And it doesn’t mean they can take away anything.
Not if they’re able to monetize your small bugfix
The problem is they can, and that’s not the point - I don’t care if you make money with something I spent my time on willingly, I care that you’re forcing me to say you’re the full and sole owner of my contributions and can do whatever you want at any point in the future with them.
Signing a CLA puts the full ownership of the code in the hands of whomever you’ve signed the CLA with which means they have the full ability and legal right to do any damn thing they want, which often includes telling you to fuck yourself, changing the license, and running off to make a commercial product while both killing the AGPLed version, and fucking everyone who spent any time on it.
If you have a CLA, I don’t care if your project gives out free handjobs: I don’t want it anywhere near anything I’m going to either be using or have to maintain.
And sure you can fork from before the license change, but I’m unwilling to put a major piece of software into my workflows and hope that, if something happens, someone will come along and continue working on it.
Frankly, I’m of the opinion that if you’re setting up a project and make the very, very involved decision to go with a CLA and spend the time implementing one, you’re spending that time because you’ve already determined it’s probably in your interests later to do a rugpull. If you’re not going to screw everyone, you don’t go to the store and buy a gallon of baby oil.
I’ve turned into the person who doesn’t really care about new shit until it’s been around a decade, has no CLAs, and is under a standard GPL/AGPL license (none of this source-available business license nonsense), and has a proven track record of the developers not being shitheads.
100%.
I see a CLA or a goofy “source-available” license, I just assume it’s going to be a rugpull and that I should move on. I very much do not give anyone the benefit of the doubt anymore.