Real Open Source

It really bothers me when people decide to redefine terms to suit their interests. I tried to stay out of this squabble but I decided to need to defend something in which I believe: Open Source. Open Source has a definition. It has licenses. The words Open Source mean something. To quote:

Open source doesn't just mean access to the source code.

If you want to call your project Open Source, you have two options.

  1. Release your project under an approved license.

  2. Create your own license and submit it for approval. If approved, congratulations. You can now use option 1.


Creating your own license and calling it "open source" is not an option. It's not a good marketing tactic either. Any "halo effect" you think you might get from bearing the "open source" label is going to be removed when people realize your project is not really Open Source.

If you want to see what got me fired up, read Matasano Blog. I don't feel the need to give any publicity to the "project" which made me post this story.

Comments

Scott Dier said…
Note that truecrypt also fails the DFSG, at least when I looked at it.

http://lists.debian.org/debian-legal/2006/06/msg00295.html

and more, in that thread.
5:08 PM
Richard Bejtlich said…
It's not on the OSI list, so simple -- not open source. "Exposed source" perhaps.
5:50 PM
Anonymous said…
I like Thomas' comment:

"Call it something else besides “open source”. Microsoft calls it “shared source”. That works! "
9:15 PM
Anonymous said…
Richard,

The fact that some people have claimed ownership of the words "Open Source" doesn't give them the exclusive right to define it. In fact, there was an attempt to trademark it, which failed on the basis that the phrase is too descriptive.

"Open Source" doesn't mean "something covered by an OSI-approved license". It means whatever people use the phrase to mean.
11:04 PM
Paul Bramscher said…
Well, there's a libertarian/American pro-capitalist take (Eric S. Raymond) and then there's an anarchistic/communitarian angle (Richard M. Stallman). Open source in the narrowest sense means nothing more than the fact that the source code was available. RMS takes it a step further and insists on additional freedoms. Check out http://www.gnu.org/.
11:20 PM
Richard Bejtlich said…
Colin, you said:

"Open Source" doesn't mean "something covered by an OSI-approved license". It means whatever people use the phrase to mean.

I'm afraid I totally reject this argument. Using that reasoning I could use the term open source for anything because I would be the person defining what it means. It could mean I provide source to you on stone tablets, one character at a time. Hey, it's "open" and it's "source"!

We have to draw a line in the sand somewhere. I think OSI is the right place to do that.
12:50 AM
Anonymous said…
Using that reasoning I could use the term open source for anything because I would be the person defining what it means.

Well, the phrase is still descriptive; I can't imagine how something could ever be described as "open source" if you don't provide source code.

But you're right that the phrase isn't very meaningful. If you mean "available under an OSI-approved license", you should say that.
1:07 AM
Chris Rohlf said…
There has to be a generally accepted definition for the term. I think that generally accepted definition is still fuzzy. IMHO it means the source is 'open for people to see', but doesnt neccessarily have anything to do with the GPL or licensing terms. If its your code you can call it whatever you want, and everyone is going to just have to deal with that.
9:47 AM
Richard Bejtlich said…
Chris,

I am not implying the project in question needs to use the GPL. Sguil, for example, uses QPL (one of the OSI licenses). OSI lists nearly 60 licenses it considers Open Source.

There is a name for code you can see. It's called "uncompiled."

Do you consider Windows open source? With the proper arrangement with Microsoft you can see it.
10:01 AM
Unknown said…
Well it is what the FSF/GNU people have been doing with free and the GPL fo decades. Nothing new here move along.
11:26 AM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more