What is open source?
Open source is software whose source code is freely available to read, use, and build on, under the terms of a license. It's the foundation nearly all modern development rests on. Free doesn't mean unconditional, though: licenses vary, and the strength of open review and community comes paired with maintenance becoming your own responsibility.
Open source is one of the foundational ideas in modern software, and at the same time a term that’s easily misunderstood. Many people hear “free” and stop there, but the picture is more nuanced than that. Here’s what open source actually is, why it’s usually a strength, and what you should keep an eye on.
The definition
Open source is software whose source code is freely available to read, use, and build on, in accordance with the terms of a license. Instead of just getting the finished, sealed product, anyone gets access to the actual blueprint – and the right to build on it.
It stands in contrast to closed, proprietary software, where the code is a trade secret and you only see the end result. Open source is, in practice, the foundation almost all modern development stands on: operating systems, programming languages, databases, and countless building blocks that developers around the world share, review, and improve together. Almost every system built today rests on layers of open code.
Free doesn’t mean unconditional
The most common misconception is that open source is simply free, full stop. It’s true that you usually avoid a license fee, but that’s not the same as it being a free-for-all with no conditions.
Every open source project comes with a license, and licenses vary. Some are very permissive and let you do more or less whatever you want. Others attach conditions – the best-known type, copyleft, can require that if you build on the code and distribute the result, your own code must also become open. For a commercial system, that can have major consequences. Understanding which license a component carries is therefore no formality, but a question that can affect the whole business.
Why it’s usually a strength
Despite the conditions, open source is, in the vast majority of cases, a smart choice, for several reasons.
- Review. When the code is open, many independent eyes can read and review it. Bugs and vulnerabilities are often found and fixed faster than in closed-source code, which only the vendor can see inside.
- Community. Popular projects are carried by large communities that develop, document, and answer questions. The knowledge is available to everyone, instead of locked up with a single vendor.
- No vendor lock-in. With open code, you’re not at the mercy of a single company’s pricing, roadmap, or survival. If a project stalls, others can pick it up, since the code is free.
That’s why the question is rarely whether to use open source, but which and how.
A concrete example
Say you’re building a new web service. Instead of writing everything from scratch, it rests on open building blocks: a framework for the application itself, a library for login, a database. It’s all open source, free to use, and saves you months of work.
But that comes with a responsibility. Each of those components gets updated on an ongoing basis, often precisely to close discovered security holes. If no one keeps them current, after a while you’re sitting on old code with known vulnerabilities – an open door for anyone looking. The benefit of open source is real, then, but it comes with a maintenance responsibility.
Maintenance responsibility falls on you
This is the key thing to take away. Unlike a purchased product with a support contract, there’s no vendor automatically responsible for an open component. Responsibility for keeping it updated and secure falls on whoever uses it – you, or your development partner.
That’s not an argument against open source; the benefits almost always outweigh it. But it should be a conscious choice, with someone keeping track of which components the system rests on and making sure they’re maintained. If you’d like help going through what your system is built on and how it’s kept secure over time, get in touch and we’ll look at it together.
Frequently asked questions
What is open source, in simple terms?
It's software where the source code itself – the blueprint – is open for anyone to read, use, and build on. The opposite is closed-source code, where you only get the finished product and can't see how it works inside. Open source consists of building blocks that developers around the world share and improve together, and that underpin most of what gets built today.
Does open source mean it's free?
Usually you can use it without a license fee, but free isn't the same as unconditional. Every project comes with a license that determines what you can and can't do. Some are very permissive, others attach conditions – for example that your own code must also become open if you build on it. The cost rarely lies in the license but in operations and maintenance.
Is open source safe to use?
Usually it's a strength. The code being open means many eyes can review it and catch bugs, unlike closed-source code that only the vendor sees. Popular projects are often extremely well scrutinized. But openness doesn't manage itself – you have to keep components updated, since known vulnerabilities in old code otherwise become a way in.
What does it mean to choose the wrong license?
Open source licenses differ in what they require. A permissive license lets you use the code freely, while a so-called copyleft license can require that what you build on top also becomes open. If a commercial project uses such a component without understanding the terms, you could be forced to open your own code. That's why the license question is worth taking seriously.
Who's responsible for the open source we use in our system?
You are. There's no vendor with a support contract behind an open component – responsibility for keeping it updated and secure falls on whoever uses it, meaning you or your development partner. That's not an argument against open source, but it should be a conscious choice, with someone keeping track of updates and vulnerabilities over time.