Open Source License

Downloading code someone published and dropping it into a product feels so ordinary that for a long time nobody thought of it as something requiring permission.

The trouble starts with the gap between published and permitted. Publishing code does not give away the copyright in it. Copyright is the right an author has to stop other people from copying the expression they created, it appears automatically the moment the work exists, and there is no application to file. Nobody gets confused about this with an essay or a photograph, but code sits out in the open where you can read it, and being readable reads as being available. So people using published code were copying it without permission and had no idea that was the situation they were in.

The only way to get permission was to ask the author directly. You send an email asking whether the code can go into something you sell, and you wait. Ten libraries means ten emails, and one unanswered email stops the work where it stands.

An open source license writes the answer down ahead of time. The author puts "anyone may use this as long as these conditions are met" into a single document, posts it alongside the code, and from then on the person using it reads the document instead of writing a letter. That is why this term sits on the side of not causing an accident with somebody else's work, rather than the side of protecting what your own company owns.

A license is permission layered on top of copyright. Copyright blocks all copying by default, and the license adds an exception on top of that block: copy, modify and distribute this, as long as these conditions hold. Break a condition and the exception disappears, which puts you back at the original prohibition. That is why a license violation is more than a broken promise.

Conditions come in three broad kinds.

1. Attribution — keep the author's name and the text of the license somewhere in the product. This is the most common kind and the easiest to satisfy. An "open source notices" entry at the bottom of the settings screen with the list behind it usually covers it.
2. Disclosure — publish the source of whatever you build with this code, under the same conditions. It's the heaviest of the three, and the approach called copyleft lives here.
3. Restriction — don't put the author's trademark in your product name, or lose the permission entirely if you sue anyone over patents covering this code.

Real licenses mix the three, and by weight they fall into two groups. MIT, Apache 2.0 and BSD ask only for attribution, so code under them can go into something you sell while your own source stays closed. GPL and AGPL ask for disclosure too. Both groups travel under the same "open source" label, which is why grouping libraries without reading the label eventually means picking up a heavy one by mistake.

Even the heavy conditions have a defined trigger. The GPL disclosure obligation starts when a program containing that code goes out to someone else, so running it only on servers inside your own company never triggers it. AGPL is the version that closed that gap: reaching the software over the internet counts as receiving it. One line of AGPL code in a product sold over the web can put that product's source on the table.

Conditions attach at three moments: when you pull the code in, when you ship the product out, and when someone outside the company looks inside it.

1. Pulling it in — a file named LICENSE sits at the top of the repository where the code is published. The name shows on the front page of that space where the code and its history live, and the name alone tells you which of the two groups you're in.
2. Shipping it out — this is where attribution gets satisfied. In an app the list goes inside the settings screen, on the web behind a footer link. The screen has to be regenerated every time a package is added, and skipping that ships a product that is out of compliance.
3. Looking inside — enterprise deals under contract law, and investor due diligence, both ask for a written inventory of the third-party software in the product. Without one, someone starts reading code late in a deal, and anything carrying a disclosure condition found at that point moves the whole timeline. Building and maintaining that inventory is license compliance.

The reason counting by hand runs out quickly is arithmetic. Forty packages picked deliberately each drag in packages of their own, the final list passes a thousand without trouble, and nobody has read the licenses of the ones that came along for the ride.

"What's the license on this library? If it's MIT just add it, if it's GPL come get me first."

Permissive means proceed; a disclosure condition means find another route.

"This release added three packages — please regenerate the notices screen too."

The attribution screen has fallen behind the code it's supposed to describe.

"Due diligence wants the open source inventory. How long if we start it now?"

An admission that nobody has been maintaining the list, and from here it usually takes days.

At Pagedeck, Theo picks a library to build the table feature into the document editor. It fits the requirement exactly and it's under AGPL. Pagedeck sells over the web, so that code could put the product's source on the table, and Theo spends two extra weeks finding an alternative that asks only for attribution.

Six months later Grace is closing an enterprise contract and gets asked for the open source inventory. Theo's note about that decision and the notices screen are both there, so the document goes out the same day.

The most common reading is that published means free and free means use it however you like. Since downloading costs nothing, it's easy to feel there is no price attached. The price is simply collected in conditions instead of money, and ignoring the conditions is the same as taking something without paying for it. Left alone, a product missing one line of attribution runs for years until the day the author notices and shipping stops.

"It's internal, so nothing applies" is also only half right. The explanation that disclosure obligations don't trigger without distribution gets repeated until "internal" starts working as a blanket excuse. But internal tools get opened up to customers all the time, and the standard changes the moment they do. When the rule you used going in differs from the rule that applies in use, you end up re-reading years of code.