JA4+ feature-gating audit vs verified FoxIO license split + uniform JA4+ surface + ja4db enrichment #136

New issue

Closed

opened 2026-07-03 06:28:08 +00:00 by p13marc · 0 comments

p13marc commented

2026-07-03 06:28:08 +00:00

(Migrated from github.com)

Roadmap. Licensing-correctness + ergonomics. Verified against the FoxIO License FAQ (2026).

The verified license split

Plain JA4 (TLS client) is BSD-3-Clause AND patent-free — FoxIO explicitly disclaims patent pursuit for JA4.
JA4S, JA4H, JA4L/LS, JA4X, JA4SSH, JA4T/TS/TScan, JA4D/D6 and "all future additions" are FoxIO License 1.1, patent-pending — permissive for academic/internal use, not for monetization (OEM license required to provide the value to paying customers).

Actions

Move plain JA4 (client) into the default OSI-clean build — it's BSD-3 + patent-free, so it need not sit behind ja4plus. Keep tls-fingerprints (JA3+JA4) royalty-free.
Verify every other JA4+ type (JA4S/JA4H/JA4L/JA4X/JA4SSH/JA4T) is behind ja4plus and excluded from l7/full umbrellas — JA4H especially must stay gated (currently present; confirm the gate). This matches FoxIO's blessed Arkime optional-plugin pattern.
Uniform surface: expose the full JA4+ suite through one consistent fingerprint API (today JA4H/JA4SSH/JA4T exist but aren't surfaced uniformly next to JA4/JA4S).
ja4db enrichment (optional): FoxIO's community DB (public read API ja4db.com/api/read/) maps fingerprints→apps/OS — a candidate feed for the IOC/asset layer.

Impact

Keeps monetizable builds license-clean while widening default JA4 coverage. Mostly feature-flag + docs; item 3 touches the fingerprint API.

**Roadmap.** Licensing-correctness + ergonomics. Verified against the FoxIO License FAQ (2026). ## The verified license split - **Plain JA4 (TLS client) is BSD-3-Clause AND patent-free** — FoxIO explicitly disclaims patent pursuit for JA4. - **JA4S, JA4H, JA4L/LS, JA4X, JA4SSH, JA4T/TS/TScan, JA4D/D6 and "all future additions" are FoxIO License 1.1, patent-pending** — permissive for academic/internal use, **not for monetization** (OEM license required to provide the value to paying customers). ## Actions 1. **Move plain JA4 (client) into the default OSI-clean build** — it's BSD-3 + patent-free, so it need not sit behind `ja4plus`. Keep `tls-fingerprints` (JA3+JA4) royalty-free. 2. **Verify every other JA4+ type (JA4S/JA4H/JA4L/JA4X/JA4SSH/JA4T) is behind `ja4plus`** and excluded from `l7`/`full` umbrellas — JA4H especially must stay gated (currently present; confirm the gate). This matches FoxIO's blessed Arkime optional-plugin pattern. 3. **Uniform surface**: expose the full JA4+ suite through one consistent fingerprint API (today JA4H/JA4SSH/JA4T exist but aren't surfaced uniformly next to JA4/JA4S). 4. **ja4db enrichment** (optional): FoxIO's community DB (public read API `ja4db.com/api/read/`) maps fingerprints→apps/OS — a candidate feed for the IOC/asset layer. ## Impact Keeps monetizable builds license-clean while widening default JA4 coverage. Mostly feature-flag + docs; item 3 touches the fingerprint API.