For years, my clients have asked me what to do about the “Good not Evil” license, which is most famously applied to JSON (JavaScript Object Notation), a widely used format for storing a…
Sorting out the Ethical Licensing Mess
Software developers who give the world, for free, usage rights to the code they write often use open source licenses to make this gift legally explicit. These free usage rights (and then some) are …
Permissive-Washing in the Open AI Supply Chain: A Large-Scale Audit of License Integrity
Permissive licenses like MIT, Apache-2.0, and BSD-3-Clause dominate open-source AI, signaling that artifacts like models, datasets, and code can be freely used, modified, and redistributed. However, these licenses carry mandatory requirements: include the full license text, provide a copyright notice, and preserve upstream attribution, that remain unverified at scale. Failure to meet these conditions can place reuse outside the scope of the license, effectively leaving AI artifacts under default copyright for those uses and exposing downstream users to litigation. We call this phenomenon ``permissive washing'': labeling AI artifacts as free to use, while omitting the legal documentation required to make that label actionable. To assess how widespread permissive washing is in the AI supply chain, we empirically audit 124,278 dataset $\rightarrow$ model $\rightarrow$ application supply chains, spanning 3,338 datasets, 6,664 models, and 28,516 applications across Hugging Face and GitHub. We find that an astonishing 96.5\% of datasets and 95.8\% of models lack the required license text, only 2.3\% of datasets and 3.2\% of models satisfy both license text and copyright requirements, and even when upstream artifacts provide complete licensing evidence, attribution rarely propagates downstream: only 27.59\% of models preserve compliant dataset notices and only 5.75\% of applications preserve compliant model notices (with just 6.38\% preserving any linked upstream notice). Practitioners cannot assume permissive labels confer the rights they claim: license files and notices, not metadata, are the source of legal truth. To support future research, we release our full audit dataset and reproducible pipeline.
Steve Krouse on Twitter / X
*gets up on soap box*With the announcement of this new "code mode" from Anthropic and Cloudflare, I've gotta rant about LLMs, MCP, and tool-calling for a second Let's all remember where this startedLLMs were bad at writing JSONSo OpenAI asked us to write good JSON schemas…— Steve Krouse (@stevekrouse) November 7, 2025
JSON Formatter & Validator
Format and validate JSON data so that it can easily be read by human beings.
Introducing EmDash — the spiritual successor to WordPress that solves plugin security
Today we are launching the beta of EmDash, a full-stack serverless JavaScript CMS built on Astro 6.0. It combines the features of a traditional CMS with modern security, running plugins in sandboxed Worker isolates.
Open Responses
This is the standardization effort I've most wanted in the world of LLMs: a vendor-neutral specification for the JSON API that clients can use to talk to hosted LLMs. Open …
RSL: Really Simple Licensing
The open content licensing standard for the AI-first Internet
Why I used to prefer permissive licenses and now favor copyleft
Licensing terms for data in the Atmosphere
I’d like to raise a fun and interesting topic, and that’s intellectual property and content licensing. The data that flies around the Atmosphere is all visible and public. We’re at a stage within the Atmosphere where services are beginning to grow, and we’re beginning to see lexicons and data that express creative works that extend in length beyond microblogging. I think that the Standard.site lexicons are a great example. But these creations lead to further questions. Who has permission to...
Nicholas Carlini - Black-hat LLMs | [un]prompted 2026
Introducing a terms of use and updated privacy notice for Firefox | The Mozilla Blog
UPDATE: We’ve seen a little confusion about the language regarding licenses, so we want to clear that up. We need a license to allow us to make some of t
WebPreferences Object | Electron
The OpenJS Foundation | Terms of Use | Privacy Policy | Bylaws | Code of Conduct | Trademark Policy | Trademark List | Cookie Policy
Introducing the Functional Source License: Freedom without Free-riding
Sentry started life in 2008 as an unlicensed, 71-line Django plugin. The next year we began publishing it under BSD-3, and ten years later we switched to the Business Source License (BSL or BUSL). Last year we purchased Codecov, and a few months ago we published it under BSL/BUSL as well. That led to some vigorous debate because of our use of the term “Open Source” to describe Codecov, from which emerged this helpful suggestion from Adam Jacob, co-founder of Chef:
What is RSL? | RSL: Really Simple Licensing
The open content licensing standard for the AI-first Internet