You can escalate to legal for edge cases, but you should be able to handle base cases yourself. As an example, I work at Google on an Apache 2.0-licensed open source project, and we have dozens of third party dependencies: https://github.com/google/nomulus/blob/master/core/build.gra...

It wouldn't remotely scale across Google if we had to escalate to legal every single time we pulled in a new dependency. Instead, there's a company-wide allowlist of accepted software licenses, and you only need legal help for exceptions beyond that.

So yes, we do have to know some basics of software licensing. It's just part of being a SWE.

So a SWE just needs to see if the set of allowed licenses contains the project license. That doesn’t require any knowledge of the license itself, other than “they exist”.

It does though. Like why waste time if you know a viral GPL-style license or a patent encumbered license would be a no go?

This is akin to saying SWE’s don’t need to understand GDPR, COPA, HIPPA, DMCA or whatever. Obviously there might be cases where someone never touches code in a GDPR or HIPPA context. But any SWE working in those areas should damn well understand the basics of the law — at least enough to flag inadvertent, but none the less blatant violations.

SWEs are all Star Wars trivia nerds, surely they can handle a few software licenses and GDPR rules and stuff.

So legal is going to tell you which NPM package to use in your NodeJS project? Is legal going to be sitting beside you when you're surfing github and see an awesome library that just happens to have an Affero GPL license?

If you're lucky, you'll have automated source scanning, legal will be informed after the fact, and you'll spend a week backing out the offending code and finding a replacement.

What's more likely is that it will be shipped to production and sit there until someone notices or you get sued ;)

Another one that likes to bite is the very not-open source Oracle extensions to open source Virtualbox / Vagrant... How many devs at big corps just click through that splash screen?

Thinking legal is going to protect you is wishful thinking... Devs need to know the basics.

Licensing isn't brain surgery. There is a grand total of five or so licenses that are in broad use today, perhaps a couple more if you include the LGPL and AGPL families. It's perfectly possible to learn what each of them do, or limit yourself to only using the ones that you understand.

No response proves my original point better than "That's a question for legal to handle, unless you're a two person shop."

Or perhaps even further -- it clearly demonstrates a reckless or willful ignorance of the entire topic.

No, At serious BigCo's developers (and their managers) are undergoing training on how to evaluate OSS software and only accept dependencies according to the company policies.

You don't develop complex software by having to go through legal for each of your dependencies.