is there a good reason to fear closed-source code *inside* of open-source libraries?

Question

Here's the situation. At work here, I hear there is resistance to using open source code (Nant in particular) because there might be closed-source copyrighted code in there (meaning copyrighted by someone who'd have an interest in suing anyone who used their code, e.g. Sun, Oracle etc.). Meaning somewhere in that open source tool or library there might be a chunk of code that was directly lifted from copyrighted code. In theory, this means our company (which is quite large) get sued for big money because they used an open source library.

We don't ship any software, so how this theoretical plaintiff would find this out is a mystery.

I have also heard that some group of people came through a year or two ago and actually found instances of this in our codebase. That's hearsay of course, so who knows.

Is this simple paranoia? Didn't something similar to this happen with Linux a while ago? Wouldn't the burden of checking for copyrighted code lie with the people who made the code, not the people who use it?

Edit: country is USA.

Answer 1

Open source is (like everything else) copyrighted BY DEFAULT! Otherwise it'd be public domain!

Also, I don't see how you can be accountable if someone else infringes someone else's copyright. Unfortunately, you left your country field empty, so I don't know what kind of crazy laws you might have wherever you are.

On the other hand, lets take a look at this situation: There were numerous cases where a closed source company violated EULAs of free software makers (Cisco and FSF come to mind first, but there are many others). What if you happen to use closed-source library made from from free code in such way that it violates free code's EULA? There is no guarantee that closed source software isn't infringing someone's copyrights. In my example FSF sued Cisco, the ones who made the infringement, not the users.

Basically, my point is that whoever is resisting FLOSS is raising a valid concern (in some countries, at least) but is using it to unfairly target FLOSS. You have no better guarantee with closed-source of its legality than you have with open-source.

Also, how would you check if some open-source software is using pieces of closed-source code, unless you have access to that same piece of closed-source code?

Just read that country is USA, well good luck then. You can get sued for anything there.

Answer 2

You questioned how anyone finds out about this stuff. Well, when companies get bought and sold (and this is always in the back of the mind of most executives), they usually instruct lawyers to do a due diligence exercise. These days, that frequently involves looking at the use of any third party code. Sometimes, the enquiries are backed up by using software which actually sniffs out the presence of third party code. Yes, they need access to the source code, but such access is usually provided as part of the sale process.

There's also the risk of whistle blowers finding such code and saying something about it.

I'm finding that the issues related to use of third party souyrce code (of any variety) are getting more frequent. Organisations which show recognition of the issues are wise, and it's worth the developer community understanding the ramifications.