The article analyzes the most popular open-source licenses in 2023. Data shows that MIT and Apache 2.0 licenses are most prevalent across different programming languages and package managers. While there are many mature licenses in place, many open source components lack a specified license, creating legal complexities and security concerns. The article highlights the importance of clear and standardized licenses for the health of the open source community.
Original link: https://blog.opensource.org/the-most-popular-licenses-for-each-language-2023/
Reproduction without permission is prohibited!
作者 | Nick Vidal 译者 | 明明如月
责编 | 夏萌出品 | CSDN（ID：CSDNnews）
The 2023 report highlights the importance of helping developers understand and properly use software licenses. While open-source software is the cornerstone of modern software development, data shows that much of it is shared and used without a clearly defined license.
Using data from the Open Source Initiative (OSI) community project ClearlyDefinned, Aleksandrs Volodjkins provides an in-depth analysis of the dataset as of September 21, 2023. ClearlyDefined is a collaborative project focused on providing comprehensive, standardized metadata on the origin and licensing of software components. Its data reveals the trends that currently dominate the open source ecosystem.
Overall, MIT and Apache 2.0 are by far the most popular license options. Their simplicity and ability to modify and distribute code with minimal restrictions are undoubtedly key factors in their widespread adoption.
Different package managers have different license options, and the ecosystem of each programming language has its own licensing preferences. For example, the JavaScript community generally uses the MIT license, while Python developers prefer Apache 2.0. The ISC license is also popular in the JavaScript community because of its simplicity and flexibility. The BSD license, which includes both 3-Clause and 2-Clause versions, is relatively low, although adoption is stable. In addition, the General Public License (GPL), which embodies the spirit of free software, does not exist as widely as MIT and Apache 2.0.
Challenges with license-free components
While there are many mature licenses to choose from, the ClearlyDefined dataset reveals a problem: many open source components are not licensed, or are labeled as SPDX "NOASSERTION". This ambiguity creates uncertainty about the rights to use these components, which can hinder collaboration and create legal and security risks for developers.
The need for clarity and standardization
Addressing the issue of license-free components is critical to maintaining the health and continued growth of the open source community. Developers, organizations, and the community at large can all benefit from clear, standardized licensing. Not only does this help facilitate collaboration, but it also ensures legal compliance and protects the intellectual property of contributors. In addition, it helps developers track down components that may have vulnerabilities.
Working together to find solutions
The issue of license-free components is a challenge that requires the community to work together to solve it. To address this challenge, the ClearlyDefined project invited developers from organizations to co-create a global database of software component license metadata. The project provides licensing metadata for each component through a simple API and allows developers to contribute missing or incorrect information to build an accurate database. Check out the details!
License usage for JavaScript (npm).
The majority of JavaScript components in the npm package manager are MIT licensed (53%), followed by Apache 2.0 (14.76%) and ISC (10.48%). The ISC license, issued by the Internet Systems Consortium, is very popular in JavaScript projects, but is used relatively sparingly in other programming languages. There are also a small percentage of projects that are unlicensed (8%) or do not have a SPDX-recognized license/no declaration (5.49%).
License usage for .NET (Nuget).
At. The most striking data in .NET's package manager, Nuget, is that a significant percentage of components are either unlicensed (26.76%) or classified as claimless (31.95%). This indicates a high degree of licensing ambiguity in the .NET ecosystem. On the other hand, 21.55% of the components are licensed under the MIT license, while 13.37% are licensed under the Apache 2.0 license.
License usage for Java (Maven).
In Maven, Java's package manager, most components are licensed under Apache 2.0 (up to 69.18%). Only 7.4% of the components use the second most popular MIT license. In addition, the percentage of undeclared components was 14.75%, indicating a degree of licensing uncertainty.
License usage for Python (Pypi).
In Python's package manager, Pypi, the usage of MIT and Apache 2.0 licenses is 29.14% and 23.98%, respectively, showing their widespread popularity in the Python community. Components licensed under BSD 2-Clause and GPL 3.0 accounted for 6.25% and 6.11%, respectively. It is worth noting that the proportion of unlicensed components is quite high, at 23.69%.
License usage for Ruby (Gem).
In Ruby's package manager gems, most of the components are MIT licensed (63.11%), showing a strong preference for MIT licenses in the Ruby community. This is followed by Apache 2.0 and BSD 3-Clause licenses, which account for 8.22% and 6.66%, respectively.
License usage for PHP (Composer).
In Composer, the package manager for PHP, the MIT license is very popular, accounting for 64.37%. In addition, the BSD 3-Clause and Apache 2.0 licenses are used at 5.72% and 3.92%, respectively, indicating that these licenses also have a presence in the PHP community.
License usage for Go
In Go, Apache 2.0 and MIT licenses are the most commonly used licenses, accounting for 32.49% and 20.1%, respectively. Notably, a significant portion of Go components are not license-specified, at 29.67%, indicating a degree of licensing uncertainty in the Go ecosystem.
License usage for Rust (Crate).
In Rust's package manager Crate, projects under MIT and/or Apache 2.0 licenses dominate, with a combined 83.52% share. This shows that MIT and the Apache 2.0 license are extremely popular in the Rust community.
What programming language do you use in your work?Are you familiar with the various open source licenses mentioned in this article?Have you noticed that the open source packages you use have the appropriate licenses?