The JSON license, as well as the jslint (and the 'jshint' derivative) license, is an otherwise unmodified version of the MIT License except for one peculiar clause which reads:

The Software shall be used for Good, not Evil.

As a result, some software developers and distributors take the (IMO) unfortunate route of not using, or not distributing, the software components licensed under these terms (that is, except for those who managed to get an exception clause added to them).
One such example is Debian. In a open issue to the jshint repository, some users voice their complain that the atypical clause prevents Debian from packaging jshint in their official repositories.

What I want to ask is: say the Debian Project were to distribute jshint in their official repositories. Assume this act is qualifiable as 'good' (not evil). No violation of the license so far, I suppose. Now consider the case of a Debian user who uses his Debian computer to practice evil (for instance, extortion, terrorism, you name it).

Who would be liable for violation of the license terms? The Debian user, who performed the wrongdoing; the Debian Project, who distributed the software; or both?

In other words: if a court were to take the clause at face value and enforce it, would the user be the sole defendant, or would the Debian Project also?

The clause states "The Software shall be used for Good, not Evil" - but I assume the distribution of the software by the Debian Project qualifies as use (right?). In that context, is the Debian Project liable for whatever evil their users might be willing to execute by means of a computer running the Debian OS?

Or, I suppose, the same question in other words would be: Is it a risk for the Debian Project to distribute jshint in their official repos?


2 Answers 2


That “shall be used for Good, not Evil” clause is a moral category, not a legal category. From a legal perspective, it is likely meaningless and/or unenforceable. Neither Debian nor users of that software should expect any legal risk for using or distributing the software.

However, software under that license will never make it into Debian because it violates the Debian Free Software Guidelines. The DFSG is not a contract in the legal sense, but it forms part of the Debian social contract with its users. It is not in the interest of the Debian project to include software unless the software is free to use for any purpose. While the JSON license's usage restriction is likely meaningless in practice, it clearly tries do do exactly what the DFSG wants to prevent.

In the Open Source community, there is a broad consensus against the JSON license. The DFSG, slightly edited, was adopted as the Open Source Definition. Consequently, the JSON license also fails to be an Open Source license. The Free Software Foundation also looked at the license, and concluded: “This is a restriction on usage and thus conflicts with freedom 0. The restriction might be unenforcible, but we cannot presume that. Thus, the license is nonfree.”

  • 2
    In your first paragraph you use the terms "likely meaningless" and "should [not] expect". I feel confident these are correct, but, for the sake of argument, let us suppose (if I may) that a court would take the clause at face value and enforce it. In that scenario, would the user be the sole defendant, or would the Debian Project also be?
    – Marc.2377
    Commented Sep 28, 2019 at 21:39
  • 2
    @Marc.2377 that’s a very good question - I suggest you ask it rather than burying it in a comment.
    – Dale M
    Commented Sep 28, 2019 at 21:43
  • @Marc.2377 My interpretation: If the license is interpreted as a direct agreement between the author and end user, a distributor who just passes along copies would not be party to that agreement and couldn't be (successfully) sued for someone else's breach. But perhaps some indirect liability for contributory infringement could be argued? And while a JS linter is harmless, more interesting examples would include cryptographic software, exploit tools, or deepfake-style software where the mere public availability already raises ethical and legal concerns.
    – amon
    Commented Sep 28, 2019 at 22:21
  • @DaleM I felt that I was asking for clarification, rather than asking an entirely different question. For that reason, I included it in the main question. The author of this answer may want to update it with his comment as well.
    – Marc.2377
    Commented Oct 2, 2019 at 19:16
  • @Marc.2377 no, I think that whether a court can decide any given act is good or evil is worthy of its own question
    – Dale M
    Commented Oct 2, 2019 at 21:22

"Say the Debian Project were to distribute jshint". That's distribution, not use. The distinction matters. This line is appended to the MIT license, which starts by enumerating different rights including both "use" and "distribute". Hence it's reasonable to assume that the term "used" in both clauses means the same. In other words, your assumption that "distribution" is the same as "use" is wrong, else the MIT license wouldn't have spelled that out.

While the MIT license allows relicensing under narrower terms, and JSON's license does not change that, removing an obligation is relicensing under broader terms. That's why IBM needed another license straight from the original author.

  • Not all users are also distributors but all distributors are users, assuming they ever load and run/test the code they are distributing. But that use would not, presumably, be Evil. Commented Sep 30, 2019 at 21:57
  • @GeorgeWhite but how do u define evil? any1 could argue that anything is good, terrorists believe that terrorism is "good" Commented Apr 3, 2020 at 3:22
  • I was referring to the simple act of a distributor loading and test the code as presumably not being evil. Commented Apr 3, 2020 at 21:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .