4

Let's say I use a x-library which I've found in GitHub and it uses MIT license. Sure, I could give attribution to it in my apps in the About > Licenses page. But what about the libraries that x-library uses? Is it my job to give attribution to it or is it x-library's job?

  • Why are you wanting to give attribution in the "About > Licenses" page of your application? The MIT license doesn't require you do that. – Brandin Jan 9 '17 at 20:33
  • 4
    There's a difference between something being "required" and it being "a good thing". While it may not be strictly "required" that you give attribution, the Open Source community succeeds best when everyone openly acknowledges all contributions, whether you are required to or not. – MAP Jan 10 '17 at 3:49
7

But what about the libraries that x-library uses? Is it my job to give attribution to it or is it x-library's job?

If you redistribute libraries with you app --whether or not they are your direct, first level deps or deps of deps at full depth-- you are responsible to ensure that you comply with each licenses, all the way. It is always your job even if and especially if the libraries you redistribute did not properly comply with the terms of the code they reuse.

4

Let's assume for the sake of simplicity that x-library only depends on libraries that are licensed under MIT as well.

The only requirement of the MIT license is:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

which is a very light way to require attribution.

You did not say which kind of programming language all of this was written in, but let's assume that this is some kind of interpreted language like Python or Javascript. Then if you use the library without changing it, you are already complying with the requirement because your copy of the software does include the copyright and permission notice of the library (even though it is not easy to access for users). Notice that if the library you rely on complies with the MIT licenses of the libraries it depends on, then you are also automatically complying with them (because the LICENSE files will already be included in the source code).

Now, in the case where there is some kind of compilation (including minification of Javascript sources), then the various licenses might disappear during this process and it is your job to put them back (all of them, not just the one of the library you are directly depending on).

Finally, it is usually advised to make the attribution more prominent than what I describe, in some kind of About page. In this case, I would advise putting every dependency of your software there, not just the direct dependencies.

What to remember: you have to comply with the licenses of all the dependencies, not just the one you are directly using.

See also: https://opensource.stackexchange.com/a/4315/5858

  • What about if we open source our web app? Is that enough attributions for the basic license like MIT? It's crazy because we ended up having 850 external libraries/node_modules (dev only + client consumption libraries) while in fact we're just really trying to use 10-15 of them. I believe 98% of those are of MIT license. – Mikko Paderes Jan 13 '17 at 7:46
  • While open sourcing would be great, it isn't enough to make sure that the licenses are included in all copies of the software (in particular "binaries"). You would still have to follow pretty much the same requirements. – Zimm i48 Jan 13 '17 at 7:53
  • Got it. I just thought there's an easier way to manage the attributions since a lot of big products like Facebook and Reddit doesn't seem to have their open source attributions in their website (or maybe I just can't find it). – Mikko Paderes Jan 13 '17 at 7:58
  • At least on Facebook Android app, I easily found open source attributions in the About menu > licenses. – Zimm i48 Jan 13 '17 at 8:13
  • Yeah I easily saw that too but the Android version should be using different libraries than the website. So it's really surprising that no ones trying to get a hold of FB with this one. Oh well. – Mikko Paderes Jan 13 '17 at 9:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.