Require Developer Certificate of Origin (DCO) signoff on all commits? about openrefine HOT 1 OPEN

@tfmorris I've never liked this extra effort and didn't think in OpenRefine (without any commercial bent connected to it, unlike Linux Foundation or Oracle projects, etc.) that a DCO would even be needed for us? Maybe I'm not the right one to comment on this. But what was your thinking about requiring this? What legal snafu's are you thinking about or helping trying to avoid? Curious, if you can explain more of your rationale on this. Thanks.

@wetneb I'd be curious what or how CS&S (essentially, our legal team) thinks about this, if we should have DCO signoffs or not? Can you email them?

My take is that DCO's are great to protect commercial entities (MSFT, GOOGLE, APPLE, etc.) from lawsuits that use a piece of open source - like the Linux kernel, or Apache Hop. But a DCO never protects a developer (they are still liable for copyright infringement, fraud ,etc. if they signoff that they have some right or authority statement to make - when, in legal reality, they do not. Or that someone years later finds out that they actually did not have the authority to make such a statement because they were under an NDA at the time of commit).

from openrefine.