Licence of VO-DML files?

[Markus Demleitner]

Hi Pat,

On Wed, Nov 04, 2020 at 12:39:58PM -0800, Patrick Dowler wrote:
> I always thought of the VO-DML file as a machine-readable description of
> the standard, so it is in between document and software (like xsd, but xsd
> seems closer to implementation so a little more like s/w).

Well, *so far* I had hoped that VO-DML is exactly like XSD in that it
tells the software what to expect where.

While the recent discussions make me doubt things will fly that way,
that's still the state of the current implementation, and that's why
VO-DML drafts come with DaCHS.

> Why would you distribute VO-DML files with the s/w? To avoid downloading
> them from a URL at build time or runtime? I will admit to being lazy and
> putting copies of (IVOA) XSD files into source to avoid the pain* of
> getting them during the build (I definitely want the s/w to be stable and
> robust from then on so would not want to get them periodically at
> runtime)...
> 
> * both transient build failures when ivoa.net fails and to avoid having
> rogue build/test/CI beating up on ivoa.net servers

These are all good reasons to keep the files with the software; also,
I sometimes have... patches in there while IVOA review is still going
on and I'm nagging on my TCG colleagues to review the relevant
standards.

For VO-DML, there's the additional problem that for most of these
files, there's not even a stable download location (or at least there
wasn't when last I looked).

Quite important to me is also to minimise the amount of "calling
home" that a software does.  In general, it is my conviction that
software should not initiate any network connection that its user
would not reasonably expect.  Fetching all kinds of resources from
across the net for tasks that for a user wouldn't seem to involve the
network to me is (at least potentially) infringing on user's rights.

But then or course there are exceptions -- while Vocabularies 2 has
offline operation as an explicit use case, my current implementations
(cf. https://github.com/astropy/pyvo/pull/241) do forsee that every 6
months the box goes to ivoa.net when the user does a datalink
semantics match.  The reasoning is roughy that since people *I* trust
are running ivoa.net, pyvo users can trust them, too.  Ahem.

But then: even if programmes go out and pull VO-DML without
distributing it, having a clear and permissive licence will help.  I,
for one, am not sure what it means if I pull and use a CC-BY-SA file
in my software.  Do I need to inform my deployer I did so?  How do I
cover the SA clause?

          -- Markus

[Who can't lie: the longer I think about it, the more I believe that
my initial assessment that the CC-BY-SA vs CC-0 debate was largely
ephemeral wasn't quite right and I should have tried a bit harder to
convince people]