2021 on OpenChain KWG

Is Open Source Compliance Necessary Even When Providing a Service as SaaS?

Mon, 20 Dec 2021 00:00:00 +0000

Most open source licenses place no restrictions on simply running the software, but they do require compliance with obligations such as source code disclosure and attribution when the open source is redistributed. Here, “distribution” generally means the physical delivery of software, such as selling an embedded device that carries the software or distributing a mobile app through an app market.

SaaS providers do not distribute software to deliver their service, so they can be relatively free of license obligations even when they use open source. However, some open source licenses, such as AGPL, impose license obligations even when a service is provided over a network, so care is needed there.

The Log4j 2 Security Vulnerability Incident (Log4Shell)

Sun, 12 Dec 2021 00:00:00 +0000

A vulnerability in Apache Log4j 2 (CVE-2021-44228, NVD) could lead to further damage such as malware infection, prompting urgent security update measures worldwide (2021.12.10). This post summarizes the related details.

Log4j

Log4j is an open source project from the Apache Software Foundation, used for logging purposes in most Java-based web services.

Timeline

2021.11.24 First discovered by the Alibaba Cloud security team (Apache announcement)
2021.11.30 The Log4j team opened the pull request Restrict LDAP access via JNDI (merged 12/5)
2021.11.30 The Log4j team opened the pull request no longer formats lookups in messages by default (merged 12/5)
2021.12.09 The issue began to spread after a tweet posted the Log4j 2 security PR along with a screenshot reproducing the vulnerability
2021.12.10 The issue gained widespread attention after Minecraft’s technical lead announced via tweet that the issue had been fixed
2021.12.10 The security vulnerability was patched with the release of Log4j 2.15.0
2021.12.12 The Log4j team added Disable JNDI by default
2021.12.12 Log4j 2.15.1 release candidate (JNDI disabled by default)

Scope of Impact

Log4j versions from 2.0-beta9 up to (but not including) 2.15.x
Regarding Spring Boot
- Spring Boot defaults to a different logging library, Logback, and is affected by the vulnerability only
  if the default logging system has been switched to Log4j2.
- As of 2021.12.12, in Spring Boot 2.6.1 (the latest version at the time), switching to Log4j2 without specifying a version installs 1.14.1
- Spring Boot 2.6.2, not yet released at the time, was planned to update to Log4j 2.15.x

NIPA Publishes Four Guides for Using Open Source Software

Tue, 23 Nov 2021 00:00:00 +0000

NIPA has published four guides for using open source software. (Source: https://www.oss.kr/news/show/ef0900db-f5b4-40fb-8745-f1b937fbd8d0)

The four open source software guides cover the following. The Corporate Open Source Software Governance Guide was co-authored by current OpenChain KWG steering committee members Haksung Jang, Seoyeon Lee, and Minho Hwang.

Open Source Software License Guide (Revised Edition)

Download the Open Source Software License Guide

Covers an overview and introduction to open source software licenses, how to comply with license obligations, copyright and patent considerations, license-related checklists, management approaches, notable dispute cases, and frequently asked questions, organized so the core content applicable to a company or organization can be identified and used across a range of situations.

China's First GPL Lawsuit Case: VirtualApp

Mon, 15 Nov 2021 00:00:00 +0000

Hello, this is Haksung Jang.

In September 2021, it was reported through a Chinese news article that the first GPL-related ruling in China had been handed down. I’ve summarized what I understood of it using a translation tool. Please keep in mind that, since I’m not a lawyer and don’t know Chinese, there may be errors in the content. :) If you find any errors, I’d be grateful if you’d let me know at any time (haksung@sk.com).

(Thanks to Jin-Young Choi, Center Director at the Korea Copyright Commission, for helping review this. ^^)

Does GPLv2 Also Require Installation Information?

Sun, 01 Aug 2021 00:00:00 +0000

Hello.

P. McCoy Smith, a well-known open source license attorney in the United States, recently published an article titled Does GPLv2 Require ‘Installation Information’ in JOLTS (Journal of Open Law, Technology & Society) (JOLTS).

In March 2021, the SFC (Software Freedom Conservancy) (SFC) blog published a post titled “Understanding Installation Requirements in GPLv2,” arguing that GPLv2 also requires the provision of installation information. This article analyzes that claim and explains, with detailed grounds, the view that GPLv3’s ‘Installation Information’ requirement does not apply to GPLv2.

This translation renders the original text while adding background explanations wherever possible to improve readability and help readers understand the content.

If you find any errors or have additional comments, please feel free to contact me at haksung@sk.com.

Thank you. :)

Distribution of Dockerfiles: Who Is Responsible for Compliance?

Tue, 04 May 2021 00:00:00 +0000

Hello!

In April 2021, Till Jaeger, a well-known German open source lawyer, published an article on who is responsible for the license compliance of the open source software included in the Docker image generated from a Dockerfile. Based on German law and the case law of the Court of Justice of the European Union (CJEU), Till explains that the Dockerfile provider must comply with license obligations.

This is a Korean translation of Till’s original English text. I added images to aid understanding, and here and there I added my own personal comments as blockquotes (in the polite register).

If you find translation errors or have questions, please contact me by email at haksung@sk.com

I am deeply grateful to Sean of Kakao for his help reviewing this translation. ^^

What Is an OSPO?

Sun, 18 Apr 2021 00:00:00 +0000

This paper was translated by Haksung Jang from the English version available at the OSPO Definition. The original document is licensed under CC-BY-SA-4.0.

Hello!

TODO Group¹ is a group² under the Linux Foundation that advocates Talk Openly, Develop Openly, aiming to build successful open source projects and programs through collaboration. TODO Group creates and publishes open source guides³, tools⁴, and more, making them available to anyone interested in open source.

For an organization such as a company to effectively manage and use open source, it is said that establishing an OSPO_{Open Source Program Office} is needed for activities such as developer education, ensuring compliance, engaging with and building community, releasing open source, and code review. This article carries over the article defining⁵ what an OSPO is and what role it plays, as written by TODO Group.

Elastic License 2.0 and the Evolution of Open Source Licensing

Sun, 28 Mar 2021 00:00:00 +0000

This paper was translated by Haksung Jang from the English version available at this white paper. The original author, Heather Meeker, has not reviewed this translation.

Hello.

This article is based on a white paper about the Elastic License published on March 11, 2021 by Heather Meeker, a U.S. attorney specializing in open source law. Most of it is a translation of the original article, and I have added my own opinions as blockquotes.

For reference, while Heather Meeker presented this white paper as her personal view, she also disclosed that it received some funding from Elastic. Perhaps for that reason, the original article takes a favorable stance toward the Elastic License.

(A bit of digging turned up that Heather Meeker wrote Elastic License 2.0 herself.)

In any case, as the times change and software distribution methods shift, commercial open source companies have had to think about which licensing model to adopt in order to pursue both development and business at once, and I think this article helps in understanding one aspect of the background behind the Elastic License. If you find any errors in this article, please feel free to contact me at any time. :-)

My deep thanks to Sean and Robin of Kakao, and Kyoungae Kim of LG Electronics, for their help reviewing this article.

Opensource license used by IT Companies

Thu, 14 Jan 2021 00:00:00 +0000

EPAM, Github Activity Ranking and License Status by Enterprise in 2020 (OSCI)

EPAM, which develops and consults Enterprise Software, provides a ranking service called OSCI (Open Source Contributor Index) that measures Github usage.

Measures the contributions of members of a commercial organization using publicly available Github Committed event data. Contributions from universities, research institutes and free email providers were not included. The target is contributors who have performed more than 10 commits, and the activity score is measured by an algorithm they have studied. The algorithm is published in OSCI Github.