Is StillSecure open source?

Once more we have a company playing games with the definition of open source, forcing potential users to look under the hood, read the license agreement carefully, and risk a "gotcha" if they unknowingly violate its terms. (Say hello to my leetle frahnd. From the Boston Herald.)

This time it's StillSecure, a 7-year old company which has decided to make its Cobia, a modular security framework, open source. Sort of.

As Roberto Gallopini Galoppini of the Commercial Open Source blog reports, it's another one of those "it depends on what the meaning of is, is" deals.

Cobia (to its credit) offers a license FAQ in which it admits that its community license structure doesn't match OSI definitions of open source. Basically you can't redistribute it or bundle it into another, larger product.

In response to calls for the company to stop calling its offering open source, the company's chief strategy officer, Alan Shimel, noted that "a strict constructionist" wouldn't say it's open source, but "I don’t like strict constructionists in my Supreme Court judges." (Hence the picture above.)

The flip answer is, we have no Antonin Scalias in open source. The snarky answer is, strict constructionist doesn't mean what Mr. Shimel thinks it does.

The real answer is the market will decide. My guess is that Cobia is a fairly sound, self-contained product, one which its makers don't feel needs much community contribution to succeed. The meaning of the term "open source" is in the eye of the beholder, and those who buy this generic as a brand should do so with their eyes wide open.

If somewhere down the road StillSecure feels it needs to throw its legal weight around to enforce the differences between its license and a true open source license, I think the publicity and community reaction will show this to be a mistake.

Open source doesn't need a Scalia to protect itself.