Blog
Articles tagged "Open source".
"Open" does not always mean free for commercial use. A model's weights carry a license layer separate from the code — sort them into three buckets (Apache/MIT, conditional community like Llama/Gemma, restricted/non-commercial). A commercial-use cheat sheet for LLM, image, and audio models, plus a use-case checklist and the version/EU/MAU traps.
Read moreBuilding an OSS/SaaS procurement policy from scratch? A copy-and-adapt kit: a three-tier allow/caution/deny list, an intake request template, and a re-licensing watch clause. Plus the operational flow from adoption to SBOM-in-CI, quarterly inventory, and change detection — practical structure, not abstract principles.
Read moreAsked to "provide an SBOM"? A practical map: SPDX / CycloneDX today, ten tools by role (Syft, Trivy, Grype, OSV-Scanner, ScanCode, and SaaS), realistic setups by team size, a copy-paste CI recipe, and the US/EU drivers (EO 14028, EU CRA) — free OSS first.
Read morePublishing on GitHub, collaborating abroad, or making controlled technology accessible to non-residents can put software inside an export-control regime — though most public OSS clears the publicly-available exemption. The dual-use logic, a five-category screen, US EAR / ITAR and EU Dual-Use basics, and a self-diagnosis checklist.
Read moreBefore adopting third-party OSS, identify its tier by SPDX identifier and reconcile it with your linking and distribution form to see what source-disclosure duties reach your code — from MIT to AGPL, plus the source-available trap and case law.
Read moreA pre-ship rights check for US/EU developers: copyright exceptions (fair use, EU DSM Art. 4), AI-generated work (human authorship, the EU AI Act), and the four-tier OSS license spectrum.
Read more