License?

[claytondaley]

I'm used to seeing a license included in the readme or a txt file in the root (license.txt, legalnotes, etc.). Is this information found somewhere else in the repo? Can someone add an appropriate reference in a "usual" place?

[claytondaley]

OK so I found it buried in the composer JSON:

"license" : "CC-BY-SA-3.0"

Any thoughts on a dual-license that is GPL compatible?

[claytondaley]

Apparently, I need to go a step further and ask "how is anyone using this library legally" under the current license. According to CC, this license is only compatible with itself:

https://creativecommons.org/compatiblelicenses

[jburns131]

Since this is an OWASP project, we stick with the OWASP policies regarding licensing. After looking into it again, I believe OWASP has changed it's licensing policies.

I'll look into this and get back to you.

[claytondaley]

Thanks. If they're resistant to a different license (whether GPL-compatible or not), I'm happy to make the case directly to OWASP. It's not uncommon for content production organizations to try and use content licenses for software. Unfortunately, these licenses (except CC0) really aren't appropriate for this use... and the people it hurts most are the people who make the effort to respect the license.

[jburns131]

We are going to be moving to the Apache 2 license next release.

There won't be a problem with OWASP, here's the licensing page for OWASP projects: https://www.owasp.org/index.php/OWASP_Licenses#Licensing_of_OWASP_Projects

Thank you for bringing this to our attention!