[j1elo]

The only meaningful informed decision, but sadly much less known (and I think we should talk and insist more on it), is to be wary if you see a CLA. Not all do, but most perform Copyright Assignment, and that's detrimental to the long-term robustness of Open Source.

Having a FOSS license is NOT enough. Idealy the copyright should be distributed across all contributors. That's the only way to make overall consensus a required step before relicensing (except for reimplementation).

Pick FOSS projects without CLAs that perform Copyright Assignment to an untrusted entity (few exceptions apply, e.g. the FSF in the past)

[baq]

Bad advice.

You should be wary always. CLA or not, nothing guarantees that the project you depend on will receive updates, not even if you pay for them and the project is 100% closed source.

What you’re suggesting is perpetuating the myth that open source means updates available forever for free. This is not and never has been the case.

[j1elo]

Was I, really? Maybe, if you feel so... but I'd have to say that I had no idea.

What I'm suggesting is that a FOSS project without CLAs and a healthy variety of contributors does belong to the broad open source community that forms around it, while a FOSS project with such CLA is just open to a bait-and-switch scheme because the ownership stays in a single hand that can change course at a moments notice.

Whether the project stops receiving updates or not, is an orthogonal matter.

[monkey26]

Do you feel the same way if the CLA is to assign copyright to an non profit foundation that is a steward of that open source project?

[j1elo]

Obviously no, if you trust that foundation; hence my

> few exceptions apply, e.g. the FSF in the past

[everfrustrated]

You are correct. Signing a CLA is in effect saying you approve this project doing a rug-pull and becoming closed-source in the future.