While working for an employer if one modifies, rewrites, contributes or alters open source software in what cases can it ever be considered a trade secret?

A trade secret, FWIW, is defined by wikipedia as:

A trade secret is a formula, practice, process, design, instrument, pattern, or compilation of information which is not generally known or reasonably ascertainable, by which a business can obtain an economic advantage over competitors or customers. In some jurisdictions, such secrets are referred to as "confidential information", but should not be referred to as "classified information", due to the nature of the word in the USA.

  • Are you interested in answers for a particular FOSS license?
    – Jeremy
    Commented Jun 4, 2012 at 19:59
  • @JeremyHeiler No not at the moment.
    – chrisjlee
    Commented Jun 4, 2012 at 20:11
  • AFAIK, for example Google does not release some of it's modification which are used internally. For example modifications related to supporting BigTable and Google FS
    – vartec
    Commented Jun 4, 2012 at 20:50
  • FYI, most big named OSS projects make you sign your rights away on the code before they let you submit it back into the project. Commented Jun 4, 2012 at 21:26
  • 1
    Depends on whether the license of the project allows you to. Look at GPL.
    – user1249
    Commented Jun 5, 2012 at 10:02

4 Answers 4


Well, there's a couple of ways you can modify open source software without releasing it.

  • If you wrote it and are the one who applied the license then you can do whatever you want. It is fully possible to release code under the GPL and have your own, internal proprietary version.

  • If you are using and modifying the software for internal purposes, and not releasing the binaries, then under most licenses (even GPL) you don't have to release source.

  • If you are in the process of developing, but have not released to the public, you don't have to release source.

  • Some open source licenses do not require release of the source. (For instance, BSD or apache style licenses.)

If you are in one of these situations, and don't have to release source, then anything in the unreleased source can be a trade secret. Once you release of course that stops being the case.

My understanding is that even with the GPL you can certainly limit who you ship binaries to, which in turn limits who you have to release source to. So, for instance, if you say "you can't have the binaries unless you sign this NDA", then I don't think you have to give the source to anyone who has not signed the NDA.

In general, my understanding is that the GPL doesn't require giving source to anyone at all, just anyone with access to the binaries.

I am not a lawyer, so obviously consult a real one if it is an issue.

  • 2
    +1 for talk to a lawyer. If this is more than a curiosity question that's really something that should happen.
    – Servy
    Commented Jun 4, 2012 at 20:08
  • 3
    I don't think an NDA will help in the case of GPL, once you distribute something under GPL you can't restrict what they do with it, unless they are distributing binaries without giving source code.
    – Ryathal
    Commented Jun 4, 2012 at 20:12
  • You may be right on that.
    – user53141
    Commented Jun 4, 2012 at 20:15
  • 6
    @StevenBurnap The GPL additionally states that a distributor may not impose "further restrictions on the rights granted by the GPL". This forbids activities such as distributing of the software under a non-disclosure agreement or contract. Source: en.wikipedia.org/wiki/…. So I'd say you can't make someone sign an NDA.
    – K.Steff
    Commented Jun 4, 2012 at 21:30
  • 2
    @MSalters I don't think so: GPL's main purpose is to unify the "Object code" and "Source code" as two inseparable parts of a work. You can keep binaries and source to yourself, but once you release them, you must comply with the GPL. IANAL, but the FSF has many, and here are their 2 cents: gnu.org/licenses/gpl-faq.html#DoesTheGPLAllowNDA
    – K.Steff
    Commented Jun 5, 2012 at 10:21

A trade secret, by definition, cannot be known to the public. Once a "trade secret" becomes common knowledge (though reverse engineering, for instance), it loses it's legal protection. If you want protection for this, you need something closer to a patent.

One of the differences between patents and trademarks ... and trade secrets... is that trade secret is protected only when the secret is not disclosed.

  • I don't think this addresses the actual question. The question is about whether modifications can be considered to be trade secrets, not which is the best way to protect such modifications. Commented Jun 5, 2012 at 12:56

And what do you mean by "trade secret"? Do you mean you don't want to share your changes with anyone else? If that's the case, you need to abide by the license that the open source software is released under. If the license requires any changes to be released as well, you are violating the terms of the license if you do not release these changes.

  • 1
    Trade secret: en.wikipedia.org/wiki/Trade_secret
    – chrisjlee
    Commented Jun 4, 2012 at 20:03
  • Most open source licenses don't require you to share your changes with others, they only require you to distribute the code if you distribute a binary. You are free to make any changes you want as long as you don't distribute the program that is based on the changes. Commented Jun 5, 2012 at 12:59

It very much depends on the Open Source license. E.g. the Reciprocal Public License 1.5 is an OSL-approved license. It explicitly requires that your modifications must be made public "when you Deploy in any form -- either internally or to an outside party." (emphasis mine).

Well-known Open Source licenses such as the GPL and BSD are studied extensively and there's a reasonable consensus on what's legally allowed and required. If you're depending on more obscure licenses (open or closed), you'll need a lawyer to consider your particular situation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.