Consider using a GPL-compatible license about js-csp

[jlongster]

I just realized that this is the EPL. Unfortunately that is also incompatible with Mozilla's license MPL (so I am told). This means I can never use it within Firefox :( which won't happen soon, but there's a chance I might convince my teammates at some point to. I'd be in favor of switching licenses as well to something like MIT or BSD.

[Waquo]

You invested so much time into a library and never looked at the license? Have you noticed mori is also published under the EPL? That's the real reason immutable-js is such a godsend, IMHO.

A permissive license like the MIT license would also be my first choice for a library with such a wide range of possible applications as js-csp, ideally it would be licensed in such a way that it could be used by anyone.

If a license with a patent grant clause is preferred, both the MPL 2.0 and Apache License 2.0 are good choices, as pointed out by the Mozilla Foundation: https://www.mozilla.org/MPL/license-policy.html

[ubolonton]

I know almost nothing about licensing :( Where can I more about the differences between licenses and how to best choose one?
How about the multiple-license approach? Is that a good choice?

[bitmage]

I like the overview presented on this site:

http://choosealicense.com/licenses/

There's more information here, including compatibilities:

http://en.wikipedia.org/wiki/Comparison_of_free_and_open-source_software_licenses

Most of what I see in the Node community is MIT. Here's a graph of the larger ecosystem:

http://www.blackducksoftware.com/resources/data/top-20-open-source-licenses

[Waquo]

Github has some advice:
http://choosealicense.com/
http://choosealicense.com/licenses/

I guess the first question to ask is: Are you afraid of your code getting stolen, meaning someone else taking the code (or parts thereof) and using it without contributing anything back?
If yes, you should use a license with copyleft restrictions. The GPL is too strong for a library like js-csp, although the LGPL might work.

On the other hand, restrictions mean that some people will not be able to follow the license, and not be allowed to use your library, if this is something you want to avoid, lean towards more permissive licenses.

Using multiple licenses is generally avoided, more licenses just means more hassle. I've never seen it done unless there were legacy reasons that made it necessary to continue using a license that was already in use but also use a new license.

I think the MIT license is the best simple, permissive "use my code, use it everywhere, do with it what you want"-kind of license. You don't get to be JQuery if you put a lot of restrictions on how people are allowed to use your code (although you can go in the opposite direction and be Wordpress). It should also be noted that the MIT license is compatible with every other open source license I know. It is a really good way to avoid any sort of situation where another open source project might have to say that they can't use js-csp because their license is not compatible with your license.

The Apache License 2.0 is similar license, but with one major difference: it has a patent grant clause. Some people (such as the Mozilla Foundation) consider this a must, although most open source projects use licenses without one and are fine.
This does complicate license-compatibility a bit, though. For example, the GPL v2 is not considered compatible with the Apache License 2.0, whereas the GPL v3 is. Most software (like Wordpress) using the GPL is licensed under the "GPL v2 (or later)" and works fine with the Apache License 2.0

The MPL 2.0 strikes a compromise that I like (that is not well-explained on choosealicense.com):
On the one hand, it does have a patent grant clause and a wee bit of copyleft thrown in, on the other hand it is designed to get out of the way and be compatible with other licenses.
For the one big case where that is complicated, namely the GPL, the license basically says that if you're using me together with the GPL somehow, ignore what I say and do what the GPL says. Other than being an exact subset of the GPL, that appears to be the only way for a license to be GPL-compatible.

I don't know why the MPL 2.0 would be incompatible with the EPL, I dont know enough about the EPL.

[jlongster]

You invested so much time into a library and never looked at the license?

I invested time into the concept; honestly the library itself is not that large, worst case if I wanted to use it within Firefox we'd re-implement it. More important to me that CSP is known among JS, and this library was an awesome implementation regardless of license.

About MPL, I don't know why it's incompatible with EPL but one of our guys informed about licenses said so. There is debate about it though. I know mori is EPL and we've talked with them to re-license it and they are willing but would take a bit of work and since we don't have an immediate need it hasn't been done yet.

If you aren't that interested in licensing this, I'd say MIT or BSD are the best bets. They are pretty much "do whatever you want".

[ubolonton]

Thanks guys, I changed it to MIT.

[Waquo]

Nice!