News for hackers. Stuff that matters.
Re:Feluda – A CLI tool to detect restrictive licenses in dep... by anistark on Friday January 31, 2025 @03:54PM (#42891849)
Hey folks,

I built Feluda, a Rust-based CLI tool that scans your project's dependencies and flags restrictive licenses before they become a problem.

It currently supports Rust, Node.js, and Go projects. It checks for GPL, AGPL, SSPL, and other restrictive licenses that may limit how you use your project commercially.

Try it out:

``` cargo install feluda feluda ```

I’d love feedback! Are there specific license edge cases you'd like covered? Features you'd want in a CI/CD setup? Happy to discuss and iterate!

Re:Feluda – A CLI tool to detect restrictive licenses in dep... by G1N on Monday February 03, 2025 @04:39PM (#42923573)
Would you be open to a PR adding support for installing from npm? Not sure if you guys are willing/ comfortable to publish there as well, but did notice you already have Node support for scanning
Re:Feluda – A CLI tool to detect restrictive licenses in dep... by korkybuchek on Monday February 03, 2025 @05:06PM (#42923918)
Shout out to my dawg Satyajit Ray
Re:Feluda – A CLI tool to detect restrictive licenses in dep... by eadmund on Monday February 03, 2025 @08:11PM (#42926036)
The GPL and AGPL are not restrictive: they ensure that you do not restrict your users.

Freedom looks like tyranny, to a tyrant.

Re:Feluda – A CLI tool to detect restrictive licenses in dep... by mubou on Tuesday February 04, 2025 @10:32AM (#42933642)
"Restrictive" in the context of licenses has a specific meaning: it's the opposite of "permissive" e.g. MIT and Apache. You can't ensure your licensees don't restrict their users without placing restrictions on what they can do with their work. The users aren't the ones agreeing to the license, after all; it's the people using GPL code to whom it's restrictive.
Re:Feluda – A CLI tool to detect restrictive licenses in dep... by sunshowers on Tuesday February 04, 2025 @02:52PM (#42937660)
GPL and AGPL libraries are impossible to use in vast chunks of the free software ecosystem.

I think you're looking for MPL 2.0, which is copyleft while also permitting use by the entire free software ecosystem.

Re:Feluda – A CLI tool to detect restrictive licenses in dep... by eadmund on Tuesday February 04, 2025 @05:29PM (#42939939)
It’s completely possible to combine GPL and AGPL software with, e.g., BSD- or MIT-licensed software. The resulting software is GPL- or AGP-licensed, and the users are not restricted from doing anything.

I honestly thought that this was a license scanner for actually restrictive — i.e. non-free-software — licenses until I visited the repo. It would be good to know if I accidentally use some piece of software with some source-available license.

Re:Feluda – A CLI tool to detect restrictive licenses in dep... by sunshowers on Tuesday February 04, 2025 @06:31PM (#42940831)
Combine if they are independent pieces of software, yes. Whether linking (hard or soft/plugin) counts is a matter of legal uncertainty. The FSF has consistently said that a single function call into a GPL library constitutes a derivative work, but other legal experts disagree [1].

Certainly, if I maintain a repo which calls a function in a GPL library, it would be misleading for me to say that my repo is MIT-licensed. I could potentially say that my specific code bits are MIT-licensed but that (per the FSF's interpretation) if you import my library, your resulting artifacts are GPL.

That is quite hard to communicate, and it also rests on a particular interpretation of the license that is the most common one but isn't universally accepted. It also becomes tricky with distributed copyright ownership without a CLA, the way most open source projects are run. I think that this rises to the level of "impossible to use".

But I guess one specific point here is that if you download my MIT-licensed-but-links-to-GPL repo, and rip out all of the bits that link to GPL libraries, you can use my code under MIT.

Compare this to MPL 2 which has none of these issues, and very little legal uncertainty in general. There is still some uncertainty regarding what constitutes a copyrightable work, though.

[1] https://tech.popdata.org/the-gpl-license-and-linking-still-u...

Re:Feluda – A CLI tool to detect restrictive licenses in dep... by pabs3 on Monday February 03, 2025 @08:18PM (#42926114)
GPL/AGPL don't limit commercial use.
Re:Feluda – A CLI tool to detect restrictive licenses in dep... by henvic on Monday February 03, 2025 @09:51PM (#42927130)
As a critic of such licenses (https://medium.com/@henvic/opensource-and-go-what-license-f6...), I love it!