Top all-time · #1312
FOSSA
Company blog · fossa.com/blogsecurityprogramming
FOSSA is the company blog at fossa.com, writing about security and programming. Since 2019, 52 different Hacker News readers have linked it 74 times, most often “Analyzing the legal implications of GitHub Copilot”. It is still writing: the last post was on 2026-10-29, and you can follow it by feed.
Rarely recommended · 3 of 36 sampled comments recommend it?
Why HN links it
HN readers link FOSSA's blog as a plain-language guide to open source license terms (LGPL, GPL, AGPL, MPL, Apache, BSL) and to the legal questions around GitHub Copilot.
- Recommended for · 3 comments
- Called a good post on license requirements and an LGPL tl;dr that 'isn't bad'; also 'interesting reading' on Copilot legal issues.
Summarised by Claude from a sample of 36 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
FOSSA secures the software supply chain with automated SBOM generation, software composition analysis, license compliance, and vulnerability management.
Most-linked posts?
- Analyzing the legal implications of GitHub Copilot7 people · 7 mentions · first linked 2021-07-15
- /blog/business-source-license-requirements-provisions-history/4 people · 4 mentions · first linked 2023-09-06
- /4 people · 4 mentions · first linked 2019-09-22
- Podcast: Adopting Haskell in Production as a Primary Language3 people · 3 mentions · first linked 2023-02-07
- /blog/open-source-software-licenses-101-agpl-license/3 people · 3 mentions · first linked 2023-04-13
- What you need to know about Apache License 2.03 people · 3 mentions · first linked 2021-02-09
- How open source conquered the world3 people · 3 mentions · first linked 2021-03-12
- Fossabot: AI code review for Dependabot/Renovate on breaking changes and impacts2 people · 2 mentions · first linked 2025-10-01
- How Open Source License Scanners Work2 people · 2 mentions · first linked 2025-10-27
- /blog/dual-licensing-models-explained/2 people · 2 mentions · first linked 2025-04-30
What Hacker News says?
Anything derivative or including LGPL code assumes the license. It prohibits commercial use unless you also adopt LGPL. https://fossa.com/blog/open-source-software-licenses-101-lgp...
Comment linking /blog/open-source-software-licenses-101-lgpl-license/amp/
on “Unity's Open-Source Double Standard: The Ban of VLC”Submitted Analyzing the legal implications of GitHub Copilot as a story · 172 points
HN discussionI did not referred to the funding remark. It is besides the point and immaterial to the discussion. My point was on the remark that this attack vector is somehow only applicable when projects are starting out. This is false, and insinuating this does a disservice to the community. The attack consists of asking someone for the keys. The projects that are the most vulnerable are those who are already established and h…
Comment linking /blog/npm-packages-colors-faker-corrupted/
on “Social engineering takeovers of open source projects”Submitted Fossabot: AI code review for Dependabot/Renovate on breaking changes and impacts as a story · 108 points
HN discussion>> Have you ever read GitHub's conditions to know whether they also have the right to use your code that way, no matter how you decide to license it? > I have, and there is not. At least one IP lawyer strongly disagrees, suggesting anything you host on GitHub is fair game [1]. [1] https://fossa.com/blog/analyzing-legal-implications-github-c... > The person writing an SO answer is intelligent and capable of conceptua…
Comment linking /blog/analyzing-legal-implications-github-copilot/
on “Copilot sells code other people wrote”Submitted Three Pillars of Reproducible Builds as a story · 82 points
HN discussionHere's Kate Downing, an IP lawyer specializing in software license: > According to Downing, the answer depends to a certain extent on where that code is hosted. If it’s on GitHub, there very clearly would not be copyright infringement. > “If you look at the GitHub Terms of Service, no matter what license you use, you give GitHub the right to host your code and to use your code to improve their products and features,…
Comment linking /blog/analyzing-legal-implications-github-copilot/
on “Copilot sells code other people wrote”Submitted Understanding the PURL Specification (Package URL) as a story · 74 points
HN discussionSome interesting reading: https://felixreda.eu/2021/07/github-copilot-is-not-infringin... https://fossa.com/blog/analyzing-legal-implications-github-c...
Comment linking /blog/analyzing-legal-implications-github-copilot/
on “Give up GitHub: The time has come”Submitted TikTok, Trump, and the Future of Open Source Surveillance as a story · 67 points
HN discussionVery cool! Reminds me of https://tldrlegal.com/ and https://fossa.com/ .
Comment linking /
on “Show HN: I made a neural net that analyzes privacy policies”Submitted Heather Meeker: OSS Investment Should Be Recognized as an ESG Investment as a story · 23 points
HN discussionFOSSA is looking for Engineering Managers + DevOps Leads! Come join us in empowering big-name enterprise customers to adopt, use and understand open-source software! https://fossa.com/careers/
Comment linking /careers/
on “Ask HN: Who is hiring? (October 2020)”Submitted OSS Compliance Expert: GPL Implications of Stockfish Lawsuit as a story · 21 points
HN discussionFrom: https://fossa.com/blog/open-source-licenses-101-apache-licen... Anyone who uses open source software licensed under Apache 2.0 must include the following in their copy of the code, whether they have modified it or not: 1. The original copyright notice 2. A copy of the license itself 3. If applicable, a statement of any significant changes made to the original code 4. A copy of the NOTICE file with attribution…
Comment linking /blog/open-source-licenses-101-apache-license-2-0/
on “YC criticized for backing AI startup that simply cloned another AI startup”Submitted FOSSA Raises $8.5M to Help Enterprises Manage Open Source Dependencies as a story · 17 points
HN discussionCompanies will use whatever is at their disposal to grow faster and more efficiently, this is the free market working as intended (and isn't a bad thing by itself: see free software companies like SourceHut benefiting as well). I think the core of the problem lies in distribution. We've gotten so used to other people distributing our code for us (through the use of package managers and such) that we've made it hard…
Comment linking /blog/bouk-monkey-importance-knowing-your-dependencies/
on ““Open source” is broken”Submitted Fossa Acquires Edgebit - Auto Dependency Updates as a story · 12 points
HN discussionHa, well look at that, not even a day later: https://fossa.com/blog/fossabot-dependency-upgrade-ai-agent/
Comment linking /blog/fossabot-dependency-upgrade-ai-agent/
on “Designing agentic loops”Submitted How open source conquered the world as a story · 11 points
HN discussion> You can't just say it could be bad one day therefore everyone should do <x> now Who said "everyone" or "one day"? It's bad today, especially for those who assume they are not affected, even though they have never done forensics to test that assumption. An example: most software incorporates other software as dependencies. As a developer, if a downstream consumer of your software is regulated, your software busines…
Comment linking /blog/cybersecurity-executive-order-software-supply-chain-security/
on “Running macOS in a Virtual Machine on Apple Silicon Macs”Submitted OSS Compliance Implications: SFC vs. Vizio (With Comment from Leading IP Lawyer) as a story · 10 points
HN discussionI completely agree that you should run 1+ license checkers in your CI process, just like you should check anything else in your CI process that you care about. In the CII Best Practices badge project we use both the "license_finder" program (which is an OSS tool) and the FOSSA service ( https://fossa.com/ ). Both examine the dependencies for licensing issues. While something could still slip through, it's much less…
Comment linking /
on “Always Review Your Dependencies, AGPL Edition”Submitted OSS Copyleft Licenses and Venture Capital as a story · 8 points
HN discussionPivotal Lab’s license finder used to be my go to recommendation (and still is if “free” is an absolute requirement), but if a company takes license management seriously, I’d recommend checking out FOSSA[0] instead. It’s significantly better and fairly reasonably priced. [0] https://fossa.com/
Comment linking /
on “Always Review Your Dependencies, AGPL Edition”Submitted Resemver: Using AI to rewrite semver based on actual breaking changes as a story · 7 points
HN discussion> Re long-term doing Wasp - also agree, we believe this is a full-time job so that is why we joined YC... All good, but what I really meant was, what happens when that funding money runs out and/or there's no business around wasp-lang to corner more investment? > Re Apache v2 vs MIT... Golang's BSD 3-Clause + patent-grant; and Rust's dual-licensed MIT (for compatibility with GPL v2, I believe) + Apache v2; whilst Cl…
Comment linking /blog/open-source-licenses-101-apache-license-2-0/
on “Launch HN: Wasp (YC W21) – DSL for building full-stack web apps”Submitted Vulnerability Remediation Tactics as a story · 6 points
HN discussionExcept every attorney that has taken a look disagrees with you. So it is complex and unless you have any standing or new data I think it's safe to dismiss your entire argument. https://decoded.legal/blog/2021/06/github-copilot-initial-th... https://fossa.com/blog/analyzing-legal-implications-github-c... https://felixreda.eu/2021/07/github-copilot-is-not-infringin...
Comment linking /blog/analyzing-legal-implications-github-copilot/
on “GitHub-Next”Submitted OSS Management Firm FOSSA raises a $23.2M Series B as a story · 6 points
HN discussion
