I think the most striking thing is that for outsiders (i.e. non repo members) the acceptance rates for gendered are lower by a large and significant amount compared to non-gendered, regardless of the gender on Google+.

The definition of gendered basically means including the name or photo. In other words, putting your name and/or photo as your GitHub username is significantly correlated with decreased chances of a PR being merged as an outsider.

I suspect this definition of gendered also correlates heavily with other forms of discrimination. For example, name or photo likely also reveals ethnicity or skin colour in many cases. So an alternative hypothesis is that there is racism at play in deciding which PRs people, on average, accept. This would be a significant confounding factor with gender if the gender split of Open Source contributors is different by skin colour or ethnicity (which is plausible if there are different gender roles in different nations, and obviously different percentages of skin colour / ethnicity in different nations).

To really prove this is a gender effect they could do an experiment: assign participants to submit PRs either as a gendered or non-gendered profile, and measure the results. If that is too hard, an alternative for future research might be to at least try harder to compensate for confounding effects.

I think (unless I misunderstood the paper), they only included people who had a Google+ profile with a gender specified in the study at all (this is from 2016 when Google were still trying to make Google+ a thing).

People contributed to HashiCorp products - the software is not something solely made by HashiCorp. This might technically be legal under their CLA and indeed even in the absence of the CLA, under the Apache License, but it certainly isn’t fair to people who contributed to it voluntarily in the expectation it would form part of a Free software project.

I think maybe the best way to combat this type of thing in the future is if F/L/OSS communities (i.e. everyone who contributes to a project without being paid) starts: 1) preferencing copyleft projects over BSD/MIT type licenses, and 2) refusing to sign any kind of CLA (maybe with an exception for obligate non-profit organisations). Then, companies will either have to pick developing entirely at their own cost, or to accept contributions on the incoming=outgoing model, meaning they are also bound by the copyleft licence and are forced to keep it as Free software. That would end the bait-and-switch of getting people to work on your product for free and then saying “surprise suckers, it’s no longer Free software!”.

There’s also the fact that GPL is ultimately about using copyright to reduce the harm that copyright can cause to people’s rights.

If we look through the cases that could exist with AI law:

1. Training can legally use copyrighted materials without a licence, but models cannot be copyrighted: This probably is a net win for software freedom - people can train models on commercial software even and generate F/L/OSS software quickly. It would undermine AGPL style protection though - companies could benefit from F/L/OSS and use means other than copyright to undermine rights, but there would be nothing a licence could do to change that.
2. Training can legally use copyrighted materials without a licence, models can be copyrighted: This would allow companies to benefit heavily from F/L/OSS, but not share back. However, it would also allow F/L/OSS to benefit from commercial software where the source is available.
3. Training cannot legally use copyrighted materials without complying with licence, models cannot be copyrighted (or models can be copyrighted, outputs can’t be copyrighted): This is probably the worst for F/L/OSS because proprietary software wouldn’t be able to be used for training, but proprietary software could use a model trained on F/L/OSS by someone else.
4. Training cannot legally use copyrighted materials without complying with licence, models can be copyrighted, outputs can be copyrighted: In this case, GPLv2 and GPLv3 probably make the model and its outputs a derivative work, so it is more or less status quo.