Open Source Licence to Kill in Software Development

@Jamie_Lee_C
Protecting you and your org
Jamie Lee Coleman
Open Source Licence to Kill

@Jamie_Lee_C
Introduction
About me
Name: Jamie Lee Coleman
Current Role: Developer Advocate @ Sonatype
Past experience: Developer in Mainframe Software (CICS), WebSphere & OpenJ9 @ IBM
Twitter: @Jamie_Lee_C
Linked-In: https://www.linkedin.com/in/jamie-coleman/

@Jamie_Lee_C
Not just the Maven Central people

@Jamie_Lee_C
What will I talk about today?
1. Why we love Open Source
2. Issues with Open Source
3. What is a Software Licence?
4. Types of Licences
5. SCA What is SCA
1. SCA Tools
6. SBOMs to the rescue?
7. Everyday Licences we use
8. Licences that may kill
9. Automation is your friend!
10. Legislation
11. Summary
12. Links & Interesting Stuff

@Jamie_Lee_C
Open Source is amazing!

@Jamie_Lee_C
Benefits of FOSS
Personal control and
customizability (4
main FOSS
freedoms)
Study
Copy
Modify
Redistribute
Privacy and
Security*
Use community to find
bugs quickly
Low or no costs
Software is free with
optional licencing
Quality, collaboration
and efficiency
Many people and
organizations working
together
Performance can be
much better due to the
amount of people
contributing
Project development
can become more
agile and efficient

@Jamie_Lee_C
Sharing = better!
90% of the applications we create are shared dependencies!

@Jamie_Lee_C
Dependency Licence Managment
150 Dependencies (avg Java project)
10 Releases Per Year (avg per dependency)
1500 Possible License updates To Consider 😱
x

@Jamie_Lee_C
Direct vs Transitive Dependency
Example: org.springframework.boot:spring-boot-starter-web

@Jamie_Lee_C
Microservices make this even harder!

@Jamie_Lee_C
Software Licences

@Jamie_Lee_C
What is a Software Licence
● These are legal documents that set permissions on software
● These permissions are to help protect intellectual property of software
● Some Licences can even contain pricing and terms of how to make payment*
● The main points of a licence are:
○ If the software can be copied, modified & distributed
○ How the software is used
○ Where and how it can be installed
○ Copyrights that apply
○ Software ownership
○ Duration

@Jamie_Lee_C
Types of Licences
Public
Domain
Licences
The software is
free to be
modified used
LGPL
You can use in
your code and
apply any
licence
Permissive
Requirements
& restriction
apply to the
distribution and
modification of
the code
Copy Left
Code
distributed with
the same
licence
Proprietary
Very restrictive
and not
suitable for
free or
modified
distribution
Least Restrictive---------------Licence Restrictiveness-----------------Most Restrictive

@Jamie_Lee_C
● These Licences have zero
restrictions
● You can use and modify the
software
● Not all software without a
licence falls under this category
so be warned!
Public Domain Licences

@Jamie_Lee_C
● Developers have the right
to include the open-
source library into their
code and apply a new
licence
● If the code from the
library is copied or
modified, then the original
licence applies (LGPL)
LGPL

@Jamie_Lee_C
● These are the most common
types of licences for open-
source software
● Some licences may require
preserving licences notices,
how the software can be
used, trademarks and
copywrites of the software.
Permissive Licences

@Jamie_Lee_C
● Code may be distributed or
modified provided it is done
under the same licence.
● If used it could mean you must
make all your software open-
source which might not be an
option for many developers,
Copy Left

@Jamie_Lee_C
● These are the most restrictive
licences and are not used in
open-source.
● The make it impossible to copy,
modify or distribute the
software.
Proprietary

@Jamie_Lee_C
Licence management is part of good
dependency management!

@Jamie_Lee_C
Devices allowed to contain OS code:
IEC 62304

@Jamie_Lee_C
In 2016 Cybercrime surpassed the
drug trade!
$450 Billion a year
$14,000 a second
Equivalent to 50 US Nimitz Class
Aircraft carriers
Cyber Crime Facts

@Jamie_Lee_C
In 2022!
$6 Trillion a year!
$200,000 a second
Equivalent to 620 US Nimitz Class
Aircraft carriers!
Cyber Crime Facts

@Jamie_Lee_C
Todays Pablo Escobar uses a Laptop

@Jamie_Lee_C
United States: $20.89 trillion
China: $14.72 trillion
Cyber Crime: $6 trillion
Japan: $5.06 trillion
Germany: $3.85 trillion
India: $2.65 trillion
United Kingdom: $2.63 trillion
France: $2.58 trillion
If Cybercrime was a country by GDP in 2023

@Jamie_Lee_C
Software Composition Analysis

@Jamie_Lee_C
What is Software Composition Analysis?
https://foojay.io/today/sboms-and-software-composition-analysis/

@Jamie_Lee_C
SCA Tools
Basic tools will provide:
• List of declared dependencies
• Basic information such as latest
version available
More advanced tools will provide:
• Transitive dependencies
• Vulnerability & Licence data
• Project scoring
• Visualisations
• Produce SBOM

@Jamie_Lee_C
SBOM To The Rescue?

@Jamie_Lee_C
SBOM
“It is great to have a software bill of materials, but the important part is
what you do with it.” - Me

@Jamie_Lee_C
Easy ways to generate an SBOM
1. CycloneDX Maven Plugin
2. Kubernetes bom
3. Microsoft’s SBOM Tool
4. SPDX SBOM Generator
5. Syft
6. Sonatype Lift

@Jamie_Lee_C
Even our SBOMs are not safe!

@Jamie_Lee_C
Main licences you should know about!

@Jamie_Lee_C
Apache & MIT
● Apache:
○ Requires copyrights and licence notifications on the distributed code or as a notice contained in
the software.
○ Larger projects and modifications are allowed to carry different licence terms.
○ Source code is not required to be included.
○ Contains Patent Grant.
● MIT
○ Most used licence.
○ Created by MIT University.
○ Very short and clear!
○ Removed Liability from the Authors*
○ Copywrite and Licence notice required for modification and distribution.

@Jamie_Lee_C
Berkeley & Unlicence
● Berkeley Source Distribution (BSD)
○ Has different levels of clauses: 2, 3, 4.
○ The 2nd level has very few restrictions and is like the MIT licence.
○ Source code is not required to be distributed.
● Unlicence
○ No conditions apply!
○ Not all software without a licence falls into this type
○ Free to modify, copy and distribute.
○ Must be in the public domain.

@Jamie_Lee_C
General Public Licence, Affero GPL & BSL
● General Public Licence (GPL)
○ All source code must be distributed under GPL
○ Suitable for commercial, patent and private use.
○ Loophole as the licence does not cover distribution over a network only.
● Affero GPL (AGPL)
○ Adds one extra clause to the GPL licence to close the loophole for distribution over a network.
● Business Source Licence (BSL/BUSL)
○ Anyone can read and used for testing and internal usage
○ Can not use the code in a production without paying
○ Still publicly available and after 4 years or less, the code converts to a compatible licence of the
companies choosing.

@Jamie_Lee_C
LGPL, EPL & MPL
● Lesser General Public Licence
○ Same terms as GPL & AGPL
○ Preserving the copyright & Licence notifications.
○ Modified source code does not require the licence to be distributed with the project
● Eclipse Public Licence
○ Mainly used for business software.
○ Software under EPL & none-EPL can be combined and sub licenced provided EPL elements are
separated out.
○ Modifications allowed provided they are released under the same licence terms.
● Mozilla Public Licence
○ Similar to EPL.
○ Patent grants and copyright notices must be included.

@Jamie_Lee_C
Licences that can kill!

@Jamie_Lee_C
Licences that can kill!
Not paying attention to
Licences can entangle your
company into a very
expensive lawsuit or make
you rewrite the whole or big
parts of your code.
Source: https://brainhub.eu/library/open-source-licenses-to-avoid

@Jamie_Lee_C
What can go wrong?
When someone wants to buy your company or buy your SaaS software, they will look at your
license agreement to make sure everything works. After spotting problems during the
license audit, the buyer may fall back.
Other potential problems include:
● Being sued for financial liability by the creator of the component.
● Having to rewrite major part of the product.
● Having to publish your software as open source (on the same license you didn’t comply
with).
● Getting penalties and restrictions on selling your software until the compliance is met.
● Losing reputation and getting negative press coverage.
https://brainhub.eu/library/open-source-licenses-to-avoid

@Jamie_Lee_C
Notable moves away from Open Source Licences
Many companies are getting tired of other vendors taking their code and making
huge amounts of money from it. This is causing a huge change to how companies
licence their software…
● Terraform
○ Mozzilla Public Licence >>> Business Source Licence (BSL)
● MongoDB
○ AGPL >>> Server Side Public Licence (SSPL) Created by MongoDB
● Reddis Labs
○ Apache Licence* >>> Reddis Source Available Licence (RSAL)
● Confluent
○ Apache Licence >>> Confluent Community Licence (CCL)
Do you see a recurring pattern here?

@Jamie_Lee_C
Automation is your friend!

@Jamie_Lee_C
Sonatype Lifecycle

@Jamie_Lee_C
Legislation affecting Open Source
ussage!

@Jamie_Lee_C
Be Proactive rather than Reactive
“If no other manufacturing industry is permitted to ship
known vulnerable or defective parts in their products,
why should software manufacturers be any different?” –
Brian Fox CTO/Founder of Sonatype

@Jamie_Lee_C
CRA: Cyber Resilience Act
Scope: Products With Digital Elements
(Software and Hardware)
Passing in Late 2023- 2024

@Jamie_Lee_C
● Rules for placing on the market of products with digital elements through a process of a mandatory or voluntary
audit, depending on organisation criticality, to demonstrate fulfilment of specific cybersecurity requirements, resulting
in attribution of a CE marking;
● Requirement for the design, development and production of such products and obligations of economic
operators, as well as processes put in place and reporting obligations for manufacturers to ensure cyber security
throughout the life cycle of such products, as well as obligation of economic operators in these processes;
● Rules on market surveillance and enforcement, which would be performed through appointed market surveillance
authorities.
Sources:
https://www.euractiv.com/section/cybersecurity/news/eu-lawmakers-kick-off-cybersecurity-law-negotiations-for-connected-devices/
https://www.linuxfoundation.org/blog/understanding-the-cyber-resilience-
act#:~:text=The%20Cyber%20Resilience%20Act%3A%20Context&text=Everybody%20who%20places%20digital%20products,auditing%20and%20certifying%20the%20products.
https://www.europarl.europa.eu/legislative-train/theme-a-europe-fit-for-the-digital-age/file-european-cyber-resilience-act
https://www.europarl.europa.eu/thinktank/en/document/EPRS_BRI(2022)739259

@Jamie_Lee_C
● Any software or hardware product and its remote data processing solutions, including software or hardware components to be
placed on the market separately.
● Products with digital elements whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data
connection to a device or network.
➔ A very wide range of digital products
◆ IoT devices, Consumer ( Apple Watch, Ring doorbells, etc) and Industrial
◆ Operating systems
◆ Software products in general.
◆ (AI) systems, including the cybersecurity of products with digital elements that are classified as high-risk
AI systems.
● Digital devices covered by specific sectoral regulations [NIS2]
● Software-as-a-service (SaaS) such as clouds, unless they are part of
integral remote data processing solutions for a product with digital
elements. [This means most backend servers in the world are
covered].
● Free not-for-profit open source software [Most open source
produced in the commercial world would be covered unless the
developers are hobbyists or unemployed].
Sources:
https://www.europarl.europa.eu/thinktank/en/document/EPRS_BRI(2022)739259
●
●
Large: €100M GAT / 2.5% sanction: up to €15M
Microsoft: $198B GAR / 2.5% sanction: up to $4.95B

@Jamie_Lee_C
➔ Designed, developed and produced to ensure an appropriate
level of cybersecurity based on the risks;
➔ Delivered without any known exploitable vulnerabilities;
➔ Be placed on the market delivered with a secure by default
configuration including a default setting that security updates be
installed automatically
➔ ensure protection from unauthorised access by appropriate control
mechanisms, including but not limited to authentication, identity or
access management systems;
➔ Encrypt relevant data at rest or in transit by state of the art
mechanisms;
➔ protect the integrity of data, personal or other, commands,
programs and configuration against any manipulation or
modification not authorised by the user, and report on corruptions
➔ Process only data that is limited to what is necessary in relation to
the intended use purpose of the product
➔ Protect the availability of essential functions, including the
resilience against and mitigation of denial of service attacks;
➔ Minimise their own negative impact on the availability of services
provided by other devices or networks;
➔ Reduce the impact of an incident using appropriate exploitation
mitigation mechanisms and techniques;
➔ Provide security related information by recording and/or monitoring
relevant activity, including the access to or modification of data,
services or functions;
➔ enable that vulnerabilities can be addressed through security
updates, including, where applicable, through automatic
updates by default
➔ Provide the possibility for users to securely and easily remove all
data and settings
“Products with digital elements and processes shall be presumed to be in conformity with the essential requirements set out in Annex I covered by those standards
or parts thereof. “
Sources:
Article 18
Annex I

@Jamie_Lee_C
➔ Identify and document vulnerabilities and components
contained in the product, including by drawing up a software bill of
materials in a commonly used and machine readable format
covering at the very least the top-level dependencies of the
product; [You Need to produce SBOM]
➔ Address and remediate vulnerabilities without delay, including
by providing security updates;
➔ Publicly disclose information about fixed vulnerabilities,
including a description of the vulnerabilities, information allowing
users to identify the product affected, the impacts of the
vulnerabilities, their severity and clear and user friendly information
helping users to remediate the vulnerabilities
➔ Put in place and enforce a policy on coordinated vulnerability
disclosure;
➔ Provide a contact address for the reporting of the
vulnerabilities discovered in the product including third party
components
➔ Provide for mechanisms to securely distribute updates for
products with digital elements to ensure that exploitable
vulnerabilities are fixed or mitigated in a timely and, where
applicable, automatic manner;
➔ Ensure Security patches or updates are available to address
identified security issues, they are disseminated without
delay and free of charge, accompanied by advisory messages

@Jamie_Lee_C
➔ Notify any actively exploited vulnerability contained in the
product that they become aware of to the CSIRT via ENISA
unified platform.
➔ In any event within 24 hours an early warning which shall
provide general information to the CSIRT, and member states
where product is used.
➔ In any event within 72 hours an update to the information to
indicate any available information about the actively exploited
vulnerability, Indicators of Compromise, the status of remediation
and any corrective or mitigating measures taken
➔ Voluntary reporting of vulnerabilities where active exploitation
has not occured
➔ The manufacturer shall inform the users of the product about
the actively exploited vulnerability or an incident having an impact
on the security of the product.
◆ Corrective measures that the user can deploy to mitigate
the impact of that vulnerability or incident,
◆ In a structured and easily automatically processible
machine-readable format.
➔ The commission may define the machine readable format in the
future
➔ Manufacturers identifying a vulnerability in a component,
including in an open source component, which is integrated in
the product report the vulnerability to the person or entity
maintaining the component.
➔ Where manufacturers have developed a software modification
to address the vulnerability in that component, they shall share
the relevant code with the person or entity maintaining the
component, where appropriate in a machine readable format.
➔

@Jamie_Lee_C
National Cyber Security Strategy
Department of Defense
FDA
CISA

@Jamie_Lee_C
● Formed of Five Pillars that instruct the regulators, agencies and states to follow rules
◆ Pillar ONE, Defending critical infrastructure
◆ Pillar TWO, Distrupt and Dismantle Threat Actors
◆ Pillar THREE, Shape Market Forces to Drive security and Resilience
◆ Pillar FOUR, Invest in a Resilient Future
◆ Pillar FIVE, Forge International Partnerships to Pursue Shared Goals
● Pillar 1 Software sold to the Federal Government follows secure
standard
● Medical Devices follow secure standard
● 3.1 Data Resilience is introduced
● 3.1 Liability for faults is introduced in software goes to manufacturers
● Anything regulated by the SEC, FDA and other regulators can
now have software requirements
Sources:
https://www.whitehouse.gov/wp-content/uploads/2023/03/National-Cybersecurity-Strategy-2023.pdf

@Jamie_Lee_C
Why is the above legislation important for OS?
● Local law always overrides Licences
● The upcoming legislation will make
any commercial company responsible
for contributing to open source.
● This means licences such as the MIT
that “Remove Liability from the
Authors” is no longer valid in the EU
and as a contributor you will be held
responsible.
This Photo by Unknown Author is licensed under CC BY-SA

@Jamie_Lee_C
My Conclusion
● Open-source usage is increasing and so are the amount of Licences to be
aware of.
● Being aware of the contents of your application can help with security.
● Check any new/updated open-source dependencies to make sure licence
changes have not occurred.
● Companies are being forced to change licences and we can’t really blame
them.
● Beware of how upcoming legislation may impact your usage of open-source
projects.
● Automate Everything!

@Jamie_Lee_C
History of AI
https://www.javatpoint.com/history-of-artificial-intelligence
History of software supply chain attacks
https://www.sonatype.com/resources/vulnerability-timeline
State of the software supply chain report:
https://www.sonatype.com/state-of-the-software-supply-chain/
LOG4J download data:
https://www.sonatype.com/resources/log4j-vulnerability-resource-center
5 AI Tools for Developers
https://medium.com/geekculture/5-ai-tools-every-software-developer-
should-be-using-in-2022-afc4fb149c60
Photoshop Generative Fill
https://www.adobe.com/products/photoshop/generative-fill.html
AI tools to build apps faster
https://geekflare.com/ai-tools-for-developers/
Useful Links

@Jamie_Lee_C
Get in touch
Website:
https://www.sonatype.com
Twitter: @sonatype
LinkedIn: /company/sonatype/

@Jamie_Lee_C
Cool stuff to
checkout!
New Maven Central
https://central.sonatype.com/
DevZone
https://dev.sonatype.com/
LOG4J Live Data
https://www.sonatype.com/resources/log4j-vulnerability-
resource-center
Software Supply Chain Report
https://www.sonatype.com/state-of-the-software-supply-
chain/introduction
Foojay Series
• https://foojay.io/today/sboms-first-steps-in-a-new-
journey-for-developers/
• https://foojay.io/today/sboms-and-software-
composition-analysis/
• https://foojay.io/today/making-sboms-threats-and-
modelling-them-a-piece-of-cake/

Open Source Licence to Kill in Software Development

More Related Content

Similar to Open Source Licence to Kill in Software Development

More from Jamie Coleman

Recently uploaded

Open Source Licence to Kill in Software Development

Editor's Notes