Let's say I use a x-library which I've found in GitHub and it uses MIT license. Sure, I could give attribution to it in my apps in the About > Licenses page. But what about the libraries that x-library uses? Is it my job to give attribution to it or is it x-library's job?
Why are you wanting to give attribution in the "About > Licenses" page of your application? The MIT license doesn't require you do that.– BrandinJan 9, 2017 at 20:33
5There's a difference between something being "required" and it being "a good thing". While it may not be strictly "required" that you give attribution, the Open Source community succeeds best when everyone openly acknowledges all contributions, whether you are required to or not.– MAPJan 10, 2017 at 3:49
But what about the libraries that x-library uses? Is it my job to give attribution to it or is it x-library's job?
If you redistribute libraries with you app --whether or not they are your direct, first level deps or deps of deps at full depth-- you are responsible to ensure that you comply with each licenses, all the way. It is always your job even if and especially if the libraries you redistribute did not properly comply with the terms of the code they reuse.
Let's assume for the sake of simplicity that x-library only depends on libraries that are licensed under MIT as well.
The only requirement of the MIT license is:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
which is a very light way to require attribution.
Finally, it is usually advised to make the attribution more prominent than what I describe, in some kind of About page. In this case, I would advise putting every dependency of your software there, not just the direct dependencies.
What to remember: you have to comply with the licenses of all the dependencies, not just the one you are directly using.
What about if we open source our web app? Is that enough attributions for the basic license like MIT? It's crazy because we ended up having 850 external libraries/node_modules (dev only + client consumption libraries) while in fact we're just really trying to use 10-15 of them. I believe 98% of those are of MIT license. Jan 13, 2017 at 7:46
While open sourcing would be great, it isn't enough to make sure that the licenses are included in all copies of the software (in particular "binaries"). You would still have to follow pretty much the same requirements.– Zimm i48Jan 13, 2017 at 7:53
Got it. I just thought there's an easier way to manage the attributions since a lot of big products like Facebook and Reddit doesn't seem to have their open source attributions in their website (or maybe I just can't find it). Jan 13, 2017 at 7:58
At least on Facebook Android app, I easily found open source attributions in the About menu > licenses.– Zimm i48Jan 13, 2017 at 8:13
Yeah I easily saw that too but the Android version should be using different libraries than the website. So it's really surprising that no ones trying to get a hold of FB with this one. Oh well. Jan 13, 2017 at 9:15