There is a moment that arrives in nearly every sizable project sooner or later. Someone — usually a lawyer or a nervous procurement officer — asks: “What licence should this actually carry?"

Until then everything had gone beautifully. Code written, tests green, repository pushed. And suddenly people are arguing about copyleft, patent clauses and derivative works as if everything depended on it.

In a certain sense, everything does.

Licences are not formalities. They are the rules of engagement under which software exists. Whoever ignores them plays anyway — by rules chosen by somebody else.

Why there are so many licences

The short answer: Because free software had two movements that were never quite the same.

On one side stood Richard Stallman and the Free Software Foundation, founded in 1985, with a clear ethical stance: software that cannot be studied, modified and redistributed strips its users of fundamental freedoms. From this emerged the GPL — strong copyleft, infectious, uncompromising.

On the other side stood the pragmatists of the Berkeley Unix tradition and later the Open Source Initiative (OSI, 1998), who regarded free software less as a moral duty than as an efficient development model. From this came the permissive licences — MIT, BSD — short, liberal, friendly to commercialisation.

Between these poles a spectrum formed. Added to the mix came lawyers, corporate interests, patents, compatibility headaches and the perennial urge to reinvent the wheel. Today SPDX lists more than three hundred valid licence identifiers. Nobody knows them all. Nobody has to. But everyone should know the important ones.

Two families, one underlying question

At heart every licence answers the same question: What may someone else do with my code — and what must they give back for it?

Permissive licences release almost everything. Use, modify, sell, embed in proprietary products — as long as my name remains in the copyright notice. Give me credit, keep the rest.

Copyleft licences instead demand reciprocity. Anyone who modifies my code and redistributes it must release their versions under the same licence. What you received, you pass on.

Weak copyleft licences sit between these positions: they infect only the library, not the program that consumes it. A compromise that protects library authors without alienating consumers.

With this grid the familiar licences fall neatly into place.

The licences worth knowing

MIT. The shortest serious licence in existence. Around 170 words. Permits virtually anything, demands only the copyright notice. React, Ruby on Rails, jQuery, Kubernetes client libraries — all MIT. Whoever wants maximal adoption chooses MIT.

BSD. Exists in three relevant variants. The 2-clause form is effectively equivalent to MIT. The 3-clause form additionally forbids using the author’s name to advertise derivatives. The historical 4-clause variant demanded acknowledgement in any product advertising — which produced absurd copyright notices across hundreds of dependencies and for a long time made BSD code unusable inside GPL projects. FreeBSD, nginx, PostgreSQL use BSD variants.

Apache 2.0. The grown-up member of the permissive family. Published in 2004, it extends MIT and BSD with three things that matter in practice: an explicit patent grant (any contributor grants users their patents), a retaliation clause (anyone litigating over patents forfeits their rights) and maintenance of a NOTICE file for attributions. Apache Kafka, the Kubernetes core, TensorFlow are Apache 2.0. Often the best choice for commercial stacks.

GPL v2. Since 1991 the glue holding the Linux kernel together. Strong copyleft: anyone distributing derivatives must release the full source under GPL v2 as well. Deliberately terse, deliberately without a patent clause. Its most famous provision is nicknamed “Liberty or Death" — if you cannot meet the conditions, you may not redistribute at all.

GPL v3. Revised in 2007 after patents, DRM and locked-down devices (“tivoisation") opened new attack vectors against free software. It added the patent grant, required installation information for devices, codified anti-circumvention clauses and improved compatibility with other licences. Politically contentious, legally cleaner. Many flagship projects stayed on v2 (Linux), others migrated (Bash, GCC, Samba).

LGPL v2.1 and v3. The “Lesser" variants. Weak copyleft for libraries: anyone modifying the library and redistributing it must release changes under LGPL — but programs merely linking against the library may stay proprietary. The classic bargain: protect the library, leave the consumer free. glibc, GTK, Qt (at times) are LGPL.

MPL 2.0. Mozilla’s house-built licence, January 2012. Weak copyleft at the file level: anyone changing individual MPL files and redistributing them must release those files under MPL — the remainder of a program may remain proprietary. Cleanly drafted, pragmatic, popular among industry consortia. Firefox, Thunderbird and numerous Rust crates use MPL.

AGPL v3. The network GPL. It closes the so-called ASP loophole: classical copyleft triggers only when software is distributed. Anyone merely hosting it as a service distributes nothing — and previously owed no source disclosure. AGPL inverted that: network use itself triggers the disclosure obligation. Popular with SaaS providers who wish to deter competitors from hosting their work unprompted. Mastodon, Nextcloud, Plausible Analytics, MinIO.

EPL. The Eclipse Public License, rooted in IBM heritage, currently at version 2.0. Weak copyleft akin to MPL, with a clear patent grant and explicit friendliness to commercialisation. Eclipse IDE, Jakarta EE, most Java foundation projects, Adoptium/Temurin JDK builds. Frequently the pragmatic alternative when GPL feels commercially risky but BSD feels too permissive.

Unlicense and CC0. The radicals. Both waive copyright entirely — insofar as that is even possible in some jurisdictions. Unlicense (2010) targets software directly, CC0 (2009, Creative Commons) was aimed originally at data, artworks and texts. Both share a weakness: where copyright is inalienable (Germany, for instance), legal uncertainty persists. Moreover CC0 lacks a patent clause. For robust production systems MIT is therefore usually preferable to CC0.

What licences restrict or enable

Concretely, licences steer five axes:

  1. Use — May I deploy this commercially? Across all licences discussed here: yes.
  2. Modification — May I alter the code? Yes, everywhere.
  3. Distribution — Under what conditions? Here the flock separates.
  4. Patents — Do I receive an explicit patent grant? Only Apache 2.0, GPLv3, MPL 2.0, EPL 2.0, AGPL v3.
  5. Network use — Does hosting trigger a disclosure obligation? Only AGPL.

Beyond these lie secondary points: trademarks (always retained by the originating project), liability waivers (universal), attribution (universal) and mutual compatibility — a whole field in which entire law firms earn their living. The bitter truth: licences are not necessarily combinable. GPLv2 code cannot be merged with Apache 2.0 code without an exemption. CDDL and GPL are considered incompatible — the basis of years-long disputes over ZFS-on-Linux.

Stories worth knowing

The BusyBox massacre. Beginning in 2007, Erik Andersen, the Software Freedom Law Center and later the Software Freedom Conservancy pursued around fourteen electronics manufacturers — Verizon, Samsung, Best Buy, Westinghouse — for shipping routers, DVRs and cameras with embedded BusyBox without disclosing the modified source. The suits ended in settlement payments and landmark injunctions. They proved: the GPL is enforceable. Taking copyleft code and ignoring its conditions carries real legal risk.

The Linksys WRT54G and the birth of OpenWrt. In 2003 hobbyists discovered that the wildly popular Linksys WRT54G Wi-Fi router internally ran on Linux and BusyBox — both GPL-licensed. Linksys, by then owned by Cisco, had not published the source. After outreach by the Free Software Foundation and Bradley Kuhn, Cisco eventually released the full source tree. What began as a compliance event became one of the most fruitful moments in consumer IT: from the freed code sprang OpenWrt, DD-WRT, Tomato and an entire generation of open source router firmware. Millions of devices their makers have long forgotten are still maintained by a community today. Lesson: enforced copyleft produces not mere compliance — it can unleash an entire ecosystem.

React’s BSD-plus-Patents episode. Facebook released React in 2013 first under Apache 2.0, then switched in 2014 to a modified BSD licence with an attached patent rider: anyone suing Facebook for patent infringement instantly forfeited their React rights. In July 2017 the Apache Software Foundation, followed by Jenkins, WordPress and others, declared this untenable. Within weeks React lost a substantial portion of institutional trust. In September 2017 Facebook capitulated and placed React, Jest, GraphQL and Immutable.js under pure MIT. Lesson: a licence concealing asymmetric clauses can jeopardise an entire ecosystem.

HashiCorp’s reversal. In August 2023 HashiCorp announced that Terraform, Vault, Consul and further projects would move from MPL 2.0 to the Business Source Licence (BSL) — a source-available licence barring competitors from offering competing managed services. Users and contributors had trusted the projects under MPL for years. The community responded with OpenTofu, an MPL fork now stewarded by the Linux Foundation. HashiCorp largely squandered its reputation as an open source pioneer.

Redis’ abrupt turn. In March 2024 Redis Ltd. overnight changed the licence of its eponymous database from BSD 3-Clause to a dual RSALv2 / SSPL arrangement. Neither qualifies as open source under the OSI definition. Major cloud providers — AWS, Google, Oracle, Snap — reacted within days with Valkey, a BSD 3-Clause fork now hosted by the Linux Foundation. Within weeks Redis lost a considerable slice of its enterprise market.

MinIO’s deliberate AGPL step. Unlike HashiCorp and Redis, MinIO, the S3-compatible object store, chose a path in 2021 that remained within open source. The company moved from permissive Apache 2.0 to AGPL v3 — a genuine, OSI-approved licence. Goal: stop cloud providers from offering MinIO as a managed service without disclosing modifications. AGPL activates precisely where classical copyleft is powerless: in network-based use. Anyone running MinIO as a service and adapting it must release their modifications under AGPL. The decisive difference from BSL or SSPL: MinIO stayed open source. Contributors were not locked out, forks remained legitimate, the licence stays compatible with the wider GPL ecosystem. Lesson: protecting against commercial cannibalisation does not require leaving open source — it requires choosing the right licence.

CentOS and the limits of the licensed. The most famous story unfolds in 2020/2023. Since 2004 CentOS had been a community rebuild of Red Hat Enterprise Linux — RHEL minus branding, free of charge, binary-compatible. In 2014 Red Hat took the project in-house, hired maintainers, brought it under its roof. Everything seemed in good order. The turning point came in December 2020: Red Hat declared CentOS Linux 8 discontinued at end of 2021 and replaced it with CentOS Stream — a rolling upstream channel feeding RHEL rather than a stable downstream distribution. Thousands of production setups built on CentOS as a free RHEL substitute faced migration. The community answered with Rocky Linux (initiated by Gregory Kurtzer, one of the original CentOS founders) and AlmaLinux. In June 2023 the next blow fell: RHEL source code ceased to be published as freely downloadable tarballs, becoming accessible only to customers via the Red Hat Customer Portal. The GPL was not breached — the code remained open to entitled parties. But the loophole enabling clone distributions was closed. Lesson: a correct licence alone does not shield against strategic course corrections. Building on a project means reading not only the licence but also the governance, funding and interests of the steward.

Cannibalisation under the guise of protection

These episodes are not isolated cases. They belong to a trend gathering pace since 2018: MongoDB (SSPL, October 2018), Elastic (Elasticsearch and Kibana from Apache 2.0 to SSPL, January 2021), Sentry, Cockroach Labs, Confluent — the list goes on. The shared pattern: projects build a contributor base and brand over years under a permissive or weak copyleft licence. As soon as a large cloud provider dominates the more lucrative managed-services business, the incumbent swaps the licence for a model shielding precisely that business.

Sometimes this is legitimate. Maintainers have a right to economic sustainability, and open source was never synonymous with unpaid exploitation. But the manner of execution matters: accepting contributions under the old licence and subsequently locking the same contributors out under the new one breaks an implicit social contract. The outcome is no longer open source — and the ecosystem learns that such projects can become risk factors at any moment.

For procurers this means: licence stability has become a selection criterion, not a footnote.

What this means for libcom.de

For a quarter century I — Jochen Demmer, libcom.de — have worked with open source products. Starting in 2001, when Linux was establishing itself as the server operating system. Today it powers global banking infrastructure, telecommunications networks, hospital IT and industrial plants.

From that experience come judgements no white paper teaches: which licences hold up in regulated environments, where copyleft actually bites, when AGPL signals warning rather than recommendation, how to spot rug-pull risks early by reading governance, financing and contributor structure — not just the README. Whether you need a compliance strategy, a stack audit, tender wording or migration-planning accompaniment, these are tasks where licence fluency marks the difference between calm multi-year planning and surprised renegotiation.

And I see no viable future left for purely proprietary licences across broad IT infrastructure. The reasons are empirical: the most important operating systems, databases, web servers, container runtimes, orchestrators, build systems and language compilers are open source. Even the largest proprietary vendors now build atop open source — Apple’s Darwin roots, Android’s Linux kernel, Microsoft’s Visual Studio Code base. Anyone in 2026 still believing closed source is the safer path overlooks that their supposedly secure supply chain already consists of free software. Proprietary licences may persist in narrow specialisations. At scale they are no longer contemporary.

Open source is the new de facto standard. Not out of ideology. Out of performance, transparency, auditability and longevity.

If you wonder whether your IT stacks are sound on licensing grounds, whether a particular dependency poses a risk, or what a compliance strategy for your environment could look like: write to contact@libcom.de. We take an honest inventory. Without sales pressure. With a view to what lasts long-term.

Free software is not the solution to every problem. But it is the only category of solutions whose rules remain readable — even in twenty years.

Disclaimer: This article offers general orientation and does not constitute legal advice. Licensing questions can depend on individual circumstances; all information is provided without warranty.