惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

云风的 BLOG
云风的 BLOG
P
Privacy International News Feed
Vercel News
Vercel News
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
博客园 - 叶小钗
F
Fortinet All Blogs
Security Archives - TechRepublic
Security Archives - TechRepublic
L
LINUX DO - 最新话题
AWS News Blog
AWS News Blog
Engineering at Meta
Engineering at Meta
Attack and Defense Labs
Attack and Defense Labs
Recent Announcements
Recent Announcements
Recent Commits to openclaw:main
Recent Commits to openclaw:main
PCI Perspectives
PCI Perspectives
Cloudbric
Cloudbric
AI
AI
cs.CL updates on arXiv.org
cs.CL updates on arXiv.org
IT之家
IT之家
Exploit-DB.com RSS Feed
Exploit-DB.com RSS Feed
J
Java Code Geeks
M
MIT News - Artificial intelligence
Cisco Talos Blog
Cisco Talos Blog
V2EX - 技术
V2EX - 技术
Webroot Blog
Webroot Blog
Microsoft Security Blog
Microsoft Security Blog
Cyberwarzone
Cyberwarzone
博客园 - 聂微东
G
Google Developers Blog
W
WeLiveSecurity
罗磊的独立博客
P
Privacy & Cybersecurity Law Blog
阮一峰的网络日志
阮一峰的网络日志
A
About on SuperTechFans
WordPress大学
WordPress大学
The GitHub Blog
The GitHub Blog
T
Tailwind CSS Blog
V
Visual Studio Blog
Application and Cybersecurity Blog
Application and Cybersecurity Blog
H
Hackread – Cybersecurity News, Data Breaches, AI and More
S
Secure Thoughts
Apple Machine Learning Research
Apple Machine Learning Research
Hugging Face - Blog
Hugging Face - Blog
Google DeepMind News
Google DeepMind News
Google DeepMind News
Google DeepMind News
雷峰网
雷峰网
cs.AI updates on arXiv.org
cs.AI updates on arXiv.org
F
Full Disclosure
Blog — PlanetScale
Blog — PlanetScale
The Last Watchdog
The Last Watchdog
P
Proofpoint News Feed

ashishb.net

A day in Luxembourg - the richest country in the world I was asked to install malware during a fake interview Book summary: Breakneck - China's quest to engineer the future by Dan Wang Book summary: How to Teach Your Baby to Read Book Summary: The Discontented Little Baby Book by Pamela Douglas Introducing Amazing Sandbox - run third-party tools and AI agents securely on your machine Why software outsourcing gets a bad reputation? Book summary: The Natural Baby Sleep Solution by Polly Moore A day in Antwerp, Belgium Journey of online influencers Two days in Brussels, Belgium Shortcuts - when we love them and when we don't A visit to Rakhigarhi Three days in overhyped Paris Empty Japan, crowded Tokyo The real lock-in in GitHub is not the code, but the stars 11-day Norwegian Breakaway East Caribbean cruise Sanskrit and Sri Lankan Air Force Use REST with Open API The Achilles heel of American capitalism Costa Rica in 4 days At a juice stall in Sri Lanka A short stay at Warsaw, Poland Best practices for using Python & uv inside Docker Two days in Vilnius, Lithuania How IntelliJ IDEs waste disk space Pregnancy Why there aren't many digital nomads from India Two days in Riga, Latvia To keep your machine secure, run third-party tools inside Docker Family Ties in Your DNA: Some relatives are closer than others Doctors per capita Two days in Tallinn, Estonia Ship tools as standalone static binaries Made in America Two days in Helsinki, Finland Maintaining an Android app is a lot of work The land of good deals Two days in Oslo, Norway FastAPI vs Flask performance comparison Google Search is losing to Perplexity Two days in Dublin, Ireland Continuous integration ≠ Continuous delivery World's simplest project success heuristic London in 5 days It is hard to recommend Python in production Inflation, IRS, Credit cards, and Vendors Temu and the Chinese approach Things to do in Miami Florida Revenue vs Cost Axis Language learning as an adult The unanchored babies of the green card limbo Price variance in the United States A day in Louisville, Kentucky A surprisingly positive experience with Air India Unhospitable Airports Android: Don't use stale views USA = Union of Sales and Advertisement A day in Nashville, Tennessee Minimize Javascript in your codebase A day in Birmingham, Alabama In defense of ad-supported products Real vs artificial world The science behind Punjabi singers Hiking Mt. Fuji The Indian startup bubble is insane Repairing database on the fly for millions of users Book Summary: One up on Wall Street by Peter Lynch It is hard to recommend Google Cloud At the Prague airport Kyoto in three days Migrating from WordPress to Hugo Book summary: Sick Societies by Robert B. Edgerton Statistical outcomes require statistical games Illegal immigrants to Europe via Cairo Tokyo in three days Mobs are Status Games Writing Script matters as much as the spoken language Sri Lanka in 5 days LLMs: great for business but bad business Book Summary: Safe Haven by Mark Spitznagel Mac shortcut for typing Avagraha symbol On a bus with an asylum seeker Nicaragua in 5 days When to commit Generated code to version control Why I always buy a local SIM in a foreign country Use Makefile for Android Four days in Guadalajara, Mexico Android Navigation: Up vs Back Hotels vs Airbnb vs Hostels Currency issues in Argentina Abstractions should be deep not wide Some data on podcasting Always support compressed response in an API service A day in El Calafate - Patagonia, Argentina Hermetic docker images with Hugging Face machine learning models American Elections The sound of "ch" API services should always have usage Limits Hiking in El Chaltén - trekking capital of Argentina
FOSS (Free and Open Source Code) Licensing FAQ
Ashish Bhatia · 2011-01-24 · via ashishb.net

There are two choices while writing on this topic. One is to write a detailed and accurate port. The other is to write a short post. I preferred the second approach and had added appropriate links to dig further.

  1. Target Audience?
    • Someone who is planning to use FOSS, free and open-source code, as a building block for their software development.
    • Someone who wants to contribute to FOSS
    • Someone who wants to release source code of their project in public

A few theoretical questions** (can be skipped)

  1. What’s free software? As defined by Free Software Foundation, it’s software whose licensing conditions promise following four freedoms

    • Freedom 0: freedom to run the program for any purpose. Eg. Software restricted for educational use hinders this freedom like those distributed under Microsoft Academic Alliance
    • Freedom 1: freedom to study how the program works, and change it to make it do what you wish. Eg. Software whose licensing terms forbids reverse engineering curtails this freedom
    • Freedom 2: freedom to redistribute copies. Eg. Software like WinXP whose licensing terms forbids the copying of software and using it on multiple systems curtails this freedom.
    • Freedom 3: freedom to improve the program, and release your improvements and modified versions to the public. Eg. Freeware which can be downloaded for free of cost but modifying them and then distributing modified copy is a violation of license agreement, hence, violating the copyright law.
  2. What’s open-source software? Quite literally, it implies that the source code of the software is available. But, OSI has a stricter definition. There are minor differences in the free and open-source movement. For example, if a hardware lock preventing the execution of a modified software is considered a violation of user’s freedom. But it is believed that it does not violate the definition of being open-source. A detailed article here.

  3. What is FOSS (free and open-source software)? Though the open-source software is a subset of free software, the word FOSS (which is identical to Free) is used to refer to software which is both free and open-source. So, from a developer’s perspective, it is the same as Free software.

  4. But I thought free software has zero price? Zero price is not central to the philosophy of free software; it’s just the outcome of Freedom 2 and economics of demand-supply. It must be noted that there is zero price software which does not adhere to above freedom; they are called freeware.

  5. So, free software is more about “freedom” rather than “free (zero-price) stuff”? Yes

Now, the practical part

  1. What are the major free software licenses?
    1. GPL
    2. LGPL
    3. Apache
    4. BSD
    5. MIT
    6. Affero GPL Full drafts of these can be found here; I will highlight the important points below.
  2. What about creative commons? Do NOT use creative commons for code licensing. Creative Commons license is meant for artwork excluding software code. Therefore, it can still apply to images/text/videos which are a part of the software. For software code, use one of the above licenses instead.
  3. What about the Mozilla Public License (or any other license not in the above list)? I might write about them once, I have read them and understood them.

GPL

  1. What is GPL (GNU General Public License)? Any software released under GPL implies that it,

    1. The software guarantees all four freedom above. There is a minor issue read the next question for that.
    2. Software code will be provided (on request or with the executable) in usable, unobfuscated format. There was a debate on Slashdot about whether providing the right build environment is necessary and I think the answer is yes since not providing it violates Freedom 3)
    3. A work derived from GPL-licensed work must be licensed again under GPL. Any “patchwork” to original code is derived work; this includes WordPress themes. A work statically linked to a GPL licensed library will be considered derived work and hence must be distributed under GPL license. A work dynamically linked to a GPL licensed library is a grey area. FSF believes it’s derived work. Novell lawyer Matt Asay believes it is not. A work which includes GPL licensed header files containing only macro definitions and no inline code is not considered a derived work. See discussion on the android-platforms group.
  2. What if the company releases source-code (due to GPL license) and then locks down its hardware from running modified code? This is called TiVoization since a consumer electronics TiVo did this. GPLv3 includes a specific clause which implies that hardware lock, e.g., encryption keys/checksum matching cannot be applied to the products. More discussion here. Industrial products like cardiac pacemaker are an exception for safety reasons.

  3. Are there any other significant changes in GPLv3? Yes, Microsoft claimed that GNU/Linux violates its patents. Further, Microsoft and Novell made a deal with a controversial conclusion that Novell customers are protected from patent infringement by Microsoft. So, all others GNU/Linux users who are not Novell customers are not. GPLv3 prevents such future deals in two ways

    1. It dictates that anyone who distributes GPL v3-licensed code and provides a patent license to some group of recipients must automatically extend that license to all recipients. (So, non-Novell customers are protected as well).
    2. It includes a stipulation that an entity, like Novell, cannot distribute covered code if the entity enters into a deal with another software distributor that involves them paying that software distributor to not sue your customers. In this case, the ‘payment’ would be in the form of an undertaking not to litigate.
  4. What if I initially released my project under GPL and now wish to move to non-GPL license? You own right to modify license for “your” code. But any patches supplied by any 3rd party are still under GPL, so, you need their permission before releasing their patches as a part of your non-GPL code. Also, the previous version of your code is still available to 3rd parties, and they can fork and develop that.

LGPL

  1. What is LGPL (GNU Lesser General Public License)?
    1. It is more permissive that GNU GPL in the sense that an LGPL licensed library can be dynamically linked to by a non-LGPL(read proprietary) code.
    2. Any derived work must still be released with the clause that “modification and reverse engineer is allowed for personal use and debugging.” Some people confuse LGPL as library GPL, which is a license for open-sourcing their libraries. This assumption arises from its former name, Library GPL. GNU website states that if your library is similar in functionality to other proprietary libraries use LGPL, but if your library offers something unique use GPL.
  2. Can I write GPL code which uses LGPL library? Yes
  3. Can I write GPL code derived from LGPL library? Yes

Permissive Licenses

  1. What is BSD license? There are various versions of this license. The fundamental crux of all these is “any code released under this license can be used in any manner after providing accreditation to the original author of the code”. Contrast this with GPL, no release of source code for the derived work is necessary, no prevention of TiVoization and, it is silent about the issue of software patents. Due to the permissive nature of this license, the BSD based code is heavily used by major companies.

  2. Can a BSD licensed code be used to write proprietary (closed-source) software? Yes

  3. Can a BSD licensed code be used to write GPL licensed software? Yes. Do note that for the reverse case, everything has to be distributed under GPL and not BSD.

  4. What is the MIT license? Same as 2-clause BSD license(FreeBSD license).

  5. What is Apache license? Apache is similar to FreeBSD license except that it is,

    1. Legally more elaborate and,
    2. explicitly grants patent rights were necessary to operate, modify and, distribute the software.
  6. Can an Apache-licensed code be mixed with GPL licensed code? Not with GPLv2 but Yes with GPLv3 because of the patent clause. GPLv2 does not allow any additional restrictions while GPLv3 allows a patent retaliation clause. I know its all confusing, but that’s how it is. Further reading here.

Finally

  1. Can you summarize this? Use GPL if you wish to restrict the use of your work and thus, ensuring more freedom for users of derived work. Use LGPL if you are developing a library which replicates functionalities of a closed-source library. Use Apache/BSD/MIT if you wish to allow more extensive use of your work (but less freedom for users of derived work) Apache has a distinct advantage of being more legally explicit than BSD/MIT and patent indemnification clause. But as mentioned in the previous question, the same patent clause renders Apache incompatible with GPLv2. BSD/MIT have an advantage over Apache of being compatible with GPL. BSD/MIT licensed code can be included in GPL-licensed project. Also, they are easy to comprehend for a software developer without a lawyer — further reading here and here.

  2. What is Affero GPL? It is useful for remotely executed applications like web applications which interact with their users over the network, and binaries are not distributed. Consider a simple example. Bob releases a web CMS under GPL, John modifies it and uses it for its website, John is under no obligation to release source-code of his website. If Bob releases his CMS under Affero GPL, then John would have to provide a download button on his website for downloading the source code.

  3. What is dual-licensing (or more generically, multi-licensing)? Since all licenses are not compatible with each other, project owners can release their code under multiple-licenses simultaneously. Hence, the one who wants to use the code can choose the license as per his/her needs. E.g., jquery is dual-licensed under MIT and GPL)

  4. What is copyright? Creator of creative work, including artwork and software, has certain rights automatically granted to him/her due creation. These rights include the ability to sell his right to someone, sell copies of work while still retaining rights, allow someone to create derivative work for royalty, and impose further restrictions. More details here. All the licenses mentioned here are copyright licenses.

  5. What is copyleft? Copyleft is a category of copyright licenses which allow someone to create derivative work and distribute copies of the work while imposing restrictions on how derivative work can be re-distributed/re-used. Eg. If someone is stating that derivative work is allowed, then they cannot restrict the distribution of the derivative work. GPL and LGPL (both described below) are examples of strong and weak “copyleft” licenses, respectively. BSD and Apache are examples of non-copyleft free software licenses. The two questions on copyright and copyleft tare added in response to suggestion. More details here

Disclaimer:

  1. I am not a lawyer. This blog post is based on my understanding of the major open-source licenses and might have errors/omissions. In case, you might spot an error/omissions, please mention that in comments and I will correct that.