Stopping bad guys from using my open source project (feedback wanted)

This raises a question in my head. If the author was to update the license to something restrictive, consumers and transitive consumers will npm update at some point, and likely not notice the dependency change.

They would then be breaking the license terms without realizing.

Is there anything in npm to protect against this? Projects have hundreds of dependencies, it's not feasible to manually check licenses haven't changed every time you update.

This is appalling. Maybe all open-source code could be published as part of a not-for-profit cooperative that defends the programmers that enter into it.

> How do you make good or bad resolvable?

It is not a computer program, but a an ethics problem. We can solve it by thinking of the context and the ethics of it.

I realize it is the topic of this thread, but OP did not mention anything in relation to licenses, and was just talking about good and bad not existing objectively (without context).

I think, if we came with a specific situation, most people with similar values might reach the same good/bad verdict, and a small minority might reach a different one.

I believe the Tyson Foods example is overly simplistic and still too abstract, because one can be vegetarian for many reasons, and these would affect the "verdict". In the real world, if we were working on that piece of software the question would be: Does the implementation of this specific hr SAP module for Tyson foods by me, a vegetarian against animals suffering unnecessarily, etc. as opposed as the abstract idea of any piece of code and any vegetarian. If a friend called you: I have this situation at work, they are asking me to write software to do x and I feel bad about it, etc. etc. I bet it would not be difficult to know what is right and wrong. Another aspect of it is, we could agree something is wrong (bad) and you might still do it. That does not mean there is no objective reality, just that you might not have options or that your values might not be the ones you think (or say) they are, for example.

There are perhaps 2500-3000 unique open source licenses, ranging from the half dozen most of you will know well to very obscure licenses which have come about because (for example) a research grant from a foundation with certain guiding principals indirectly paid for some of the development of some software as part of a larger research initiative. There's even a license that precludes use of the software in any military equipment other than that which is strictly of a defensive nature, due to the constitution of the country sponsoring (a small part of) the project.

Since the author mentioned trying to find a general solution, not one just for his project - here's one that could work:

Make a new standard license similar to the GPL, but one that includes machine-readable payment requirements, each consisting of:

- a UUID

- a minimum profit threshold

- a license fee, either a fixed amount or some well-defined formula (you'd probably want an inflation adjustment system)

- a recipient

Anyone who wants to use the software can do it, but if you cross the profit threshold, you have to pay, once per project. Dependents would naturally inherit the payment requirements of their dependencies, but you'd only pay once per dependency even if it was used in multiple projects (hence the UUID).

With high enough profit thresholds and small payments, this should avoid the license from becoming toxic:

* If you aren't a megacorp, you don't care because you're not hitting the thresholds.

* If you aren't a megacorp but dreaming of becoming one, you still don't care, because if you do become one, you can afford the cost, and the combined cost (payments + compliance cost) is well understood and limited.

* If you are a megacorp, you still don't care, because we're most likely talking about peanuts and the machine readable descriptions make it practical to comply, and you get a "software bill of materials" out of it as a side effect.

This relies on the minimum profit thresholds being high enough and the license fees low enough. This could be achieved by the text of the license itself being licensed only as long as you keep within certain thresholds.

Building a new license ecosystem and the critical mass behind it is a tall order, but I think this way it's not hopeless-from-the-start. The design isn't meant to "capture a fair share of the value" or anything like that, it's meant to be minimally toxic (because that's a hard requirement for having a chance of becoming popular) while still delivering some minimal contribution to big projects with a lot of dependents.

I was originally planning to suggest a revenue threshold, but I think profit is better, as it excludes nonprofits, startups in the starting-up phase, companies that aren't money printers, etc.