What Is Open Source Software? Code Anyone Can Read, Change and Share

Software is written by people as source code, readable text, and converted into the machine instructions a computer actually runs. A company that sells software usually ships only the machine instructions and keeps the source code secret, so customers can run the program but cannot see how it works or change it. That is proprietary software, and until the 1970s it was unusual; early computer code was routinely shared among researchers.

In 1980 Richard Stallman, a programmer at MIT, wanted to modify the software for a jammed laboratory printer and was refused the source code by its manufacturer. He concluded that secret code made users dependent and helpless, and in 1983 he announced the GNU project, an effort to write a complete operating system that anyone would be free to study and change. He called it free software, meaning free as in freedom rather than free of charge, and wrote the licence that would enforce it.

What makes software open source is not that its code is visible but that its licence grants rights. Stallman's General Public License, or GPL, allows anyone to use, copy, modify and distribute the code, on one condition: anything distributed that is built from it must be released under the same terms. That copyleft clause, using copyright to guarantee openness rather than restrict it, means that GPL code cannot be taken private. The Linux kernel, written by Linus Torvalds from 1991, uses it, which is why every company that ships Linux must publish its changes.

A second family of licences asks less. The MIT and BSD licences and Apache's let anyone do anything with the code, including using it inside proprietary products, as long as the original authors are credited. Most of the web's building blocks use these permissive licences, which is why the software inside an iPhone includes code from BSD Unix and why Google could build Android on Linux but keep parts of it closed. The term open source itself was coined in 1998 by a group who felt free software sounded hostile to business and wanted to sell the practical benefits rather than the ethics. The two camps still argue, and use each other's code.

Open source projects are run in public. The code lives in a shared repository, today usually on a site such as GitHub, where anyone can read it, report a bug, or propose a change, called a pull request, which the project's maintainers review and accept or reject. Large projects have hundreds or thousands of contributors; the Linux kernel accepts around ten thousand changes from more than a thousand people every release, and its rules for who may approve what are strict and long established.

Who does the work has changed. In the early years it was mostly volunteers. Now the majority of contributions to the biggest projects come from people paid by companies, Intel, Google, Microsoft, Red Hat and others, who need the software to work well and find it cheaper to improve a shared version than to build their own. Beneath the giants sits a long tail of small libraries maintained by one or two unpaid people, on which enormous systems quietly depend.

Giving software away turned out to be compatible with several businesses. Red Hat, bought by IBM for 34 billion dollars in 2019, sells support, certification and guarantees for Linux that companies pay for even though the code is free. Cloud providers charge for running open source databases and tools on their machines. Many companies release a core product as open source and sell extra features, hosting or an enterprise edition around it. And the largest technology firms treat open source as infrastructure: it costs them less to share the foundations and compete on what they build above them.

The model has strains. A cloud provider can host a small company's open source database and capture the revenue, which has pushed several projects to adopt licences that forbid exactly that, moving them out of open source as usually defined. And the small libraries that everything depends on are often maintained by one exhausted person, a fragility exposed in 2014 when a bug in OpenSSL, the encryption library used by two thirds of the web and maintained by a handful of volunteers, left much of the internet insecure. The main rights and obligations, by licence type:

• •Copyleft (GPL): use, change and share freely, but share derived works under the same licence
• •Permissive (MIT, BSD, Apache): use, change and share freely, including inside closed products, with credit
• •Source-available: code is visible but some uses, often competing cloud services, are forbidden; not open source
• •Proprietary: code is secret and use is licensed on the vendor's terms

Open source did not win because it was free of charge, though that helped it spread. It won because software that many people can inspect and fix tends to become more reliable and more secure than software that few can, because developers prefer to build on foundations that cannot be taken away from them, and because sharing the boring parts lets everyone concentrate on the interesting ones. The result is that a person setting up a website today can assemble, at no cost, a stack of software that would have cost a fortune and years of work in 1995, and that the same code runs on a hobbyist's laptop and in the largest data centres in the world.

In March 2024 a software engineer named Andres Freund noticed that logins to a computer over SSH were taking a fraction of a second longer and using more processor time than they should. Following the clue, he found a hidden backdoor in xz, a small compression library that many Linux systems depend on. The malicious code had been slipped in by a contributor who, over roughly two years, had built up trust by making helpful changes and had gradually taken on maintainer duties from an overstretched volunteer. The backdoor was caught before it reached most stable Linux releases, largely thanks to one person's curiosity about a slow login.

The episode shows both sides of the open model. Because the code was public, an outsider could trace the problem to its source and everyone could inspect the fix within days; a similar backdoor in secret code might never have been found. But the attack also exploited exactly the weakness of small, essential projects maintained by one tired person, who can be worn down or befriended. Since then, companies and foundations have put more money and attention into identifying critical but underfunded projects, and into tools that check where each piece of code actually came from.

Code that is merely visible is not automatically open source. Under copyright law, anything a person writes belongs to them by default, so a project posted publicly with no licence grants nobody the right to copy it, change it or reuse it in their own work, beyond whatever the hosting site's terms allow, such as viewing it. Open source code is copyrighted too; the licence is what turns that ownership into permission. That is why developers are advised to add a licence file to any project they want others to build on, and to check the licence of anything they borrow before using it.

Restrictions that sound reasonable can also disqualify a licence. The Open Source Initiative, which maintains the accepted definition, lists ten criteria, including that a licence must not discriminate against any person or group, or against any field of endeavour. A licence that forbids commercial use, military use or use by a particular company may be well meant, but it is not open source, and neither is freeware, which is software given away free of charge with its code kept secret. The strictness is deliberate: if every author could add exceptions, combining code from many projects, which is how most software is now built, would become a legal maze.

Open source software runs in more places than most people realise. Android, the operating system on most of the world's smartphones, is built on the Linux kernel, an open source project started by Linus Torvalds in 1991. Linux also runs most of the world's web servers and all of the most powerful supercomputers.

In 2021 NASA's Ingenuity helicopter made the first powered flight on another planet, at Mars, and its flight software ran on Linux, using an open source framework originally developed for small satellites. Engineers chose it partly because it was flexible and well tested. That a piece of free, collaboratively written software helped fly a helicopter on Mars shows how far the model has travelled from its origins among hobbyists and universities.

Open source software is code published with a licence that lets anyone use, study, modify and redistribute it, either on condition that derived works stay open, under copyleft licences like the GPL, or with almost no conditions under permissive ones. Begun as an ethical movement in the 1980s and adopted by industry as infrastructure, it now underlies most of the internet and is paid for through support, hosting and the companies that depend on it.