3 ms·
Why does Socket flag npm packages with "MIT" in the license field as non-FSF approved, such as in lodash [1]. It appears the FSF seems to prefer to call the MIT
by syntheticcdo 5y ago
Why does Socket flag npm packages with "MIT" in the license field as non-FSF approved, such as in lodash [1]. It appears the FSF seems to prefer to call the MIT license "Expat" -- but Expat's SPDX identifier is literally "MIT".
[1] https://socket.dev/npm/package/lodash/files/4.17.21/package.json#L9 https://socket.dev/npm/package/lodash/files/4.17.21/package....
[2] https://directory.fsf.org/wiki/License:Expat https://directory.fsf.org/wiki/License:Expat
- feross 5y agoNon-FSF approved licenses as just flagged as informational – they shouldn't detract from the score. But perhaps that bit of info just isn't that interesting to most people. If you find more examples like this, please email them to me (see bio) so we can fix them. We appreciate the feedback!
- bjornstar 5y agoIt looks like having an MIT license gives you a score of 70. It seems wrong that the most commonly used license on the platform is poor and it makes it hard to trust your scoring on anything else.
- Uehreka 5y agoI may be able to speak on this specific issue! (I had to get this license approved by legal recently) Lodash is MIT, but contains a non-standard clause referencing the fact that it’s based on Underscore.js. Legal said this was totally fine, but as usual: my lawyer is not your lawyer ;)