POST: Rapid increase in Source Available and AI-related licenses

[mjherzog]

We are seeing a significant increase in the number of new Source Available and AI-related licenses.

• Source Available licenses are not open source, but they are open source adjacent so detecting them accurately is important to avoid faux-open source. There is also a proliferation of so-called "additional use grants" for the Business Source License.
• AI-related licenses introduce new terminology and concepts that make it difficult to determine quickly how open they actually are.

With the sliding scale from open source to closed proprietary licenses it is also becoming more important to detect and report proprietary licenses.

In any case it is essential to detect these proliferating licenses in the wild - license scanning tools need to work beyond open source licenses to include most public licenses.

Use ScanCode and LicenseDB as an example of dealing with this challenge.

[DennisClark]

Once upon a time, you could look at some publicly-available software, quickly and accurately identify its overall license, and check your organization's guidelines (database, spreadsheet, document) to determine how quickly or how cautiously you might make use of that software for your own product development. This was a time when you could find most open source licenses on the OSI list (https://opensource.org/licenses) or the SPDX list (https://spdx.org/licenses/) or the ScanCode LicenseDB (https://scancode-licensedb.aboutcode.org/index.html) and you could generally go with the working assumption that a specific license text that you have previously reviewed is a close enough match to the license of the software you are now considering. That time is probably over.

New licenses, often with names that include the words "open", "community" or "public", are now appearing at a breakneck pace, almost daily. Many (most?) of them are not open source but resemble open source licenses in style and format. Currently it is not uncommon to see a license text that looks exactly like a BSD license, but with the crucial words "for non-commercial purposes" inserted into the otherwise standard text. One also sees license texts that closely resemble Apache 2.0 but with little modifications and insertions that change the terms enough that you need to read the entire text carefully. There are also many completely new licenses that begin with declarations of freely available code but then present you with a list of significant obligations and restrictions that are unique to that software license and which might require legal expertise to interpret. One also finds software projects that declare a license by a standard identifier (such as the SPDX short identifier) but then append an extra notice that significantly alters the actual terms that apply.

So your automated license detection tools and processes might be clever enough to distinguish the genuine standard licenses from the newer variants, but you cannot avoid the license compliance risks involved. In other words, unless you are certain to have found an exact match, you have to examine each license notice carefully. It is probably safe to conclude that this situation is slowing down the pace of free software adoption, in addition to generating an uncomfortable level of confusion and anxiety.

The motivations for the rapid increase in new custom licenses are impossible to define precisely, but one can observe the following patterns:

• An organization does not want its otherwise permissively-licensed software to be excessively exploited commercially, but still wants to maintain an "open" appearance.
• An organization wants to deflect attention from its controversial appropriation of copyrighted material into its LLM's without any attribution by insisting that users of its products comply with a long list of ethical guidelines.
• An organization welcomes engagement with an open community, but is very concerned that someone might use its software in a directly competitive manner.

There is no indication that the torrent of new kind-of-open licenses is going to diminish; there is no license authority to put brakes on this trend. The best we can do is to continue refining our tools and processes to keep up with ever-mutating license compliance requirements.

[DennisClark]

@pombredanne @mjherzog and anyone, comments and suggestions are welcome!