What open source means in practice

Updated: Oct 28, 2026

Most of the software running the internet, and a large part of what runs on your phone and laptop, is open source: its source code is published under a licence that lets anyone read, modify and redistribute it. The phrase is often used loosely to mean “free”, “community-made” or “trustworthy”. In practice it means something more specific about rights, and those rights have consequences for cost, security, longevity and the way projects are governed. This article explains what open source guarantees, what it does not, and how to evaluate a project before depending on it.

Licences, source code and who may change it

Software is protected by copyright automatically. Without a licence, you may use a program only as its author permits, and you have no right to change or share it. An open-source licence is a grant from the copyright holder that gives everyone four freedoms: to use the software for any purpose, to study how it works, to modify it, and to distribute copies, including modified ones. The Open Source Definition maintained by the Open Source Initiative lists the criteria a licence must meet, and dozens of licences qualify.

Licences differ mainly in what they ask of people who distribute modified versions:

• Permissive licences (MIT, BSD, Apache 2.0) ask for little more than keeping the copyright notice. You may include the code in proprietary products.
• Copyleft licences (GPL, AGPL) require that if you distribute a modified version, or in the case of the AGPL make it available over a network, you must release your changes under the same licence. The aim is to keep improvements open.
• Weak copyleft (LGPL, MPL) applies the sharing requirement to the licensed component itself but allows it to be combined with proprietary code.

Some projects publish their code but use licences that restrict commercial use or competition. These are “source available”, not open source, and the difference matters if you plan to build on them.

What open source does not guarantee

Not necessarily free of cost. The code is free to obtain, but running, supporting and securing it costs time or money. Many companies sell hosting, support or enterprise features around open-source cores.

Not automatically secure. “Anyone can read the code” is only a benefit if qualified people actually do. Critical bugs have survived in widely used libraries for years. Security comes from active maintenance, audits and a responsive disclosure process, not from openness alone.

Not necessarily maintained. A large share of open-source packages are maintained by one or two volunteers. When they stop, the project stops, unless someone else steps in. The licence lets someone fork it, but a licence does not create maintainers.

Not necessarily community-governed. Many important projects are controlled by a single company that can change direction or licence in future versions. The existing code remains open, which is why several high-profile relicensings have produced community forks.

Everyday examples

Linux runs most servers, all Android phones and many embedded devices. Chrome and Edge are built on the open-source Chromium project; Safari’s engine descends from KHTML. WordPress, which powers a large fraction of websites, is GPL-licensed. Python, Node.js, PostgreSQL, Git and the OpenSSL library that encrypts most web traffic are all open source. Even proprietary operating systems ship thousands of open-source components, listed in the legal notices most people never open.

Evaluating a project before depending on it

• Licence. Confirm it is genuinely open source and compatible with how you intend to use it.
• Activity. Look at recent commits, release dates and how quickly issues receive responses. Silence for a year is a warning.
• Maintainers. How many people have commit access? Is there a foundation or company behind it, and what is its incentive to keep going?
• Security process. Is there a published way to report vulnerabilities, and a record of advisories being handled?
• Dependencies. A small project that pulls in hundreds of packages inherits their risk.
• Documentation and community. Can you find answers without the original author?

Choosing and using open-source software wisely

• Read the licence before using code in a product, and keep a record of what you depend on.
• Pin versions and review updates; an automatic upgrade can pull in a compromised release.
• Support the projects you rely on with bug reports, documentation fixes, sponsorship or paid support; sustainability is a shared responsibility.
• Prefer projects with several maintainers and transparent governance for anything critical.
• Treat “open source” as a starting point for evaluation, not a conclusion about quality or safety.

Frequently asked questions

Can I sell open-source software?

Yes. Open-source licences permit commercial use and sale. Copyleft licences require that recipients also receive the source and the same rights.

Is open source the same as public domain?

No. Public-domain works have no copyright restrictions at all. Open-source software remains copyrighted; the licence grants rights while keeping conditions such as attribution.

Why would a company give away its code?

Adoption, trust, contributions from users, recruiting, and the ability to sell services around it. For infrastructure software, being the open standard is often more valuable than licence revenue.

Open source guarantees rights to the code; whether the code is good, safe and maintained depends on the people around it.

In short: Open source means a licence that lets anyone use, study, modify and share the software. It does not by itself guarantee cost-free operation, security or ongoing maintenance. Evaluate projects on activity, governance and process, and contribute back to the ones you depend on.