Open source is often described as “free software,” which captures only part of it. The price is usually zero, but the defining feature is what the license lets you do: read the code, change it and share it. That freedom is why open source components sit inside most of the software people use, usually without anyone noticing.
What the definition requires
The Open Source Initiative, a nonprofit that maintains the most widely used definition, lists ten criteria. Among them: the license must allow free redistribution and may not require a royalty or fee for it. The program must include source code, in the form a programmer would prefer to modify, and deliberately obfuscated code is not allowed. The license must permit modifications and derived works and allow them to be distributed under the same terms.
Other criteria are about neutrality. A license must not discriminate against any person or group, and it must not restrict use in a specific field of endeavor, so a license that forbids commercial use does not qualify. Rights cannot depend on the software being part of one particular distribution, and a license may not place restrictions on other software distributed alongside it.
The result is a broad family of licenses rather than a single one, and the definition is the test for membership.
Two license families
In practice, open source licenses fall into two camps. Permissive licenses let others use the code in almost any way, including inside closed commercial products, usually on condition that the copyright notice is kept. Copyleft licenses allow use and modification but require that distributed changes stay under the same license, so the code remains open.
The distinction matters to any company that builds products from open components. Mixing code under incompatible licenses can create legal problems, which is why larger organizations keep track of which licenses apply to what they ship.
Who builds and pays for it
The people behind open source include volunteers, employees whose companies depend on a project, nonprofit foundations and independent maintainers. The funding picture is uneven. Some large projects are heavily supported by companies that benefit from them. Many smaller libraries, which can sit deep inside thousands of products, are maintained by one or two people in their spare time.
Funding models range from donations and sponsorship to foundation membership, paid support and commercial editions of the software. The concentration of reliance on lightly resourced projects is a recurring concern in discussions of software security.
The supply-chain problem
Modern applications are assembled, not written from scratch. A product might include dozens or hundreds of open source libraries, and each of those pulls in more. When a flaw is found in one, the first question for every organization is whether it uses the affected component, and many cannot answer quickly.
That is the problem a software bill of materials is meant to solve. CISA describes an SBOM as “a nested inventory, a list of ingredients that make up software components,” and calls it a key building block in software security and supply chain risk management. CISA has also published joint guidance on updated minimum elements for SBOMs.
Inventories only help if they are acted on. Unpatched components are a common way in for attackers, and CISA lists internet-facing vulnerabilities among the routes into networks, a pattern described in our guide to ransomware.
Is open source more or less secure?
Neither, automatically. Publishing code allows many people to review it, but only if someone looks. Closed code is hidden from outsiders, which does not stop attackers from finding bugs in it. What predicts security is less the license than the maintenance: how quickly problems are fixed, how vulnerability reports are handled and how reliably users apply updates.
For teams choosing a component, the signs of a healthy project are practical. Look for recent releases, an active community, clear documentation, a stated license and a published way to report security issues.
Getting involved
Contributing does not require writing code. Bug reports, documentation fixes, translations and answers to other users’ questions all keep projects alive, and so does money. For individuals, open source also offers alternatives to commercial software in areas from office suites to image editing, many maintained by large communities.
The shared foundations also reach the internet’s plumbing. The naming system that turns addresses into server locations, described in our explainer on how DNS works, runs on openly published standards that anyone can implement.
