Forem: Oleksii Borisenko

Which open-source AI models are good for urbanism tasks and smart cities?

Oleksii Borisenko — Fri, 16 May 2025 11:19:01 +0000

In this research, we tested different Large Language models on urban-related questions dataset.

AI assistants and models are actively used by city dwellers to check information about city services and check routes (tourists) and by those who developed cities, such as architects, urbanists, environmental activists, politicians, and municipal government employees.

Urban MCQ (Multiple-Choice Question) Benchmarks include different types of questions related to urban studies, urban design, public spaces architecture, etc.

Questions related to the best urban practice were collected based on well-known research like "World Cities Report 2024", books and publicly available information.

Here is how the questions look like:

How does the "network" differ from the "polynuclear field" in urban planning?

There are also questions about specific places like:

What is a key feature of the Piazza del Campo in Siena that makes it a successful public space?

  {
    "id": 5,
    "question": "What type of urban space fosters social interaction?",
    "choices": [
      "Narrow alleys",
      "Pedestrian plazas",
      "Underground malls",
      "Expressways"
    ],
    "answerIndex": 1
  },

You can find the questions dataset and LLM answers logs in this repository.

Open LLMs/AI models Performance

Comparison of multiple LLMs on 101 domain-specific questions related to planning, design, and smart cities

Open source is significant for cities since it allows using related projects/models without limitations. City IT departments or contractors can deploy models on city infrastructure or in the certified cloud and are not subject to commercial limitations. In the list below, only one model published its wights under an open-source license: Mixtral 8x22B.

Mixtral 8x22B is developed by Mistral AI. Model weights are released under the Apache 2.0 license. This is a permissive license that allows users to use, modify, and distribute the model, even for commercial purposes, as long as they include the original copyright notice.

Llama-4 Maverick 17B 128E is part of Meta's Llama model family. Meta releases Llama models under a custom license that is more restrictive than open-source licenses. While it allows for research and some commercial use, it prohibits specific applications and requires users to register before accessing the weights.

Cohere Command R+ uses the CC BY-NC license (Creative Commons Attribution-NonCommercial). This license allows others to use, share, and adapt the work, but only for non-commercial purposes. Commercial use requires additional licensing arrangements directly with Cohere.

Google Gemma-3 27B is part of Google's Gemma family of models. Google released these models under the Gemma license, which is based on Apache 2.0 but with additional terms. The license allows commercial use with certain restrictions, particularly around safety, illegal content, and competing products.

Results for proprietary models with closed AI model weight.

Key Results for proprietary models:

Claude 3.7 Sonnet leads with highest score: 96.04%
GPT-4.1 follows closely behind: 95.05%
Gemini 2.0 Flash, Cohere commandA, and Mistral Large trail with scores of 90.1%, 89.11%, and 88.12% respectively
All LLMs performed strongly with scores above 88%
Notable performance gap (6-8%) between the top two models and the rest

There are 101 questions in this dataset, but we try to select and create different types of questions.

If you are an architect, urbanist, or environmental activist working with cities or have any ideas for urban-related questions and datasets, please contribute to the project or reach out to me.

How GoPro, Mercedes, Santander, and others retain open-source licenses and copyrights.

Oleksii Borisenko — Thu, 06 Jul 2023 16:32:06 +0000

One of the central claims in open-source licenses is to retain the copyright. Many proprietary software uses open-source projects, libraries, or packages.

For licenses like MIT, and BSD, copyright included in license text

Visual Studio Code license copyright

For licenses like Apache 2.0, copyrights are included in a file named NOTICE, which you can find in the root directory of the source code.

Prometheus NOTICE file

For Example, in license text, MIT license contains the following instructions "The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software."

Apache 2.0 license text contains the following requirement
"You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works;"

GoPro

GoPro for action cameras has a dedicated page where you can download archives which are open sources that are used in related camera models.

List of open-source projects and packages with licenses

Mercedes-Benz

Mercedes-Benz AG uses Free and Open Source software in their Vehicles. To check which software is used in your vehicle, you need to paste the related VIN on this site

As a result, you can download the pdf file with information related to the vehicle model.

Santander

The Mobile app has a separate menu item, "License", that contains license text with related copyrights notice.

License menu item

License text and copyright

Cisco

Cisco AnyConnect Desktop client contains license copyright information related OpenSSL Toolkit and libcurl HTTP library

AnyConnect dialog window

Share your findings on how the companies you know retain open-source licenses and copyrights in the comments.

How I use GitHub Codespaces for prototyping and demos. Instructions.

Oleksii Borisenko — Fri, 03 Mar 2023 13:00:44 +0000

GitHub Codespaces is an interactive developer environment in GitHub cloud, aka Cloud IDE, that uses VS Code and different types of containers to run User's code and expose internal ports using public URLs if needed.
I don't even remember when I used ngrok last time. Codespaces has all the needed features for my projects. You can work in codespaces with your private and public repo and other public open-source projects on GitHub.

What I've enjoyed in GitHub Codespaces:

Work, run and deploy your apps from any device and location
Each developer who has a GitHub account can easily fork and run your repo following instructions
Expose internal IP addresses and resources
Adjust and test Interaction using Webhooks or API server

Disadvantages:

CodeSpaces will be deleted after some time of inactivity. The default and maximum parameter is 30 days
Consequently User can lose the changes if you forget to push it to a related git branch
Developer needs to describe how to paste and manage credentials and sensitive data in Codespaces

List all of your Codespaces you can see on the following page https://github.com/codespaces

Containers in Codespaces

What happens when the User opens a repository in Codespaces by clicking "Create codespace on main":

Default Linux Universal container is deployed
All repository source code and other files uploaded to the new Codespace
Cloud VS Code will be available through the users browser

Default Linux Universal supports the following programming languages: Python, Node.js, JavaScript, TypeScript, C++, Java, C#, F#, .NET Core, PHP, Go, Ruby, and Conda.

The following customization is available:

Customize your container
Open related file(s) in Codespace
Provide post-create a terminal command that will run automatically
Port Forwarding instructions

All these instructions should be described in the .devcontainer/devcontainer.json file. The .devcontainer folder should be stored in the root directory of your repo

You can configure the dev container for a repository so that codespaces created for that repository give you a tailored development environment, complete with all the tools and runtimes you need to work on a specific project. Suppose you don't define a configuration in the repository. In that case, GitHub Codespaces uses a default configuration, which contains many of the standard tools that your team might need to develop your project.

The following examples use a universal container with 4 CPUs, and after deploying the container in Codespace, we open README.md and index.js files, run the npm start command, and Expose an internal 3000 port with a public URL (like https://${CODESPACE_NAME}-3000.preview.app.github.dev/)

{
 "image": "mcr.microsoft.com/devcontainers/universal:2",
 "hostRequirements": {
   "cpus": 4
 },
 "waitFor": "onCreateCommand",
 "updateContentCommand": "npm install",
 "postCreateCommand":"  ",
 "postAttachCommand": {
   "server": "npm start"
 },
 "customizations": {
   "codespaces": {
     "openFiles": [
       "README.md",
       "index.js"
     ]
   }
 },
 "portsAttributes": {
   "3000": {
     "label": "Application",
     "onAutoForward": "openPreview"
   }
 },
 "forwardPorts": [3000]
}

Codespace environment variables

There are a few Codespace environment variables that are helpful for the topic of this article:

CODESPACE_NAME - The name of the Codespace For example, octocat-literate-space-parakeet-mld5
GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN - Returns the domain of the GitHub Codespaces forwarded port. Usually, preview.app.github.dev

We have a few ways how we can use and store static public URL
Print URL in the terminal and copy and paste it into a related .env file or into the source code

The following examples help construct external URLs for the Node.js and Python Flask App.

The app is running on port 3000

const port = 3000
app.listen(port, () => { console.log(`App listening on port ${port}`) });

And you need to get the URL for the webhooks event.

echo "https://${CODESPACE_NAME}-3000.preview.app.github.dev/webhooks/event"

Or if you set the env variable as

PORT=3000

Than, we can construct this URL by the following command

echo "https://${CODESPACE_NAME}-${PORT}.${GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN}/webhooks/event"

Expected output:

The following code snippet deploys Flask App on port 8080

if __name__ == '__main__':
    app.run(host="localhost", port=8080)

Let's run this command to the URL for the Flask App

echo "https://${CODESPACE_NAME}-8080.preview.app.github.dev/"

By default Codespace port is private.
So in the terminal, open the Port tab. Click on Private in the Visibility column, and change it to Public

Share your tips for using Codespaces in the comments.

API Product Managers vs. API Developers

Oleksii Borisenko — Thu, 01 Dec 2022 23:12:32 +0000

Terminology that will be used in the article:

API Consumer - end user(s) interacting with an API
API Resource - an entity that has a URI where it can be manipulated through HTTP requests. Defined by the endpoint + path, e.g. https://API-SERVER/v1/book
API Operation - a combination of a resource and HTTP method, e.g., GET https://API-SERVER/v1/book/1

API Product managers are usually responsible for the following:

Defining the technical and business details of API (API contract)
API strategy, follow and know the API lifecycle, and bring the necessary reliability, observability, and governance to your operations.
Responsible for the creation initial OAS document
Defining API roadmap
Managing feature requests
Organizing EFT & GA releases

API developers and architects are usually responsible for the following:

Organizing the API implementation
Refining the API design
Reviewing updates of the API contract
Following security standards

What instrument does the API product manager have.

First, if you are a product manager for API, you should understand that your API Consumers/clients are developers and businesses, of Course.

Important tools:

Conjoint Analysis
Interview
Analytics

Apimatic complete set of DX components such as autogenerated SDKs, API portal, API docs, live code samples

An Open List of REST API Standards

API development tool: Postman, Eoapi

Whether you work with an open-source product or a big enterprise solution, be sure you can find internal/external (or northbound/southbound) API to interact with specific solutions. As for now, 90% of developers use external APIs.

What instruments do API developers and API architects have.

OpenAPI Generator allows the generation of API client libraries (SDK generation), server stubs, documentation, and configuration automatically given an OpenAPI Spec (v2, v3)

API Insights - manage versioned API specifications (Swagger 2.0/OpenAPI Spec 3.x) for services. It also does static analysis of API spec files.

RESTful API Modeling Language (RAML)

JSON visualizer
JSON validator
YAML validator
Collaborative Design & Documentation for APIs

Cherrybomb is a CLI tool that helps you avoid undefined user behavior by auditing your API specifications, validating them, and running API security tests.

API development tool

Workato API Platform
MuleSoft- API management, monitoring.

The Biggest cloud provider has their solutions and tools for API:

URI, Status codes
Refer to the API design; your dev team should manage the status codes.
The product manager should define what useful information can be added besides the HTTP Status Messages Description that can be extended by API PM (HTTP/1.1 406 Not Acceptable).
REST API URI suggestions:
Use a dash to improve the readability
The lowercase letter is a good choice
Avoid odd pluralization (network/networks image/images)

API limitation
API or API QPS (Queries per second) can be limited by the number of API calls. Or after API Consumer buys the product and purchases a subscription, the API Consumer should not pay extra and can use this API without API operation limitation. API product managers need to define the difference between freemium and Pro/paid API versions for other products.
In limitation, we expect that Business models will be defined with the customer.

Developer support
As for me, it is a must to have. First, it helps your API Consumer solve problems connected with the API and services you provide. Second, this also gives you valuable data to analyze what you can improve and which service capabilities you can enhance or retire old APIs.

Developer documentation
Part of the project that needs to be delivered. Auto-generated docs sometimes need to be clarified and fully documented. API PM, developers, and tech writers must add operation descriptions, input/output parameters, and structure for all success and failure responses. Your API will be used using various SDK programming languages. At the familiarization and testing stage, the API Consumer will use specific API operations to solve the problem. Therefore, it is essential to write clear documentation, and besides that, the URI can tell a lot about what the API method does precisely.

Code samples and learning materials
These resources are essential for the API Consumer to quickly prototype and bootstrap projects and learn how to utilize your API. Besides, it's good to have learning materials and tutorials to help educate API users. Finally, furnish samples of queries and replies to enhance the understanding and usability for developers.
Need to be detected and defined by API PM and developers

Tests environments
Need to be defined by API PM, detect minimum resources and scope required by the clients. And then, the Product manager monitors usage and issues connected with the test environment, collecting data to add new features to the test env.
API Developer design and deploy test env, maintain tech environment, and upgrade related hardware and software

Changelog
All changes need to be tracked and available for the changes. If you have different versions and migrate from one to another /v0 to /v1, you need to give us time for our customer to change it. I saw different samples when this transfer period was six months and up to 1 year.

Conclusion
Of Course, product and dev teams need to work closely with each other to create the best products. From the users and business side, developers and product managers are on one side of the wall, so no matter if you are an API developer or API, Product manager. Your main goal is to do your best, collaborate and deliver the best product.

Unpacking new OpenAI image generation API (+ Postman collection)

Oleksii Borisenko — Wed, 09 Nov 2022 17:59:02 +0000

OpenAI release new image generation capabilities with DALL·E models.
All images (except compilated and screenshots) in this post were generated using OpenAI image generation API.
According to Your Content Terms of Use chapter: "OpenAI hereby assigns to you all its right, title and interest in and to Output."

New users can use credit for $18 (Free trial usage). With this credit, you can create or edit 900 images 1024x1024

API key

First, after registering and confirming your phone number, you need to Generate your API key

With this API key, we can move forward.

OpenAI API images Postman collection

I've created OpenAI API images Postman collection that users can play with. You can open this collection and go through the steps below.

Let's begin with generating the image

In Postman, when API opaeration body contain response_format="b64_json" we will receive base64 image string

POST API operation with body

{
    "prompt": "RESTfull API security",
    "n": 1,
    "size": "1024x1024",
    "response_format": "b64_json"
}

We received the following response.

{
    "created": 1667860720,
    "data": [
        {
            "b64_json": "iVBORw0KGgoAAA  ...."
        }
    ]
}

And then, we need to convert the base64 string into the image.

For this, let's use the following Postman Test script:

var data = JSON.parse(responseBody)

const base64ImgData = `data:image/png;base64, ` + data.data[0].b64_json

const template = `
<img src="{{img}}">
`

pm.visualizer.set(template, {img: base64ImgData})

In base64ImgData, I've also concatenated data:image/png;base64, string with b64_json encode string for the correct output in Postman.

And then clicking on the Visualize tab, we can see our generated image.

Create image edit

Here inputs images and the results. Prompt: DS-1 Death Star in the sky

For creating your own mask, you can use a free online editor https://www.photopea.com/ or for the background removing https://www.remove.bg/

Python function to edit image:

def imageEditB64(promptText, numberOfImages, imgSize, uploadedImgPath, maskImgPath):


    response  = openai.Image.create_edit(
    image=open(uploadedImgPath, "rb"),
    mask=open(maskImgPath, "rb"),
    prompt=promptText,
    n=numberOfImages,
    size=imgSize,
    response_format="b64_json"
    )

    image_64_encode = json.loads(str(response))["data"][0]["b64_json"]
    image_64_decode = base64.b64decode(image_64_encode)
    fileName = promptText.replace(' ', '_') + '.png'
    image_result = open(fileName, 'wb') # create a writable image and write the decoding result
    image_result.write(image_64_decode)

imageEditB64("DS-1 Death Star in the sky", 1, "1024x1024", "kolochava-ukraine-1024.png", "kolochava-ukraine-1024-mask.png")

The result of using the OpenAI library was OpenAIObject, so we need to convert it to a string for parsing and next image decoding.

Also, you can check simple Python source code here.

Create image variation

To add a related image needed for an API request in Postman, click the 'Body' tab, and then in the 'VALUE' column, push the 'Select Files' button.

Regarding API response time* (using my Postman collection)

Image generations for size 1024x1024 take 6s-8s
Create image edit for size 1024x1024, takes 15s-17s
Create image variations for size 1024x1024, takes 12s-14s

for prompts with 10-195 characters

During my work, I received diferent HTTP error codes, and the response description is excellent and informative.

Missing image

400 Bad request
{
    "error": {
        "code": null,
        "message": "'image' is a required property",
        "param": null,
        "type": "invalid_request_error"
    }
}

In case if uploaded image size is not one of 256x256, 512x512, or 1024x1024:
401 Unauthorised

{
    "error": {
        "code": null,
        "message": "Uploaded image must be a PNG and less than 4 MB.",
        "param": null,
        "type": "invalid_request_error"
    }
}

401 Unauthorised

{
    "error": {
        "code": null,
        "message": "You didn't provide an API key. You need to provide your API key in an Authorization header using Bearer auth (i.e. Authorization: Bearer YOUR_KEY), or as the password field (with blank username) if you're accesing the API from your browser and are prompted for a username and password. You can obtain an API key from https://beta.openai.com.",
        "param": null,
        "type": "invalid_request_error"
    }
}

In case the API key is wrong.

{
    "error": {
        "code": "invalid_api_key",
        "message": "Incorrect API key provided: sk-***********************. You can find your API key at https://beta.openai.com.",
        "param": null,
        "type": "invalid_request_error"
    }
}

But returning the wrong API key in response is not a good idea from a security perspective. For example, imagine that we print API errors in the console or the GUI of our APP with information about errors, and an external audience can see this.

If you have a problem with limits, you will get the next response
400 Bad request

{
    "error": {
        "code": "billing_hard_limit_reached",
        "message": "Billing hard limit has been reached",
        "param": null,
        "type": "invalid_request_error"
    }
}

Complete guide to open source licenses for developers. Friendly licenses for proprietary software

Oleksii Borisenko — Thu, 08 Sep 2022 10:42:50 +0000

Introduction
- Disclaimer
Open source licenses
About popular licenses
- GNU General Public License
- Apache
- MIT
- BSD
- Creative Commons
Other interesting licenses
What about unlicensed projects?
Compatibility of licenses
Multi-licensing
- How to correctly add multiple licenses to your GitHub project?
About changing the license
- Contributor License Agreement (CLA)
Open source policies in commercial companies
Friendly licenses for proprietary software
Interesting legal cases
Using license templates (GitHub, GitLab)

Introduction

Developers do not often pay attention to licenses when using various open-source projects. We can often use projects*/part of a project or functions for our applications and programs without thinking about how it might affect the future. Do you need to keep copyright? What are the requirements and obligations of different licenses? In this article, I want to highlight the issue of choosing licenses for the project and the specifics of using projects with different types of licenses.

*Here and below, the project refers to an open-source project or repository.

At Cisco, I have been developing two platforms for code exchange. Code Exchange and Automation Exchange are aggregators of open-source projects. We have requirements for the availability of licenses, for the availability of copyrights, etc. Below I will share information about licenses and their use for commercial projects/proprietary software.

Disclaimer:

Information in this guide should not be considered legal advice.

Open source licenses

A license for open source projects is a legal contract that regulates the relationship between the author(s) and the user, which describes the terms of use of the project/code, including in commercial programs. The license defines what can and cannot be done with the software components, the obligations, and the features of use. Also, the license regulates the responsibility of the authors and contributors to the project. Courts of different countries have ruled that an open-source license is an enforceable contract.

In licenses, pragmatism and free software ideology often fight. When we hear open source, we may think that it is possible to use/modify projects without problems. Still, as mentioned above, each license imposes certain obligations from the moment of use, at least - to keep the copyright. Specific licenses may require you to publish the source code of the entire project in which the code was used, for example, when using a project under the GPL license.

Licenses can be divided into:

Copyleft (GNU GPL, Microsoft Public License),
Permissive (Apache, MIT, BSD).

Copyleft can also be divided into “weak” and “strong”:

"strong" include GNU, GNU Affero General Public License
"weak" - for example, Eclipse, GNU Lesser General Public License (LGPL).

For weak Copyleft licenses, it is permissible to compile different binary files and release the result with a different type of license, or not to change the license of the source project.

This is what the Top licenses looked like in 2021. Data: MEND open source research

But what is the difference, for example, between different copyleft or permissive licenses?

For this, it is necessary to dive deep into the license text and look for differences there, as well as in legal cases and judicial practice. Also, unfortunately, the speed of reading licenses can be equal to the rate of reading the user agreement.

In this regard, infographics like:

Generally, it is common practice to recommend a license for use (except superseded ones) from the Open Source Initiative (OSI) list. There is a separate term - Source-available for projects that are distributed with licenses, not from the OSI list.

About popular licenses

GNU General Public License

The GPL is generally considered an "aggressive" license, which sometimes is incompatible with other copyleft licenses.
In addition, this license is often called viral license because they are transferred from project to project.

If you use GPL-licensed projects in your software, then all your software is considered a "work based on" the GPL. Copyright and patent usage rights are unregulated. Who then monitors that GPL projects remain copyleft? Various associations and unions do this, but in addition, individual contributors and free software evangelists (Harald Welte) also act as plaintiffs in cases of violation of the license agreement. Besides Free Software Foundation (FSF) - this organization owns the rights to parts of the GNU systems project.

Exceptions to the GNU Lesser General Public License

Until 1999, the license was called the GNU Library General Public License. GNU LGPL was created not to violate the principles of free software so that developers can use this license for their libraries and scripts. In addition, other developers and companies can use the relevant projects with the LGPL license without affecting the license of the main/compiled project, derivative work (including commercial ones).

Projects using the GNU GPL: Linux Kernel, WordPress (GNU GPL-2.0), Solidity, the Smart Contract Programming Language (GNU GPL v3.0), Grafana (GNU Affero General Public License v3.0), FFmpeg (GNU Lesser General Public License (LGPL) version 2.1), Signal (GNU Affero General Public License v3.0)

Apache

Unlike other permissive licenses, it has clause 3 (3. Grant of Patent License.), which refers to patents. The Clause governs the disposal of patents: participants grant permission to use any of their patents that may relate to their contribution.

Also, if you have modified parts of the files/code, you can apply for a new license. And indicate all the files that have been changed.

The difference between Apache 1.0 and Apache 1.1, Apache 2.0 licenses is that version 1.0 removed the requirement that all promotional materials of the project should contain the message "This product includes software developed by the Apache Group* for use in the Apache HTTP server project (http://www.apache.org/)." In later versions, it is enough to simply place the license in the root of your repository.

Also, you can release/publish a modified version of the project (which was under the Apache license) under a different license, excluding those files that were not modified.

The popularity of this license is constantly growing, not least because this type of license has been chosen as mandatory for projects by the Cloud Native Computing Foundation.

Projects using Apache 2.0: Kubernetes, Selenium, TensorFlow

MIT

The license allows you to do whatever you want with the code; the only requirement is keeping the original license and attribution information. If choosing between permissive licenses for your project, I would choose and recommend MIT.

In short, it is straightforward, does not require additional NOTICE files, and you can use copyrights of any organization and trademark.

There are projects and resources that automatically apply the specific license to code/content that you created using related project
For example:

The ISC License is the default license used when setting up a new npm package with the npm init command. > The ISC License (ISC) is functionally identical to the MIT License, but with some wording deemed unnecessary removed.
CodePen's are automatically MIT licensed.

Projects using MIT: Visual Studio Code, Julia Language, Electron, Angular.js, Rails

BSD

BSD (Berkeley Source Distribution). Permissive open source license that retains license and copyright notices. The license allows the distribution of more significant or licensed works without source code and under other license terms. The 2-Clause BSD License is very similar to the MIT License.

The modified 3-Clause BSD version protects you/the contributor from having your name used in the project if you don't want it, thanks to the unsupported posting.

Also, there is a license BSD+Patent that regulates patent issues. And each copyright holder and contributor with this grants an irrevocable patent license. But, good news for patent owners - "The patent license shall not apply to any other combinations which include the Contribution."

Some code of BSD projects distributed under BSD or similar licenses is used in commercial Windows, macOS, and iOS software.

Projects running BSD: Flutter, libssh2

Creative Commons

The license allows users to distribute and copy the author's works.
For StackOverflow users, it will be interesting to know that according to the Terms of Service, all content created on the platform (including questions and answers) is licensed under Attribution-ShareAlike 4.0 International (CC BY-SA 4.0).
License is also used on the YouTube platform for video creators.

Other interesting licenses

Do What The F*ck You Want To Public License - no comments here, in fact the license can be classified as permissive.

Open Government License — Canada

Canadian government license for open source. According to the text, the license can be classified as permissive. However, as noted in the License text, the license is also subject to "Crown Copyright".

Business Source License 1.1

License from MariaDB Corporation, which develops the relational database project of the same name. The license is attractive in that it limits the project's use only in a non-production project (non-production use of the Licensed Work).

Restrictions are set for four years. And the term is calculated from the change date or the fourth anniversary of the first public distribution of a specific version of the project, whichever comes first.

What about unlicensed projects?

If the project is published without a license, it does not mean that it can be used.

By default, the software is protected by exclusive copyright, and without a license, use is illegal, even if the project is published. Only the license grants permission to use, copy, distribute, or modify the software without risk of infringement if the terms are met.

In particular, we cannot accept and publish projects without a license on our project exchange platforms. Most organizations and companies also do not publish their projects without licenses.

Compatibility of licenses

Each application or program usually involves many different libraries, and projects, each of which has its license with its own set of conditions. So how can you ensure that all the licenses you use are compatible and compliant?

Black Duck Audit Services found that 53% of audited codebases in 2021 contained open source code with conflicting licenses. 20% had open source projects without licenses or custom licenses. In general, 97% of commercial code contains various parts and open source projects. Most licenses protect and insure authors from possible lawsuits or damages that may be caused during the use of open source components and projects in commercial products.

Next, I will list some examples of license compatibility/incompatibility.

The Ms-PL license is attractive because it does not oblige you to publish the source code. However, the license also obliges you to retain all copyright, patent, trademark, and attribution notice originally present in the software.

Microsoft Public License (Ms-PL) and Microsoft Reciprocal License (Ms-RL) compatibility. The difference between them is that Ms-RL is a copyleft, so you can modify and use the files as long as you keep the source code under the Ms-RL license. Interestingly, most projects are now distributed under the MIT and Apache-2.0 licenses.

Ms-PL is not compatible with the GNU GPL. (Ms-PL clause enables compiling the program without distributing the source code.)

2-clause BSD and 3-clause BSD are compatible with the GNU GPL.

The Apache 2.0 license is compatible with the GPLv3, provided, of course, that the final software is to be released under the GPLv3.

However, Apache 2.0 is incompatible with GPLv2 because a restriction stops the release of a patented work if a court has found a patent infringing (Clause 7 of the GNU GPL-2.0).

The following diagram shows an example of compatible licenses.

If the licenses are compatible, there is an arrow between them. The direction of the arrow indicates the more substantial license. A substantial, strong, inclusive license is a license that essentially includes all the key terms of another license.

Multi-licensing

Some projects are released and published under two or more licenses. Often, multi-licensing in a project involves using both copyleft and proprietary licenses. This principle gives users and organizations more freedom in using the project or code.

Supporters of the free distribution of code and programs can, for example, leave the GPL license. Proprietary licenses can be used by developers who want to monetize their products or use the project in commercial solutions with patenting and without publishing the code. In addition, several licenses allow you and users to use one of the corresponding licenses. This avoids conflict of licenses when integrating the project into the main application or project in which solutions with other licenses were already involved.

An example of multi-licensing is the Perl programming language. Perl has a GPL license in the Copying file, and the Artistic license in the root directory. The README states that it is possible to distribute and modify the project according to the terms of one of the licenses. In addition, the License file may not contain the text of the license directly, but information about the licenses under which the project is published or the projects/libraries included in it.

In addition, the License file may not contain the text of the license directly but information about the licenses under which the project is published or which projects/libraries are included in it. For example OpenPDF.

How to correctly add multiple licenses to your GitHub project?

To display correctly on GitHub, you must add license files with the appropriate text inside. And place the files in the root directory of your project.

The keyword License or COPYING must be placed at the beginning of the file name, for example, License.BSD, License_MIT. An excellent example of how to organize multiple licenses - RocksDB

A dialog window with Licenses on GitHub

The project includes a fork or part of another project with different licenses.

When your open source project contains forks of other projects or used project code with different licenses and copyrights, a separate directory is created where the licenses of the projects used in your project are placed.

Refer to the following examples:

The following screenshot shows an example of organizing information about licenses that are used in different parts of Elasticsearch:

It may be a good practice to add appropriate license and/or copyright information to each source file. Sample: About License Headers in Contributing to elasticsearch.

About changing the license

Can I change the project license? Yes, the license can be changed, but the license change must be agreed upon with all project contributors. Even if it was a contributor to the Readme file. So it's good to do it in the beginning when you're the only contributor. You can even change the license to a proprietary license, but such a change is not retroactive. Accordingly, all previous versions/releases can be used with the licenses in place at that time.
There are cases when you transfer rights (copyright, moral rights) to an organization, a legal entity that owns the rights to the project. In this case, the relevant rights owners can change the license without the contributors' consent. See Contributor License Agreement (CLA)

Case: Facebook was using a BSD license plus their custom Additional Grant of Patent Rights. License was changed to MIT on September 26, 2017, and the Patent grant was deleted.
Some companies decide not to use React in their project because of the patent grant.

“The license granted hereunder will terminate, automatically and without notice, if you (or any of your subsidiaries, corporate affiliates or agents) initiate directly or indirectly, or take a direct financial interest in, any Patent Assertion”

A number of licenses require the project to be released under the same license and version or a later version of the corresponding license (e.g., GNU LGPL).

Contributor License Agreement (CLA)

CLA - the document that regulates intellectual property of user contribution.
In some cases, open source project owners/maintainers ask to sign a Contributor Agreement, which can affect copyright and other rules. So signing the CLA is one requirement for reviewing your Pull/Merge request.

Two options are available:

Copyright License. The contributors retain the copyright to their contribution. Sample: InfluxDB
Copyright Assignment. The contributors transfer the copyright of their contribution to the project. Sample: Clojure Contributor License Agreement

Transfer the copyright. Sample from the MongoDB Contributor Agreement
By submitting a Contribution, you assign to MongoDB all right, title and interest in any copyright you have in the Contribution, and you waive any rights, including any moral rights, database rights, etc., that may affect our ownership of the copyright in the Contribution.

Open source Contributor License Agreement assistant

Friendly licenses for proprietary software

For commercial companies, the question always arises, which products can be used in commercial/proprietary software (solutions), and what are the exceptions for this? Although, in particular, most licenses can be used in commercial software, you must also consider whether you are not violating other rights, including rights to trademarks and patents.

Permissive licenses are often called commercially friendly. However, if the application/device uses a part licensed under the GPL, then, accordingly, the issue of publishing the entire source code will arise.

Many commercial organizations and non-commercial organizations created their open source licenses with appropriate names:

Common Public License (IBM).
Eclipse.
PHP License 3.01.
Mozilla Public License 2.0 (uses Terraform).
W3C License (W3C).
European Union Public License.
Python License.

For many projects and products, it is important to keep track of which open source projects and under which licenses you use.

In particular, Open source inventory is a mandatory stage in the following cases:

Security audit of the company;
Certifications (including information security);
Merge and acquisition operations. The scope of the company's intellectual rights, patents, and developments should be determined.
Investments in startups

In my experience of working with startups, only once have they asked whether open source component licenses allow them to be used in commercial solutions and what obligations arise.

Unfortunately, most project analyzers (Open source inventory) are applied before external requirements and are not integrated into the development process. And then, the report on the compatibility of licenses may look like a disappointing diagnosis of a doctor, and conditional treatment in such a case may be painful — rewriting components and searching for a replacement with appropriate licenses/patents.

Instead, it is better to go through prevention, that is, to conditionally know about the topic of licenses - this guide is written for this. So creating license usage documentation and policies can help, regardless of the size of your company.

Open source policies in commercial companies

Some companies create their licensing policies. The policies describe procedures and requirements for publishing projects. In addition, there are also requirements for project licenses that can be used in the company. There may also be lists of valid and invalid licenses (for example, block, allow list).

In particular, permissive licenses (Apache, MIT, BSD) or other special licenses of companies are usually added to the permissible ones. In most companies/organizations, the default copyright is the legal name. When creating and contributing to relevant projects, intellectual rights may belong to individual employees or be transferred to the company/customer (where the employee works), unless otherwise specified in the contract.

For example, patent protection covers specific processes, products and methods; and copyright protects the corresponding work, in our case, program code, graphic elements, and images.

I give an example of a list of licenses with a level of risk relative to use in proprietary software. The greater the risk, the greater the problem of using adequately licensed components in your proprietary (commercial) software.

Open source inventory (BoM) is a mandatory stage before mergers and acquisitions, IPOs, and attracting investments. As a result, you can get information about the dependencies and licenses of the included components.

Such reports can also identify components with restrictive requirements or incompatible with other components.

Reports contain information about all included libraries/projects, including transitive dependencies.

In the security field, we can often find tools for collecting information about the components of the analyzed software. Some of these tools and products also report information about licenses and conflicts between them. Most of the functionality of such tools is paid.

Interesting legal cases

GOOGLE LLC v. ORACLE AMERICA, INC.

As often happens, large corporations acquire many projects and startups. Later, problems or claims regarding using open source projects or other resources protected by patents and copyrights appear.

Google bought Android. Android code used Java API methods. Oracle's lawsuit alleged patent and copyright infringement related to Java SE. The trial took several stages, resumption of hearings in various courts. A decision by the US Supreme Court has determined that use falls under the term "fair use".

GitHub Copilot

For example, if you are training a neural network or your product includes models that are licensed under a free content license, what obligations arise in this case?

GitHub Copilot was trained on repositories, including those with copyleft licenses, which stipulate that projects based on and/or incorporating the software are licensed under the same copyleft license.

But developers/owners did not publish the GitHub Copilot source code. And not under a copyleft license, but, on the contrary, the use is paid according to the subscription model. In this case, using repositories for neuron training and using a project with a copyleft license is not the same, so it is challenging to comment unambiguously on the issue.

Faker

There was also an interesting case that is not directly related to licenses. Still, it raised several questions regarding the responsibility of developers of open source projects, and the distribution and use of open source projects by commercial companies.

An NPM Faker library was published under the MIT license (the project is no longer available). The library was used in many commercial companies and other open source projects (AWS CDK). The license provides for commercial use, but at one point, the developer decided to make specific changes that, when updated, disrupted the regular operation of applications in which the project is used.

MIT protects authors and developers from possible damages and liability "THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT...". But on the other hand, the changes made and further communication from the developer revealed that critical changes were made to the project because many commercial companies do not pay for the developer's work. However, the project was published on GitHub under a free-to-use public license.

GitHub later closed access to the repository, which caused some questions from the developer and part of the open-source community.

Using license templates (GitHub, GitLab)

Previously, many open source projects were published without licenses. The situation in this direction changed after deploying related features in GitHub/GitLab. When creating a repository, you can choose a related license template. And in the license text, the corresponding copyright will be included (if the license provides for it). Usually, it's your name or the name of the organization. But even when using templates, a number of things should be done manually. For example, for Apache 2.0, the copyright must be added to a separate NOTICE file, but the file is not automatically created.

But unfortunately, most licenses for private, small projects are not chosen wisely. For large projects, the choice is usually made by people with relevant experience. They already select a license that considers the project's specifics, forked projects, and potential license conflicts.

GitLab also has a license selection functionality, but the functionality is available after the repository is created (and not during creation as in Github). Therefore, you need to go to the License section to choose a related license. In addition, in GitLab, for specific licenses, the copyright is not added to the corresponding NOTICE file but the text of the license. Namely, for Apache 2.0 and GPLv3.0 licenses, it is correct to add the copyright not to the license text itself but to the NOTICE file. For Apache 2.0, the license text in the section Appendix lines 189-190 specified what information should be entered in the NOTICE file. Same for GPLv3.0 (section END OF TERMS AND CONDITIONS) see lines 633-635.

Other open source project aggregator platforms can also offer a choice of appropriate licenses or, like Google developers, limit the selection to the 6-9 most popular ones.

Edit or contribute on GitHub

IoT application using LoRaWAN Network Server

Oleksii Borisenko — Thu, 07 Apr 2022 16:45:52 +0000

This story is about how my team and I developed an IoT application for parking that received data from IoT sensors, processed data, and displayed it. Also, in the solution, we have many features connected with booking parking slots, etc.
Of course, since the time this application was created and is running (2019), other competitive solutions have significantly developed. The solution that uses computer vision or cheap sensors for underground parking is more effective, more inexpensive, or easy to deploy in some cases. The experience described below can also help create IoT applications to interact with various other sensors that work using sensors of movement, door opening, light, temperature and humidity, water meter, kilowatt-hour meter, etc.

Сomponents used in this solution:

Smart Parking devices (Libelium Smart Parking, TBS-220 geomagnetic vehicle detector)
LoRa Gateway (Cisco Wireless Gateway for LoRaWAN)
LoRaWAN Network Server (Actility or Open source LoRaWAN server)
IoT app can be deployed on IoT compute gateway

Why LoRa?

Extended range of one radio gateway - up to 15 km radius outside the city area (up to 10 in the city).
Unlicensed frequency band - no use permit is required.
Scalability - up to 20,000 end sensors per 1 gateway.
Low cost of both end devices and radio gateways.
Due to its low power consumption, the sensor runs on an average of 4-5 years of battery life, allowing it to be placed anywhere without wiring and power.
Data Security - All data is encrypted by AES-128 by default; each sensor has its unique encryption keys.

In general, security aspects are also problems in this area. For example, there were a lot of cases when a home IoT system, based on an open source, was hacked, and the attacker was in control of turning on the light and getting control of other devices (blinds, electrical appliances, etc.) And also getting access to IP cameras.

Table comparing different technologies for IoT

Are Sigfox and LoRa still competitors? Unfortunately, yes. But people aren’t as focused on network technology these days — they’re focused on use cases and applications. As a result, these technologies have been relegated to their proper place — they’re tools, nothing more.

Each LoRa device sensor has unique parameters for recognizing in LoRa network and encrypting the data payload:

Device EUI
Device Address
Network session key
Application session key

Many IoT device manufacturers have apps and interfaces for configuring devices and firmware.

Some other settings:

LoRaWAN join mode, ABP or OTAA
LoRaWAN port
LoRaWAN application key
LoRaWAN application EUI
LoRaWAN EUI that will be loaded from the device.

Network Server interface, device configuration

Interaction with the sensors

For interaction, we use Uplink and Downlink. Uplink is what we receive from a sensor or IoT device, and Downlink is the data we can send to IoT devices.
We can have 12 bytes payload in the uplink, more precisely 96 bits.

What information can we extract from this?
ID of the device, Battery level, Status of the parking slot, Temperature (Celsius degrees) from the node’s internal sensor.

For example
Payload: 0400003f34b909173f600fc2

Python function that we use for extract the data

    def parsing_payload_hex(data, payload_key="{http://uri.actility.com/lora}payload_hex"):
        try:
            _hex = data[payload_key]
        except IndexError:
            raise IndexError('No frame in payloads')
        else:
            byte_binary = "{0:08b}".format(int(_hex[:2], 16))

            parking_slot = int(byte_binary[:1])     ## Occupation status    0 - free; 1 - occupied;
            battery = int(byte_binary[1])           ## Charge level         0 - Good; 1 - little;
            frame_type = int(byte_binary[4:8], 10)  ## Frame type           0 - Info; 1 - Keep-alive; 2 - daily update; ...

            return parking_slot, battery, frame_type, int(_hex[2:4], 16)
            ##       parking_slot|battery|frame_type|frame_counter

Application

Technology stack: Vue.js, Python, C

Basic capabilities:
The Application with GUI, where admin can add parkings, configure parking slots, assign parking slots to certain IoT devices. Essential features for users like displaying which parking slot is occupied/free. Review which slots are booked/available on a specific date and time. Send links for external users to book places for themselves.

Extra features:
Automatic cancellation of the booked place if the place was not being occupied within 15 minutes of the scheduled time.
Ability to define a fixed parking space as available for booking during a specific period (for example, in case of vacation or business trip)
Display users booking statistics
Integration with 3d party messaging service

Also, the admin can see statistics. For example, is the slot occupied during the booking period and the number of cancellations.

We use this solution for corporate parking, where we have slots for guests and need to book it for guest customers or partners. Through API app can also send the card number to the 3d party system.

You can test your app using this sandbox