Open source

What it means

Open source is software whose source code is published and which may be used, modified and distributed under the terms of its licence. It is not automatically free software - the download is free, running and supporting it is not.

Licences differ markedly. Permissive ones (MIT, BSD, Apache) allow almost anything including closed use; copyleft ones (GPL, AGPL) require derivative work to be published on the same terms.

Open source is not freeware. Freeware may be used at no charge, but its code is closed and cannot be modified; some products publish their code under a licence that forbids commercial use or offering it as SaaS, and they are not open source in the proper sense. What decides is the licence text, not the fact that the code is freely available online.

How it works in practice

Companies meet it more often than they realise: the CMS, libraries inside their own application, tools on the server. When commissioning a custom solution we ask which components the supplier used and under which licence.

The cost moves into operations: hosting, updates, support and security. In the books those are services, exactly as a paid licence is.

When a supplier builds an application from open source components and its own code, the client books the price paid as software. Above the statutory cost threshold it is an intangible fixed asset and is amortised, even though part of the code is freely available; the value lies in the work on the solution, not in the components’ licences.

What to watch out for

Breaching a copyleft licence is a copyright infringement and gets expensive in a commercial product. So compliance includes keeping a record of components used and their licences - reconstructing it later, during a sale of the company, is considerably harder.

A project its authors have stopped maintaining keeps running, but nobody fixes its security flaws any more. If customer data leaks through such a library, the operator of the system is responsible, not the community, and has to deal with the personal data breach with every obligation that comes with it.