Metraipolis › archive › dc_522a85b60caa

License Compliance in Open Source Cybersecurity Projects — arXiv:2609.21218

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.21218
License (as archived): CC0-1.0
Archived: 2026-10-10T01:42:40.775Z
SHA-256 of the archived text: 2cbe3074c28a64605c95579d93eb8e7101b24d5535041664f31eac6e429c3d15
Stable URL of this page: https://metraipolis.com/documento/dc_522a85b60caa

How to cite

License Compliance in Open Source Cybersecurity Projects — arXiv:2609.21218 — arXiv (en), https://arxiv.org/abs/2609.21218 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_522a85b60caa (Metraipolis archive dc_522a85b60caa, sha256 2cbe3074c28a64605c95579d93eb8e7101b24d5535041664f31eac6e429c3d15)

BibTeX

@misc{dc522a85b60caa,
  title = {License Compliance in Open Source Cybersecurity Projects — arXiv:2609.21218},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.21218},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_522a85b60caa; sha256 2cbe3074c28a64605c95579d93eb8e7101b24d5535041664f31eac6e429c3d15},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.21218. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Developers of cybersecurity software often include and rely upon open source software packages in their commercial software products. Before open source code is absorbed into a proprietary product, developers must check the package license to see if the project is permissively licensed, thereby allowing for commercial-friendly inheritance and redistribution. However, there is a risk that the open source package license could be inaccurate due to being silently contaminated with restrictively licensed open source code that may prohibit the sale or confidentiality of commercial derivative work. Contamination of commercial products could lead to expensive remediation costs, damage to the company's reputation, and costly legal fees. In this article, we report on our preliminary analysis of more than 200 open source cybersecurity projects to identify the most frequently used license types and languages and to look for evidence of permissively licensed open source projects that are likely contaminated by restrictive licensed material (i.e., containing commercial-unfriendly code). Our analysis identified restrictive license contamination cases occurring in permissively licensed open source projects. Furthermore, we found a high proportion of code that lacked copyright attribution. We expect that the results of this study will: i) provide managers and developers with an understanding of how contamination can occur, ii) provide open source communities with an understanding on how they can better protect their intellectual property by including licenses and copyright information in their code, and iii) provide entrepreneurs with an understanding of the open source cybersecurity domain in terms of licensing and contamination and how they affect decisions about cybersecurity software architectures.

Tema degli esploratori: governance digitale e beni comuni (retro-catalogo arXiv: annunci del 2026-09-21 in cs.CY).
Categorie arXiv: Software Engineering (cs.SE) ; Computers and Society (cs.CY).
Pagina del lavoro: https://arxiv.org/abs/2609.21218 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-10T01:08:18.790Z dalla pagina https://arxiv.org/catchup/cs.CY/2026-09-21?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).