Why licences matter when downloading
Every program comes with terms that say what you may do with it. For most commercial software those terms are a licence agreement you accept when installing. For open source and free software, the terms are a public licence that anyone can read before downloading, and that grants rights rather than only restricting them.
You do not need to be a lawyer to use open source software, but knowing the basic categories helps in two ways. It tells you what you are allowed to do, such as using a program at work or giving a copy to a friend. And it helps you spot when something described as "free" is not what it claims to be. This guide is general information, not legal advice; for a question about a specific licence and a specific use, the licence text and a qualified adviser are the authority.
Free of charge is not the same thing
"Free" is used for two different ideas. The GNU Project, which coined the term free software, says to think of "free" as in free speech, not as in free beer. Its definition is about the freedom to use, study, share and change a program. It notes that you may have paid for a copy of a free program or got it at no charge, and either way the freedoms are the same; you may even sell copies.
Plenty of software that costs nothing is not free software or open source at all: the maker simply chooses not to charge, while keeping the source code private and forbidding copying or changes. Nothing about its price tells you whether it is safe, and CISA points out that free software is a common place to find a Trojan horse, a program that looks legitimate while doing something harmful.
The four freedoms
The GNU Project's Free Software Definition says a program is free software if its users have four essential freedoms, numbered from zero:
- Freedom 0: to run the program as you wish, for any purpose.
- Freedom 1: to study how the program works and change it so it does your computing as you wish. Access to the source code is a precondition for this.
- Freedom 2: to redistribute copies so you can help others.
- Freedom 3: to distribute copies of your modified versions to others.
Source code is the human-readable form of a program that a programmer edits. The installer you normally download is a compiled form built from it.
The Open Source Definition
"Open source" is a separate term with its own definition, maintained by the Open Source Initiative. The OSI states that open source does not just mean access to the source code; the licence must meet ten criteria. In summary:
- Free redistribution. The licence must not stop anyone selling or giving away the software as part of a larger collection, and must not require a royalty for that.
- Source code. The program must include source code, or there must be a well-publicised way to get it for no more than a reasonable reproduction cost. Deliberately obscured code does not count.
- Derived works. The licence must allow changes and derived works, and allow them to be shared under the same terms.
- Integrity of the author's source code. A licence may ask that changes be shipped as separate patch files, or that modified versions use a different name or version number.
- No discrimination against persons or groups, and none against fields of endeavour. The OSI's example is that a licence may not forbid use in a business or for genetic research.
- Distribution of licence. The rights must pass to everyone who receives the program, without them signing anything further.
- Not specific to a product, not restricting other software, and technology-neutral. The rights must not depend on the program being part of one particular distribution, must not dictate what other software is shipped beside it, and must not depend on a particular technology or style of interface.
The OSI notes that its definition was originally derived from the Debian Free Software Guidelines, written by the Debian Linux project. In practice the two terms, free software and open source, cover most of the same licences, though the two organisations describe their aims differently.
Copyleft and permissive licences
Open source and free software licences fall broadly into two families.
Copyleft
The GNU Project describes copyleft, very simply, as the rule that when you redistribute the program you cannot add restrictions that deny other people the central freedoms. If you share a copy, or a modified version, the people who receive it get the same rights you had. The best-known copyleft licence is the GNU General Public License (GPL). The GNU Project's licence list describes version 3 as its latest version and recommends it for most software.
Permissive
Permissive licences, which the GNU Project calls lax, permissive or non-copyleft, still grant the freedoms but do not carry the copyleft rule, so they place fewer conditions on what people who redistribute the software must pass on. The GNU list gives the Apache License 2.0 and the Expat licence as examples. It adds that many people call the Expat licence "the MIT License", a name the GNU Project considers ambiguous because MIT has used several licences.
Compatibility
Licences do not always mix. The GNU Project's list notes, for example, that the Apache License 2.0 is compatible with version 3 of the GPL but not with version 2, and that GPLv3 is not compatible with GPLv2 by itself. Compatibility matters to people who combine code from different projects; it rarely affects someone who only installs and runs a program.
Example: reading a licence notice
This is an invented example and describes no real program. A small image-conversion tool's download page says "Licensed under the Apache License 2.0" and links to the source code. From the categories above, a reader can tell that the tool is open source, that using it at work is allowed, and that a copy can be passed on to others. None of that says whether this particular download is genuine: that still depends on getting it from the project's own site or a distribution's package manager, and checking a published checksum.
What a licence asks of someone who just runs it
For most readers, the reassuring point is in the definitions themselves. Freedom 0 is the freedom to run the program for any purpose, and the Open Source Definition forbids licences that restrict use by field of endeavour. Copyleft conditions, as the GNU Project describes them, attach to redistribution: they govern what you must do when you pass the program on, not what you may do with your own copy.
The obligations grow when you share copies, ship the software inside a product of your own, or publish a changed version. At that point read the actual licence text, because the details differ between licences and versions.
Licences and download safety
Open source projects are often mirrored, repackaged and re-uploaded by others, which is exactly what their licences allow. That freedom also means a copy on a random site may have been changed. The safe habits from the other guides apply in full:
- Get open source software from the project's own site or from your operating system's package manager, where it has been packaged and signed.
- Use the checksums and signatures that many projects publish; the guide on hashes and signatures explains how.
- Be wary of "free" versions of paid programs. They are not open source by being free of charge, and CISA warns that free software can hide a Trojan horse.