Tell me more ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.
up vote 5 down vote favorite
1

Are there any situations where it may not be a good idea to use the code of an open source project, even if your company might allow you to do so?

Some cases that I think might be valid include:

  • The code may be implemented in a different languages.
  • It is not portable
  • It may need some other close-source libraries

What might be some other reasons?

share|improve this question

4 Answers

up vote 11 down vote

The most obvious to me are...

  • When the terms of the license are incompatible with the way the company will want to deploy the code - e.g. the GPL may require you to distribute other code in your project which your company may not even have the right to distribute.
  • When the open source code overlaps strongly with your companies core expertise. If your companys core expertise is designing games and graphics rendering engines, for example, it makes little sense to use Ogre3D. See http://www.joelonsoftware.com/articles/fog0000000007.html
  • When the open source code is badly written, badly documented and/or horribly buggy. If it'll take you longer to figure out how to use and fix the code than to roll your own, where's the benefit?

It may also be an issue if you suspect the open source project will take a different direction in the future than the one you need it to take. You have the option to maintain your own fork, but then you lose most of the longer-term benefits of open source anyway - the further your fork diverges from the original project, the less likely it is that others will find and fix your bugs for you and contribute useful new features.

share|improve this answer
7  
+1 for the GPL terms. It's the biggest issue I've run into using different OSS projects. – SplinterReality Oct 18 '11 at 2:45
up vote 2 down vote

The risks of using a third party are the same regardless of it being open-source or commercial closed source. things to check for when choosing a third party :

  1. Licence : is the licence compatible with the product you are building. for closed source look for royalties and redistribution rights. for open source look for attribution and viral licencing that could force you to go open source (GPL family).

  2. Active support and development. How stable is the development of this application (company or community) Is there an active support platform (support hotline, forums or mailing lists), can you see activity lately on them if they are available.

  3. How risky is getting stuck with library. If you are stuck with a library that is no longer supported, can you take over the support ? here having the source can save your ass at least temporarily until you find a replacement. Some closed source product will have means for you to acquire the source code, usually with extra expenses.

these are the three main points I look for in a third party. Of course I have no legal background whatsoever so if you work in a very sensitive product / domain best you ask legal competent persons first.

share|improve this answer
3  
-1 for repeating viral license FUD. If you amended someone else's open source code you have absolutely no right to profit from their work, and, your customers are going to be hacked off when they find out you sold them something that was available for free. If you used an open source library then you just need to make it clear that the library belongs to someone else and make it available. – James Anderson Oct 18 '11 at 6:21
5  
@James : You are clearly confusing free as beer and free as freedom. The GPL like most other open licences out there will not prevent you from profiting by selling a work based on opensource libraries. They may however obligate you to to release the source code of a modified library or, as is the case of the GPL, obligate you to release your ENTIRE system's source code under the GPL (hence the viral nature of the licence). If you feel offended by the word "viral" I'm open to suggestions and will edit if a better word comes up. – Newtopian Oct 18 '11 at 7:33
7  
@James: I strongly suggest you take the time to read and understand GPL licence. While your at it you should have a look at the LGPL and understand the difference between them. – Newtopian Oct 18 '11 at 13:23
1  
@James: Newtopian is right. What you're describing sounds a lot more like the MPL. The GPL came about the "viral" designation fairly: if you use one GPL-licensed library anywhere in your codebase, you are required to release the entire thing under the GPL, even if that library was just one minor portion of a large and complex product. The LGPL is a bit more forgiving, as it was designed specifically for libraries, but it's still got some pretty rigid restrictions on what you can and can't do with it. That's why I avoid GPL even in open-source work, and prefer MPL libraries. – Mason Wheeler Oct 24 '11 at 22:31
1  
@JamesAnderson It's not FUD if it's true. You may not like what he said about licensing, but GPL licensed items are NOT friendly to closed source projects, and it's the stated intention of the FSF to push projects into the Open Source domain. Don't believe any of us though, take the FSF at their own word: gnu.org/philosophy/why-not-lgpl.html – SplinterReality Oct 25 '11 at 2:44
show 5 more comments
up vote 1 down vote

The biggest thing I find with open source is support.

Is the open source project active? If the project has not been updated in some period of time and there is no activity in forums or the community, you may not be able to get a bug fixed.

Is there paid support? If it is written in a language you don't know or you don't have strong expertise on your team, you may really need paid support to get something fixed.

Depending on your company there may a security review required and if there are issues, you may not be able to get them fixed.

share|improve this answer
up vote 0 down vote

One thing I didn't see in the other answers is auditing.

If you're making something that's going to be determine if a missile gets launched, or how often someone breathes, it's pretty important to have auditing. If you need to import 20,000 lines of code from a "general purpose" open source library, it will usually be more productive to instead write 2,000 lines of code internally for just the one special purpose you need the library for. This goes much more so where all code must have formal proofs.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.