The 2023 report of the licenses in use by the biggest package managers highlights the need to educate developers on…
  • Daniel QuinnEnglish
    18•1 year ago

    This is really disappointing. I had hoped for a lot more representation for the AGPL and GPL.

    • @TootSweetEnglish
      9•1 year ago

      I’m glad to hear I’m not the only one who feels that way. I use GPL3.0 and AGPL3.0 exclusively. AGPL for anything that makes sense. Anything that’ll be used over a network, basically. And GPL for things that aren’t used over a network.

      There are things I wish in retrospect I’d made AGPL rather than GPL. But I think copyleft is a fuckin’ great thing that ought to be used more. For non-code works (3d-printable models, mostly), I also like the Creative Commons share alike licenses. I usually go for CC BY-SA. I’m fine with commercial use mostly as long as it’s only used in things that aren’t going to deprive the end user of the same rights that the seller got from me. And I very much want to encourage remixes/derivative works.

      • @[email protected]English
        4•1 year ago

        Whenever I’m started anything new, I just go AGPL without even thinking about it. If I later change my mind and think GPL or LGPL or BSD or something would be more appropriate later, I can always change it (though I’ve never found a need to), but you can’t really go the other way. If you start permissive, that’s just out there, forever.

  • @merthyr1831
    3•1 year ago

    I fundamentally distrust the language package repos with a high share of unlicensed libraries in their repositories. It’s a basic legal step for protecting the software supply chain and supports the open source community.

    Also, it feels like a sign of immaturity from a package repo to have many unlicensed packages since most serious maintainers see a license as an important step in declaring your software “ready” for distribution. You just can’t assume a package will be maintained if the contributors aren’t going to do these basic steps.

    Dart’s package manager actively penalises packages without a license file (at least when browsing on the website directory). Many languages, including those better at enforcing license declarations, would benefit from a similar feature.

    • @KellyEnglish
      3•1 year ago

      Zealot!

      In my heart I like the middle ground the MPL offers. Vitality at the file level feels like a compromise between letting people both have an obligation to the upstream and still maintain ownership of their additions.

      But if course by brain recognises that there is an insignificant population of projects using it and the community gravitates to the extremes