Source Code Licenses
I think there is a critical lack of understanding about the implications of different source code licenses in the Flash and Flex world. As my company has grown, and we have tackled more critical projects for larger clients, I have had to educate myself and my team on this topic.
I think this is a hugely important topic, so I’ve devoted quite a lot of time and energy to research and synthesize information on some of the most popular source code licenses being used in the Flash community today. I would also encourage you to spread this information around, either by linking to this article from your blog, or by sharing its contents with your colleagues. Hopefully it helps developers sharing their code to choose appropriate licenses (I’m getting sick of seeing LGPL source code), and also help the community to use shared source code legally and appropriately.
While I have worked hard to research everything in this article, I am not a lawyer, or an expert on this topic, so I make no claims that it is accurate or correct. It is also written from the perspective of someone who releases free code, and runs a service oriented development shop. Implications may vary for product development.
Below you will find an overview of some of the most common open source licenses. I have tried to list them in order from most restrictive to most permissive.
Quick Links
| Intro | Implicit | GPL | LGPL | MPL | BSD | Apache | MIT | Public Domain | CC | Summary |
Implicit Copyright (no license specified)
| Commercial Use | Derivative Works | Attribution |
| No | No | Yes |
Overview
There is a general misunderstanding that any source code released without an explicit license is in the public domain (see below) and is free and clear to use. In fact, quite the opposite is true – any source code released without a license is afforded implicit protection under copyright law. This applies even if there is no copyright notice.
Implications
Without specific permission from the author, you cannot legally utilize unlicensed code in your projects. The enforceability of the publisher’s rights is somewhat unclear with regards to source code (especially you have significantly modified the source code prior to distribution), but it is better to be safe than sorry.
If you want to use publicly released code that does not have a license explicitly specified, I would encourage you to contact the developer and ask them to re-release the code under an MIT license.
More Information
GPL GNU General Public License
| Commercial Use | Derivative Works | Attribution |
| Yes, but ALL source code must be distributed under GPL. | Source and distribution | |
Overview
The GNU General Public License is a “viral” license, meaning that it must be applied to any source code that interacts with GPL libraries. According to the Free Software Foundation (FSF), this includes dynamically linked libraries.
Implications
You are free to use GPL libraries in commercial projects. However, if you do so ALL of the source code for your project must be made available under GPL to anyone “who comes into possession of a copy” of your project. This means that your client’s competitors could potentially take the code, and legally deploy it for themselves. Very few clients are going to agree to that.
Note that server-side code is an exception because the application is never in the possession of the end user. Exactly how GPL applies to web application built in Flash, which execute on the client machine, but aren’t installed software is a subject for much debate.
You are also required to display conspicuous copyright notices in your program, and provide the full text of the license with it. Exactly how this applies to web applications is unclear, but putting the notices and a link to the license text in the application’s about box would probably suffice.
More Information
LGPL GNU Lesser General Public License
| Commercial Use | Derivative Works | Attribution |
| Yes | Yes, but direct derivatives must be released under LGPL. Requirements are technically difficult to satisfy in AS3. | Source and distribution |
Overview
LGPL is very similar to GPL, with one major difference: It specifically allows you to dynamically link LGPL libraries into your project without having to release your source code under LGPL. Direct derivatives of the LGPL code, including modified versions or subclasses, must be released under LGPL.
Another requirement is that any LGPL libraries in your project must allow for reverse engineering, and you must allow the user to swap those libraries for newer versions.
Implications
While it is technically possible to dynamically link libraries in AS3, there is no easy mechanism to do it. Loading classes at runtime is easy, but compiling against a library without compiling it into your binary still requires some messing around.
Further, it is unclear how you would satisfy the requirement that a user be able to replace LGPL libraries in a web application.
You also have to be careful when subclassing any code covered by LGPL. Subclasses are considered direct derivatives and subject to LGPL, which means they must be dynamically linked in your project (otherwise your whole project will be subject to LGPL).
LGPL has effectively the same attribution implications as GPL. You must provide copyright notices and the text of the license, as well as information on obtaining the source code for the LGPL libraries.
More Information
MPL Mozilla Public License
| Commercial Use | Derivative Works | Attribution |
| Yes | Yes, but modifications to original code must be released under MPL. | Source and distribution |
Overview
MPL is a very permissive license. It allows commercial use and derivative works, and is very lenient in its definition of covered code. Only files that were modified in the original MPL libraries, or that contain code copied from such a library are required to be re-released under MPL. Unlike LGPL, there is no requirement for dynamic linking – libraries can be compiled into your project.
Implications
Besides releasing any modifications you make to the MPL libraries, the only important requirement is that you must include advice on where to get any MPL libraries in the project (in the about screen, for instance). As long as your client is okay with this condition, it should be no problem to utilize MPL code in a project.
More Information
BSD 3 & 4 clause versions
| Commercial Use | Derivative Works | Attribution |
| Yes | Yes | Source and documentation. Deprecated 4 clause version requires attribution in ALL marketing materials |
Overview
The BSD license is a very simple, permissive license. It allows you to use the source code however you’d like, requiring only that you include the copyright notice and license text in the covered source code files and in the documentation for your program.
An older 4 clause version of the license required all marketing materials for a program to include credit for the author of the BSD licensed libraries. This has since been rescinded, and it is unlikely you will find modern code libraries using the 4 clause version.
Implications
The attribution requirements are the only real implication of using source code covered under the BSD license. As long as it is the 3 clause version of the license, and your client is okay with the copyright notice and license text appearing in the covered source code, and in their documentation (this could probably be a document linked from the application’s about box), you should be fine.
You should be very careful using any libraries licensed under the 4 clause BSD license in commercial projects. Clients are unlikely to be happy if they need to include attribution in every banner ad or radio spot they run.
More Information
Apache License version 2.0
| Commercial Use | Derivative Works | Attribution |
| Yes | Yes | Source, and distribution if specified by licensor. |
Overview
The Apache License version 2.0 has similar conditions to the BSD license, but is more verbose and specific, covering a broader range of intellectual property issues. Source code under AL2 can be used for virtually any purpose, but you must retain all relevant IP, licensing, and attribution notices in the source code. You may also be required to display these notices in either a “NOTICE” file or in an appropriate location in your binary.
ASL2 is a popular license with the Cold Fusion community.
Implications
As with the BSD license, the implications of using AL2 libraries are mainly limited to the attribution requirements. You must retain the notices in the source code, and you may also have to display notices in either an accompanying NOTICE file, or in the about screen of your application. The latter is required only if a NOTICE text file has been included in the original distribution.
More Information
MIT (X11)
| Commercial Use | Derivative Works | Attribution |
| Yes | Yes | Source code only |
Overview
The MIT license is very simple and very permissive. It allows you to do whatever you want with the licensed code, except remove the license and copyright information.
Implications
Because the only requirement of the MIT license is to retain the header in the source code, there is generally no problem using MIT licensed code in commercial projects.
I release most of our publicly available libraries under MIT, and I encourage other developers to do the same.
More Information
Public Domain
| Commercial Use | Derivative Works | Attribution |
| Yes | Yes | No |
Overview
In order for a work to enter the public domain, the owner must explicitly dedicate the work to the public domain. Once they have done so, they release all rights to the work.
Implications
Work in the public domain is theoretically completely free of encumbrances. This is potentially qualified by the specific wording of the public domain dedication that the owner uses.
More Information
Creative Commons
| Commercial Use | Derivative Works | Attribution |
| Varies | Varies | Varies |
Overview
Creative Commons offers modular licenses that allow a developer to select the conditions that meet their needs. For example, I could create a license that allowed commercial use, derivative works, and did not require attribution. Or, I could create one that did not allow any commercial use or modifications, and required attribution. They also offer versions of GPL, LGPL, and BSD licenses, as well as a Public Domain Dedication.
One of the really nice things about Creative Commons licenses is that they include a human readable summary of each license in addition to the full legal text.
It is important to note that the “modular” Creative Commons licenses are not intended for use with software.
Implications
Dependent on the license used.
More Information
Summary
If “shared” source code does not have a license, it is covered by copyright law, and is very risky to use in commercial projects.
The GPL and LGPL licenses are quite restrictive, and it can be difficult or impossible to utilize code covered by these licenses in commercial projects. The former due to its viral terms, and the latter due to technical difficulties meeting its requirements.
The other licenses listed here are more permissive, and libraries covered by them should be usable in most situations. It mainly depends on your client’s tolerance for including copyright and license information in their source code, documentation, or compiled application.
The most important thing to remember is that regardless of the type of license public source code is released under, you have a responsibility to clear its use with your client prior to implementing it in a project. Hopefully this guide helps you to explain the implications of doing so to your client in a concise, easily understood manner.
Another thing to keep in mind is that it is always a good idea to carry out due diligence, and attempt to verify that whoever is releasing the source code under license has the right to do so. It is a little unclear what the exact implications are if you incorporate source code that was incorrectly released under one of the above licenses, but it’s unlikely to be good.
I would strongly encourage developers to release shared code under the MIT license. When I release source code, it’s generally to help other developers with their day to day work, not to impose painful restrictions or requirements. My goal is to encourage the free sharing of helpful code, not force it (as the GPL does). I always appreciate attribution, but understand it’s simply not possible on some projects.
I would also encourage developers to petition the owners of their favourite shared libraries to change their licensing to MIT, if they haven’t already.
Did I get something wrong? Do you have more information to add? Please let me know in the comments. I will happily update this article with more accurate information as it comes in.
The FAQ on the Creative Commons site has something very important to say about licensing software:
“Creative Commons licenses are not intended to apply to software. They should not be used for software.”
http://wiki.creativecommons.org/FAQ#Can_I_use_a_Creative_Commons_license_for_software.3F
Josh, you’re right. I have updated the article to include this information. Thanks!
Really interesting and useful since I didn’t know all that at all.
And the problem of the CC for software is also important… I’ll change some of my free licences now ! 🙂
Viva the MIT !
Apache 2.0 license is also used a lot so it might warrant a reference here.
Like Renaun, I’d like to see Apache Source License 2.0 included. It’s a very permissive license that is very commercial-use-friendly. I release all of my code under ASL2 and it’s what most open source projects use in the ColdFusion world these days.
Ditto on the Apache license – may be good to add to the list there.
Also, it may be good to note that the GPL’s restrictions don’t really apply when the software is conveyed over a computer network, as is typically the case with embedded Flash applications. This loophole is how web apps often get around the release source code requirement of the GPL. Instead, the AGPL should probably be used for people trying to GPL code that will be used in web applications, as it has an additional clause (13) specifically for this purpose.
Of course, since a SWF is downloaded and run client-side, I could be wrong on this, since I’m not sure this denotes “remote interaction over a computer network” as the AGPL specifies.
I’m surprised that Apache isn’t covered as it’s very common to see in the OS world.
All – I will do some research and add ASL2 later today or tomorrow. It’s slightly complex because of the different versions (1.0, 1.1 and 2.0).
Sean V. – good point, but my understanding is that Flash is covered by GPL because it executes on the client, as opposed to a web service which executes on the server but allows remote interaction. I could be wrong though.
Added the AL2 license. Let me know if there’s any inaccuracies.
very nice coverage of the different license, specially the part about the attribution that most if not everyone forgot.
But I don’t agree when you encourage people to pick MIT, I feel like you’re saying “pick MIT because commercial projects can not be bothered with the implication of the other licenses”, but maybe I understood that in the wrong way.
The choice of a license is personnal, even the GPL (which is not my favorite) has it uses.
Not to launch a big debate about that, but after all commercial projects credits photography, credits music, etc.
so if the project use an open source license and that implicate to put a credit in an about box, I think it’s just fairplay.
Also for the part “I always appreciate attribution, but understand it’s simply not possible on some projects.”, well if a commercial project really can not put attribution in their credits they still can contact the open source project author(s) and ask them a commercial license.
The GPL’s ‘restrictions’, or ‘copyleft’, only applies when you distribute the application/code. Since this is a AS3/Flash related article, that aspect of the license doesn’t make much difference, because Flash apps run on the client, and thus the code is always distributed. But you could definitely use GPL-ed software in a server farm or whatever, without having to open up any of your application’s code. That’s how Google, Yahoo! etc got big, using open source software will low cost hardware to scale their apps into the millions of users. You wrote:
“You are free to use GPL libraries in commercial projects. However, if you do so you must release ALL of the source code for the project under GPL, and make it available to the public. ”
This is a little vague because commercial projects can use GPL libraries without releasing ALL of the source code, as long as the app’s byte-code stays on their server farm. I’d change it into something like:
“You are free to use GPL libraries in commercial projects. However, if your application is distributed publicly you must release ALL of the source code for the project under GPL, and make it available to the public. ”
Thanks for writing this article, I’ve also had to scrape all that legal info from the web once, and I wish this article would’ve been around at the time to save me a lot of time.
zwetan,
Definitely. Everyone has to decide the best license for their work.
For significant libraries (large, or especially valuable), I agree that attribution is a small thing to ask, and if it isn’t possible then the user can negotiate for a commercial license.
For less significant libraries (which comprise the bulk of shared code in the Flash community), I think MIT is the best license. It increases the value of the code, by reducing the barrier to use it. Many clients simply can not or will not allow attribution in their projects, and with smaller libraries negotiating a commercial library is impractical. Legal fees alone can run into the thousands, not to mention the time required by both sides. Recreating the library from scratch becomes the best option (which is not a very good option at all).
For me, I tend to either release my code unrestricted under MIT, or else only release it commercially. If people can give me a credit in their projects, I appreciate it. If not, I’m just happy that I was able to help them and contribute to the community. In our connected world, most of the promotional value of releasing code comes not from appearing in an application’s about box, but from the actual act of releasing it on your site. For instance, I’ve never gotten any work from being in the Flash IDE credits, but I’ve definitely picked up projects from releasing code freely.
Cheers.
Thijs,
Yes, as you mentioned, I’m writing this from a Flash / Flex perspective, so the binary is pretty much always distributed. I’ll see if I can tweak that paragraph to be more clear, without overcomplicating the core message.
Grant,
Thanks for the overview of these licences, it’s really helpful.
One thing to note about the GPL. It does NOT force you to release the code to the public. It only states that if you use a GPL library, the derivative work must follow the GPL too. The implication is that people to whom the derivative work is DISTRIBUTED to, must be able to request and obtain the source code.
This means that for commercial projects meant for intranet, there is no issue (provided you are OK to distribute your source code to your own client of course). The public never even knows of the derivative work.
For publicly accessible work, the question of whether the source must be released publicly or not, depends solely on the interpretation of DISTRIBUTION. Indeed, the GPL (at least up to v2), doesn’t constaint you on where the software runs (either client or server) BUT it makes the distinction on the DISTRIBUTION of the derivative work. When you release a desktop software, you are clearly distributing an executable to your recipients. For commercial web projects you distributed the project to your client, and they installed it to their servers, they are entitled to the source. However When the users are accessing the site, even though they are running swf locally, were they being distributed a copy of the derivative work? I think it’s up for debate.
In my opinion, the users of site are being provided with an online service. The act of downloading part of the app to run locally does not necessarily constitute distribution of the project. Well, this is where I state that, just like you, I am not a lawyer, so I may be conpletely wrong. Just that I believe the situation for web projects using GPL libs is not as clear cut as it seems.
Tim.
Hey Grant,
I just wanted to commend you on a great post and the recommendation of releasing code under the MIT. One thing that I love about the flash community is the willingness to use MIT licenses fairly frequently (Papervision is a great example). It’s often frustrating when I’m working on a project in a different environment/language where most of the code that is released has ridiculous/unnecessary limitations applied (I recently was working on a non-commercial project that I was trying to get out quickly where there was code available that would have worked great for me, but due to the limitations imposed, I had to end up creating something myself). When I release code, I typically use MIT or just put it in the public domain.
I think when source code is released without any encumbrances it helps the community grow because people are free to do what they need to do with the code. Basically, I just wanted to say thanks for a great post and support the MIT recommendation.
Timothy,
You’re correct about the source code distribution – I was only thinking of it as it applied to our regular public facing projects. I’ve updated that section to reflect this. I also reworded it to indicate that how the GPL is applied to web apps is a subject for debate.
I think it would be very easy to interpret the GPL to apply to web apps. After all, the user does have possession of the application (in their cache), and it is executing on their machine. Any user could also more permanently save the SWF on their system. It doesn’t really matter whether you intended for them to do so, as license states you must provide GPL source to “anyone who comes into possession of a copy” of your application, without qualifying how they did so.
Grant,
thanks for your clarity :), you’re right it mostly depends on the size and/or how much valuable/significant the library is, so yes for the bulk of shared code MIT should be favoured.
personally, I have a tendancy to pick the MPL but most of the OSS project I work on are a bit consequent (that does not necessary mean significant ;), for the rest like code in forums/blogs/groups/etc. it’s either MIT or public domain.
The flash community is strong (in numbers) but imho still “young” in the usage of license and release of code, I really hope your post will help moving the community forward.
from the top of my head the “bad” thing we can see frequently are
* people publish code on a blog, no license specified
problem: fall under implicit copyright
* people pick the CC to license their code
problem: CC is good for text and documentation, not code
* people does not use simple service as google code hosting (or sourceforge or others)
problem: people does not realize that open source code need to be maintained to be valuable
* people develop the same functionalities in N different projects
problem: this fragment the efforts of devs, instead of having 4 devs working together on a shared project you got 4 projects with 1 dev solving the same problems in parallel (AS3 3D libraries for ex)
ok it’s not that bad, but maybe more articles and use cases could help the community in the log run.
cheers.
Thanks for this. A really useful article. I have often wondered about the basic differences between each license.
Thanks for a very clear article about something that might be tricky to grasp without reading for hours and hours.
I as wondering how it works if, say I found a piece of GPL-licensed code on a blog, and instead of using the code directly, I use similar concepts learned from reading that piece of code. Would this force me to use the GPL as well, or does that make me the copyright owner of the code?
Basically, if I rewrite the code, using a slightly different syntax but the same functionality. (kind of what i did with my homework in the 4th grade 😉 )
Bob,
Again, I’m not a lawyer, but my understanding is that copyright only applies to specific code, not to functionality. I believe the courts also realize code is a structured machine language, and similar functionality will result in similar code. To prove a violation of copyright for code, you need to show that it is substantially the same code, not just similar code or the same functionality.
I wasn’t able to find a good reference to confirm this though.
Hi Grant, All,
Nice article.
I normally release my code under MIT, but the Google Code project for SemanticFlash.org[1] was created using AL2. ( I have people working on my name for this kind of administrative stuff ).
At the moment I thought that it was OK, but now that I read this post I’m thinking that maybe even the source code comments may turn down some people.
What do you think. Should I stick to AL2 or try to switch to MIT?
I guess the switch might be complicated ( googlecode-wise ) but better to do it now as there are no pub releases yet.
Thanks,
Aldo
[1] http://www.semanticflash.org/
Grant, you are slightly wrong still on GPL…
> However, if you do so ALL of the source code for your project must be made available under GPL to anyone “who comes into possession of a copy” of your project.
You only need make your source available (and under GPL) if you *modify* the GPL’ed code.
Therefore if you make use of a GPL’ed class, its fine not to release the source for your app so long as you dont modify the GPL’ed class.
Even if you modified the class in question, it would only be that part of your application you would need to make available as source – eg the modified GPL’ed code.
All said, good effort Grant at getting this all down in one place.
Aldo, AL2 is fine, particularly if you don’t include a NOTICES file. I think requiring that the copyright and license are maintained in the source code is completely reasonable.
Grant, I was just highlighting your misunderstanding of the GPL, a common misconception.
Jethro,
I’m fairly certain you’re mistaken. Utilizing a GPL library in your program makes it a covered work, because it is a “work based on the program”. This is specifically dealt with in the GPL FAQ here:
http://www.fsf.org/licensing/licenses/gpl-faq.html#IfLibraryIsGPL
This one, and the following few also deal with it:
http://www.fsf.org/licensing/licenses/gpl-faq.html#LinkingWithGPL
If you can provide evidence to the contrary, I’d be happy to check it.
Grant, its very muddy!
A very good article is at:
http://blog.milkingthegnu.org/2008/04/gpl-for-dummies.html
It is very worth noting that many of these licenses are specifically focused on how code or software is distributed and many do not cover models where the code is distributed over the network and then run in the client (i.e. browser). O’Rielly (see http://radar.oreilly.com/archives/2006/08/open-source-licenses-are-obsol.html) has been talking about this for awhile so it might be worth updating your chart to focus specifically on licenses that do cover ‘Web 2.0’ models.
Grant,
Thank you for the informative post, good summary. It’s something that is painful to wade through, and I had recently been taking to putting a Creative Common Attribution licence in my headers ( http://creativecommons.org/licenses/by/3.0/ ) – which is apparently not appropriate?
It sounds like the MIT license is essentially what I was looking for – I want people to be able to use and remix and redistribute the work freely that I release, as long as the headers for attribution are kept intact – which CCA seemed to satisfy to my limited legal knowledge.
And yes, seeing GPL on small libraries or classes is something that can be a bit bothersome if you want to use it in developing a project for a client, since my understanding was in line with your summary. And clients aren’t usually too keen on having to distribute all of the source code they paid you to develop simply because you used a 30 line class from someone else, which means I have to reinvent the wheel rather than just keep attribution intact.
Slightly off topic, but where do people turn for a suitable commercial license for their code, ie code that that is meant to incur a license fee to be used? Is the only way to deal with that a trip to a software lawyer/specialist or are these types of licenses also available ‘off the shelf’ in a similar fashion to the open source licenses?
Just to be clear: I do release a lot of (free) code into the public domain myself, but I struggle with the agreements around commercial licenses much more…
What about:
Open Software License 3.0 (OSL 3.0)
http://www.opensource.org/licenses/osl-3.0.php
Academic Free License 3.0 (AFL 3.0)
http://www.opensource.org/licenses/afl-3.0.php
especially with respect to the GPL and LGPL, respectively?
First off, I’m thrilled that I found this article. Super helpful — thanks Grant!
Second, here’s a scenario I’m wondering about: Lets say I have a GPL library of code that I use to create a swf A. I’m happy to release that bit of code open source.
But now lets say I want to then load that swf A into swf B. swf A isn’t required for swf B to run, though you would get a degraded experience (no fancy effects, for example). Would I have to release the code for swf B under GPL?
Thanks!
Thanks for the great info. I was curious with the coming Air 2.0 and ability to call native applications. If you compile a native executable like FFmpeg, then after installation of the Air app you download the GPLed binary and make calls to it via the native process, are you avoiding the GPL requiring you to release your source code. From the GPL FAQ it seems like this would be the case: http://www.gnu.org/licenses/gpl-faq.html#NFUseGPLPlugins
Just curious if that’s how others see it or if there are any issues with this?
Hello,
I would like to qoute from the LGPL 3.0 license, then I would like to ask help to interpret it.
Quote
“An “Application” is any work that makes use of an interface provided by the Library, but which is not otherwise based on the Library. Defining a subclass of a class defined by the Library is deemed a mode of using an interface provided by the Library.”
As far as I can understand that part of the license subclasses (which extend LGPL-licensed classes) and classes (which implement LGPL-licensed interfaces) don’t have to be LGPL-licensed.
Using an interface provided by the Library means (for me):
– Instantiating an LGPL-licensed class, calling it’s method, using it’s public variables.
– Calling static method of an LGPL-licensed class.
– Using static constants of an LGPL-licensed class.
* If that’s what they mean when they talk about “use of an interface provided by the Library”, then the Application can be licensed using another type of license (BSD, MIT, propietary or commercial, etc.) Right?
And subclassing is “deemed a mode of using an interface provided by the Library”.
And if * is true, then subclasses can be licensed using another type of license (BSD, MIT, propietary or commercial, etc.), too, and not LGPL. (Of course… Nothing prevents you to use LGPL license. :))
And dear friends,
I don’t want to fan up the fire. I only want to understand LGPL. I hope you can help me.
Thanks in advance,
Laszlo Sas
thanks a lot for the nice wrap-up 🙂
Wow! Wow i’m never see information like this about licenses. thanks for this compilation.
I want to publish this information, but translated to spanish?
Can I do it?
Thanks!
Hi there, just wanted to say, I enjoyed this post.
It was practical. Keep on posting!
Good blog post. I absolutely love this website.
Stick with it!
my web site; agencja reklamowa Krapkowice