FOSS for Enterprise
Understanding Open Source Licenses, Risks, and Compliance
Indrajeet Patil
(xkcd, CC BY-NC 2.5)
Source code for these slides can be found on GitHub
What you’ll learn today
- FOSS licensing history and philosophies
- Legal implications and compliance requirements
- Enterprise risks: security, sustainability, and violations
- Automated tools for managing open source dependencies
Scope
✅ Inbound FOSS • Using open source in your products
❌ Outbound FOSS • Releasing your code as open source
Disclaimer: Educational purposes only. Not legal advice.
The FOSS Movement
Free Software
Free Software Foundation (1985)
Four Freedoms:
Run, study, modify, share
Open Source
Open Source Initiative (1998)
Open Source Definition:
10 criteria (non-discrimination, license distribution, technology-neutrality)
What are software licenses?
Different aspects of software are protected by different types of intellectual property law.
Software license: Legal instrument governing use, modification, and distribution of software
Movements ↔︎ Licence Philosophies
| Reciprocal (Copyleft) | Permissive | |
|---|---|---|
| Origin | Free Software Movement | Open Source Initiative |
| Philosophy | Preserve freedom for all users | Maximum freedom to developers |
| Key Feature | Derivatives must use same license | Minimal restrictions |
| Examples | GPL, AGPL, MPL | MIT, BSD, Apache |
| Goal | Ensure software remains free | Enable broad adoption and use |
License Combination Examples:
=
Copyleft
Custom
Copyleft
=
Permissive
Custom
Any License
Case Studies: License Violations
Famous legal battles involving FOSS license infringement:
Germany • Dismissed
Linux developer sued VMware for GPL violation. VMware ultimately removed problematic component.
Takeaway: Dismissed cases can still force compliance
USA • Settled
U.S. court ruled GPL is enforceable contract. Landmark Ghostscript case.
Takeaway: GPL licenses are legally binding contracts
USA • Multiple Settlements
First U.S. GPL enforcement lawsuits vs. Verizon, Best Buy, Samsung, and others.
Takeaway: Big names aren’t immune to enforcement
Security vulnerabilities
Common security risks:
- Outdated packages with known CVEs
- Unpatched critical vulnerabilities
- Supply chain attacks
CVEs can enable:
- Remote Code Execution - Run arbitrary code
- Data Exfiltration - Access sensitive data
- Denial of Service - Crash or disable systems
Case Studies: Vulnerabilities
The cost of failing to patch FOSS vulnerabilities:
Unpatched Apache Struts
150M+ people affected. Patch available 2 months before breach. Cost: $575M settlement.
Takeaway: Delaying patches costs hundreds of millions
CVSS 10/10 Critical
Apache Log4j vulnerability. CISA: “most serious in my career”. Hundreds of millions of devices vulnerable. Half of corporate networks probed.
Takeaway: Ubiquitous library = ubiquitous vulnerability
OpenSSL Memory Leak
17% of SSL servers affected (Yahoo, GitHub). Bug existed since 2011, disclosed 2014. Undermined Internet security foundations.
Takeaway: Encryption bugs expose everyone’s secrets
Sustainability risks
Common sustainability issues:
- Maintainer burnout and underfunding
- Abandoned or undermaintained projects
- Toxic communities
Business impact:
- No security patches or bug fixes
- Forced migration to alternatives
- Reputation damage from toxic projects
Critical dependency risk:
FOSS project at your product’s heart = its sustainability is your sustainability
Case Studies: Sustainability Failures
Real-world examples of FOSS sustainability crises:
Package Removal
11 lines of code, 15M+ downloads. Maintainer removed after dispute, breaking thousands of projects (React, Babel, Node).
Takeaway: Tiny dependencies create massive failure points
Burnout & Underfunding
9B+ downloads, 50% of top 10k websites. Solo maintainer earns ~$400/month, threatened to go closed-source.
Takeaway: Critical infrastructure runs on volunteer labor
Maintainer Protest
3.3B+ downloads. Maintainer sabotaged libraries to protest Fortune 500s using free work without giving back.
Takeaway: Frustrated maintainers can become security risks
Open Source Tool: Trivy
Trivy - Comprehensive security scanner by Aqua Security
- Vulnerability detection
- License scanning
- Secret detection
- SBOM generation
Scan a container image:
trivy image nginx:latestFree, open-source, widely adopted in CI/CD pipelines
Commercial Tool: Black Duck
Black Duck by Synopsys - Enterprise-grade SCA platform
- Comprehensive vulnerability management
- License compliance automation
- Supply chain risk assessment
- Policy enforcement
Configuration (application.properties):
blackduck.url=https://blackduck.example.com
blackduck.api.token=${BLACKDUCK_TOKEN}
detect.project.name=MyProject
detect.policy.check.fail.on.severities=BLOCKER,CRITICALEnterprise support, extensive database, advanced reporting
Integrating tools into your workflow
- Scan early and often - Integrate into CI/CD pipeline
- Set clear policies - Define acceptable risk levels
- Automate fixes - Use dependency update tools (Dependabot, Renovate)
- Monitor continuously - New vulnerabilities discovered daily
- Educate developers - Make security everyone’s responsibility
