When not to Open Source?

[shahnawazshahin]

Most likely I'm asking the question in the wrong place, but worth a shot .

Can anyone advise when not to Open Source a solution? This meaning developing a solution and making it Open Source, rather than adopting Open Source solutions.

This is something I'm trying to get an understanding in the limitations of adopting Open Source when developing a solution.

I'm concerned around cases such as:

1. Is it okay to Open Source a solution that is developed against a data source or system that contains sensitive data (such as National Insurance numbers, financial details, etc.)?
2. Could it put a risk in competitive advantage?

Are there any other factors that could impact the adoption of Open Source of the solution?


Shah.

[whyBish]

Are you asking about when to use/not use Open Source components, or are you asking about when to provide your actual project as an Open Source project.

[shahnawazshahin]

I'm asking about when to provide an actual project as an Open Source project.

[whyBish]

I'm asking about when to provide an actual project as an Open Source project.

Other factors to consider:
- is it generic enough to be useful elsewhere?

- what is the reason for open-sourcing?
* more eyes for testing?
* more hands for development?
* more minds for problem solving/ideas?
* will anyone else be interested in those roles? what incentives will attract them?

- Do you want to retain control?
* have final say on what is committed?
* have final say on what ideas are included?
* have final say on release cycles?
* have final say on backwards compatibility etc. after first public release?

As to your original two points, does the project really have anything to do with sensitive data, or is the use on sensitive data just one way that the project could be used? (i.e. do you need to actually expose that data?)
As to competitive advantage, do you currently have something already in this space? Is it currently providing you with an advantage, or does the advantage come from data that it uses that wouldn't be released? If you currently have software how reliable is it? How hard (cost/time) would it be for a competitor to imitate?

[shahnawazshahin]

Thanks for your valuable input.

With regards to sensitive data, if a solution is open source that could potentially expose the data model of, say, a financial system holding bank account details?


Shah.

[whyBish]

Exposing the model should not be a concern from a security perspective.
The questions I'd ask would be is the model reusable? Is it likely that a competitor would come up with a similar model (or already have one)? Is the model 'clean' (i.e. is it just the model being exposed or does it have some additional functionality tied in that may be a risk to expose)?
If you came to the conclusion that the model couldn't be exposed then I'd ask, could you inject a model into the framework (i.e. open source the framework with interfacese for a generic model, and keep your specific implementation private)?