Open source,
explained for people
who aren't developers.
What is it, really? What's it good for? How do companies make a living giving software away for free? Why does AI change everything? Which tools should you try? How do you avoid getting burned? The complete guide, jargon-free, written on the assumption that you've never once opened a terminal.
What you'll understand
- Open source is code you're allowed to read, modify and redistribute — it does not automatically mean "free of charge"
- There are four terms you shouldn't mix up: open source, free software, source available, open weights
- Companies that do open source make their money on service, hosting, or enterprise features — not on the code itself
- AI in 2026 is in the middle of a split: Mistral, Llama, DeepSeek (open) versus GPT-5, Claude, Gemini (closed). You can test an open model on your own machine in five minutes
- Top 5 tools to try tomorrow: Bitwarden, Firefox, LibreOffice, Joplin, Audacity. No credit card, and you take back control of a lot of your data
- Full transparency: this article was written with Claude (Anthropic), then reviewed and signed off by me. If you spot an error or something that rings false, write to me and I'll fix it.
What is it, exactly?
Open source is computer code you're allowed to read, modify and redistribute. Picture a recipe published in full, with the ingredient list and every step: you can cook it, tweak it to your taste, and share your version. For a piece of software to genuinely earn the "open source" label, it has to tick ten very precise criteria laid out by the Open Source Initiative (the OSI), a reference non-profit founded in 1998.
No fine print, no exclusion by profession, no "free for individuals only." Without those ten criteria, it's not open source anymore. It's something else. And the distinction matters a lot, as you're about to see.
Four terms you shouldn't mix up
Before we go further, let's pin down the vocabulary. Four words you hear everywhere and that nobody tells apart clearly.
| Term | What it means | Example |
|---|---|---|
| Open source | Code that's readable, modifiable, redistributable, with no usage restriction. Validated against the ten OSI criteria. | Linux, Firefox, VS Code |
| Free software | Basically the same thing as open source. Same camp, different vocabulary. "Free" here means "free as in freedom," not "free of charge." | GNU, GIMP, GPL |
| Source available | You can read the code, but your use is restricted (no reselling it as a service, no direct competition). This is NOT open source. | Elastic, Redis (since 2024), HashiCorp Terraform |
| Open weights | AI-specific. You can download the model's parameters, but not the data used to train it. Not really open source in the strict sense. | Llama (Meta), Mistral 7B |
Why you need to remember this
Plenty of vendors play on these nuances to sell a product that isn't really open source. Meta's Llama is constantly presented as "open source" — it isn't, the OSI settled that in 2024. It's open weights, which means there are restrictions hidden in the license. Read before you sign.
The story in five steps
To understand where we are, you need to know where it came from. Forty years, five key moments.
Everyone shares
Software isn't a product. IBM sells outrageously expensive machines, and the code comes with them, free of charge. Universities swap their programs on punch cards. That's the default culture.
Stallman invents the movement
Richard Stallman, a researcher at MIT, can no longer modify the drivers for his printer. He launches the GNU project and founds the Free Software Foundation. In 1989 he publishes the GPL: if you use my code, you have to publish yours.
Linus Torvalds releases Linux
A 21-year-old Finnish student, Linus posts on Usenet: "I'm making a free OS, just a hobby." Thirty-five years later, his code runs 96% of the world's web servers and every supercomputer.
The term "open source" is born
Netscape opens the source of its browser (the future Firefox). Eric Raymond, Bruce Perens and Christine Peterson coin the phrase "open source" to make it less scary for companies. The Open Source Initiative is created right after.
Total explosion
Android (2008), GitHub (2008), VS Code going open source (2016), Microsoft buying GitHub (2018, 7.5 billion), license flip-flops (2021-2024), the boom in open AI (Llama, Mistral, DeepSeek). Today, more than 90% of enterprise software contains at least one open source component.
The licenses you need to know.
A license is the contract that says what you're allowed to do with the code. Not knowing how to read a license is like buying an apartment without reading the deed. Good news: there are only three families to understand.
- Permissive · "do whatever you want, just keep my name on it" → MIT, Apache 2.0, BSD
- Strong copyleft · "if you modify and redistribute, you have to publish your changes" → GPL, AGPL
- Weak copyleft · "copyleft only on my files, not on the product that uses them" → LGPL, MPL 2.0
If you want X, pick Y
The table someone should have handed you straight away.
| You want... | Pick | Well-known examples |
|---|---|---|
| Maximum adoption, code usable even inside closed proprietary software | MIT or BSD | React, Rails, Node.js, VS Code |
| Same, but with patent protection | Apache 2.0 | Android, Kubernetes, TensorFlow, Mistral |
| To force anyone who modifies your code to publish their changes | GPL v2 or v3 | Linux, Git, WordPress, VLC |
| To force even online services (cloud, SaaS) to publish | AGPL v3 | Mastodon, Nextcloud, Plausible |
| To ship a library usable in proprietary software without forcing everything to be freed | LGPL | FFmpeg, GTK, glibc |
| You're not sure | choosealicense.com | A GitHub site that asks you 3 questions and tells you what to pick |
Three false myths to break
Open source ≠ free of charge. Red Hat, bought by IBM for 34 billion, sells Linux. Open source ≠ amateur. 96% of the web runs on it. Open source ≠ nobody's responsible. Linux Foundation, Apache Foundation, Mozilla: tight governance, security audited by thousands of eyes.
If it's free, how do companies survive?
This is the first question that comes up, every single time. The one-sentence answer: the code is free, but everything around it isn't. Support, hosting, enterprise features, legal guarantees. Here are the three cases that prove it.
The five business models
Services + support
You give the code away for free and sell consulting, support and guarantees. Reference: Red Hat, SUSE, Canonical (Ubuntu).
Hosted SaaS
The code is free, but the "turnkey" version that runs in the cloud with backups and auto-scaling, you pay for monthly. Reference: MongoDB Atlas, Elastic Cloud, Confluent.
Open core
The community version is free. The features big companies need (directory sign-in, audit logs, advanced security) are paid. Reference: GitLab, Sentry, Cal.com, Plausible.
Dual license
The code is under a viral license (GPL). If you want to embed it in your closed product without publishing your code, you pay for a commercial license. Reference: the old MySQL, Qt.
Sponsorship + donations
The community voluntarily pays the maintainers through GitHub Sponsors or Open Collective. Works well for small projects, but never enough to build a real company. Reference: Vue.js (Evan You), Sindre Sorhus.
The myth of the bearded volunteer in a sweater
The romantic image of a contributor coding Linux on weekends for the sheer love of it is false. 84% of Linux kernel commits in 2025 are made by full-time salaried employees at large companies: Intel, Google, Red Hat, IBM. Why? Because Intel needs Linux to support its processors perfectly, Google runs Android on it across three billion smartphones, and Red Hat sells support. Modern open source is shared industrial investment, not romantic volunteering. Governance is handled by the Linux Foundation, the Apache Software Foundation and their equivalents.
The 2024-2026 controversy.
Over the past three years, several big companies have changed the license of their flagship product overnight, to block Amazon Web Services and the other clouds that were reselling their software without contributing back. The immediate side effect: it's no longer open source. The community responded by creating copies under the old license, which we call "forks."
| Tool | Date | Before → After | Reaction |
|---|---|---|---|
| Elastic | January 2021 | Apache 2.0 → SSPL | AWS forks → OpenSearch |
| HashiCorp Terraform | August 2023 | MPL → BSL | Linux Foundation forks → OpenTofu |
| Redis | March 2024 | BSD → SSPL | AWS, Google, Oracle fork → Valkey |
The founders' argument is always the same: "AWS takes our software, resells it as a managed service, makes hundreds of millions off it, and sends us nothing back. Without the pivot, we die." The opponents' argument: "You're hijacking the words 'open source' to sell a product that no longer is."
My personal take: both camps are right. But remember this: before you commit to a tool that's critical for your business, look at who controls the license. An independent foundation (Linux Foundation, Apache Software Foundation, Cloud Native Computing Foundation) = no pivot risk. A single company with shareholders = real risk.
Open source and AI: why it changes everything.
You use ChatGPT, Claude, maybe Gemini. All closed: you can only use them through their website or their API, and your data always passes through their servers. But since 2024, another constellation has exploded in power: open models. You can download them and run them on your MacBook or PC, without sending a single byte of data to anyone.
Five open models worth knowing
| Model | Maker | License | Really open source? |
|---|---|---|---|
| Llama 4 | Meta | Llama Community License | No — commercial restrictions (anti-competition clause at 700M users) |
| Mistral Small 4 | Mistral AI (France) | Apache 2.0 | Freely open weights — usable commercially with no strings attached |
| DeepSeek R1 | DeepSeek (China) | MIT | Freely open weights — the one that crashed the stock market |
| Qwen 3 | Alibaba | Apache 2.0 | Freely open weights — supports 119 languages |
| OLMo 3 | Allen Institute (AI2) | Apache 2.0 + Dolma dataset | Genuinely open source — weights + training code + data all published |
The DeepSeek moment
On January 27, 2025, a nearly unknown Chinese company releases DeepSeek R1, a reasoning model comparable to OpenAI's GPT-o1. Announced training cost: 5.6 million dollars instead of the usual hundreds of millions. Open source. The market rules on it the next day: NVIDIA loses 589 billion in market cap in a single session, the biggest single-day loss for one company in all of financial history. The whole thesis that "you need billions and 30,000-dollar GPUs to do AI" collapses. If you want the full story of that day, I tell it in episode 4 of my AI Wars podcast.
Why it changes everything for you
Three concrete examples to make it click.
You're a lawyer and you want an AI to analyze fifty client contracts. With ChatGPT, your documents go off to OpenAI and you breach attorney-client privilege. With Mistral installed locally via Ollama, the analysis happens on your own machine. Not a single byte leaves.
You're the CFO of a French SMB. IT won't approve ChatGPT for data-sovereignty reasons. Mistral, hosted in France, under the Apache 2.0 license, gives you clear guarantees.
You run an accounting firm and you want an AI that masters the French chart of accounts. With an open model, you can "fine-tune" it — feed it your own documents so it becomes an expert. With GPT-5, impossible.
Run Mistral on your own machine
Here's how to run a real AI model at home, no subscription, without sending out a single byte of data.
- Go to
ollama.comand download the Mac, Windows or Linux version. Double-click the installer. - Open the Ollama app. In the bar, type
mistralorllama3. The download takes five minutes the first time. - You end up with a chat interface just like ChatGPT. Except you can turn off your Wi-Fi and keep chatting. Magic.
If you'd rather have a proper graphical interface, look at LM Studio (a clean, Discord-style interface) or Open WebUI (which mimics ChatGPT perfectly). With 16 GB of RAM (the standard on a modern MacBook), you can comfortably run Mistral 7B or Llama 3 8B. Quality comparable to GPT-3.5.
For the complete walkthrough — hardware choices, models, RAG, cloud vs. local comparison, beginner traps — I've written the twin article to this one: Run a real AI at home. It's the natural next step when you want to go from "I download it in 5 min" to "I use it every day on my real documents."
Thirty tools to try.
You don't need to code to enjoy open source. Most of these tools install in two clicks, like any regular app. Here's my pick, by category.
Office & documents
LibreOffice
An alternative to Microsoft Office. Covers 95% of personal and small-business needs. Reads .docx, .xlsx and .pptx files natively.
Joplin
An alternative to Notion or Evernote. Encrypted Markdown notes synced across all your devices, without depending on a proprietary cloud.
OnlyOffice
Real-time collaboration on documents, without sending your files to Google. Excellent Microsoft compatibility.
CryptPad
Encrypted collaborative documents right in your browser. Nobody (not even CryptPad) can read what you write.
Visual creation & design
GIMP
An alternative to Photoshop. Photo retouching, compositing, cutouts. For 90% of amateur and freelance needs, it's plenty.
Inkscape
An alternative to Illustrator. Logos, icons, vector illustrations. Native SVG format.
Krita
Digital painting, illustration, comics. On a graphics tablet with a stylus, it's a real joy.
Penpot
An alternative to Figma. Interface design (websites, apps). Penpot 2 supports CSS Grid natively.
Audio & video
Audacity
Record your voice for a podcast, clean up audio. The dated interface is a deliberate choice, but it's brutally effective.
OBS Studio
Streaming to Twitch, YouTube, screen recording. The absolute standard among streamers.
Kdenlive
Video editing for YouTube or family use. Classic multi-track editing. Save often.
Shotcut
An alternative to iMovie / Movie Maker. Simpler than Kdenlive, perfect to get started.
Local generative AI
Ollama
The tool that lets you run Mistral, Llama and DeepSeek locally on your own machine. Two-click install.
Mistral Small 4
A genuine open source license, a French model. Excellent on 16 GB of RAM.
FLUX.1 schnell
Local image generation, an alternative to Midjourney. Needs a decent graphics card.
Whisper
Multilingual audio transcription (99 languages). The standard that a lot of paid tools use behind the scenes.
Communication & collaboration
Mattermost
An alternative to Slack. Very similar interface, painless switch.
Jitsi Meet
Quick video calls with 2-15 people, no account needed. Shareable link, instantly.
Element (Matrix)
Encrypted, federated messaging. Like email, your server can talk to another one.
Nextcloud
A complete collaboration suite: files, calendar, contacts, video. The open source Swiss Army knife.
Productivity & browsing
Bitwarden
A free password manager that works everywhere. If you're not using one yet, drop everything and install this today.
Firefox
The only mainstream browser still genuinely independent of Google and Apple. Excellent privacy handling.
VS Code
An excellent, powerful text editor, even for Markdown or config files. Better than TextEdit.
Plausible
An alternative to Google Analytics. No GDPR cookie banner, no data sent to Google.
Top 5 to try first if you're just starting
Bitwarden (instant security, zero friction) → Firefox (one click, you replace Chrome without losing anything) → LibreOffice (95% of personal office needs) → Joplin (simple notes, your data stays yours) → Audacity (perfect for discovering open source hands-on).
How to keep an eye on it.
The mistake beginners make is trying to follow everything. Unsustainable. The right approach: five minutes a day, thirty minutes a week, and sources that do the filtering for you.
Three go-to sources
Korben.info
The go-to for tech explainers in French. Korben tests the tools, explains what's at stake, and simplifies without being condescending. If an open source tool is worth attention in France, he writes about it.
Hacker News
The absolute reference. A homepage updated continuously, an ultra-responsive community of devs and founders. Every open source tool that gains traction shows up there. Address: news.ycombinator.com.
Console.dev
A weekly newsletter dedicated to open source dev tools. Ultra-curated, never any noise. Ideal if you want the pick delivered to you without having to scroll.
To automate it, add an "Open Source" folder in Feedly (free) with your RSS feeds. You open it five minutes a day, mark things as read, and save one or two articles to dig into over the weekend. That's it.
The five major traps.
Trap 1 — License contamination (the GPL trap)
If you embed GPL-licensed code in your closed proprietary product, you MUST publish your entire source code under the GPL. Not a part. All of it. Plenty of startups learned this the hard way. Fix: check the license of every dependency before you install it.
Trap 2 — The project that dies (or that the maintainer sabotages)
In January 2022, the maintainer of colors.js (pulled in by projects with 3.3 billion downloads) deliberately broke his own code, tired of maintaining it for free. Thousands of production apps went down overnight. What to anticipate: date of the last commit, number of active contributors, visible sponsors.
Trap 3 — The unilateral license change
HashiCorp Terraform, Redis and Elastic all changed their license overnight between 2021 and 2024. You were using something open source, and you end up with something that no longer is. Spot the risk upstream: who controls the license? A foundation = safe. A single company with shareholders = risk.
Trap 4 — The "free" that isn't open source
DaVinci Resolve, Discord, Notion, Skype, Zoom: all free, all proprietary. You can use them, but you have no rights over the code, no visibility, no guarantee. The day the vendor changes its mind (acquisition, pivot, bankruptcy), you lose everything.
Trap 5 — Fake open source in AI ("open weights")
Llama and Mistral are consistently presented as open source. Llama isn't (a restrictive license with an anti-competition clause). Mistral is on its small models (Apache 2.0), but not on the big ones. Read the license before you invest dev time in a model.
Security: vet it first.
Supply-chain attacks on open source are real. Three recent episodes that should serve as a lesson.
Log4Shell (December 2021): a maximum-severity flaw in Log4j, a library used everywhere in the world. It let anyone execute code remotely on any vulnerable server. It had been sitting there silently since 2013.
XZ Utils (March 2024): the most chilling attack of recent history. An attacker spent more than two years honestly contributing to a compression utility used by every Linux distribution. He earned trust, became a co-maintainer, then slipped in a backdoor. Caught by chance by a Microsoft engineer (Andres Freund) who'd noticed his SSH connections were taking 500 ms instead of 100 ms.
Polyfill.io (June 2024): a JavaScript service used on 100,000 sites is bought by a malicious actor. Starting in June, the service injects malicious code that redirects mobile visitors to scam sites.
Checklist to vet a tool before installing
- License recognized by the OSI: MIT, Apache 2.0, BSD, MPL = fine for most uses. AGPL, SSPL, BSL = read the license first.
- Active official repo: recent commits (last month at most), issues that get replies.
- Identifiable maintainers: real profiles with a track record, not anonymous handles created last week.
- Visible sponsors: GitHub Sponsors, Open Collective, or a recognized foundation (Linux Foundation, Apache).
- More than 100 stars and forks: a sign of real use by the community.
- No unpatched CVEs: search on
cve.mitre.org.
The free tool to turn on right now
GitHub Dependabot on your GitHub repos. Go to Settings → Security → Dependabot alerts. It's free, automatic, and it emails you every time a vulnerability is found in your dependencies. One click, and weeks of pain avoided.
If you want to start today.
The open source ecosystem in 2026 is mature, varied, accessible. You can replace 80% of your proprietary stack without losing any quality, just by investing a little learning time. The worst that can happen when you try: you uninstall it. The best: you save €200 a year in subscriptions and you take back control of your data.
My three concrete suggestions to get started:
- Install Bitwarden tonight. If you're not using a password manager yet, that's your one real cyber risk. Bitwarden is free, works everywhere, and you'll be set up in fifteen minutes.
- Try Mistral via Ollama this weekend. Download, install, first prompt: thirty minutes tops. You'll see with your own eyes that a powerful AI can run on your machine with no subscription.
- Sign up for Console.dev. A weekly newsletter dedicated to open source tools. Five minutes of reading, zero ads, and the end of the fear of missing out.
If you want me to send you more guides like this (on AI, open source, the tools I test), sign up for AI Playbook — it's my weekly curation, I share exactly the same thing I keep for myself. And if you have a question, a comment, or you think I've got something wrong in this article, write to me. I read everything, and I don't take it badly.
Open source FAQ.
What is open source, really?
Open source is computer code you're allowed to read, modify and redistribute. To earn the label, a piece of software has to tick ten precise criteria set by the Open Source Initiative (OSI), a reference non-profit founded in 1998. Without those ten criteria, it's no longer open source, it's something else.
Does open source mean free of charge?
No. Open source does not mean free of charge. Red Hat, bought by IBM for 34 billion dollars in 2019, sells Linux. The code is free, but support, hosting, enterprise features and legal guarantees all cost money.
Which open source tools should I try first?
My top 5 to get started: Bitwarden (password manager, instant security), Firefox (a browser that's independent of Google), LibreOffice (95% of personal office needs), Joplin (encrypted Markdown notes) and Audacity (audio editing). No credit card, two-click install.
How do companies make a living giving software away for free?
Five main business models: paid services and support (Red Hat), turnkey hosted SaaS (MongoDB Atlas generates 73% of revenue), open core with paid enterprise features (GitLab), commercial dual licensing (the old MySQL, Qt) and sponsorship via GitHub Sponsors. The code is free, but everything around it isn't.
What's the difference between open source and open weights?
Open source in the strict sense means source code plus data plus the right to modify and redistribute. Open weights is AI-specific: you can download the model's parameters, but not the data used to train it. That's not really open source in the OSI sense. Llama and Mistral are open weights, while OLMo 3 from the Allen Institute is genuinely open source.
Are the Mistral and Llama AI models really free and open?
Mistral Small 4 is under the Apache 2.0 license, genuinely free for commercial use. Llama 4 isn't: its Llama Community License includes an anti-competition clause at 700 million users, and the OSI ruled in 2024 that it isn't open source. Read the license before you invest dev time in a model.
What traps should I avoid with open source?
Five major traps: GPL contamination that forces you to publish your proprietary code, the abandoned project or one sabotaged by its maintainer (the colors.js case in 2022), the unilateral license change (Elastic, Redis, HashiCorp), the free-but-not-open-source trap (Discord, Notion, Zoom) and fake open source in AI (open weights sold as if it were free and open).
How do I vet an open source tool before installing it?
Six things to check: a license recognized by the OSI (MIT, Apache 2.0, BSD, MPL), an active official repo with recent commits, identifiable maintainers with a track record, visible sponsors (GitHub Sponsors, a recognized foundation), at least 100 stars and forks, and zero unpatched CVE on cve.mitre.org. Also turn on GitHub Dependabot for your repos.
What's the Elasticsearch, Redis and HashiCorp drama?
Between 2021 and 2024, these three vendors changed the license of their flagship product overnight to block Amazon Web Services. Elastic went from Apache 2.0 to SSPL in 2021, HashiCorp Terraform from MPL to BSL in 2023, Redis from BSD to SSPL in 2024. The community responded by creating forks under the old license: OpenSearch, OpenTofu, Valkey.
Why did DeepSeek crash NVIDIA?
On January 27, 2025, the Chinese company DeepSeek released R1, an open source reasoning model comparable to OpenAI's GPT-o1, trained for 5.6 million dollars instead of the usual hundreds of millions. The next day, NVIDIA lost 589 billion in market cap in a single session, the biggest single-day loss for one company in financial history. The thesis that "you need billions and 30,000-dollar GPUs to do AI" collapsed.
Shall we keep going?
I test AI for real and I share what works, no jargon and no hype. If this article helped you, the simplest way to not miss anything is my Friday letter. And if you have a question or a doubt: reply to me, I read everything.