity spike after announcing raw video (see e.g. Petapixel (https://petapixel.com/tag/magiclantern/), EOSHD (https://www.eoshd.com/tag/magic-lantern/) and several others). To date, Canon have not removed the ability to run AUTOEXEC.BIN from the card (feature present in all EOS models from DIGIC 2 to DIGIC X), they have not removed the massive amount of debug messages we are relying on, they have not locked down the UART interface and so on.
What they did: they removed the ability to downgrade from certain firmware versions, but this seems to be in response to vulnerabilities (https://www.magiclantern.fm/forum/index.php?topic=24385.0) recently identified by Checkpoint Research. In other words, they do react quickly if anything bothers them.
They have also changed the encryption in EOS R/RP and newer models, but we didn't even have to figure it out. That's because, at the same time, they also enabled Canon Basic (https://www.magiclantern.fm/forum/index.php?topic=25305.0) on those models - the scripting engine documented by CHDK (https://chdk.fandom.com/wiki/Canon_Basic) some 10 years ago - making it even easier to execute code on these cameras, without even having to worry about DMCA. This scripting engine is likely present on all DIGIC 8 and X models, already confirmed on R/RP, R5/R6, M50, 250D and others.
On top of that, on DIGIC 7/8/X, you can temporarily patch pretty much anything in Canon firmware, by remapping parts of the ROM into RAM. This was possible to a very limited extent on DIGIC 2..5 ("cache hacks"), and no known possibility to patch ROM contents on DIGIC 6. Longer version here (https://www.magiclantern.fm/forum/index.php?topic=17695.msg231009#msg231009).
In other words, recent models are likely a lot more hackable than previous ones. The main reason why there is no ML on these models yet, is lack of developer time. Proof of concept was already done back in 2018 - all those "Hello World" screenshots actually demonstrate running custom code alongside Canon's own firmware. Though, the initial plan was to delegate the porting efforts for new models entirely to the community... hence all of that work on emulator (https://foss.heptapod.net/magic-lantern/magic-lantern/-/blob/branch/qemu/contrib/qemu/README.rst) and development (https://foss.heptapod.net/magic-lantern/magic-lantern/-/blob/branch/qemu/contrib/qemu/HACKING.rst) documentation (https://www.magiclantern.fm/forum/index.php?topic=15895.msg185084#msg185084).
Yes, there are some technical difficulties, as the hardware changed significantly (so porting is no longer "just" a matter of tweaking the existing code), and the instruction set also changed to Thumb (so, many of our low-level tricks will no longer out of the box), but all of these can be solved given sufficient development time.
BTW, operating under Open Collective's umbrella is somewhat like a nonprofit - Open Collective themselves call it a "virtual nonprofit". Does this count as "commercial" or otherwise a threat for Canon? I don't know, and I hope they don't see it that way. One of the biggest advantages of this approach is - if you ask me - that two fiscal hosting organizations with no previous connections to our project (Open Collective and Conservancy) have reviewed our reverse engineering activities and - after multiple rounds of legal advice - they have (finally) found our project acceptable. I hope this is going to give some peace of mind to everyone involved in the project - at least compared to previous state, where quite a few ex-contributors asked me to remove their e-mail / username / etc from this website because of the legal uncertainty.
We are not the only ones doing this - there are also other "alternative firmware" projects moving in the same direction, for example, OpenWrt joined Software Freedom Conservancy a few months ago (https://sfconservancy.org/news/2020/sep/10/openwrt-joins/), and Rockbox considered (https://www.rockbox.org/mail/archive/rockbox-dev-archive-2020-10/0000.shtml) joining (https://www.rockbox.org/mail/archive/rockbox-dev-archive-2020-10/0007.shtml) as well.
And it wasn't a rushed decision either. I've started to consider Open Collective at the beginning of 2019, but fiscal hosting isn't a recent idea - back in 2013 we've tried to apply to Software Freedom Conservancy. As it didn't work out, back in 2014 I've started to work with Apertus, hoping to "subsidize" ML development that way. That didn't work either. Earlier this year I've tried my luck with freelancing (again, didn't work out), and also started some side projects that don't rely on reverse engineering, but none of them had the potential to cover any costs of living within the next few years without *massive* time involvement from my side. So, the only sensible choice was to... change my mind towards fundraising for ML development.
I've submitted the application to Open Collective a long time after crossing a critical point of no longer being able (https://www.magiclantern.fm/forum/index.php?topic=24548.msg221283#msg221283) to dedicate long hours to hobby projects (ML in particular). The alternative - for me - would have been to watch from the sidelines - as I did since mid-2019 - at least for the next few years, and hope for the best. Yes, the project can definitely progress without my involvement - Danne and others already proved this - so I can also step back if there are serious concerns about Canon getting upset by this change. As I said before, things will only move in this direction as long as there will be consensus.
This video - very similar to the previous one - explains the situation very well. It's from one of the founders of Open Collective - meeting with them scheduled for Tuesday :)
https://www.youtube.com/watch?v=szE_00HC5h4
Quote from: Walter Schulz on December 18, 2020, 08:13:48 AM
No link given and therefore unable to check source.
If it is important and something changes, then I can look for it in the CHDK forum.
Quote from: a1ex on December 18, 2020, 03:05:42 PM
They could have done so back in 2012, when we were accepting donations, or in 2013, when we've got a massive popularity spike after announcing ...
Thank you very much for the detailed explanation.
As an enthusiastic CHDK and ML fan, I naturally hope that it will continue ...
don't be afraid. really. Nothing to worry about.
Canon will love this just because of ML they will sell even more cameras. They will sell cameras and it s free marketing for them. Every forum post. discord, reddit, twitter, whatever. Youtube, vimeo and such. It will contain "Canon".
They lack sales and ML will help. Not much maybe but still in these times where smartphones replace cameras every penny counts and that's just my 2 cents. They compete with Nikon, Olympus and such. And Ml will be one reason for potential buyers out there to grab a Canon.
Quote from: nikfreak on December 18, 2020, 06:44:00 PM
Canon will love this just because of ML they will sell even more cameras. They will sell cameras and it s free marketing for them. Every forum post. discord, reddit, twitter, whatever. Youtube, vimeo and such. It will contain "Canon".
They lack sales and ML will help. Not much maybe but still in these times where smartphones replace cameras every penny counts and that's just my 2 cents. They compete with Nikon, Olympus and such. And Ml will be one reason for potential buyers out there to grab a Canon.
Absolutely!
I've been thinking what would have happened if Canon would have decided to offer some support to ML developers for porting ML to their most advanced prosumer DSLR model - the 5DMkIV which is an expensive product. Sales of this highly capable camera would have exploded and Canon would have made a lot of money on that helping them to overcome these hard times nowadays. Now imagine the same thing for the R5/R6 models equipped with real 4k RAW video. Everybody would buy Canon, for many years to come! And what did they do instead? Commited that overheating fraud. What a shame, Canon ...
Some hopefully good news:
First one is that I've already found a way to allocate significant amounts of time for ML without worrying about making ends meet, and without breaking the bank. Look at the current Bitcoin price :)
In short, g3gg0 agreed to transfer me 0.737 BTC that I can exchange/trade as I see fit, and that should cover part of my living expenses for the current year. Obviously, it doesn't reach the threshold for dropping out of my full-time job - so one shouldn't expect miracles, besides visible progress. The remaining balance of 1.0 BTC is still available for the entire ML project, but any decision to spend it would be much easier if there were a steady stream of income.
Current priority for me is project maintenance: things like completing the transition from Bitbucket to Heptapod, figuring out and documenting a contribution workflow, continuous integration/testing in QEMU, integrating previous contributions into mainline, assisting other developers with technical advice etc. Development for new models is secondary for me, at least for the time being - there are more important issues that need to be addressed first. Of course, others are free to explore whatever areas they are interested in, including new camera models.
Once the project will be back into "maintained" state, i.e. able to accept/manage contributions, we can also think about fundraising towards supporting new camera models, new features, maybe a stable release etc. Bounties could be useful too, but again, somebody has to manage the contributions. Food (https://duo.com/decipher/open-source-software-needs-funding-not-bug-bounty-programs) for (https://old.reddit.com/r/opensource/comments/guce0a/should_maintainers_of_open_source_projects_be_paid/) thought (https://opensource.com/article/18/9/its-time-pay-maintainers).
The second part is about the fiscal hosting application. I still see some value in having some legal backing for the project and some consistent funding (as opposed to relying on occasional Bitcoin bubbles) - the project would no longer have the "underground" feeling, and a small team of part-time "staff" members (maintainers, devs, community assistants) might speed up the development quite a bit.
So far, we have met (using video-conferencing) with both Open Collective and Software Freedom Conservancy to discuss the initial details, but without any commitment, so we still have to decide which organization to pick in order to complete the application process.
In a nutshell, the more I think about it, the more I'm leaning towards Software Freedom Conservancy - and here are a few reasons.
First, they provide services like
"Basic Legal Advice and Services",
"Some Personal Liability Protection" etc:
Quote from: https://sfconservancy.org/projects/services/When a project joins Conservancy, it formally becomes part of the Conservancy. (The project is thus somewhat analogous to a division of a company or a department in a large agency.) As such, project leaders benefit from some amount of protection from personal liability for their work on the project.
This is obviously valuable for US-based contributors, but also for EU-based ones, as I expect a significant part of the donations to come from US-based supporters. Yes, DMCA affects the EU as well (https://www.websiteplanet.com/blog/dmca-ignored-countries/).
Conservancy is a 501c3 charity, and - to my understanding - the personal liability protection comes primarily from the Volunteer Protection Act (https://en.wikipedia.org/wiki/Volunteer_Protection_Act). We haven't discussed this particular detail with them; that was just my googling.
Some details to be reviewed (long reads):
https://sfconservancy.org/projects/apply/ConservancyFSATemplate.pdf
https://sfconservancy.org/projects/policies/conflict-of-interest-policy.html
https://sfconservancy.org/projects/policies/conservancy-travel-policy.html
For Conservancy, we need to have a
"Project Leadership Committee" with at least 3 active members. There are also some fairly strict rules about managing expenses, about getting paid for one's time (contract work) and so on; while they are probably overkill in the beginning, gut feeling says they will be beneficial for the project in the long run. These rules are probably part of the reason they can offer personal liability - again, my own interpretation.
Here's an opinion I've got on Discord, from the author of Copy this book (https://copy-this-book.eu) (no affiliation, but he has some experience running a nonprofit association):
Quote from: schrijver
The project leadership committee is a good thing, I think. It creates a structure wherein as project leadership you can have more confidence in your decisions because you don't take them all by yourself.
They leave some freedom as in how to structure this committee—the "Simple Self-Perpetuating Committee" is clearly the easiest. That being said, it would be good to think about a way to involve the community with this committee. For example, you could have the committee meetings be open to members of the community to attend.
Then, a detail that further tips the balance towards Conservancy, if you ask me:
Quote from: https://godotengine.org/donate
The Patreon donations are processed by Conservancy, which then uses them to hire developers based on contracts made transparent to all supporters.
It's not advertised on Conservancy's website, but... apparently they are compatible with Patreon!
I haven't discussed this aspect with them - found the above quote earlier today - but we might be able to open a team Patreon account to be managed by Conservancy, i.e. without personal liability :)
Of course, they also accept direct donations via Paypal (which also handles credit/debit cards), so one will not have to create a Patreon account in order to support our work.
Finally, getting paid for one's time would be done for contract work (as a freelancer), and I believe they can be invoiced via Xolo Go (https://www.xolo.io/go) (an Estonian service that allows EU-based freelancers to invoice any EU/US/CA-based business without requiring the freelancer to incorporate/register in their home country - much like a virtual company).
In comparison, Open Collective Europe ASBL (where we've also received green light) has a few important differences:
* the project would be an
unincorporated partnership, and Open Collective Europe would hold the money for us
+ much less bureaucracy; the core team would simply have to approve any expenses without a formal process
- there's no personal liability protection - probably not needed as long as we "stay" in Europe (both regarding contributors and supporters, to my understanding)
- requires sharing the home address of a core contributor, for invoicing
- donations (under OCE) must be without any kind of expectations/promise attached, otherwise they are considered "services" and taxed 20% extra
+ they have some very interesting funding options (https://docs.opencollective.com/help/collectives/funding-options) involving services, such as a support contract / support tiers (https://docs.opencollective.com/help/collectives/tiers-goals), or even office hours (https://www.jrockowitz.com/blog/webform-office-hours) for companies - but there is an important limitation
*) on the European side of Open Collective, see below
- the collective would not have a VAT number, so if anyone would like to get paid for their time, they would have to invoice the collective
with VAT - the usual EU rule about reverse VAT charge does not apply here. I smell double VAT taxation for any services that we might decide to offer through Open Collective Europe, but I might be wrong.
- cannot invoice the collective via Xolo Go (reason: lack of VAT number)
- no Paypal, only debit/credit cards available
+ transparent budget visible by everyone (recommended reading: From Firms to Collectives (https://blog.opencollective.com/from-firms-to-collectives/))
+ Twitter integration
*) Regarding the services (including users who donate towards e.g. supporting a particular camera model), there is another important limitation:
Quote from: https://opencollective.com/europe/conversations/about-vat-04qj9b68If your collective plans to offer products and services on a regular basis, you should apply for your own VAT number. If that's the case, we would highly recommend you to create your own fiscal host for your collective that could also act as a fiscal host for collectives like yours in your country.
Some of the shortcomings might be fixed in the near future, as they plan to expand Open Collective Europe, but we haven't discussed these details yet.
Some common aspects (would apply to both Open Collective Europe and Conservancy):
+ reimbursing project-related expenses (e.g. for cameras to work on) can be done for contributors from at least US and EU (other countries might work as well, but not all)
+ taxes are only due if anyone gets paid for their work (and only for their part, not for the money received by the entire group)
+ both orgs allow reimbursements via Paypal or bank transfer
Docs to be reviewed:
ToS: https://docs.google.com/document/d/1Cc8GBkH4XUfdF9hxmrK5b2W2YUw09hRNoCMdoR2Kzao/pub
VAT issue: https://opencollective.com/europe/conversations/about-vat-04qj9b68
TLDR: for covering various expenses, such as server costs or cameras to work on, Open Collective Europe is a fair choice, but that's not primary reason we are applying for fiscal hosting:
Quote from: Audionut on September 07, 2017, 06:14:13 AM
Need hardware + time.
Hardware is easy.
Rather, the problem I'm trying to solve is this one:
Quote from: Walter Schulz on October 10, 2018, 10:42:41 AM
ML code doesn't grow on trees.
Thoughts welcome - although I might sound biased or undecided, I'm just trying to find the best way forward for the entire project.
Happy New Year, btw!
definitely 2021 is gonna be a great year !
it would be cool if people with a better understanding of alex' mentioned tax question/issues can look a bit closer and give feedback.
Well, I didn't mean to ask for tax advice on the forum; just sharing my current understanding.
With Xolo Go, VAT for invoicing works like this:
Quote from: https://www.xolo.io/faq/xolo-go/category/income/article/how-does-vat-work-for-invoicing-your-sales
If your customer has a valid VAT number for intra-EU transactions, and is located in an EU country other than Estonia, then the VAT is marked as 0% due to the reverse-charge mechanism.
[...]
If your customer does not have a valid VAT number, then it will be necessary to add the Estonian VAT rate of 20% to the invoice.
Quote from: https://www.xolo.io/faq/xolo-go/category/income/article/what-if-my-customer-does-not-have-a-vat-number
If your customer does not have a valid VAT number for intra-EU transactions, for instance, they only have a local VAT number or they are a legal entity that is not able to apply for a VAT number, then it is still possible for you to invoice them via Xolo Go.
However, in this case, the Estonian VAT rate of 20% will be added to the invoice.
The following explanation is clearer, but applies to Xolo Leap (i.e. if one registers a company in Estonia through them). Likely similar to Go, from what I could tell:
Quote from: https://www.xolo.io/faq/xolo-leap/category/taxes/article/what-are-the-vat-rates-for-consultancy-services
If you sell services which need human intervention, such as consultancy, the following examples apply:
- If your customer is a business from the EU (e.g. Germany), and has a valid VAT number, you apply 0% VAT adding a special clause on your invoice: 'The purchase is liable to Intra-Community supply 0%, Reverse charge.' (You can check the validity of your customer's VAT number here)
- If the customer is a private individual or a business from Estonia, you need to charge 20% VAT (Estonian VAT)
- If the customer is a private client or business from the EU, and does NOT have a valid VAT number, you need to charge 20% VAT (Estonian VAT)
- If the customer is outside the EU (e.g. U.S.), don't apply any VAT (0%)
To my understanding, Open Collective Europe would fit into #3, while Conservancy (or Open Collective 501c6, which is off-limits for us) would fit into #4.
I've mentioned Xolo Go because it could be interesting for any EU-based contributors looking to get paid for their work on ML, as it might be easier to get started (depending on their home country, there might be less paperwork, compared to registering as self-employed in their home country). In this case, they would have to pay local taxes on a foreign
salary, to my understanding (no dividends available from Xolo Go). Further reading: https://www.xolo.io/faq/xolo-go/category/withdrawals/subcategory/reporting-income
There might be a way to get around the second VAT - the one applied when invoicing Open Collective Europe:
Quote from: schrijver
In Belgium you can work around this if you have a small chiffre d'affaire—you don't need to charge VAT then
That is, if the freelancer registers a local business in their home country, and their yearly turnover is below a certain limit (3000 - 60000 EUR/year, depending on their country (https://europa.eu/youreurope/business/taxation/vat/vat-exemptions/index_en.htm#shortcut-3)), it might be possible to invoice OCE without VAT.
For potential US-based contributors, I have no idea how things would work there. Assuming things will be straightforward for Conservancy (as they are US-based), but expecting surprises with Open Collective Europe - they would have to invoice the unincorporated EU-based partnership, whatever that means for them.
Again, this is not tax advice or request for tax advice - just my own understanding :)
Quote from: a1ex on January 02, 2021, 08:07:56 AM
Well, I didn't mean to ask for tax advice on the forum; just sharing my current understanding.
...
Again, this is not tax advice or request for tax advice - just my own understanding :)
yeah for sure, but if somone can confirm the current understanding or give any feedback or even contra-indications, this would be welcome i assume.
Of course, any thoughts are welcome. However, tax issues aside, the choice that we are going to make (Open Collective Europe vs Conservancy) may impact the future of the project in some very significant ways - so I'd prefer opinions that would help us make the right decision.
BTW, another possible reason for choosing Conservancy:
Quote from: c_joerg on December 18, 2020, 08:05:06 AM
In the CHDK forum I once heard the statement that as soon as CHDK became more commercial, Canon could protect its cameras better for debugging. Is that to be expected here too?
Conservancy is a 501c3 (https://www.501c3.org/what-is-a-501c3/) charity (based in New York); therefore, by choosing them, we would emphasize the non-commercial nature of the project even further (compared to choosing Open Collective). Or, at least that's my understanding. Whereas, if we were to incorporate a regular LLC or something similar, that would have screamed "commercial intentions", so this was excluded from the start:
Quote from: g3gg0 on June 11, 2013, 11:35:52 PM
we really need support in some things.
but it is our rule set to be
a) non-commercial
b) self-financing
c) non-profit
d) spare time project
within these rules, feel welcome to help :)
BTW, the following could also serve as a longer answer:
Quote from: a1ex on September 16, 2020, 09:19:57 PM
- The Value of Fiscal Sponsorship in FLOSS Communities (https://events.static.linuxfound.org/images/stories/slides/lfcs2013_sebro.pdf) (also covered on LWN (https://lwn.net/Articles/548542/))
While Open Collective fiscal hosts are also non-profits (Open Source Collective is 501c6 (https://nonprofitlawblog.com/comparing-501c3-vs-501c6-for-nonprofit-startups/) in California, Open Collective Europe is ASBL (https://fr.wikipedia.org/wiki/Association_sans_but_lucratif) in Brussels), they actually go a little further away from the charitable path, in the direction of offering services to companies and backers. This probably makes sense for a large number of open source projects - Open Source Collective already host over 2000 projects, despite being quite recent (2017-2018?), while Conservancy - about 50 projects, despite them being around since 2006. However, it looks like Open Collective don't have the legal protections available for charities, so they had to be much more conservative regarding our application. I'm no expert, but apparently in US there is a clear difference between nonprofits and charities.
https://blog.opencollective.com/moving-beyond-the-charity-framework/
https://blog.opencollective.com/from-firms-to-collectives/
Quote from: a1ex on January 02, 2021, 01:02:15 PMWhereas, if we were to incorporate a regular LLC or something similar, that would have screamed "commercial intentions", so this was excluded from the start:
yeah, i would still recommend keeping these as basic rules.
at least in most areas of europe this helps in being some innocent, non-evil entity.
Quote from: g3gg0 on January 02, 2021, 09:20:15 PM
yeah, i would still recommend keeping these as basic rules.
at least in most areas of europe this helps in being some innocent, non-evil entity.
as it was a bit misleading:
I still would stick to these rules as close as possible - especially non-commercial/non-profit.
using donations as financial support like for a1ex is absolutely okay for me and i fully support this.
this does *not* mean, ML is giving away money for everyone who asks for.
instead there was a lot of discussion before and everyone had no doubt that this is necessary and good.
Thanks. I'd like to add that it's not my intention to keep everything for myself, and I'd find it very useful to have a small team that I could rely on, rather than doing most of the maintenance work myself. For example, having at least an extra pair of knowledgeable eyes when reviewing pull requests would help a lot. Same for being able to delegate tasks like issue triaging, documentation, release management and so on, at least to some extent. But it would be unreasonable to expect any kind of commitment from volunteers / spare-time contributors (or, at least I'd feel bad about it).
https://snarky.ca/setting-expectations-for-open-source-participation/
And a related joke: https://twitter.com/ryanchenkie/status/1067801413974032385
(maybe not relevant atm, but it used to be very true for us some years ago)
So, it's not for anyone's personal benefit, but for moving the project forward. And some oversight for Conservancy could actually help with this - for example, if we join them, we'll have to think seriously about the project governance, and maybe write down some rules.
Here's an example from another project that operates under Conservancy's umbrella:
https://twitter.com/reduzio/status/1338108643762429952 (the entire thread)
And another example of how to organize tasks that are eligible for funding, from another project under Conservancy:
https://inkscape.org/support-us/funded-development/
One particular detail in the Inkscape guidelines: there is a rule that any development tasks eligible for funding should stay on a waiting list for at least 6 months, so volunteers could get a chance to implement these on their own. If we were to consider a similar rule, support for new cameras would qualify, for example.
I think I could handle some PR reviews. I managed to merge lua_fix and unified without breaking anything major :) And the Qemu update. (Do you want me to format this work for inclusion in Heptapod? I was assuming not at this stage) These are partly isolated changes by their nature (although lua_fix contained a bunch more than just Lua), so I haven't looked at all areas of the code. Entirely up to you as to whether I'd be useful for what you have in mind. However, if I'm not there yet, feel free to let me know which areas you think I'm not yet competent in - I'd be happy to improve, but I don't know what areas are most important to ML as a project. I don't want you to be my boss, this is a spare time project! But on the other hand, some direction would be valuable for knowing where to explore.
It's a little off topic, but not entirely: ML as a project could do with more visibility into what wants doing. Yes, there are open tickets (but do many people even know that?). But there's a lot of them and they're not organised. A single page that linked to some important tickets that normal devs could get started on (or, get started learning how to do them), would be quite useful I feel. More involved, prioritising and categorising tickets would be valuable. E.g., I'd also like to help with automated Qemu testing, I know that's an important area, but I don't know exactly where to start or what it should end up looking like in order to get accepted.
Things I would happily volunteer for:
- closing cold tickets (reporter didn't respond, no way to reproduce or test, report too low quality to repro, etc)
- categorising / prioritising tickets (Qemu? ML framework? Model specific?)
- improving Qemu automation
- code cleanliness work (e.g., making all code conform to coding standards. Which ML has! Which are ignored!)
- some maintenance tasks (e.g. porting everything to python3. Although this I can't test alone as I don't have access to Mac or Windows)
- PR reviews where you think I'd be useful (good way to improve my knowledge of the code, in those cases where I have the base knowledge to be useful in the review)
I'm sure there's a lot more. I'm leaving out porting tasks on purpose. I think there's a lot of tasks that "normal" devs could work on, but they don't know it. Notably, I want to do all those tasks, but I don't know if ML wants me to, and I don't know how to do them the right way. Let me do some of the boring tasks so you can do more of the fun ones! I like being useful and won't let myself only do boring tasks ;)
well, ML is by its technical complexity nothing for one or two people.
it did and will not work that the same people digging into asm rev eng tasks (which are not just "a few minutes" of work, but rather weeks for one specific topic)
are the same ones who organize the project on a PR, doc, JIRA etc level :(
by the way - thanks to all contributors on the forums who try to keep the forum tidy :)
The complexity provides ample opportunity. This is a multi-faceted project with plenty of avenue to assist.
Things are fragmented. People come and go, available time ebbs and flows, new challenges constantly appear. Take the closure of bitbucket for example, that being a significant burden. Having to find another suitable host, work with the new changes, etc etc. All of this diverts resources (time) away from the main project, to tasks that don't exactly drive the project forward, and yet are inherently necessary due to circumstances.
Asking to ask (https://dontasktoask.com/), while apparently polite, is, to some extent, just another burden. If you think you can assist in a specific area, take charge of that task, take the burden of that task off of the hands of another community member. Don't be afraid to step on toes, because after all.....
Quote from: Dealing with rudeness link=http://www.catb.org/esr/faqs/smart-questions.html#keepcoolMuch of what looks like rudeness in hacker circles is not intended to give offense. Rather, it's the product of the direct, cut-through-the-bullshit communications style that is natural to people who are more concerned about solving problems than making others feel warm and fuzzy.
We all make mistakes, it is part of the learning process.
You may venture down a path for 3 days working on some specific thing, at which point after some discussion it inevitably ends with having to cease completing that task. Would that be considered to be a waste of time? Possibly, but asking to ask could enviably lead to a months worth of waiting for someone to answer. Which avenue wasted more time? Surely in the 3 days being spent working on a task, something was learned, yes? What do we learn by waiting a month for someone to say no, or giving up on waiting.......
I've lost count of the amount of people who have appeared, proclaimed to be in a position to help, been offered assistance, then disappeared. I don't mean to criticize those people at all, I just simply ask to respect my healthy load of skepticism towards people who ask to help.
I'm not asking to ask, or asking to help - I'm already doing things that I guess will help. But, I only have limited time, and, are my guesses good? I'm not saying "I won't do anything until I know the best thing to do", that way lies paralysis. I am asking because I want to be more useful. I think I've been very useful getting new contributors up to speed with dev environment and early porting tasks. The Qemu 4.2 update I think is useful and well received. I've learnt a lot about the code layout and how it works with Qemu, boot process on cams, etc. I am not waiting around for guidance. But I could do better with guidance, and be of more benefit to ML, not just what I find interesting.
3 days is fine to try something out. But improving Qemu testing automation, or refactoring the build system, these are tasks that could take months. Personally, *while I want to do those tasks*, I don't want to commit several months of time to then be told I did them in the wrong way and it's useless to ML. Both sides win if requirements can be given in advance.
Quote from: names_are_hard on January 04, 2021, 05:12:04 PMPersonally, *while I want to do those tasks*, I don't want to commit several months of time to then be told I did them in the wrong way and it's useless to ML. Both sides win if requirements can be given in advance.
good point. in this case the best is to try to understand how you thing it should be, then
explain your plan and ask if that is okay :)
from my experience: when an experienced developer (not a "what is C?"-newbie) made a plan of how he would solve things, this not different from what alex, me or any other would have done.
(you have no idea how often we have developed things and iterated 10x over it and finally thrown them away because it didn't work out or made no sense at all)
also experience: its always easy to say: "meh, i would have done it that way". but the answer to this is - "you haven't done it at all, so get cope with it :)"
Quote from: g3gg0 on January 04, 2021, 05:19:19 PM
also experience: its always easy to say: "meh, i would have done it that way". but the answer to this is - "you haven't done it at all, so get cope with it :)"
Yes, and this goes both ways (new devs <=> old devs), which is a point I was trying to make.
Quote from: names_are_hard on January 04, 2021, 05:12:04 PM
refactoring the build system
This is a perfect example (the other tasks you have taken are also probably good examples, sorry I haven't been following along to closely). The build system is as it is, because it works. But you've seen an opportunity to refactor the code and jumped straight into it. You made a comment on discord along the lines of "well, no one is complaining about my proposed changes, so...."
That was after a Q&A session where you sought clarity on a few details of the build system. This to me is exactly how things should proceed.
Far to often, it seems to end at a position where someone ends up asking for permission to proceed (do you think I should do this? Is it ok if I do this?). This is asking to ask.
Quote from: names_are_hard on January 04, 2021, 05:12:04 PM
I've learnt a lot about the code layout and how it works with Qemu, boot process on cams, etc.
This is the value IMO. Reaching an end goal of providing something
useful, is obviously icing on the cake, but learning along the way also has it's value. If you're focus is entirely on ML, in the least, you are now in a better position for ML in the future (I reply to you, but it applies to everyone).
This project is not a corporate. There are no expectations to deliver results. You won't lose your job because you spent 2 months working on something, but didn't deliver an end product. If you had some fun along the way, learned some new things along the way, perfect.
Quote from: names_are_hard on January 04, 2021, 05:12:04 PM
I am not waiting around for guidance. But I could do better with guidance, and be of more benefit to ML, not just what I find interesting.
You've made good points regarding organization. I expect these to be addressed when the fiscal problem is sorted as by nature, the project will be required to become more organized. Just like the bitbucket issues forced a requirement to focus on issues related to that, so will the fiscal hosting force a requirement into other areas.
But.... What you find interesting, shouldn't in my opinion, be dismissed as if it doesn't help ML, or only helps to a lesser extent. A
typical user sees no value in the work you have done at all, because it doesn't solve "when will ML be available for" or, "when will feature XYZ be available". But the value is there, if for no other reason, then you had fun doing what you did.
Status update: polishing the application to Software Freedom Conservancy - it already grew way larger than I'd like to admit :)
Currently, reviewing the application takes place on Discord - anyone is welcome to take a look... except for the search engines :D
If you are not already on Discord and you'd like to take a look, feel free to ping me on IRC (no registration needed) or via PM.
Edit Jan 11: application submitted!
Thanks to schrijver and Audionut for the major edits, but also to everyone else who made comments and suggestions :)
Update: received an answer from Conservancy, regarding our application.
We still have some things to fix, the most glaring issue being project governance (or lack thereof), but the outcome is - in their words - "we're committed to get there" :)
Quote
Our first next step is to discuss the governance of the project and its representation in Conservancy to make sure we understand how decisions are made on behalf of Magic Lantern and to make sure Conservancy is set to interface well with the project. I know from the application you submitted that there's currently no formal decision-making on behalf of the project, so we'll have to design a process that fits with the way you all currently collaborate. Some of the easiest ways to do this are having an elected or self appointed committee, which we can discuss in greater detail.
As such, they invited us to a virtual meeting, together with the new and/or currently active developers. Trammell will be able to join us on Thursday evening. Meeting time wasn't fixed yet, but - my guess - it will be most likely between 18:00 and 21:00 GMT. For the meeting, we will use BigBlueButton, which works directly in browser - there's no need for the participants to install any custom software.
For reference, here's the agreement we'll have to complete - but after the meeting, of course:
https://sfconservancy.org/docs/sponsorship-agreement-template.pdf
Thanks for the update.
Scanning the agreement, the one area that may need clarifying is this one
QuoteFees. The Signatories agree to donate ten percent (10%) of the Project's gross revenue (includ- ing, but not necessarily limited to, all income and donations) to Conservancy for its general operations.
That is how to measure gross revenue in our ML project. The wording implies at least 10% of donations go to Conservancy. I guess this is the base model?
Right - Open Collective would have taken the same percentage. It's not something I'm worried about.
On the contrary, I believe the services (https://sfconservancy.org/projects/services/) offered by Conservancy are worth a lot more than that, as discussed earlier in this thread.
Thanks for the reassurance and sharing your views.
Did you agree on any cooperation (in March 2021)?