If you are a commercial software developer or manager, and you want to learn how to safely leverage open source to enhance your own source code, without incurring the legal risks that often accompany open source, you have come to the right place. 

• Maybe you have heard about the recent lawsuits where commercial software suppliers have been sued by open source advocates for downloading the open source while ignoring the license obligations.  Some of these lawsuits have been settled out of court, but all of the ones that have gone to trial have been settled in favor of the open source plaintiffs.
  
  
• Maybe your customers have heard about some of these lawsuits, and know that sometimes the plaintiffs target them as customers instead of you as their software supplier, so they are demanding that you give them a thorough accounting of what is inside your software.
  
  
• Maybe you suspect one of your engineers downloaded some open source and didn’t tell anyone about the license obligations.
  
  
• Maybe you are worried that your source code includes some open source software that could impact the value of your intellectual property.

Regardless of the issue that brought you here, you have come to the right place.

Here you will learn:

• What are the real legal risks of using open source inside commercial software
  
  
• How to form an open source policy which specifies which open source licenses are allowed inside your code base and which open source licenses should be avoided
  
  
• The typical license obligations that come with the most common open source licenses
  
  
• The specific reasons why most commercial software organizations would consider the GPL license as unacceptable for use inside a proprietary code base (hint: it is viral and can contaminate your own intellectual property).
  
  
• The specific conditions under which it is completely safe to use GPL licensed open source
  
  
• How to find out what open source is already in your source code
  
  
• When it makes sense to use a professional audit firm to document what is in your source code
  
  
• What to do if you already have GPL licensed open source in your code that should be avoided.

If you stick with this and read through this website, you will be much more confident in your ability to sidestep the legal dangers of open source, and you will have a clear strategy to answer your customer’s questions about what is inside your source code.

So, let’s get started, shall we?

So what are the the legal risks with using open source inside commercial software?

•    You will attract a lawsuit.  This is a real risk.  There have been a number of lawsuits brought by open source advocates like the Free Software Foundation.  Being a small software developer with no deep pockets has not helped, some of the legal targets have been small software developers (like Monsoon Multimedia).  Being a large corporation with extensive legal defense resources has not helped, some of the legal targets have been F500 corporations (like Verizon, CISCO, and Ebay/Skype).    All were charged with not honoring the license obligations that came with the open source software that they incorporated into their proprietary software.  (More info on lawsuits…)

Some of the lawsuits were settled out of court, and all of the cases that have gone to settlement have gone in favor of the open source advocates.  The courts have ruled that not honoring the license obligations that come with open source software, is essentially the same as copyright infringement, and that even though the open source software was free, the license obligations are a legal contract, and enforceable in court.

You should periodically conduct a complete audit of your source code, making sure you know exactly what open source is inside, and what the license obligations of that open source is.  You can either conduct your own internal audit, questioning your engineers and using standard tools like grep, or you can use a professional audit firm to make sure that your assessment is accurate and comprehensive.  Here is more information on how to find the open source inside your source code.

The Public Domain licenses are the least restrictive with no obligations, while the Common Public License variants are the most  restrictive.  Many of these licenses have additional restrictions as well, for example, the Common Public License has a  provision that makes it difficult to use the open source package and then sue any of the open source copyright owners for patent infringement.  Some of the other licenses such as those from SUN and others, have restrictions on the ability to modify or distribute the source code, or to distribute even the object code without packaging it with your own software.

Most of the non-copyleft licenses are not onerous and can be added to the approved list in your open source policy.  What is important, though, is to fulfill the obligations, and for example, to set up a URL where the open source package and any modifications can be downloaded by users under the same license.

• Create an open source review board which maintains the approved list of open source licenses
  
  
• Understand what the key licenses mean to your organization’s obligations
  
  
• Create an open source policy with an approved list of licenses and an unapproved list of licenses
  
  
• Audit your source code and create an inventory of all open source present, including the associated license obligations
  
  
• If any open source is present from an unapproved list, remove and/or replace it
  
  
• Track all open source submissions on an ongoing basis, and do not allow any open source to be added which is not on the approved list of licenses

For situations where you need a complete and accurate audit of your source code, ie, doing it on your own is not accurate enough, we suggest you use a professional audit firm like Source Auditor.

Source Auditor has a great deal of expertise and experience in conducting open source code audits.  Our methodology, expertise, and proprietary software tools can insure a comprehensive and accurate audit, as well as sound recommendations on what to do given the audit results.  (More info about us…..) (More info on Source Auditor audits…)

Source Auditor charges $10,000 per audit (plus travel costs if you need us to do the audit on your site for a site outside the San Francisco Bay Area).  This charge includes all necessary scanning software from Source Auditor so no expensive third party tools are required.  This charge is also the same even if your code base is many hundred thousand lines of code long (the code base for a single audit must be associated with a single product or product line).  We only bill after you approve the audit results, so, the results are 100% Satisfaction Guaranteed.

We understand that it may not be entirely clear if you need a professional open source code audit and it may not be clear to you what our services entail.  To help clarify the situation, if you are serious about evaluating the value of a professional open source code audit, Source Auditor is happy to provide 1 FREE sample consultation audit.  In these sample consultation audits (which last 1 day in duration, and are conducted remotely if your site is outside the San Francisco Bay Area) we will scan your entire code base, but audit a representative portion of your code base and provide a report based on this sample of your code base.  This should provide a clear illustration of the value of our audits.