Investigating Whether and How Software Developers Understand Open Source Software Licensing

Daniel A. Almeida and Gail C. Murphy (University of British Columbia), Greg Wilson (DataCamp), and Mike Hoye (Mozilla Corporation)

Abstract. Soon.

Appendix. Real-world Cases Retrieved From StackExchange

Question #1: Help me choose an Open-Source license (link)
Codes: Specific Case, License Interaction
Summary: Question asks for help to select a license that fulfills a number of requirements. The author is implementing a library and wants to allow its use in other open source projects regardless of their licenses, but not in closed-source/commercial projects unless s/he grants written authorization. The proposed solution is dual licensing and answers suggest it isn't possible to fulfill all of the requirements.

Question #2: digital signature with specific itext version 4.2.0 (link)
Codes: Specific Case
Summary: The author wants to know if the iText library offers a certain feature in version 4.2 (instead of 5.0) because the latest version has been released under AGPL (according to its GitHub repository, they "moved to the AGPL to improve their ability to sell commercial licenses"). Version 4.2 was released under dual licensing (MPL/LGPL).

Question #3: Use default authentication and separate cloaking/impersonation in DCOM call (link)
Codes: Invalid
Summary: Author has a programming question and mentions that his project will be released under GPL/MPL as an incentive ("So your help will go GPL/MPL.").

Question #4: Override MapView Tile Source? (link)
Codes: Technical Detail
Summary: Author is looking for an Android component/library that overrides the MapView behaviour. The component cannot be based on GPL/LGPL. One of the answers suggests a couple of libraries that are under LGPL, but the author reiterates that he was trying to avoid anything under LGPL. The respondent clarifies to the author that it's possible to use LGPL libraries without making his code available. A second respondent goes further and explains that it's possible to use LGPL if there's a "suitable shared library mechanism", which is not the case for Android because the resulting application will be a single DEX (Dalvik Executable format) file.

Question #5: Mozilla Public License (MPL 2.0) vs Lesser GNU General Public License (LGPL 3.0) (link)
Codes: Technical Detail, License Interaction
Summary: The author wants to release a library as open source while making it possible for others to use it in proprietary/closed projects. He is considering either LGPL or MPL and identifies the type of linking as the main difference (static for MPL and dynamic for LGPL). He believes that LGPL imposes extra obstacles for packaging and that neither of them (LGPL or MPL) requires extensions of the software library to be released as open-source. His solution is: "With the help of the discussion in the accepted answer, I choose to stick to the MPL because of the popularity, freedom in linking and because it is an official, unmodified license."

Question #6: How to encode/decode video using C#? (link)
Codes: Technical Detail
Summary: Author is trying to find a better way of encoding/decoding video to improve a legacy application built around ffmpeg, an open-source library released under GPL or LGPL. The author seems to be confused about what he can or cannot do with the current code (co-workers made him believe that improvements/changes to the current code might result in violations of ffmpeg's license and possibly its dependencies' licenses as well.

Question #7: Fast asymmetric cypher for C++ application (link)
Codes: Technical Detail
Summary: Author is looking for an algorithm for asymmetric cryptography so that he can implement it himself OR a library that implements the algorithm. He needs to use static linking in his proprietary application, which means that the library cannot be under GPL or LGPL. He says that MIT/BSD or public domain code would be fine.

Question #8: GPL, LGPL licensed product in a comercial software [closed] (link)
Codes: License Interaction
Summary: Author is confused about what GPL, LGPL allows him to do. He wants to use a piece of software's documentation in his commercial product. It turns out that the product (processing.org) is released under GPL or LGPL, but its documentation is under Creative Commons.

Question #9: How to handle DWG files in C++ (link)
Codes: Technical Detail, License Interaction
Summary: Author asks for a library to handle a certain file type but specifies that it has to be under a permissive license (e.g, MIT or BSD) or a weak copyleft license that allows him to statically link (he mentions LGPL but isn't sure if it allows static linking).

Question #10: Restful Webservice Java, server side (link)
Codes: Component Request
Summary: Author is looking for a simple embedded servlet container and says it cannot be under GPL/LGPL.

Question #11: iText 2.1.7 in commercial Project (link)
Codes: Technical Detail, License Interaction
Summary: Author wants to use a library (iText, a Java PDF library) in his commercial project but isn't sure about how to proceed and what is allowed. The library used to be under MPL/LGPL until version Version 2.1.7, but is now under AGPL. He has questions regarding a number of different aspects, such as:
a) if the lib can be used in a commercial project;
b) if he can choose which license to use (MPL or LGPL);
c) if he has to ship only the license text or the library source code as well;
d) if he can put everything in an executable or if the iText should be in a separate jar file.

Question #12: Legal problem on lifting from open source libraries (link)
Codes: License Interaction, Technical Detail
Summary: Author used a number of libraries during prototyping development and now wants to reduce external dependencies. It turns out that he is heavily using a class (LazyInitializer) from the apache common-lang3 library (under Apache 2.0) to implement the Singleton Pattern and isn't sure about the licensing implications. He says that removing that dependency would implicate in the creation of more than 40 static inner private classes to implement the Singleton Pattern. Finally, he simply asks what are the implications of other major open source licenses (mentions MIT, GPL, LGPL, and BSD).

Question #13: Is there any free opensource (GNU GPL, LGPL etc) Comet Video Chat? (PHP) (link)
Codes: Component Request
Summary: Author is looking for an open-source/free Comet Video Chat implementation to use in his own CMS (Content Management System).

Question #14: Which licenses can I use? (link)
Codes: License Interaction, Technical Detail
Summary: Author understands that some licenses are not compatible with each other and is concerned with compatibility issues between GPL or LGPL and a license already in use in his project (MongoDB driver in Java released under AGPL 3). He wants to know which licenses are compatible if the project or libs in the project are under GPL, LGPL, and AGPL. Respondent explains AGPL license and possible license combinations. Another respondent suggests that LGPL and AGPL code are compatible provided that they're linked (doesn't specify if dynamic or static linking though).

Question #15: Qt License now after Digia bought it (link)
Codes: Invalid
Summary: Author doesn't know if a set of libraries (Qt platform) is still under the same license (LGPL) and is afraid of any changes that might prevent its use in commercial projects. Respondent quotes the company's website suggesting that both versions (one under LGPL and the other under a commercial license) will continue to be maintained.

Question #16: Can I use GPL, LGPL, MPL licensed packages with my application and make it closed source? (link)
Codes: Technical Detail, License Interaction
Summary: The author is not sure about the extent to which a program released under GPL affects the licensing of other software in the same "aggregate" [2] (a bundle of individual programs under different licenses). In this case, he mentions a company building closed-source applications mixed with/using BusyBox [1], an application released under GPL. The most accepted answer suggests that GPL allows the use of open and closed-source software in an aggregate as long as the GPL license is respected, i.e., the source code of the software under GPL is released. According to the respondent, GPL doesn't extend to other programs running on the same computer. It's possible to have closed-source software interacting/communicating with open-source code under GPL. "As a rule of thumb, the GPL reaches as far as the address space of the licensed code."

Question #17: Efficient Multiply/Divide of two 128-bit Integers on x86 (no 64-bit) (link)
Codes: Invalid
Summary: Author wants to know how to efficiently do something and cannot use GPL/LGPL code.

Question #18: How to read utf-16 file into utf-8 std::string line by line (link)
Codes: Invalid
Summary: Author wants to know how to do something and cannot use GPL/LGPL code.

Question #19: Which Licenses to ship within an NW.js - application? (link)
Codes: Generic
Summary: Author is using a library built on top of Chromium, which has a number of dependencies under different licenses. The author doesn't know what licensing information he has to provide to respect those dependencies' licenses.

Question #20: Requirements for using ffmpeg to create mpeg4 files in SaaS solution (link)
Codes: License Interaction, Technical Detail
Summary: Author is building a SaaS solution and is trying to avoid a commonly used library (ffmpeg) because it introduces "licensing hell" not only with GPL/LGPL, but because it is not available under a commercial license. He doesn't not how licensing applies to SaaS solutions since the code will not be distributed. A respondent clarifies that a few of the license's requirements don't seem to apply to his case (SaaS solution) based on his own interaction with the company that owns the library's rights.

Question #21: Software license with external libraries (link)
Codes: License Interaction, Technical Detail
Summary: The author wants to make a project open source and restrict its use to research/academia but isn't sure about the licensing implications because of the dependencies and its different licenses (e.g., BSD, GPL, LGPL). He suggests that by placing his code and the dependencies in different folders he would be able to license them differently. The accepted answer suggests that the author's work is derivative of a dependency under GPL, which restricts the licensing options of the whole project. Finally, the respondent suggests the use of a custom license IF the project isn't actually dependent on the GPL code.

Question #22: What license for code resembles CC BY-SA most? (link)
Codes: License Interaction / Technical Detail
Summary: Author wants to know/discuss what license would be the most similar to CC BY-SA when used on code. A respondent suggests that CC BY-SA is viral and describes the restrictions and [technical] details of GPL, LGPL, and MPL in comparison with CC BY-SA.

Question #23: GPL, LGPL or MPL for open source app with closed source Pro flavour (link)
Codes: License Interaction
Summary: Author has two versions of an Android app (free and "premium") and wants to make the free version open source while making it possible to build the next version of the app, which will be paid/premium, off of the free version. A respondent clarifies that the licensing imposes restrictions on others, not on the author if he is the sole author of the software. In this case, he is the copyright owner and not bound by any licenses when it comes to his own software.

Question #24: Choosing a licence for open source projects (link)
Codes: License Interaction, Specific Case
Summary: Author wants to clarify the restrictions imposed by each of the licenses (GPL, LGPL, and MPL) as he wants to make his open source projects available under certain conditions. He ends up deciding for a multi-license scheme, which makes his projects available under any of the three licenses above.

Question #25: How does trilicense (mpl,gpl,lgpl) work when you want to use it on public website (link)
Codes: Specific Case, License Interaction
Summary: Author isn't sure about the exact implications of using a trilicensing approach with MLP, GPL and LGPL in a specific scenario (components used on the backend of a website, i.e., software not distributed.

Question #26: Difference between free and open software?? (link)
Codes: Generic
Summary: Author wants to understand the difference between free and open software.

Question #27: Non-viral open source license but with clause for source disclosure? (link)
Codes: License Interaction
Summary: Author is trying to find a license that imposes very specific restrictions on a library he is planning to release. He proposes a licensing approach that is similar to GPL but non-viral/transitive. A respondent explains that his proposed scheme doesn't work and that GPL is viral because it needs to be to guarantee that its restrictions will be imposed on derivative projects.

Question #28: Which licenses are free for commercial use? (link)
Codes: Generic
Summary: Author wants to know which licenses allow him to use the licensed software components in commercial projects.

Question #29: Open Source license compatibility checker (link)
Codes: License Interaction
Summary: Author is looking for a tool for checking whether a combination of licenses is compatible because he is planning on building a number of tools and isn't sure about the licensing approach he should use to impose certain constraints.

Question #30: Writing proprietary and possibly closed source software while avoiding license infractions (link)
Codes: License Interaction, Technical Detail
Summary: Author needs help to understand how to use open source components without violating licenses' requirements, such as GPL and LGPL.

Question #31: GPL/LGPL/MPL non-code content license (link)
Codes: Technical Detail, Specific Case
Summary: Author wants to use a dictionary in his own closed-source commercial application. The dictionary is part of a plugin released under a tri-licensing approach (GPL/LGPL/MPL) and he isn't sure that he can use the dictionary in his application. To work around the licensing restriction, the author proposes writing a script that would use the plugin's dictionary to generate his own.

Question #32: LGPL and commerical application in PHP (link)
Codes: Specific Case, Technical Detail
Summary: The author wants to use non-code content (a text file) that is part of a plug-in under a tri-license (GPL, LGPL, MPL), but he doesn't understand how tri-licensing works or what/how exactly he can use the non-code content in his commercial, closed-source application.

Question #33: What does "Released under MIT and GPL license" mean? (link)
Codes: Specific Case, License Interaction
Summary: Author is confused about the correct interpretation of the licensing restrictions of a project licensed under MIT and GPL. He suggests that understanding tri-licensing (GPL, LGPL, MPL) is easy since one can choose any of the three licenses, but that a project "Released under MIT and GPL license" would require that one respects both licenses' requirements. He then explains that he doesn't know how to interpret the combination of the two licenses.

Question #34: Using jTransforms for a commercial (non-free) android application? (link)
Codes: Specific Case
Summary: The author wants to use a library that is licensed under MPL/LGPL/GPL (tri-license) in his commercial, closed-source application, but he doesn't understand what exactly the tri-licensing means and what constraints it imposes on him.

Question #35: Shipping unmodified open source applications with closed source apps (link)
Codes: Technical Detail, License Interaction
Summary: The author is working on an application that launches unmodified open source applications under a number of licenses (GPL, LGPL, MIT, and others) but doesn't want to release his own software as open source. He is particularly confused about GPL and what restrictions it would impose on his software (launcher).

A respondent suggests that it depends on how the launcher works. If it spawns the GPL code as a different process, then the launcher doesn't contain or incorporate the GPL code, which means it's not a problem. The author and respondent discuss what technical mechanisms can or cannot be used for inter-process communication while still respecting GPL's constraints.

Question #36: Do I need to include a copy of the GPL / LGPL to every copy of my program? (link)
Codes: Generic
Summary: The author wants to know if it's necessary to include a copy of the GNU GPL in every application that uses a GPL-licensed component (the alternative being a link to the license). A respondent suggests that it's necessary because the license might change, which means the link would point to a different version of that license.

Question #37: How to *detect* if open source software is used in a commercial product? (link)
Codes: Invalid
Summary: The author is interested in understanding how violations of a license can be detected, i.e., how can one detect that a commercial product is using an open source component in a way that violates its license's requirements.

Question #38: Signification of YOLO LICENSE (link)
Codes: Invalid
Summary: The author wants to understand the YOLO License.

Question #39: Is there a free library for morphological analysis of the German language? (link)
Codes: Component Request
Summary: The author is looking for a library and says it has to be a "free library (L)GPL, MPL, …".

Question #40: List of licenses of Debian components (link)
Codes: Invalid
Summary: The author is looking for a list of the licenses of Debian components.

Question #41: Can I use Mozilla Public License 1.1 (MPL) in a commercial app? (link)
Codes: License Interaction, Technical Detail
Summary: The author is using a component under MPL and isn't sure if it can be used in his commercial application and what implications it might have w.r.t to the licensing of his application. He explains that he uses .jar files and doesn't change/touch its source code.

Question #42: Changing the default header comment license in Xcode (link)
Codes: Invalid
Summary: The question is about the default behaviour of Xcode (adding a licensing header to files) and doesn't concern licensing.

Question #43: Open Source Graph Layout Library (link)
Codes: Component Request
Summary: The author is looking for an open source component under GPL, LGPL etc.

Question #44: Is there any free opensource (GNU GPL, LGPL etc) Comet Video Chat? (PHP) (link)
Codes: Component Request
Summary: Author is looking for a Comet Video Chat component under GPL or LGPL.

Question #45: Distributed issue tracker for git with usable Eclipse Mylyn support? (link)
Codes: Component Request
Summary: Author is looking for a component/software under GPL, LGPL, MIT, or BSD.

Question #46: Can I use LGPL libraries (client side javascript or server side jar) in my Commercial Web Apps? (link)
Codes: Technical Detail, License Interaction
Summary: The author is generally interested in how GPL/LGPL-licensed components can or cannot be used as part of Web application (server side, binary not distributed) because he wants to "protect" his own components. He also asks about the use GPL/LGPL components as a developer working on commercial applications. The accepted answer suggests that LGPL has been designed to allow for the component's use in closed-source apps. The respondent also says that apps running on servers (not distributed) are not affected by restrictions such as the ones GPL imposes.

Question #47: Cross-platform C++ sound library that isn't GPL/LGPL? (link)
Codes: Component Request
Summary: Author is looking for a component that is NOT under GPL/LGPL. He explicitly says that the component cannot rely on dependencies under GPL or LGPL.

Question #48: Encoding Android Camera Frames h263/h264 (link)
Codes: Component Request
Summary: Author is looking for a library and doesn't care if it's under GPL or LGPL.

Question #49: C Command-line interface - History function like in BASH (link)
Codes: Component Request
Summary: Author is looking for a platform independent component that is not under GPL/LGPL.

Question #50: Spell checker and dictionary licences (link)
Codes: Specific Case, License Interaction
Summary: The author is looking for a spell checker component that can be used in a commercial, closed-source application. He identifies three existing options, but one of them is under GPL/LGPL/MPL (tri-license), the other under GNU Free Documentation License, and the last one he has not been able to identify the license. He doesn't understand how the tri-licensing works and isn't confident that the second component, under GNU Free documentation License, can be used in a commercial product. The accepted answer clarifies that tri-licensing means that the author can choose one of the three licenses, not that the three licenses' constraints have to be respected simultaneously.

Question #51: HTML/CSS/JS build tool (link)
Codes: Component Request
Summary: Author is looking for a tool to build/minify HTML/CSS files and says that the tool cannot be under GPL/LGPL. Someone asks why not GPL/LGPL and the author says that he works for a large company and that GPL and LGPL are not allowed there.

Question #52: Show instructions based on the answers to a previous selection (link)
Codes: Invalid
Summary: Author has technical questions about how to create a website that will provide licensing instructions based on answers to a number of questions.

Question #53: QScintilla in PySide (link)
Codes: Component Request
Summary: Author is looking for an editor and it needs to be licensed under GPL or [preferably] LGPL.

Question #54: Android/PC GIS library wanted (link)
Codes: Component Request
Summary: Author is looking for a GIS library and says it needs to be "open source", i.e., under GPL/LGPL/MIT (preferably).

Question #55: How do I correctly ship licenses with my desktop app? (link)
Codes: Generic
Summary: Author is shipping software that uses a number of components under different licenses. He wants to know how to "ship the licenses". The accepted answer suggests an About page with an "attribution notice" and the licenses.

Question #56: How to rotate Document pages to come out landscape? (link)
Codes: Invalid
Summary: The author is using a library (iText) under MPL/LGPL and needs to know how to do something (rotate document pages).

Question #57: how to extract used licenses from a java project (link)
Codes: Invalid
Summary: Author is using a number of open source components and needs a way of extracting the list of licenses being used.

Question #58: Securing a License file with a backwards compatible signature (link)
Codes: Invalid
Summary: Question removed from Stack Overflow for reasons of moderation.

Question #59: Multi-platform MIDI Player library (link)
Codes: Component Request
Summary: Author is looking for a library not under GPL or LGPL.

Question #60: Using ckeditor or tinymce (link)
Codes: Specific Case, Technical Detail
Summary: Author wants to use components in his SaaS application and doesn't know if that's legal. One of the components is under GPL/LGPL/MPL (tri-license) and the other under LGPL. He mentions that there are free and paid "tiers". He also asks if it's legal if he makes the application open source under the MIT License.