Guidelines for Open Source Software Use

I posted earlier about the Silicon Flatirons session on “Re-examining Open Source & Community Development.”  During that session, I took some notes on organizational practices that may help as a commercial software development teams contribute to Open Source software projects and build commercial products from Open Source software.

Below are five guidelines discussed at the session: 

Guideline 0. Record every use of Open Source as it occurs.  Print paper copies of license agreements.  Be sure to keep the copy of the license under which you started using the Open Source applications or components as licenses may change over time.

Guideline 1. Decide how and when your company will provide indemnity and warranty for Open Source software.  Evaluate the risks your are assuming as you may have little or no upstream indemnification or liability protection from the Open Sources licenses you have agreed to. Articulate this policy to your customers and users of your software.

Guideline 2. During a sale or major funding event for the company, the question about Open Source software use will come up.  Because there is no purchase record for Open Source software, you should assemble your documentation form engineering notebooks, filed Open Source license agreements (see Guideline 0) etc. as you prepare for due diligence.

Guideline 3. Your strategy for complying with Open Source licenses is to cooperate with the community as much as it is to figure out the exact meaning of each agreement and come into technical compliance.  As much as staying out of court, you are trying to stay off Slashdot (www.slashdot.org) or get the negative attention of the Free Software Foundation.

Guideline 4. If your company chooses to build a core product using community development and Open Source licensing, articulate your code ownership policy clearly to every contributing developer.  If you plan to retain ownership of the code, create the appropriate Ownership Assignment Agreement, have each developer sign it and keep them on file.