Grandma Pina's ragù and the GPL: the story of free software, and licences explained in the kitchen

Thursday night, almost midnight. You've just finished ricettario, your first project that's really yours: an app that digitises Grandma Pina's recipe notebook, the one with the greasy cover and quantities written as "a glass", "to taste" and "until it's ready". It took three months of weekends. The parser that turns "a fistful of flour" into grams is the thing you're proudest of in your entire career.

You create the repository on GitHub and, before pushing, a drop-down appears: Choose a license. MIT, Apache 2.0, GPLv3 and twenty other acronyms. Underneath, a sentence that is kind and useless: "A license tells others what they can and can't do with your source code."

The cursor blinks. Last night you read the story of gnocco's maintainer, the one with 11 dollars a month in sponsorships, and now that menu looks a lot less innocent. At that very moment Grandma Pina, who at 84 uses WhatsApp better than you do, sends a message: "So, who's allowed to use my ragù recipe?"

Good question, Grandma. To answer it we need to take a trip. First stop: a jammed printer.

1980: the printer

Imagine working at MIT's Artificial Intelligence Lab in 1980. Xerox has just given the lab a laser printer, a 9700: huge, very fast, and installed in another room. It jams a lot. With the previous printer the problem had long been solved: a programmer at the lab, Richard Stallman, had modified its software so that it alerted users when the paper got stuck, and told whoever was waiting for a print-out when it was ready. A small change, made in an afternoon, that saved everyone a lot of wasted walks.

With the new printer it can't be done. Xerox supplied only binaries, no source. Stallman finds out that a researcher at Carnegie Mellon has a copy of the code, goes to ask for it, and is turned down: that researcher had signed a non-disclosure agreement with Xerox. The code couldn't be shared even with a colleague who only wanted to fix a paper jam.

To you, today, that's normal. To a hacker in that lab it was a betrayal: until then software had travelled between universities and research centres the way recipes travel between neighbours. Whoever improved something passed it on. Now someone was handing you the dish while forbidding you to know how it was made, and above all forbidding you to fix it.

On 27 September 1983 (it turns 42 in two weeks) Stallman announces the GNU project on Usenet: a Unix-compatible operating system, completely free. In 1985 the Free Software Foundation is born. And free software gets defined by four freedoms, numbered from zero as programmers do:

• Freedom 0: run the program for any purpose.
• Freedom 1: study how it works and change it. That requires the source.
• Freedom 2: redistribute copies.
• Freedom 3: distribute your modified versions, so everyone benefits.

Watch that word. In English free means both "libre" and "gratis", and Stallman has spent forty years repeating "free as in free speech, not as in free beer". Italian, for once, is clearer: libero and gratis are two different words. Free software can be sold. The freedom is about what you can do with the code, not how much you pay for it.

The copyleft trick

One problem remained. If you give your recipe away with no conditions, anyone can take it, improve it, lock it in a safe and sell it as a trade secret. That's exactly what had happened with the printer. What was needed was a way to give code away and, at the same time, stop anyone from closing it again.

The solution is a brilliant legal trick: use copyright, the tool designed to restrict copying, to guarantee it. The author keeps the rights and grants a licence that says, in essence: "You can do anything, on one condition: if you distribute this program or a modified version of it, you must do so under the same terms, source included." It was called copyleft, a pun on copyright. In 1989 it became the GNU General Public License, the GPL. In 1991 came version 2, which you'll get to know better in a moment.

Copyleft is a recipe with an inheritance clause. Whoever uses it to cook something and then gives or sells that dish must hand over the recipe too, including their changes, and with the same clause. Its critics call it "viral". Its fans say it's the only way to keep free what was born free.

1991: a kernel "just as a hobby"

By the end of the eighties GNU had almost everything: a compiler (GCC), an editor (Emacs), a shell, libraries, utilities. It was missing the hardest piece, the kernel. In August 1991 Linus Torvalds, a computer science student at the University of Helsinki, announces on Usenet an operating system in the works, "just a hobby, won't be big and professional like gnu".

Linux's first licence was Torvalds' own, and it banned commercial use. In January 1992, in the release notes for version 0.12, Torvalds announced the switch to the GPL, effective from 1 February. It would prove a decisive choice, and the reason is copyleft itself: a company that improves Linux and distributes the result must give its changes back. Companies contributed out of self-interest, not kindness, and the kernel became the largest collaborative project in the history of software.

Today, 11 September 2025, the latest stable release is 6.16, and 6.17 is at its fifth release candidate. Almost every kernel file starts with a line declaring its licence in SPDX format, readable by machines too. If you have the source at hand, try:

$ git clone --depth 1 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
$ cd linux
$ grep -rhoE "SPDX-License-Identifier: .*" --include="*.[ch]" . \
    | sed 's/ \*\/$//' | sort | uniq -c | sort -rn | head -5

At the top you'll find GPL-2.0 and GPL-2.0-only, and a little further down a curiosity: GPL-2.0 WITH Linux-syscall-note. It's the exception that makes everything else possible. It says that a program using the kernel only through normal system calls is not a derivative work. Without that note, every program running on Linux would risk having to be GPL, and nobody would use it.

Notice that -only too. Many GNU projects say "GPL version 2 or any later version", and so they moved to GPLv3 automatically in 2007. Linux didn't: Torvalds never wanted v3, and relicensing today would require the consent of thousands of authors, some of whom are no longer with us. The kernel will stay GPLv2 forever.

2003: the router that didn't want to be free

Let's jump ahead. It's 2003 and you've just bought a Linksys WRT54G, the blue-and-black Wi-Fi router everybody has. What you don't know is that it runs Linux. In June a developer, Andrew Miklas, spots it and reports it on the kernel mailing list: the firmware contains GPL code, but Linksys (just bought by Cisco) hasn't published the source.

This is where the GPL does its job. Shipping a router with Linux inside means distributing Linux, and whoever distributes GPL code must make the source available. After a few weeks of pressure, in July, Linksys publishes it (incomplete at first: a second round of complaints on the same mailing list is needed). From that source, in 2004, OpenWrt is born, along with DD-WRT and Tomato: alternative firmware that turns a sixty-dollar router into a professional networking box, with VPN, QoS and a configurable firewall.

The best part comes later. In 2005 Linksys moves the WRT54G to another operating system, VxWorks, with less memory. The community protests, and Linksys puts out a dedicated model, the WRT54GL. The "L" stands for Linux. It stays on sale for years, among the best-selling routers ever, bought precisely by people who wanted to install free firmware on it. If your home router today has an interface called LuCI, or your ISP uses OpenWrt-based firmware, you're using a descendant of that story. And it wasn't a one-off: in the following years the Software Freedom Conservancy took several manufacturers to court for shipping BusyBox (GPL) without source, and got the code published.

Today, in your pocket and on your desk

Pick up your phone. If it's Android, underneath there's the Linux kernel, GPLv2. But look at how Google organised the kitchen: the kernel is GPL because it couldn't be anything else, while almost all the rest of the system, the userspace, is Apache 2.0. Instead of GNU's C library (glibc, LGPL), Android uses Bionic, written specifically under a BSD licence. The internal rule was clear: no GPL above the kernel. That way phone makers can modify Android and keep their changes, and apps don't have to worry about any copyleft. It's a licensing decision as deliberate as an architectural one, and it worked: Android runs on billions of devices.

Now open a terminal on a Mac and type:

$ /bin/bash --version
GNU bash, version 3.2.57(1)-release (arm64-apple-darwin24)

Bash 3.2: a release from 2006, frozen there for almost twenty years. It isn't laziness. From bash 4.0 the licence became GPLv3, and v3 has clauses on patents and locked-down devices that Apple didn't want to accept. So Apple kept the last GPLv2 bash and, in 2019 with macOS Catalina, switched the default shell to zsh, which has a permissive licence. For the same reason, among others, Apple invested in LLVM and Clang rather than staying on GCC, which moved to GPLv3 in 2007. Two licences moved millions of developers from one shell and one compiler to another.

And then there's everything else. Since November 2017, 100% of the world's 500 most powerful supercomputers run Linux, and the June 2025 list confirms it. Almost the entire cloud runs on Linux. The web server that served you this page is open source. Free software won so thoroughly that nobody notices any more.

1998: when "free" became "open"

One piece is missing, and it explains why GitHub's menu says "open source" and not "free software". In January 1998 Netscape announces it will release the code of its browser (it will become Mozilla, and later Firefox). A group of developers realises it's the moment to talk to businesses, and that the word free, with its ambiguity and political flavour, scares them off. In February, at a meeting, Christine Peterson suggests an alternative: open source. A few days later Eric Raymond and Bruce Perens found the Open Source Initiative.

The two labels almost always describe the same software, but for different reasons. For free software it's an ethical matter: users have the right to control the programs they use. For open source it's a practical one: developing in the open produces better software. Stallman never accepted the second term. Hence the neutral acronym used by those who'd rather not pick a side: FOSS, Free and Open Source Software.

The licence kitchen

Back to Grandma Pina, who is still waiting for an answer. Imagine her ragù recipe is code, and you have to decide how to give it away. Each licence is a different way of doing it.

Public domain (CC0, Unlicense). You leave the recipe on a sheet of paper on a tram seat. Anyone can do anything with it, even sign it with their own name. Simple, but in some countries, Italy included, waiving copyright entirely isn't even possible, which is why CC0 includes a fallback licence.

MIT. You give the recipe away with a little note attached: "Grandma Pina's recipe". Whoever uses it can do anything, even open a Michelin-starred restaurant and sell a reinvented ragù, keeping their changes secret. The only obligation is to keep the note, meaning the copyright notice and licence text. At the bottom of the note it also says: "If you get a stomach ache, Grandma had nothing to do with it." That's the "AS IS", no-warranty clause you'll find in every licence. It's the most used licence on GitHub: React, Node.js, Ruby on Rails.

BSD. Like MIT, plus a postscript: "Don't write 'approved by Grandma Pina' on your menu without asking her." In other words, don't use the authors' names to promote your product. The original version also had a clause requiring every advertisement to credit the University of California, Berkeley; it was dropped in 1999 because ads were turning into lists of acknowledgements. FreeBSD and nginx use BSD licences. The PlayStation's operating system is based on FreeBSD, and Sony doesn't have to publish a thing.

Apache 2.0. MIT with a notary. Besides the note, whoever modifies the recipe must mark what they changed ("added chilli"). And there's a patent clause: if Grandma had patented her three-stage soffritto, this licence also gives you permission to use the patent. But if you sue her claiming the soffritto infringes one of your patents, you lose the licence. Companies love it for exactly that. Kubernetes, Swift and Android's userspace are Apache 2.0. (In 2017 React had a BSD licence with a patent clause written by Facebook, which revoked your rights if you sued Facebook over any patent at all. The Apache Software Foundation banned it from its projects, the community protested, and in September Facebook moved React to MIT.)

MPL 2.0. Copyleft by the jar. If you change the sauce inside the jar, you must share the sauce recipe. The lasagne you build around it, though, stays yours. Technically, the copyleft applies file by file: MPL files you modify stay MPL, your new files can carry any licence. It's Firefox's licence.

LGPL. The sauce as an ingredient. You can sell your secret lasagne using Grandma's sauce, but if you change the sauce you must share the changes, and the customer must be able to swap the sauce for another one, even a version they modified themselves. In software, this means you can use an LGPL library in a closed program, usually via dynamic linking: the library lives in a separate file (.so, .dll) that the user can replace. Static linking works too, but you have to provide the object files needed to relink the program. glibc is LGPL, and so is FFmpeg in its default configuration.

GPL. The golden rule: whoever tastes it is entitled to the recipe. You can use Grandma's ragù however you like, change it and even sell it. But if you give someone the dish, meaning you distribute the program or a derivative work, whoever receives it is entitled to the full recipe, including your changes, under the same licence. Two details many people miss. First: if you only cook at home, meaning you use the program internally without distributing it, you owe nothing to anyone. Second: "derivative work" isn't only about modifying files, it also covers combining GPL code into your own program. According to the Free Software Foundation, linking, static or dynamic, creates a single work. That's why companies tread so carefully.

GPLv3. GPLv2 plus a few new rules, each born from a true story. The most famous: no padlocks on the baking dish. TiVo, a digital video recorder, used Linux and dutifully published its source, but the hardware only accepted software signed by TiVo: you could read and change the code, but not install it. GPLv3 forbids that in consumer products: if you hand over the dish in a padlocked tray, you must hand over the key too (the "installation information"). It also has explicit patent clauses. Bash, GCC and Samba are GPLv3.

AGPL. The GPL goes to the restaurant. Under the GPL, if you serve the ragù in your restaurant instead of selling it as takeaway, you aren't "distributing" anything, so you don't have to hand over the recipe. This is the so-called SaaS loophole: a company can take GPL software, modify it and offer it as a web service without ever publishing a line. The AGPL closes it: if users interact with the program over a network, they're entitled to the source of the version they're using. Mastodon and Grafana are AGPL.

The fake free recipes (SSPL, BSL). "Free recipe for everyone, except anyone opening a trattoria that serves ragù." These are the source-available licences you met yesterday in the relicensing sagas of MongoDB, Elastic, Redis and HashiCorp. You can read the code, but they aren't open source: the Open Source Initiative's definition forbids discriminating against who uses the software or what for. Readable source isn't enough.

Proprietary. The Coca-Cola formula: in a safe. You buy the drink, not the recipe.

Licences at the table

One last thing every cook knows: not all recipes can be mixed. Permissive code can go into a GPL dish (MIT inside GPL is fine), but not the other way round. And some copyleft licences don't get along: Apache 2.0 can be combined with GPLv3 but not with GPLv2-only, which is why ZFS, under the CDDL, can't go into the Linux kernel. Before adding a dependency, check what's in the pantry:

# licence summary of a Node project's dependencies
$ npx license-checker --summary

# does your project declare the licence of every file correctly?
$ pipx run reuse lint

A quarter past midnight

You go back to the drop-down, and now the acronyms mean something. You ask yourself three questions. Do you want ricettario used by as many people as possible, companies included, with no friction at all? MIT, or Apache 2.0 if you also want patent protection. Do you want people who improve and distribute it to give their changes back? GPL, or LGPL and MPL if you're writing a library meant to live inside other programs. Are you worried someone will turn it into a paid service without giving anything back? AGPL.

You think about gnocco, its 11 dollars, the companies that receive the dish and never ask for the recipe. And you choose. You add an SPDX-License-Identifier line at the top of every file, commit and push.

Then you answer Grandma: "Everyone, Grandma. Anyone can use it, change it, even sell it. But whoever serves it to others has to give them the recipe too."

The reply comes a minute later, with three heart emojis: "Right. That's how it's always been done."