« Back to blog

Licenses aren't shackles, they're nutrition facts

In an ideal world, everything would be unlicensed, and the following would be moot. Oh well.

I agree very much with the sentiment expressed by the Unlicense. I've avoided putting anything code-related under GPL and the like for this very reason (and I unlicense/uncopyright anything where I can and where appropriate). The complexities of licensing are often frustrating, to put it mildly. The lack of native ZFS in Linux is a perfect example. Still, the license has a valuable function that the unlicense approach doesn't really formally allow for.

The inclusion of the license notice matters when you redistribute software, which with Web applications is far less common than just implementing the software. Assuming the license notices are properly included, they create a 'chain of custody,' so to speak, through redistributions. In this way, the license is a formal way to acknowledge and track usage of code.

For example, webapp FooCMS includes package Bar, but doesn't mention that usage anywhere because package Bar is unlicensed. There is no included way for the users of FooCMS to know package Bar is in there, short of digging into the code itself. A security hole is found in Bar, but the author of FooCMS has discontinued working on it. There could be a patch to fix Bar, but it doesn't matter because it won't be put into FooCMS. Consequently, anyone using FooCMS but unaware of its inclusion of Bar will continue to use the insecure version of Bar. If FooCMS clearly stated that it made use of Bar, then upon becoming aware of the hole in Bar, the users of FooCMS could apply the patch to their copies of it.

(Granted, this scenario isn't a frequent occurrence, but something like it could happen. Anyone who is using RSA-786 and doesn't know it is potentially in trouble.)

This all is more an argument for proper acknowledgement of code for the sake of knowing what is where; the license is just the mechanism for doing so. Versions are instrumental, as well. Yes, licenses are not always followed to the letter, and most people wouldn't bother enforcing anything. Also, many people gladly put badges representing everything they use on their projects, even when they don't have to or it's not entirely appropriate. (Guilty as charged.) Still, the license functions as a reminder to keep track of what code is used where. In an ideal world, there would never be any need to keep track of this, because the code would be perfect and never have any problems. If only…

I don't really care if people use my stuff and redistribute it without a prominent and complete license notice. I just don't want people to be stuck using an inferior version of my work simply because they don't know they're using it and nobody else is keeping up with it. It's for the users, not the author; think of the license as "nutrition facts" for code. Permissive licenses, such as the MIT license or the zlib license, aren't much more than public domain + acknowledgement, and are basically suitable for this. Unfortunately, they do have the forceful, negative language that's not much fun. Perhaps a 'friendly reminder' wording would be more appropriate — WTFPL + a good idea:

0. You just DO WHAT THE FUCK YOU WANT TO, but don't forget that code isn't supposed to be like mystery meat.