Open-source software is software whose source code is public. Anyone may read it, use it, change it and pass it on. Richard Stallman, who started the free software movement, summed it up in one line: “free as in free speech, not free beer.” Open source is about freedom, not price.
You probably used some today already. Android phones run on Linux and so do most web servers. In August 2026 Linux turned 35. The project that Linus Torvalds once called “just a hobby” now runs a big part of the world’s IT.
For a long time, many companies in Germany and Europe did not think much about where their software comes from. Today this looks different. When business applications and sensitive data sit with a provider in the USA or another country outside the EU, other laws can apply to them. A foreign government may request access. Sanctions may cut off a licence. A vendor may change its prices from one year to the next. For personal data, health records or business secrets this is an uncomfortable thought. Open-source software gives you a way to keep such data in your own hands.
Bareos develops open-source backup software. Backup is exactly the place where these questions become very practical. Andreas Rogge, principal in Bareos, explains this in his talk “Why Free Backup Software Matters” and many of his ideas found their way into this article. It looks at where open source came from, how it is used today, what to keep in mind and what it all has to do with digital sovereignty and backup.
What open source means
Every program starts as source code. This is the text developers write. With most commercial software you only receive the finished program. You can run it, but you cannot look inside or fix something yourself.
With open source the code is published together with a licence. The licence gives you four freedoms that the free software movement wrote down in the 1980s. You may use the program for any purpose. You may study it and change it. And you may share copies, also of your changed version.
Companies may also sell open-source software and many of them do. The licence protects your right to work with the code.
Two families of licences
Code on GitHub without a licence is not open source, by the way. Legally nobody may reuse it. Most open-source licences belong to one of two families.
Bareos, for example, is published under the AGPLv3, a copyleft licence.
A short history of open source
Open source is older than its name. In the 1950s and 1960s software came together with the hardware. Researchers passed code to each other freely, a bit like cooks share recipes.
In the late 1970s this changed. Software became a business of its own. Vendors closed their code and added strict licences.
In 1983 Richard Stallman, a programmer at MIT, announced the GNU project. His plan was a completely free operating system. In 1991 the Finnish student Linus Torvalds published the Linux kernel, the part GNU was still missing. Soon developers from all over the world were sending improvements over the internet.
The term “open source” came in 1998. Its supporters wanted a name that managers would not mix up with “no cost”. The Open Source Initiative (OSI) was founded in the same year.
Microsoft is a good example how much opinion has changed. In 2001 its chief executive called Linux “a cancer”. In 2018 the company paid $7.5 billion for GitHub, the largest home of open-source code. Microsoft now earns more from its cloud business, which runs mostly on Linux, than from its classic Windows business.
Open source today
Today open source is part of almost every software. Black Duck’s 2026 OSSRA report checked 947 commercial codebases and found open source in 98% of them. In a typical application more than 70% of the code is open source .
It runs much of the infrastructure companies depend on: Linux on servers, Kubernetes and PostgreSQL in the cloud, Proxmox VE for virtualisation and PyTorch in AI research.
The business side has grown up too. Vendors earn money with subscriptions, support, consulting and hosted services. Bareos works the same way. The software is open source, while Bareos Subscriptions give you maintained binary packages, subscription plugins and official support. In Germany public buyers now also have clearer rules for this. In 2026 the EVB-IT contract templates for public IT procurement were updated to include open-source software.
Benefits of open source
The first thing many IT teams like about open source is transparency. You can read the code yourself or let an expert check it. So you know what the software does with your data.
The software itself costs nothing. What you pay for is support, maintained packages and know-how, and only when you need them.
Security problems are discussed in public. Anyone can report a bug and the fix is published for everyone.
Good projects also tend to last a long time, often longer than the company that started them. Linux is 35 years old and still in active development.
For organisations in Europe two more benefits are probably the most important ones today: independence from single vendors and digital sovereignty.
Vendor lock-in
- Vendor lock-in means you depend on one supplier so much that switching gets too expensive or too risky. Usually nobody plans it. A tool is convenient, the price in the first year is fair and the team gets used to it. Some years later your data sits in a proprietary format and your processes are built around one product.
- With backup this has a special twist. A backup system is one more business-critical service in your company. If it fails, your business continuity is at risk. And the biggest risks for it are often not technical at all. They come from the vendor and the market.
- A vendor can stop supporting the old systems you still need to back up. A cloud backup service can be shut down. After a merger one of two backup products often disappears and with it maybe the ability to read old archives. Or you need an urgent restore, the backup fails and the fix for the bug already exists upstream. The vendor just plans to ship it some months later.
- New rules play a role too. Maybe a vendor does not implement what the Cyber Resilience Act requires. Sanctions or export restrictions can even forbid a foreign vendor to sell or license its software to you. And then there is money. Vendors drop small and medium customers, move features behind a paywall or change from charging for transferred data to charging for stored capacity.
- The virtualisation market showed recently how real this is. After Broadcom bought VMware, changes in licensing and product packaging made many organisations look for alternatives .
Why backup is especially exposed
Backup makes all of this harder. Backups often have to cover systems that reached end of life five or ten years ago. The data is kept for many years, sometimes for decades. Moving it out of a proprietary format is a big project. And if the product fails during a real disaster recovery, there is simply no time to switch.
Open source does not make these risks disappear completely. What it does is turn a problem that looks impossible into one that is merely painful. The data format is defined in public code, so your backups stay readable. You can run the software yourself, debug it or ask a developer to patch it. You are free to change your support partner. Nobody can later lock away features that were open before. And if a project drops a function, you can still keep the old version alive.
Why open source matters for digital sovereignty
Digital sovereignty means that an organisation can decide about its IT by itself. Where is the data stored? Who can access it? Can we change the supplier if we want to?
For many years Europe relied on a small group of large vendors, most of them from the USA. For a long time this felt safe enough. In the last years the political situation changed. The relationship between the USA and Europe became less predictable, with trade disputes, tariffs and sanctions in the news. Many companies saw how quickly access to software and cloud services can turn into a political question.
The legal side adds to this. GDPR sets strict rules for personal data. At the same time the US CLOUD Act allows US authorities to request data from US providers, even when this data is stored in a European data center. For customer data, health information or business secrets this is not a comfortable situation.
Open source gives organisations a practical way to keep control. They can check the code, run the software in their own data centre or with a European hosting provider and change service partners when needed.
German public authorities are moving in this direction. Schleswig-Holstein has started to replace proprietary software with open-source solutions in its state administration . The Center for Digital Sovereignty of the Public Administration (ZenDiS) offers openDesk, an open-source workplace suite. It also runs openCode, the central platform for open-source software in German public administration. Bareos is listed there since September 2026. In France Bareos has been on the government’s SILL list of recommended free software since 2018.
Regulation goes in the same direction. Under the EU Cyber Resilience Act (CRA) manufacturers have to report actively exploited vulnerabilities starting in September 2026. Most other obligations follow in December 2027. Who builds products on open source carries the manufacturer’s duties for them. Public code and a clear maintainer make these duties easier to handle.
Private companies face the same questions. For a small and medium-sized company sovereignty is quite concrete. If a supplier raises its prices or leaves the market, the business keeps running and the data stays accessible.
This is why Bareos is open source. Bareos is fully open source under the AGPLv3 and runs in your own infrastructure. It backs up Linux, Windows and macOS systems, virtual machines on VMware, Proxmox VE and Hyper-V, databases and tape libraries. The backup format is documented, so your data does not depend on a single supplier. Companies that need maintained packages and guaranteed support get them through a Bareos Subscription, directly from the team in Germany that develops the software.
What to keep in mind
Like any software, open source has some weak points. It helps to know them before you depend on it.
Many important projects rely on a small number of volunteers who work in their free time. Big companies use their work but give back rarely. When such a maintainer gets tired, a project can slow down.
Public code is safer only when people really look at it. In 2021 a bug in the small Java library Log4j, known as Log4Shell, affected millions of systems. In 2024 an attacker spent years winning the trust of a maintainer and then hid a backdoor in the xz compression tool. A developer found it more or less by chance. Of course closed software has serious bugs too. The difference is that outsiders cannot look for them.
Modern applications also include hundreds of components. The 2026 OSSRA report found licence conflicts in two thirds of the checked codebases, more than ever before.
Some vendors started with an open licence and later moved to a more restrictive one. Elastic, HashiCorp and Redis did this. The community answered with forks: OpenSearch, OpenTofu and Valkey. So it makes sense to check who governs a project.
And a free download is not yet a production setup. Especially backup needs maintained packages, tested updates and somebody to call if a restore does not work.
Open source vs. proprietary software
The main difference is who controls the software. With open source it is you. With proprietary software it is the vendor.
| Open source | Proprietary | |
| Source code | Public, anyone can check it | Closed, only the vendor sees it |
| Costs | No licence fees; support is paid if needed | Licence fees per user, server or data volume |
| Vendor lock-in | Low, you can change partners or run it yourself | High, you depend on one vendor |
| Digital sovereignty | Can run in your own data centre under EU law | Often tied to the vendor’s cloud and jurisdiction |
| Security | Open review and public fixes | Internal review, you rely on the vendor |
| Future of the product | Code remains even if the vendor disappears | Product can be discontinued |
| Customisation | As far as you need | Limited to what the vendor allows |
Proprietary products have their strengths too. Some of them are very polished and one vendor is responsible for everything. On the other hand, an abandoned open-source project can be worse than a commercial product with good support. So it is worth looking beyond the licence. Who maintains and supports the software? And how hard would it be to leave?
Conclusion
Open source started with a simple idea: people should be able to share and improve software. This idea is now more than 40 years old and most of the software we use today depends on it.
For companies, using open source well is mostly a question of planning. Know which components you run, prefer projects with active maintainers and have a support contract for your critical systems. Then you can look inside your software, adapt it and change suppliers when needed.
If you plan to replace a proprietary backup system, take a close look at the open-source options. Also check how stable a vendor is. If a small company is bought or closes down, you still want to be able to restore your old backups
For public authorities in Germany it got easier than a few years ago. openCode helps them find open-source software and the updated EVB-IT templates give them a contract framework for buying it.
Backup is a good place to start. Bareos is open-source backup and recovery software, made in Germany, that you can run fully in your own infrastructure.