5 potential risks of open source software
June 29, 2021
0 mins readThe case for open source software is compelling. So much so that it has now become a standard part of the application development process.
Access to freely available libraries, frameworks, and processes saves the modern enterprise the time and cost of writing an entire application stack from scratch, helping to speed up development and drive innovation.
Unlike proprietary software, open source code isn't obfuscated. So it's also easy to adapt the codebase to suit your own individual business needs. Not only that, but anyone can find bugs and recommend fixes for issues within the code. This means problems are often identified more quickly, which in some cases helps open source software be more robust and secure than proprietary counterparts.
Risks of open source software
However, there are still some risks of open source software that should be considered when selecting projects for your stack.
For example, you may find some deployments difficult to set up and use due to immaturity or lack of documentation. Or you may run into hardware compatibility problems due to a lack of robustness. And in some cases, you may need to sign up with a costly third-party support provider to get technical assistance.
This post takes a closer look at five particular areas of concern, which represent the most significant risks of using open source software.
1. Software quality
Open source projects are typically community-oriented undertakings, whereby software is developed, tested, and improved through collaborative participation. That's why it's often considered more reliable than proprietary alternatives.
However, nothing is guaranteed — especially where projects are maintained by just a handful of participants.
Furthermore, contributors vary in knowledge, skills, and experience. Some are unable to dedicate as much time as others. So, as with any project with inadequate resources, quality will inevitably suffer.
One way to evaluate an open source project is to look at such metrics as maintenance and security. Evaluating those parameters and comparing similar open source projects will help make more educated decisions. It is easy to find and evaluate the best open-source package for your project with Snyk Open Source Advisor which covers over 1 million open source packages.
And unlike commercial software, which is usually backed up by some form of warranty, if it fails to perform, very few open source licenses include such protection.
2. Long-term sustainability
Many forms of open source software are the work of a small group of contributors. As volunteers, they all too often find themselves under pressure to maintain their projects while still holding down a full-time job.
This can lead to open source burnout, where a project stagnates because contributors cannot keep up the commitment — until eventually it winds down completely.
If you end up relying on open source components that are no longer maintained, you could find yourself responsible for fixing vulnerabilities and other code defects. So make sure you monitor how often projects are updated.
3. Software licensing
While most open source software is free to use, virtually all of it is licensed in some form or other.
There are currently more than 100 OSI-approved open source licenses. So a complex application stack or development environment may be subject to a bewildering array of open source license agreements — some of which may be highly complex and detailed.
An open source license normally falls into one of two broad categories — permissive licenses and copyleft licenses.
Permissive licenses, such as the MIT License, generally allow you to use the code as you see fit. In addition, you can incorporate the code into your own proprietary applications and distribute your derivative software — provided you acknowledge the original creator.
Copyleft licenses, such as the GNU General Public License and Server Side Public License (SSPL), also allow you to modify the code as much as you like. However, if you intend to repurpose and distribute it then you must make the new source code freely available. This can be particularly problematic if you want to integrate copyleft-licensed components into your proprietary software, as you may have to open up your own code in order to comply with the software license.
One way to steer clear of license issues is to draw up a list of approved open source components and maintain an inventory of open source software in use in your systems. Open source policies are another way of ensuring that license compliance is maintained.
At the same time, you should give due consideration to technical issues, such as how different applications and services interact, before deciding on which open source components to use. And also bear in mind that, even if your applications are for internal use, you may yet decide to release them sometime in the future.
Beware:
A large proportion of freely available software on development platforms such as GitHub does not have any license at all.
However, in many countries, application code is automatically granted exclusive copyright protection by default. So just because it’s in the public domain, doesn’t give you the right to use it. In other words, you should avoid using such software unless you have permission to do so.
4. Copyright infringement
Many open source developers are hobbyists. They are often left to their own devices and may not understand (or respect) the concept of protected intellectual property.
This poses the risk of copyright infringement, as an inexperienced or negligent coder can potentially allow proprietary code (or copyleft code) to make its way into a project. As a result, open source licenses don't accept responsibility for copyright or other intellectual property violations.
So make sure you perform due diligence before adopting any open source software to help avoid the potential of legal action and any resulting damages claim.
5. Software security
By virtue of its collaborative and transparent nature, open source generally has a better reputation for software security than proprietary software.
When a security flaw surfaces in a commercial application you have to wait for the vendor to respond. But, with open source software, someone is often on hand to fix it immediately.
However, this isn't always the case — especially for small-scale projects.
Not only that, but nearly half of all open-source projects also still don't have security auditing procedures in place.
So you shouldn't simply rely on the notion that everyone in the open source community is continually reviewing their projects for open source security issues.
In addition, keeping track of the latest software updates, patches, and unresolved vulnerabilities is no easy challenge.
For example, you can subscribe to the feeds of various databases of known vulnerabilities including Snyk's vulnerability database. But not even the largest and most comprehensive services, such as the National Vulnerability Database (NVD), list all reported issues.
You should also be aware that these services usually put updates on hold for several weeks to give open source developers time to discuss, fix, and test the vulnerability before it's made public.
While this approach makes sense, it still gives any hacker with inside knowledge more time to plan and launch an attack. And, even when users do get notified of a vulnerability, some will be too slow to patch — or, even worse, may not even be aware they use the affected component.
State of Open Source Security 2022
A look at software supply chain complexity and risk in collaboration with the Linux Foundation.
Stay ahead of the game
Despite the widely acknowledged benefits of open source software, you still need to do your research to ensure you choose the right solution for your organization.
But you also need to adopt tools that help you manage your deployments. These should give you clear visibility into your open source inventory. That way, you can keep track of all frameworks and libraries you use in your applications and maintain compliance with open-source license requirements.
You should also look for solutions that help you stay on top of application security by providing early detection of open source vulnerabilities before attackers get the chance to exploit them.
Careful management of your open source usage, with special attention to potential security and legal pitfalls, will help you enjoy all the advantages of the open source model with minimal risk of costly problems further down the line.
However, without the support of automated security and governance tooling, you'll be saddled with a significant amount of manual work to keep tabs on licensing compliance and the latest package vulnerabilities.
Get started in capture the flag
Learn how to solve capture the flag challenges by watching our virtual 101 workshop on demand.