Explore corporate concerns with open-source software components
In summary, modern software development, including the Microsoft developer platform and ecosystem, implies open-source components.
It has implications for companies that build software, either commercially or for internal use.
The inclusion of software components that are not built by the companies themselves means no complete control over the sources.
Being responsible for the source code used in components used within a company means that you must accept its risks. The concerns are that source code component:
- Are of low quality. It would impact the maintainability, reliability, and performance of the overall solution.
- Have no active maintenance. The code wouldn't evolve or be alterable without copying the source code, effectively forking away from the origin.
- Contain malicious code. The entire system that includes and uses the code will be compromised. Potentially the whole company's IT and infrastructure is affected.
- Have security vulnerabilities. The security of a software system is as good as its weakest part. Using source code with vulnerabilities makes the entire system susceptible to attack by hackers and misuse.
- Have unfavorable licensing restrictions. The effect of a license can affect the entire solution that uses the open-source software.
The companies will have to make a trade-off: its developers want to use open-source software components, allowing them to speed up development and use modern frameworks, libraries, and practices.
On the other hand, giving the developers and projects the freedom to include open-source software should not put the company at risk.
The company's challenges are finding a way to keep the developers empowered and free to choose technology to use while making sure the risks for the company are managed as well as possible.
Other challenges come from companies that offer open-source software to the public.
These challenges include having a business model around the open-source, when to publish open-source code and how to deal with community contributions.
The fact that your source code is open doesn't imply that anyone can make changes to it.
There can be contributions from community collaboration, but a company doesn't necessarily have to accept it. It's referred to as-closed open-source.
Suggestions for change are welcome, but the maintainers are the ones that carry out the actual changes.