HOWTO: Pick an open source license (part 1)

HOWTO: Pick an open source license (part 1)

Summary: If you write some code keep in mind that it's yours and you get to decide if, how, or under what circumstances, other people can use it. Let's say you've made the decision to release your code as "open source". What does that mean, what is an open source license, and how do you pick the right one? This question comes up all the time so I thought I'd write up a simple decision tree to try to explain the choices.

SHARE:

Update: Part 2 is now available. [More updates were made to this article on 22jun06 to clarify a few things based on reader comments. -ebb]

You've made the decision to release your code as "open source". Ok, what does that mean, what is an open source license, and how do you pick the right one? This question comes up all the time so I thought I'd write up a simple decision tree to try to explain the choices.Many people use GPL without realizing the implications or understanding the other options. This isn't legal advice, and I'm not a lawyer, and I'm probably over-simplifying some of the points, but I hope you find it helpful.

First of all, if you write some code, it's your code and you get to decide how other people can use it. Period. Nobody but you can say how your code can be used, either by putting restrictions on it or taking them off, without your permission. That's a very important point to keep in mind while reading this article. 

The second point to keep in mind is that nobody but you can even use your code unless you explicitly give them permission. Another way of saying this is that all source code is closed and proprietary and off limits until you, the author, open it. 

Note: The text of all the licenses mentioned here can be found at opensource.org

Decision 1: Do you want to relinquish any control over how your code is used and distributed?

If yes, then don't copyright it, and don't license it. Put it in the public domain, and you're done. This is a good choice for examples, templates, and other illustrative code where the whole point is that you want everybody to feel free to use what you've written. [Alert readers pointed out that "public domain" is is not a good choice because in many jurisdictions you can't give up your copyright. Use a liberal license like MIT/BSD instead. -22jun/ebb]  Example: code listings in a book or article.

If no, then Copyright the code (paste copyright notices all over it) and continue with decision 2. 

Hint: Just to make sure your intent is clear, either put in explicit copyright notices, or put in explicit notices that the code is in the public domain. Copyright is how you retain control. Without a copyright, there is no control. [Technically the notices might not be necessary but they don't hurt and are still recommended. -22jun/ebb]

Decision 2: Do you want to allow people to use your code in non open-source programs?

If yes, then continue to decision 3.

If no, then release your code under the GPL, a restrictive "free (libre) software" license that actively promotes user choice at the expense of direct commercial interests. For the most part, GPL'd code can only be used with other GPL'd code, and in fact if you start using [and distributing -22jun/ebb] some GPL code in a program you wrote then you either have to release your program under GPL as well or quit using that code. This is why GPL is sometimes described as "viral". Examples: Emacs,  Linux kernel.

Hint: Don't take this choice unless you really mean it. Many people use GPL without realizing the implications or understanding the other options, and thus lock the code away from a whole segment of potential users, so please read the rest of the choices first. 

Decision 3: If somebody uses your code in their program and sells their program for money, do you want some of that money?

If yes, then you have two choices. The first choice (3a) is not to release it as open source at all, i.e., use closed source and you're done. This would preclude anyone from using your code in free (no cost) packages. And it would only allow people to use your code in commercial programs if they came to your first and worked out a deal for a commercial license. Note that even if the source is "closed" you can give permission if you like for certain people to have access to the source and use it in limited ways. Example: Microsoft Windows, Sun Java (sort of).

The second choice (3b) is dual license. I'll talk about licenses more in a moment, but dual license just means you give permission for people to use your code under two or more licenses. You pick one license (probably GPL) for free (no cost) programs, and one for commercial ($$$) programs. This is a good choice if you're trying to make a living off licensing fees for the code itself. Examples: MySQL, JBoss, SleepyCat. Continue to decision 4.

If no, then give permission for others to use your code under one or more "commercial friendly" licenses. This is a good choice if you want your code to get into as many hands as possible and either you don't care about the money or you plan to make money in other ways, for example by selling your own programs that use the code or from consulting or support. Examples: Apache HTTPD, Eclipse, Firefox. Continue to decision 4.

Decision 4:  If somebody uses [and distributes -22jun/ebb] your code and improves it (fixes bugs or adds features) do you want to make them give you the improvements back so you can use them too?

If yes, then use a "reciprocal" license. Any modifications to your code need to be made available under the same licensing terms as your original code. This is useful if you're worried somebody will take your code and go off on their own private "fork". Examples: Eclipse (EPL), Solaris (CDDL), and Firefox (MPL). Done.

If no, then use a non-reciprocal license. Often times the people using your code will send back improvements anyway, especially if you have a history of frequent releases and they get tired of having to re-merge in their changes every time. This is the most wide open type of license so it will get you the most exposure and users, but it can also relegate the original writer(s) to the sidelines. Example: FreeBSD (BSD).  Done.

In a follow-up article I'll explain how the most commonly used open source licenses fall in the categories like "commercial friendly" and "reciprocal", and address any concerns raised by commenters. So whether you agree or disagree with my points above please give me some feedback in the talkback section.

[Note: this is just intended for informal, simplified, educational purposes. It is not a substitute for advice from a qualified legal professional. -22jun/ebb] 

Topic: Software Development

Ed Burnette

About Ed Burnette

Ed Burnette is a software industry veteran with more than 25 years of experience as a programmer, author, and speaker. He has written numerous technical articles and books, most recently "Hello, Android: Introducing Google's Mobile Development Platform" from the Pragmatic Programmers.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

36 comments
Log in or register to join the discussion
  • Correct me if I'm wrong

    but wouldn't using a dual license (GPL and proprietary) mean that you lose the benefit of community participation? Certainly anyone can take the GPL code and do what they wish with it, but you, the original coder, cannot take community contributions and put it under your proprietary license. Not without that contributer's permission, and I can't imagine someone giving permission without at least asking for a piece of the pie, and some may refuse altogether on principle alone.
    Michael Kelly
    • Depends on the committer agreement

      There are ways to solve this. One way is to require all the committers sign agreement to, say, assign you the copyright to any modifications so you can make all the licensing decisions.
      Ed Burnette
  • open source languages

    Last paragraph, it should be "the most commonly used open source *licenses*", right?
    chaves@...
    • Fixed, thanks

      The article has been corrected.
      Ed Burnette
  • Disagree with "hint"

    Thanks for writing about choosing a license.

    I must disagree with the anti-GPL tone. First of all, the GPL is very compatible with many commercial activities. One FAQ about the GPL is whether one *must* contribute back changes made to GPLed software. That is FALSE, *unless the modified software is redistributed*. So already that is already one error in this blog entry. For a far more careful review of licenses, please consult http://www.gnu.org/licenses/licenses.html . (Yeah, I know some of you hate GNU, but if you really hated them, why not try to embarrass them by finding a flaw in their content on licensing, for example.)

    One thing I like about the blog entry is the mention of a dual-license option. Imagine you developed some code that would be useful to, say, Microsoft. If you merely chose BSD, your blood, sweat, and tears are just taken. However, with GPL + proprietary, you are in the driver's seat and get the best of both worlds. The likes of Microsoft and Apple have been getting free rides for far too long! Stand up for yourselves!
    b3timmons
    • GPL MAY be safe to use...

      ... but you really need to understand the ramifications to know for sure.

      If you use GPL in your commercial system, be sure that you can discontinue the use if it turns out that your understanding of the licensing requirements were mistaken. Or hire a lawyer who's also a programmer. Or a programmer who's also a lawyer.

      For example: If you let someone use your software over the web, have you "distributed" it to them? GPL 2 says "no" (http://www.gnu.org/licenses/gpl-faq.html#UnreleasedMods), GPL 3 says "yes". What happens to you if some software changes the license version? And will a court uphold the GPL 3 interpretation? (Nobody can say for sure)

      So, as an IT-manager, GPL software in production software is banned as far as I am concerned. Special considerations apply - we use (commercial) Linux as an OS and I have no problems with GCC. But if Apache was GPL, we probably wouldn't use it.
      johannes@...
      • Nonsense

        Your reasoning makes no sense. If Apache was released under the GNU GPL why would you not use it?

        All that *might* be asked is that you make the sources available - and only *if* you had modified it.
        noahslater
        • For legal documents: Hard to interpret = bad

          > Your reasoning makes no sense. If Apache was
          > released under the GNU GPL why would you not use it?
          >
          > All that *might* be asked is that you make the
          > sources available - and only *if* you had modified it.

          The brief answer is that I don't want to have to go through the discussion with our lawyers to find out whether it is safe to use a piece of software that is lisenced under GPL.

          If you think using GPL'ed software in commercial software is "smooth sailing" you don't understand the license. There are safe situations, but in everything except the very straightforward cases, you have to understand more about contract and copyright law that most developers do to know what is safe and what isn't.
          johannes@...
          • Re: Hard to interpret = bad

            I agree. Lawyers tend to see the worst possible interpretation, just to be on the safe side. Ask one what "linking" means in the LGPL for example. And unfortunately the bigger your company is, the more you have to listen to the lawyers.
            Ed Burnette
    • "Anti-GPL tone"

      Is that kinda like your Anti-BSD tone?

      And I think the author was assuming distribution when talking about the GPL. And his comment below, where he mentioned lawyers and big business, is (right or wrong) how it really does work in many places.

      You, like many GPL advocates completely miss the point of the BSD license. The BSD license isn't right for everthing, but neither is the GPL.
      toadlife
  • Public Domain

    Personally, I would recommend against releasing software into the public domain. The legal ramifications are not 100 % clear. For example it might be possible that you at a later time can retroactively withdraw it from the public domain again. Other nations than the US may also have limitations on whether you can actually release something into the public domain (my country does). See http://en.wikipedia.org/wiki/Public_domain for gory details.

    The problem is: If I want to use software that has been released into the public domain, I probably need to be a lawyer to understand how to do it 100 % safely, or whether the author later can change his mind and make demands of me.

    Personally, I use the Creative Commons license for my work, as it is the license with the most through legal foundation. This means that you don't have to interpret law to understand what it means. With public license, you really should.
    johannes@...
    • Creative Commons?

      You refer to "the Creative Commons" licence. This indicates that you might be a little confused about matters. Creative Commons is a project that features many licences - one of them being GPL.

      You cannot licence anything with THE Creative Commons licence. So, which one do you use?
      noahslater
    • Debatable

      Thanks for the reference. It looks like there's disagreement about whether or not "public domain" is legally meaningful (see for example http://creativecommons.org/licenses/publicdomain/) but even for lawyers this seems like splitting hairs. If it's clear what the intent of the author is, then it would be difficult to imagine a judge or jury finding against that. Most of the weird cases they're talking about are times where a work accidentally went into the public domain and then the author or their estate tried to correct that mistake. But if you're really worried about that then an MIT/BSD style license could be used. I just think it's overkill, but I'm not a lawyer (thank goodness!).
      Ed Burnette
  • The GPL is about freedom - not locking people in

    From the article:

    "If yes, then use a "reciprocal" license. Any modifications to your code need to be made available under the same licensing terms as your original code."

    This is exactly what the GPL is about, and yet you ignore this fact and label exactly the same requirements levied by the GPL as restrictive and locking users in.
    noahslater
    • GPL is reciprocal, but

      It's true GPL is reciprocal in that it requires changes to be released back under the same license. However it's different than, say, EPL, in that EPL doesn't say anything about how the code that *uses* EPL'd code must be licensed.
      Ed Burnette
  • Reader beware!

    I am afraid this article is a poster child of why blogs should be taken with a large grain of salt.

    If the author is serious about helping anyone, I suggest he consult http://lwn.net/Articles/187669/ to see a few excellent critiques of his blog entry.

    Finally, it is tempting to give up and just consult a lawyer; personally, before doing that (the lazy and dumb response), I would educate myself on these important matters.
    b3timmons
    • Looks like they mostly agree with me

      I read the thread and most of the comments were positive. Here are two I liked particularly:

      maney writes:
      That audience is, on the record, likely to get in trouble if they use the GPL without carefully considering what it may oblige them to do down the road. OTOH, you could say that about *any* license they might use without proper consideration (and probably competent legal advice - if there's a serious flaw in this article it's that he didn't beat that drum).

      arcticwolf writes:
      Now, copyright has a "default deny" policy where (with some narrow exceptions) you are not allowed to do certain things (like copying the work in question) without permission from the copyright holder. The GPL, like any other license, thus does not restrict what you can do; rather, it gives you additional freedoms not automatically granted by copyright. You're free to accept the license or not, but if you don't, you only have the rights given to you by default by copyright law, which usually means you have no rights at all.
      Ed Burnette
      • Thanx for contributing b3timmons. After all....

        ...collaboration, so that we can all make more informed decisions is vital to the growth of all concerned. It's a good thing that not all of us are users of subversion, to get things done, or to try to get things done or ARE getting things done...I mean, well; I guess that would depend on what your motives and purpose are.

        (Inside joke-guess ya had to be there)
        http://subversion.tigris.org/
        http://svnbook.red-bean.com/
        http://metissian.com/projects/macosx/subversion/
        http://www.macdevcenter.com/pub/a/mac/2004/08/10/subversion.html
        http://www.developer.com/java/other/article.php/3499816
        http://www.collab.net/products/subversion/index.html
        http://www.onlamp.com/pub/a/onlamp/2002/10/31/subversion.html
        http://www.onlamp.com/pub/a/apache/2002/12/19/svn2.html
        http://www.red-bean.com/sussman/svn-anti-fud.html

        Wow, ok so I never knew subversion could be such a good thing; as long as it's this kind of subversion.
        yogeee
  • dual licence

    "The second choice (3b) is dual license... This is a good choice if you're trying to make a living off licensing fees for the code itself. Examples: MySQL, JBoss, SleepyCat"

    JBoss is not using a dual licencing scheme.

    JBoss software is out there for the community to use / embed / redistribute for free, unlike the "open source" hypocrites like MySQL and SleepyCat
    TheUglyOneWithTheJewels
    • JBoss

      You're right, JBoss shouldn't have been included in that list. I've corrected it.

      JBoss uses LGPL for most of their projects. Some companies are wary of LGPL because their lawyers are uncertain about what "linking" means (I work for such a company). However, JBoss goes out of their way to try to clarify that, see:
      http://www.jboss.org/company/aboutopensource
      http://jboss.com/pdf/Why_We_Use_the_LGPL.pdf

      Still, you'd probably need to get your own lawyer to look that over and make the decision. Sigh.
      Ed Burnette