A Guide to Open Source Software

This blog explains open source software (OSS), its history, and major licensing categories (strong/weak copyleft and permissive), then outlines organizational policies for license compatibility and security, including inventories/SBOMs, proactive dependency updates, and use of SCA tools for discovering, prioritizing (KEV, EPSS, CVSS), and remediating vulnerabilities, along with benefits of binary repositories. It also highlights current trends such as pseudo-open “responsible” licenses and increased U.S. government attention to OSS supply-chain security (e.g., EO guidance and CISA’s roadmap).