Licensing and Credit

Every piece of software you build rests on work done by others — operating systems, programming languages, libraries, frameworks, fonts, icons, and code snippets from documentation. How you use that work, and whether you give appropriate credit, is both a legal obligation and an ethical one. Getting this wrong can expose you to lawsuits. Getting it right builds trust and sustains the open-source ecosystem that you depend on.

Software Licenses: What They Are and Why They Matter

A software license is a legal instrument that specifies the terms under which software may be used, copied, modified, and distributed. When you find code on GitHub or install an npm package, that code has a license — even if you never read it. Your use of that code is governed by that license whether you are aware of it or not. The major license families: Permissive licenses (MIT, Apache 2.0, BSD): grant broad freedoms. You may use, modify, and distribute the code, including in commercial and proprietary products. The primary obligation is attribution — you must preserve the original copyright notice and license text. Copyleft licenses (GPL, AGPL): grant similar freedoms but require that any software you distribute that incorporates the code must itself be distributed under the same license. This is the share-alike principle. If you incorporate GPL-licensed code into a product you sell, you must open-source the entire product under GPL — a significant constraint for commercial builders. Proprietary licenses: restrict use, modification, and distribution. Using proprietary code outside its license terms is copyright infringement. Creative Commons licenses: primarily for non-code creative works (text, images, music) but increasingly used for datasets and documentation. Variants control commercial use, modification, and share-alike requirements. A concrete example: React, the popular JavaScript library used in millions of web applications, is licensed under the MIT license. You may use it in commercial products. You must preserve its copyright notice. Violating this — shipping an app that uses React but strips its copyright notice — is a license violation.

How to practice responsible licensing: Check before you use: before adding a dependency or copying code, look up its license. Most package managers display this. npm packages list their license in package.json. Use a license for your own work: if you publish code without a license, others cannot legally use it. Add a LICENSE file to your repository. For most projects, MIT is a sensible default — it is permissive, widely understood, and requires only attribution. Keep attribution chains intact: if you modify a library and ship it, preserve the original author's copyright notice. If you use a snippet from documentation or Stack Overflow, check whether attribution is required. Be aware of license compatibility: mixing code under different licenses is not always legal. GPL-licensed code cannot legally be incorporated into a project that you want to release under a permissive license. Tools like FOSSA or the SPDX license compatibility matrix help navigate this.

Credit: The Ethics Beyond the Law

Licensing sets the legal floor. Ethics set a higher bar. Credit — acknowledging the people whose work made your work possible — is not always legally required but is professionally and ethically expected. In open-source communities, credit is the primary currency. Stripping attribution from a contributor's work, or presenting another person's solution as your original invention, damages community trust and harms the person whose work was taken. In AI-assisted work, credit becomes complex: When AI generates code trained on public repositories, the original authors of that training data generally receive no credit — and often had no say in their code being used for training. This is an active ethical debate. When you present AI-assisted work in academic or professional settings, honesty requires disclosing that assistance. Most institutions and employers now have explicit policies. Passing off AI-generated work as entirely your own is a form of misrepresentation. When you build on another person's open-source project, a meaningful contribution back — a bug report, a documentation improvement, a pull request — is the ethical response, not just the required attribution.