A note on licensing code snippets =================================

First draft: 2025-09-18
Published:   2025-11-12

TL;DR: Content licensed under CC BY or CC0, and not explicitly stated to use a proper permissive software license (like Apache-2.0 for example), should only be used for educational purposes. This basically means I would recommend against copying and pasting directly. A good alternative method would be to try understanding the concepts, then recreate the code yourself.

Motivation

In a recent article I wanted to share some GIMP scripts, before updating them to a new version. I have found that originally I have dedicated them to the Public Domain, through the CC0 mark. This had caused a bit of a headache for me, because at first I wanted to explain there how is this different from other code on this site, just to realize that really, it is about the same.

Now the one thing I do not want to do, is changing the license after-the-fact. It is not what responsible people do. So instead I would like to explain now why could this be an issue for you as user of the code, and how can I as publisher maybe address the problem in future cases.

CC licenses for software?

Because Creative Commons licenses address patent rights in a different way to other permissive software licenses, this makes them dangerous not for the publisher but for the users of the code. It could turn out to be a trap: if the publisher were to hold any patents on underlying concepts that this code is an implementation of, they could start enforcing their rights in the future, which might be something unexpected for users of the code who are not aware of this risk.

Just to be clear, while if I am not mistaken this is a problem with all the CC licenses, we are mainly talking about CC0 (the Public Domain dedication) and CC BY here; the rest are more complicated with other concerns as well.

I do not want to explain here what the Public Domain is and what it is not, I hope you can find the most important facts in the linked articles. One thing that must be kept in mind is that it does not seem to be recognized everywhere, or at least not to the same extent; so while it appears to be a perfectly valid choice for software, I believe the main issue is what happens in jurisdictions where it is not applicable. Here comes CC0 into the picture, which is not a license in itself strictly speaking, but a dedication that comes with a fallback license: in the case Public Domain is not applicable, here are a bunch of terms that tries to resemble the same rights. One caveat is that it explicitly says (in section 4. paragraph a.) that the licensor does not waive their patent rights.

The Creative Commons Attribution license (or CC BY for short) is similar to the CC0 fallback, just adding that the licensee must retain or provide the appropriate attribution notice alongside the work. It contains a similar statement (in section 2. paragraph b2.) on patent rights, that we were concerned with in CC0 as well.

While these both are considered to be a good choice for art, documentation, educational materials or data/databases, Creative Commons explicitly recommends against using their licenses for software. While this definitely includes CC BY, the situation for CC0 is not that clear cut: this FAQ post states that while they deem it suitable for software, other independent organizations have differing opinions.

Interestingly, the Free Software Foundation treats these as compatible with GNU GPL, but they list them under the "Licenses for Works of Practical Use besides Software and Documentation" section. As a side note, I could not find a good reason why they would not be suitable for documentation; in fact CC states in the same FAQ as above, that they can be used this way.

To quote another important organization, the Open Source Initiative also state that they "do not recommend releasing software using the CC0". While they have considered it, the concerns they raised made Creative Commons to withdraw their application for approval, thus none of the CC licenses appear on the list of OSI approved open source licenses. They bring some interesting facts about the Public Domain also in their FAQ.

About code snippets

My original thinking with those scripts might have been that they are so short and innocent that they pose no risk, the concepts are so simple that nobody would expect them to be patented. While it is true that I should have chosen a more suitable license, these points are still valid. Let me share a couple of legal concepts that might be applicable here.

First let us consider "short". There is a concept called substantial similarity, which is a subjective measure to decide if copying have occurred or not. It is in place to provide protection from minor changes. In this case, if we would consider the whole blog post as one work (for example when I specify no explicit license and the CC BY dedication in the footer comes into effect for the entire thing), then using just a couple of lines from a code snippet could probably not be considered substantial enough.

Also if the code is real short, it could not even be copyrightable in the first place, if it can be regarded trivial or shows a way of doing things that does not have many alternatives. In court, they would probably ask the opinion of experts on the matter, and I would expect the code snippet should be something quite remarkable to be considered original and unique.

Then there is fair use, which permits limited use in certain situations. Among the factors to be considered besides substantiality which we have covered already, are that the use should be transformative, non-commercial (preferably), and not hinder the copyright owner's ability to exploit the original work. In addition, there are cases known where acknowledgment of the copyrighted source have helped. (Note that there is a similar term in existence called Fair-code, which has nothing to do with fair use and certainly cannot be considered free and open-source.)

It might be an important point in itself if we are talking about a standalone script or a code snippet, the latter being by definition only a little part, an embedding in a larger work. Using code from a snippet might be easier to defend, especially if there are descriptions in the surrounding text. On the other hand a singular script is just like any other program source, so it would be wise to be alert.

(Non-legal) Advice for code users

Generally speaking, I think one should refrain from using code licensed under CC0 or CC BY, unless it can be considered really simple. Even then, retaining or providing proper attribution is key, and I would not consider commercial applications because it is just asking for trouble. And what is "simple", I hear you ask: a rule of thumb can be that if you could not describe it (to one of your peers) in about the same number of words or lines than the code itself, there is a good chance some clever trickery is going on.

Under "usage" here I mean blindly copying and pasting the code, and leaving it unmodified as part of a derivative work. Simply being in possession of code that you have obtained lawfully is not a crime though, so this applies to a broader set of software that are called open-access: you can safely download, study, and run these (if you trust it enough) without worrying, as long as you are sure it had been rightfully published originally. In some jurisdictions it is even considered fair use to have a private copy of copyrighted material, and this is usually at least tolerated in other places as well; but of course I would not count on it if it comes to something sensitive.

For anything that is open-access but does not grant you all the necessary rights explicitly, the best approach would be to use it for educational purposes only. As per the above, without doubt you can study the code and learn from it, and who knows you might even find defects in it. Then if you wanted something similar in your application, the most cautious action would be to clean-room reimplement the concept.

(Non-legal) Advice for code publishers

Who am I to issue advice on a topic where I have made mistakes is the past? Admittedly this is the very reason for this article in the first place. Well, I just wanted to suggest that you should be aware of these concepts and make conscious decisions.

Remember, having no license means that all rights are reserved. Sometimes you might want exactly this, but even then, to avoid confusion you should explicitly state like so. If you want something more open, start considering the four essential freedoms (running, studying, redistributing, modifying): do you have a good reason to restrict some of these? If not, you are fundamentally on the right path to allow free and open source use of your code. Try looking at some of the more popular licenses listed at the OSI and FSF sites, or in the SPDX License List (which provides handy short identifiers standardized).

I know it could seem daunting to read through pages and pages of legal text, all seem about the same with only subtle differences. Try looking for comparisons like this Wiki article, summaries such as the tl;drLegal site, and tools similar to the IOPEU Licensing Assistant, that can all help find the right choice in different ways. Also do not forget that license compatibility is an important aspect as well, i.e. when the derivative work is to be licensed differently. There is a Wiki page dedicated to the topic (I like the compatibility graph in particular), and you can find nice matrices too, like this in the GPL FAQ, or the one at licensecheck.io.

Finally, if your embedded code snippets can be considered long or particularly smart, please consider licensing those differently from the surrounding text. Right tool for the right job. And if you have made the mistake earlier of publishing something with a license that seems inadequate now, know that usually you cannot just revoke it later without potentially harmful consequences. I would like to promote a culture and practice where people take responsibility for their decisions, where it is considered a virtue admitting a fault if one's able to learn from it, and where it is shameful to change the terms of a contract after-the-fact. As a note I might add that you can still use dual-licensing though, but I think that will be a topic for another occasion.

Disclaimer and conclusion

I am not a lawyer, so just to be clear, all the above is according to my understanding, interpretations and beliefs on the topic and the presented source material, and to be considered only an opinion. Also I write from Hungary so even though I am using the English language, I might misinterpret some of the terms used, and even if not they are likely to be applicable only in certain jurisdictions. I am not even well-versed in the Hungarian aspects of the subject. So I am urging you to seek authorized legal help if you want to, because I cannot be held liable for my opinions.

That been said, it is also my opinion that there are billions of people living around the world dealing with software, who are also not lawyers and generally do not have the financial means for consulting one on every occasion. That is why we have these fine licenses preconstructed so we just have to select the right one from them. For the sake of the users and fellow programmers, yourself included, try studying up on these options and make conscious decisions when you choose to use or publish a piece of code. It does worth the effort.