Using open source securely - Richard Seidl

Open source is essential in today's software development. However, challenges such as licensing issues and security gaps are key issues that need to be considered when integrating open source software into commercial products. It is often underestimated how much effort is involved in the successful use of open source.

Podcast Episode: Using open source securely

In this episode, I talk to Dirk Riehle about open source. He explains how crucial it is to integrate open source software securely and correctly into products. We talk about the challenges, such as licenses and security vulnerabilities. Dirk gives insights into the importance of commercial open source strategies. Because some companies take the risks too lightly and underestimate the effort behind the use of open source.

"If it doesn't say anything, it's private property. Then you're not allowed to use it without the owner's consent. Just because you see the apple on the apple tree in the neighbor's garden doesn't mean you can reach over and take it." - Prof. Dirk Riehle

Prof. Dirk Riehle is Professor of Open Source Software at the University of Erlangen in Germany. Before entering academia, Prof. Riehle worked in Zurich, Switzerland, and in the USA, both in Boston, Massachusetts, and in Silicon Valley, California.

Highlights der Episode

• Open source software must be securely and correctly integrated into products.
• Licenses and security gaps are major challenges with open source.
• Commercial open source strategies support university mission and revenue generation.
• The effort behind the use of open source is often underestimated.
• Quality of the software can be significantly improved through close examination.

Using open source software securely

Introduction to the secure use of open source software

Today, open source software (OSS) is a central building block in the modern software ecosystem. Numerous products and projects are based on freely available components that are maintained by a global developer community. This openness promotes innovation, saves development costs and accelerates time to market.

**The secure integration of these components is important when using open source software. The use of open source not only brings advantages, but also challenges:

• Security risks: can arise from undiscovered vulnerabilities in dependencies.
• License verification: is essential to avoid legal pitfalls and to correctly comply with license terms.
• Transparency regarding the OSS components used through a Software Bill of Materials (S-BOM) helps to maintain an overview and quickly identify the affected components in the event of known problems.

The security of the entire software solution depends heavily on how carefully open source components are tested and managed. Companies must therefore not only ensure the technical quality of the OSS, but also understand the legal obligations associated with its use.

Using open source software securely means identifying risks, understanding licenses and continuously monitoring them - an integral part of modern software development.

Legal framework for the use of open source

Open source software is subject to various license obligations that must be understood and complied with in order to avoid legal risks. A basic distinction is made between two types of license:

• Permissive licenses (e.g. MIT license) allow extensive use and integration of the code, usually only with the requirement to name the original author.
• Copyleft licenses (such as the GPL) require derived works to be published under the same license. This means that the source code must be disclosed if you redistribute or modify software.

Using software from GitHub repositories without a valid license is legally problematic. Many projects on GitHub are not automatically open source; this depends on the explicit licensing. If this is missing or ignored, there is a risk of copyright consequences - including possible claims for damages or injunctions.

As a user or developer, you should always check whether the license is suitable for the intended use and what obligations arise from it. The distinction between end user and distributor is crucial here: the latter is often subject to additional disclosure and publication obligations.

Copyright remains fundamentally protected, even with open source. It defines the legal framework for licenses and their obligations as well as for the rights of authors. A sound understanding of these basics protects against unexpected legal problems when dealing with open source components.

Practical recommendations for companies when dealing with open source components

The need to understand license terms and security obligations within the team is crucial for the secure use of open source software in companies.

Companies should ensure that their team is informed about the following points:

1. License understanding:

• Thorough knowledge of the different types of open source licenses (permissive and copyleft).
• Understanding of the legal requirements and obligations when using open source components.

2. Security obligations:

• Raising awareness of security aspects when using open source software.
• Compliance with security standards and disclosure of security vulnerabilities within the framework of the security regulations.

3. Secure use of open source software:

• Regular training and updates on licensing and security.
• Implementation of processes for appraisal of license terms and security obligations prior to integration of new open source components.

A sound understanding of licensing and clear communication of security obligations within the team are key to minimizing the risk of legal consequences and security vulnerabilities when using open source software.