How to dissuade certain organizations using my open source code? I want to prevent military, policing, and surveillance companies from using my open source code in their projects, through a custom permissive license. Of course, I can't tell the military itself what it can and cannot do. So I think terms such as "this may NOT be used for military or surveillance applications" are pretty pointless. Would I be better protected with a statement like "This code may be used for all projects, private and commercial, except when used for ______ purpose, in which case a one-time fee of 5,000,000 USD will be immediately due."? My theory is that it outlines a path for such organizations to still use it, even if that path is so expensive no rational organization would take it, and acts as a good damages baseline should I ever have to take any such an organization to court. edit: I'm not interested in money and would actually like to avoid mentioning it at all, I'm just trying to lay out the correct legalese to prevent such entities from using my work. If it's enough to define said entities and say "May NOT use this" I'm happy with that.
You cannot do this through any established public license that I know of, but you could write your own. The model would be any educational use or non-commercial use license, such as CC NC licenses. The main challenge is defining the excluded classes of usage. That is why you should engage an attorney to draft this for you. I don't think there is any point in adding a $5M penalty clause. You offer a separate paid license for individuals who do not want to comply with the particular terms of your license, and set the fee to whatever you want. Saying that you're gonna fine violators is a bad idea because penalty clauses are illegal. Instead, the standard approach is a liquidated damages clause, where you state what a reasonable estimate of your damages would be. In the case of software that is available for purchase, illegal copying of the software obviously results at least in the cost of the software qua lost revenue as damages. Plus shipping and handling.
The GPL does not forbid you from charging money for software, nor does it require you to provide source code to the general public. What the GPL requires is that your software be free software, with "free" used in the sense of "free speech" rather than the sense of "free beer." According to the Free Software Foundation (authors of the GPL), the right of users to sell software is a requirement for it to be free software. If you receive a GPL license for software, you can give it to whoever you want provided you also ensure that person can get the source code. You don't need to make the source code available to the public, only to the people you actually distribute the binaries to. The GPL is structured along the lines of "if you distribute the software to someone, you must give them these rights;" it is not structured along the lines of "you must distribute the software." Of course, if users have the right to distribute copies for free, it's hard in practice to charge money (all it takes is one user distributing copies). But that doesn't mean you can't try. Some companies make substantial money selling free software through various models (e.g. Red Hat, which charges money for support). Others might bank on the fact that plenty of people are willing to pay to get it from the official site, and aren't interested in finding a free copy somewhere. It doesn't matter; as long as they license the software to you under the GPL and give purchasers access to the source code on the same terms, they're in the clear (if you want to redistribute binaries, it's your job to redistribute the source code as well).
If you are subcontracted, then some other company is going to use the code that you wrote, and since you were not paid for it, you are the copyright holder. A letter to that company's legal department might work wonders.
The software being free and open source has no impact on whether it infringes any patents or violates any copyrights. Copyrights attach to fixed representations of creative work in a tangible medium (e.g., the actual code and graphical elements of the software in question). As long as you aren't copying the copyrighted work of someone else, you should be in the clear. So, if you write your own code from scratch, or rely on code that you're allowed to use (e.g., "free" software with a permissive license that allows it to be used freely), you should be fine. On the other hand, if you copy a chunk of code that you aren't allowed to use, and then change the variable names so that it's superficially different, you're likely violating someone's copyright. Patents are a much more difficult question. To determine whether you would infringe any patents, you would have to read the independent claims of every patent that might be related. If you perform all the steps of any one of those claims, then you are infringing that claim (and therefore, the patent in which it is found). Unfortunately, this is much easier said than done. First, it may be difficult to search for all the potentially relevant patents, and once you've found them, there may be far too many to read. Second, claims are written in a type of language that is specific to patents, and someone without experience in patent law may not understand them correctly. Finally, the terms in the claims may not take on their plain English meaning, but rather may have been defined by the language in the rest of that patent, so it's possible that you might incorrectly think you were in the clear based on a misunderstanding arising from that. All that said, it may be best to go ahead with implementing an idea and then waiting to see what happens. Chances are that the implementation will arguably infringe some patent in some way, no matter what's done. But chances are also high that there will never be any worrisome enforcement action taken against it by a patent owner, simply due to the difficulty and expense associated with enforcing patent rights.
There is no general prohibition against taking down material, even non-infringing material, which is posted by some person, but there is a risk to the service provider. Abstracting away from the specifics of github, a Provider has some agreement with the User whereby User rightfully makes Stuff available on Provider's site. Arbitrarily removing Stuff (in violation of the usage agreement) may cause damage to User, who may sue Provider, and Provider will avoid that if possible. DMCA protects Provider from copyright infringement suits by Victim, providing the proper DMCA procedure is followed, and it allows Provider to remove Stuff without fear of getting sued by User (17 USC 512(g)). This protection is not available if the takedown notice is not proper. (As a case in point, the entire series of Harry Potter books is still out there freely on the internet, because only the rights holder can demand a takedown, and the rights holder seems to not be concerned).
Gather evidence that the software you are requesting the source code of really is based on, in whole or part, an existing open source project that has a license which requires source code to be made available, and then contact that projects copyright holders. Only they have standing to sue.
The first thing that people need to do is to quit over thinking it. That being said, I'm going to see if I can tackle your problems one by one, before summarizing and providing my own opinion: Many users don't care if their code is copied. I'm like that. I left a couple comments on Shog9's post that read this: Good point: Licensing does not prevent careless or malicious use. I'm surprised about how many people are thinking that this license will let them steal their code, because it's already happening right now. I don't want to sound pessimistic, but when thousands of people break a license/law/contract, it's a bit of a lost cause. You're not significantly damaged in a direct way, so honestly, let it go. All I want is to make sure that no one can come up to me if something of mine screwed something on there side. Aside from that, I don't care about people who don't attribute me: chances are, they have no moral sanity, and I will appreciate the people who do, and help me out. As it is, I'm 16, I share what I know with a good heart, and in a well-spirited manner, and at the end of the day, knowing that I was able to help someone out makes my day. I don't mind if my code is copied. I know that people will copy my code whether I like it or not, but I also know that there will be people in the world who will say "thanks", and will try to attribute me where possible. I feel good about that. That being said, I don't care. But the person who uses my code does. The license that affects all Stack Exchange posts are licensed under the Creative Commons Attribution Share-Alike license, or CC BY-SA. Code contributions don't fit well with this. This excellent post on Open Source explains why it's discouraged for code. What these people want is a code-friendly license, so that they can stay in the clear when it comes to copyright issues. The next thing they want, is for someone to come after them over some licensing issue. You may think that people are good, but you never know the world around you. They can be evil. For other users, they don't mind their code being copied to another post, as long as there is a link to the post and a mention of the original author. Most people post with good intention. There's not that much of an issue from a legal perspective either: The license allows people to copy and paste into answers of their own, and since the license remains the same, there's no issue to get into. The license allows it, and contributors kind of have to acknowledge it. I don't think anyone cares what happens to code that is less than 3-4 lines at least. I can probably agree. Such code probably wouldn't be eligible for copyright anyway, since it's so trivial. Many jurisdictions have a "Threshold of Originality," which means that simple things can't be under copyright. Stack Exchange does not probably want people to own the code they submit. For example, Stack Exchange has (and probably wishes to retain) the right to keep even deleted posts in the visibility of the high rep users (even if the author is against it). Wait what? You may be right that it is in Stack Exchange's interest to host content. After all, they get hits, which helps them as a business. It is illegal for companies to host illegal content. If somebody sees objectionable, copyrighted content hosted on Stack Exchange that they would like removed, then they need to file a DMCA Takedown Request. This is also why moderators, like myself, cannot process legal requests. The reason why Stack Exchange doesn't act themselves, even if they see something that is copyrighted and objectionable, is because it's a form of liability. When YouTube began removing copyrighted content themselves, they received a wave of lawsuits (If you remove some, you need to remove all. Why didn't you remove mine? being the argument). The plaintiff's won those, and when YouTube did nothing, they weren't liable at all. If a user wants to have their content taken down, it's tricky. You need to look at the Terms of Service for Stack Exchange: (quoting Section 3) You agree that all Subscriber Content that You contribute to the Network is perpetually and irrevocably licensed to Stack Exchange When Stack Exchanges gets your content, you grant them an irrevocable license to your contribution. This is pretty standard across a lot of sites: it's just a way to secure data and stay in the clear of licensing issues. At the same time, it doesn't seem fair for SE to acquire complete ownership of the content. The user must still have the final say, if the content is to be used for purposes not already agreed upon in the licence. They don't. What users have done is that they have provided a license of their content to Stack Exchange. This is done, again, through their Terms of Service: You grant Stack Exchange the perpetual and irrevocable right and license to use, copy, cache, publish, display, distribute, modify, create derivative works and store such Subscriber Content and to allow others to do so in any medium now known or hereinafter developed (“Content License”) in order to provide the Services, even if such Subscriber Content has been contributed and subsequently removed by You. The user grants a license to their content to Stack Exchange, but they do not assign or relinquish copyright. The code still belongs to them. It's important not to conflate the user contribution policy, with copyright assignment. You are still free to add an additional license to your content (known as dual or multi-licensing), and have a copy for your own use. Stack Exchange will always host a copy licensed under the CC BY-SA license. Stack Exchange can expect a high level of decorum and respect for laws from its users. At the same time, it cannot expect redundant attributions anywhere and everywhere, because one of its main aims is to not waste the users' time. Not only Stack Exchange expects it, but many copyright laws in various jurisdictions require it too. There's a concept known in many jurisdictions known as moral rights. These are rights that are irrevocable, whether you like it or not. Generally, these include attributions, disclaimer of liability, and other rights as well. Even if your work is in the public domain, you still retain these moral rights. If memory serves me right, the right to be attributed is revokable under United States copyright law. Therefore, attribution becomes more a courtesy, when the right is revoked. Licenses such as CC BY, and CC BY-SA still require attribution as a part of their licensing terms. What defines attribution is generally up to the person who uses the content. If memory serves right again, one can not demand how to attribute. There should be a clear-cut way to determine what is code and what isn't. The code formatting indicators on SE may not be adequate because some users simply use backticks, or 4-space indented text for other not-so-codey text. Personally, I feel like making the entirety of a post under both the Creative Commons license and whatever proposed code license they use is the best option, and allow people to use moral judgement to determine the most appropriate license. The concern comes about people who lack such judgment. I bet these same people don't follow the existing license anyway - and are a lost cause. We made it through! There will always be debate on the license of choice. Some people want the GPL, a license that's apparently closer to the status quo of Creative Commons license (I disagree that it's a good match), while other's want permissive licenses, such as the MIT or the Apache licenses. I'd prefer the permissive type, since it allows use in closed-source applications, and grant more rights (i.e. less restrictions) to the people that use them. I'm not going to right much because my hands are tired, but I'm sure if you've got more questions about the open source licenses themselves, you can probably ask on Open Source Stack Exchange.
Impressum Requirement Wow, based on your citations, you've done a lot of research on this topic. I'm just going to add one more reference, which is from the same site as your first German citation and has incredibly detailed and judicially referenced information on almost everything related to the Impressum. All my non-GitHub links are to sections of that page. Based on your research, I'm going to take it for granted that you understand that according to the Telemediengesetz (TMG), an Impressum is required on a web page if it is &quot;business-like&quot; (geschäftsmäßig), or if it helps, I prefer to word it as &quot;potentially commercial.&quot; I would have to argue that open source projects have to be seen as inherently &quot;business-like&quot; for the purposes of the TMG for two reasons: Some other legal person may have similar software as part of their business and might have the need to serve legal notifications to the owner of a GitHub project (TMG § 8 gives competitors the right to sue). Think potential copyright violations here. It is possible to build a more traditional commercial business around open source, for example what Canonical is doing around Ubuntu. Additionally, the common legal advice is to even include an Impressum on a personal blog, though I'm not aware of any court case having occurred at that level yet. In my opinion, a GitHub account can be seen as more &quot;business-like&quot; than a personal blog, and would follow that advice out of caution. I'll note that the XING situation you bring up is complicated. It centers over whether the content of XING pages is &quot;business-like&quot; according to the TMG. It may well turn out that some pages will need an Impressum and others won't. As for placing it in the project's readme.md, that might work but I have two concerns: The courts have essentially stated that the text of the link must imply that the required information under TMG § 5 is located there. For example, the words Impressum and Kontakt work, but the word Information does not. To me, &quot;readme&quot; is not sufficient, but this concern might be negated by the fact GitHub by default renders the readme.md directly on the project home page. While it has been ruled that the Impressum does not necessarily have to be directly on the home page (for GitHub, that would be the company's/users profile page), it must still be readily available in an intuitive location. I don't know if putting it in a project page satisfies the legal requirement. If it was sufficient, it's also likely that each project would have to have an Impressum so that it can't be missed. Examples The dominant pattern that I could find1 on GitHub is an off-site link to the Impressum contained in the profile page's byline right underneath the title. Examples: https://github.com/sedadigital, https://github.com/comsysto, https://github.com/znes, https://github.com/eSagu, https://github.com/TIBHannover. I'm almost certain this meets or exceeds the legal requirements. Example screenshot: Additionally, I found a few that had a repository specifically for an Impressum. Example: https://github.com/johsteffens. Since these repositories were clearly visible on the user's main page (either because there weren't enough repositories to make them span multiple pages, or because it was specifically pinned to the main page), I would argue these also meet the legal requirement for being readily available. While I didn't find any examples of it, another possibility would be to combine the above two approaches, having a link in the byline that links to an Impressum repository or some other page within GitHub. This would be useful if you didn't otherwise have an Impressum hosted elsewhere. There were also scattered examples of people placing an Impressum on a project wiki page or on an impressum.md file at the top level. However, none of the users I looked at were consistent in doing this across all their projects. Also as previously mentioned, it's questionable whether not having it on the main user profile page meets the legal requirement. The Wiki page in particular I don't think meets the requirement that it can easily be found. Found using the following Google search: site:github.com impressum -impressum.php -impressum.html -impressum.jsp -impressum-manager -github.io -issue. Exclusions meant to filter out a lot of false positives, mostly projects for websites that had their Impressum in code format meant for deploy and not for display on GitHub itself.