Ahmed Shah, Selman Selman, and Ibrahim Abualhaol report a preliminary analysis of more than 200 open source cybersecurity projects, cataloging the most frequently used license types and languages and looking for permissively licensed projects contaminated by restrictively licensed code. They found cases of restrictive-license contamination inside permissively licensed projects and a high proportion of code lacking copyright attribution, and argue that absorbing such packages into commercial products can block sale or confidentiality of derivative work and lead to costly remediation, reputational damage, and legal fees.
License Compliance in Open Source Cybersecurity Projects
Ahmed Shah, Selman Selman, and Ibrahim Abualhaol report a preliminary analysis of more than 200 open source cybersecurity projects, cataloging the most frequently used license types and languages and looking for permissively licensed projects contaminated by restrictively licensed code. They found cases of restrictive-license contamination inside permissively licensed projects and a high proportion of code lacking copyright attribution, and argue that absorbing such packages into commercial products can block sale or confidentiality of derivative work and lead to costly remediation, reputational damage, and legal fees.
Source: Arxiv