Open Source (and Source Avaliable) vs Proprietary

On this site I suggest using source available software whenever possible. This is a highly important subject worth explaining: what is source availability, why do I push it so heavily, and what are the advantages and disadvantages of it?

What is Open Source Software?

The exact definition of open source varies depending on who's guidelines you're following. This is an important subject, but overall one that falls far outside the scope of this website. If you wish to learn more, I recommend starting with the Open Source Initiative and Free Software Foundation Europe.

For the purposes of this site, the improtant parts are that open source software is software that respects transparency, user freedom, and meets a few other technical criteria.

This website places a special emphasis on the "transparency" part of open source, specifically "source availibility." Source available software is software who's source code has been publicly published for anyone to view. This may include open source software, but sometimes software that is not "open source" by definition will still publish their source code publicly.

In other words: all open source software is source available, but not all source available software is open source.

There are several reasons an organization or developer may publish their source code, and of those reasons there are two that cause me to place a heavy emphasis on source available software.

The primary reason is for trust and transparency. With source available software, experts who know how to read and interpret the code can confirm that there’s nothing unethical going on in the background such as unnecessary data collection, or search for potential bugs or vulnerabilities such as poor encryption implementation.

A second closely-related reason is because those same people can submit suggestions for improvement when they find those issues.

While far from being a guarantee of either of these, source availability is one of many tools that can help us ensure that an app or service is indeed doing what it promises to do and does not have any glaring weaknesses.

Even if you don't possess these skills yourself, you still benefit from this type of freedom if you follow some of the recommendations I list later on this site.

Why Does Open Source Matter?

LastPass

LastPass is a password manager who does not publicly publish their source code. After suffering a data breach in which user vaults (encrypted password databases) were stolen, it came to light that LastPass was using poor hashing implementation for user master passwords and was not encrypting the URLs of sites stored in the vault, making vaults potentially easy to crack or helping cybercriminals know what sites you had accounts with and effortlessly craft convincing phishing emails to steal your logins for those sites. It's very likely that had LastPass been source available, the large userbase would've noticed these issues ahead of time and urged the company to fix them.

Digital Rights Management (DRM)

Digital Rights Management (or DRM) is the technical term for anti-piracy or anti-copyright abuse technology. It allows companies to ensure that you're using a legitimate copy of their software, game, or ebook (or other digital files) rather than a pirated version, and also that you're using it in accordance with the terms of service (ex: not hosting a for-profit movie theater in your home).

In some ways, there is a good reason for this technology to exist. This can ensure that musicians get paid for their work and that that popular products have a chance to continue their success.

However, DRM is being rampantly abused by corporations today. Let's examine two real-life cases of DRM gone wrong and how open source could prevent these issues.

Two separate people purchased different proprietary products: a refrigerator and a printer. Those products come with additional accessories that provide additional revenue streams: water filters and printer ink respectively. In today's competitive market, it's often more frugal (and legal) to find a third-party off-brand who offers a compatible part for less than the manufacturer's product that works just as well. Manufacturers are beginning to respond by making their products digitally refuse to use third-party accessories.

In the case of the fridge, the owner learned this when they installed a $19 generic water filter. The fridge used DRM to confirm that installed filter was not an official first-party name-brand filter and therefore refused to dispence ice or water like it had before. The official filter costs $55.

The printer story was even worse: the customer noticed that they had a recurring $5/month subscription to "HP InstaInk." The customer cancelled this subscription, unsure what it was for. After cancelling, the printer refused to print anything, even with official HP ink installed.

On the one hand, one could argue that this is a company protecting its investment or intellectual property, especially since many manufacturers sell the initial product at a loss or reduced profit expecting to make the money back in recurring purchases.

However this also sets a dark trend where corporations control all the products in our lives and crush out competition.

The modern era is flooded with examples of DRM overreach.

• In 2022, BMW started requiring a subscription to make use of the heated seating feature installed in their cars.
• Pearson, the publishing company who essentially monopolizes the academic textbook space, abused their monopolistic power to raise texbook prices by $500 in a single week.
• In 2009, Amazon entirely removed digital copies of 1984 from the libraries of customers who had already purchasd them after a copyright dispute.
• Many Apple users were outraged in 2014 to wake up one morning and find that copies of U2's latest album had been placed into their iTunes libraries without their consent.

There are certainly defenses to be made to fight piracy and ensure products aren't being used for illegal means, but these stories also illustrate the potential for this technology to be oppressive.

We live in a world of 24/7 online connectivity.

Many cars now have their own modems built in to connect to the internet from anywhere; our appliances like thermostats, lightbulbs, washing machines, and coffee makers are constantly connected for remote control or convenience.

As connectivity increasingly permeates every item in our lives, it's important to not only be aware of what data those devices are recording and the security risks, but also to know that they now have the ability to enforce the terms of service (which are often subject to change without warning) at any time for any reason.

In 2021, the power companies in Texas remotely adjusted smart themostats during a heatwave without warning to conserve power and reduce strain on the grid.

Your car might not report you for speeding right now, but it has the ability to and at any time the service provider may start reporting your speeding habits to insurance and law enforcement.

In the future your car may only allow you to repair it with manufacturer parts, or may decide that attempting repairs at home voids your warranty.

In 2020, a driver got stranded when his rental car couldn't connect to a network.

Open source protects against situations like these because they are designed to be proliferated. You can't control the competition if you make the product freely available without restriction. You can't stop anonymous users from sharing and modifying it. Even if you tried to enforce DRM, the source code can be modified to remove that enforcement.

It protects consumers from anti-competitive monopolies who price gouge, collect too much data, fail to implement proper security, and put unreasonable restrictions on users for the products they already paid for.

Despite all my praise on this page, it's important to note that open source products are not automatically guaranteed to be safer or more private. However, with the code freely available there's less room for abuse and more opportunity for an active, involved community to help improve the product.