What to Consider with Open Source Licenses?

The Two Groups

Permissive Licenses (MIT, Apache 2.0, BSD): commercial use allowed, modifications allowed, no obligation to disclose. Usually, it is sufficient to provide the license text and the copyright notice. This group is uncritical.

Copyleft Licenses (GPL, AGPL): Anyone who distributes the software and uses copyleft code may be required to disclose their own source code as well. With the AGPL, this can even apply to software that is only provided over the network.

Why This is Practically Relevant

If your application incorporates an AGPL library and is accessible over the Internet, it may lead to an obligation to disclose your own code. The situation is different for purely internal applications.

This question cannot be answered universally – it depends on the nature of the integration and usage.

What You Should Require

A list of the components used with licenses – for every project and kept up to date. It costs the service provider little and answers the question in minutes instead of days in case of doubt.

What You Should Not Require

A complete waiver of open source. Practically every modern application is based on it. A waiver would multiply costs without increasing security – on the contrary: widely used components are better tested than custom-written ones.

This text does not replace legal advice.