2

I'm currently working on my Node.js library/framework. I would like to eventually publish it as FOSS software, but I would like to hinder people who change/fork my code from not giving their changes back. This would lead me to preferring a GPL-style licence over a BSD-style licence such as most Node.js-related projects I've seen use (Node.js itself, Express.js, etc.).

So my question actually boils down to two parts:

  1. Is there any particular reason most of the Node.js ecosystem publish their software under the MIT (or similar) licence? Is it just a historic thing, is it related to the fact that JavaScript is not compiled/linked but run?

  2. Related to the first question, what problems can arise (in terms of practical application of the licence) from publishing my software under the GPL? First, can I do it without violating the Node.js licence or the licences of the dependencies I use (I use one dependency at the moment, which is also MIT-licensed)? I assume I can, since MIT itself is permissive. Would it be a problem the other way around (If Node.js were GPL-licensed and I wanted to publish my framework under MIT)?

Bottom line, I'm trying to understand the interplay of GPL with non GPL code in non classically-linked environments, if that has ever been put to the test, in order to see whether it makes sense for me to license my code under the GPL in order to reach the above-mentioned goal.

1

You can license your code under the GPL, but it is an unusual step in the Node ecosystem. The tendency in that ecosystem to prefer MIT and ISC licenses seems to be largely a cultural thing where developers prefer simple licenses that allow any kind of downstream use, without any extra attribution requirements (MIT generally only requires that you keep existing notices intact). Many package authors also do not care about licensing, and simply stick with the NPM default (ISC). Furthermore, the GPL license text alone is significantly larger than many small packages.

Since Nodejs is completely under GPL-compatible permissive licenses, you are free to use a copyleft license such as the GPL.

The use or non-use of a specific linking technology is irrelevant for the GPL. If you require an NPM module that is not meaningfully different from dynamically linking a native library or a C program that uses dlopen(). AFAIK these issues have not been litigated to date, and even then any court precedent would only apply to that jurisdiction.

Note that no open source license will guarantee that any changes to the software will be made available. The goal of the GPL is to ensure that end users always have the freedom to inspect and change the software that they use. Therefore, a user of your software may make private modifications. They are not required to publish them at all. The GPL only requires that if someone receives a copy of the modified software, that they also receive the source code of this modified version under the terms of the GPL, so that end user freedom is ensured.

But for server side code, it is very rare that copies of that code are given out. The GPL requirements do not trigger on ordinary server side use. The AGPL license may then be a better choice because the AGPL already triggers when users interact with the modified software over a network, not just when the users receive a copy of the software. This is why many open source infrastructure companies used the AGPL for their products, until recently (see Redis/Commons Clause and MongoDB/SSPL for two examples of switches from AGPL to non-Open Source licenses).

Note that the (A)GPL comes in different versions, and that versions 2 and 3 are incompatible with each other, and that version 2 is also incompatible with the Apache 2 license. Choose the (A)GPL “version 2 or later” if you are concerned about maximum compatibility, otherwise version 3 is better as it clarifies and improves the license in some crucial aspects (such as an anti-patent-treachery clause, or that running the software in the cloud is allowed).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.