I'm trying to learn more about the open-core business model of software libraries such as Sidekiq, Gitlab, etc.

What I know so far is that they have a free, open-source community version which is hosted on a public repository such as Rubygems, which can be forked, and to which people can contribute code. They also typically have a premium, enterprise-version which is hosted on a private server, and which can only be accessed by paying a subscription fee and obtaining a license key, which the private server verifies before allowing the user to download the library. This enterprise version typically includes code which periodically makes a request to the maintainer's server to verify that the license is still active.

However, once the enterprise user signs up for a subscription and pulls down the code from the private server, what's to stop them from opening the code for the library and commenting out the code which verifies the license? Do these libraries distribute their premium code in a different, compiled format to prevent reverse-engineering? Or do they distribute the code in uncompiled form and just hope for the best?

  • 3
    Some orgs obfuscate their proprietary code, but that might not even be necessary due to how B2B sales work. Customers buy an enterprise edition because this saves them money. Those savings may come from additional features, but also from guaranteed updates and support. Modifying the code greatly complicates updates, and disabling a license check just to avoid paying misses out on non-technical benefits like support. Also, most enterprise offerings are cloud based, for which no interesting code is disclosed to customers.
    – amon
    Commented May 25 at 10:48
  • Can you explain how what you're asking differs from distributing any proprietary software? If the source has to be delivered then they may have some kind of contract in place. For e.g. Gitlab that is completely unnecessary because it's a web service. It will vary a lot depending on the product. Commented May 31 at 12:40
  • If it's a web service, I understand how access is controlled- API calls to that web service will be authenticated and authorized with an API key, and the request can be denied if the key is invalid. But if it's not a web service (i.e. Sidekiq, which runs locally), then how would the business know if the contract is being broken by the end user? I think @amon's answer makes sense- the business model is what ensures this monthly fee is paid, otherwise the end user can't receive support and updates. Commented Jun 1 at 15:24
  • @amon given that your comment is (a) an answer, albeit in short form, (b) receiving upvotes, and (c) has received the approval of the OP, could you maybe write it up as an answer, so the OP can accept it, and the question be put to bed?
    – MadHatter
    Commented Jun 2 at 7:39


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.