I know that when I use MIT projects, I have to include the license text of that author.

But when I use that stuff on the server-side should I render/send it to the client of the server?

Should I put the license into my source code as comments, also for things that are not directly seen/used by the client?

For example, I use grunt.js for putting all the files together or I also use some sort of png captcha code.

  • 1
    Should you send attribution/copyright notes to a client? Well, I think you should. But the license doesn't put you under any obligation to do so. – Martijn Aug 6 '15 at 18:55
  • For example I put some license notes(program used on the server-side) into my JavaScript-file(as a comment), which will be send to the client. Imagine if someone wants to attack my website, the attacker can see the version I use on my server and see which exploit he should use !? – user254197 Aug 6 '15 at 19:22
  • 2
    You should never rely on an attacker not knowing that you have vulnerabilities as a defense against vulnerabilities. It's a pretty bad defense. Patch your servers. The should here is a moral should (and therefor not part of my answer) – Martijn Aug 6 '15 at 19:28
  • Ok, I totally aggree with you regarding server patches, but I meant if an exploit just released and there is no security fix avaiable... – user254197 Aug 6 '15 at 19:38
  • If it's a zero-day which has no patches yet, then you're vulnerable, whether you show which version you are using or not. An attacker isn't going to "not bother" trying some exploit on your website if they're not sure what version of what software you're running. But we're quickly drifting off-topic here. It might hold a good question for security.stackexchange.com though – Martijn Aug 6 '15 at 19:41

No, you don't.

As far as I know, the only license that requires that you make its source available if it's a "network" program is the AGPL, the MIT license has no such requirement.

| improve this answer | |
  • I don't understand how the AGPL's source requirement reads on this question about sending license/notice information across a wire. – bmargulies Aug 7 '15 at 1:09
  • Yeah it is two different things... the answer is pretty much the same, though. You don't have to make the license available if you don't have to make the source available. – Tim Malone Apr 29 '16 at 10:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.