← posts

licenses are not vibes

oct 17, 2019


I used to treat licenses like the paperwork part of code. I would pick the one everybody else used, move on, and get back to the actual project. MIT felt friendly, GPL felt complicated, and Apache felt like something a company made a lawyer stand near. That was about as deep as I wanted to go.

The problem is that a license is not just the little text file you forget about after the repo is public. It decides who gets to keep the freedom later, after the code leaves your hands and gets wrapped in somebody else's product, build system, app store listing, or hosted service. That's the part developers, including me, like to skip because it turns a nice clean technical decision into a values decision.

Permissive licenses like MIT, ISC, and BSD are easy to like for good reasons. They are short, readable, and mostly say: keep the notice, don't sue me if it breaks, have fun. If I am publishing a tiny helper function or some throwaway tool, that might be exactly what I want. Take it, vendor it, ship it, close it, whatever. I don't need a ceremony around every scrap of code I release.

But that kind of freedom mostly belongs to the next developer in the chain. It lets them take the code private, bundle it into a product, hide the changes, and hand the actual user an executable with no source and no leverage. That is not a bug in the license; it is the bargain. Sometimes it's the right bargain, but it shouldn't be confused with some universal moral high ground called "freedom."

Copyleft makes a different bargain, and it is annoying on purpose. The GPL family says, roughly, that if you distribute your changed version, the next person gets the same rights you got. You can use it, study it, change it, and share it, but you don't get to be the last free person in the chain. That can feel restrictive when you are the one trying to ship something, and protective when you are the person receiving the thing, which is why both feelings are real to me.

I still think GPL code can be a pain. License compatibility and linking questions are real, and the difference between GPL, LGPL, and AGPL is not trivia if you are shipping software, embedding a library, or running a network service. I also understand why a lot of people hear "free software" and immediately think of Richard Stallman and all the baggage attached there. Fine; people are messy, and movements collect weird furniture.

Still, the mechanism itself is worth looking at without all the noise around it. Copyleft uses copyright against enclosure, taking the legal machinery that usually locks users out and pointing it the other way. That is a clever move whether or not you like the culture that grew around it.

The permissive side has its own lazy version too. A lot of projects are MIT because the generator made them MIT, or because the last project was MIT, or because nobody wanted to spend ten minutes thinking about what they were actually allowing. I have done that. It feels pragmatic, and sometimes it is, but sometimes it is just apathy wearing better clothes.

Apache 2.0 is where I land when I want permissive reuse but don't want to pretend patents are imaginary. It is longer and less cute than MIT because it says the patent part out loud: contributors grant patent rights, and that grant can terminate if someone turns around and starts patent litigation over the work. That sort of clause is boring until the exact moment it matters, which is true of most adult paperwork.

CC0 is the opposite temptation: just throw the whole thing into the public domain and be done with it. I get the instinct. Unfortunately software lives in a world with jurisdictions, fallback clauses, patents, liability, and other garbage that does not go away because the README sounds generous. The OSI still does not recommend CC0 for software, largely because of the patent language, and I think that is enough reason not to use it as a default.

So the way I think about it now is less "which license has the right vibe?" and more "what am I trying to preserve?" If I truly do not care where the code ends up, MIT or ISC is fine. If I want permissive reuse with a clearer patent story, Apache 2.0 is probably the boring correct answer. If downstream user freedom matters more than making life frictionless for the next developer in line, GPL or AGPL is doing something real.

None of this is legal advice. It is just the part of releasing code that feels optional until it suddenly is not. A license is a little constitution for your project after you stop watching it, so the one you choose should match what you actually mean.