Taking a risk on open-source software

By Ellen Messmer, NetworkWorld.com, 01/05/04

Every decision in life comes with risk, if not reward, and Midvale, Utah-based consultancy Burton Group drives home that point well in a report sizing up the pros and cons of bringing open-source software into use in any organization.

According to the report "Open Source Software: Risks and Reward," the advantage of using open-source software rests on the notion that it is often identified as "free" and "open" because the source and binary files are available at no cost and without the licensing restrictions found in commercial software. However, as the Burton Group report makes abundantly clear, there are many legal considerations that come into play in using open source that may not make it a good fit for every organization.

There are thousands of types of open-source software available-Web sites such as SourceForge and Free Software Foundation are great pointers to them-that typically can be used only by agreeing to the open-source terms and conditions. Some open-source software, such as Apache Web Server source code, can be used and resold commercially with few restrictions, such as following guidelines on posting an Apache copyright notice.

But there are hundreds of different open-source licenses, with a handful known as the GNU Public License, the Lesser GPL and Berkeley Software Distribution gaining the most attention due to their prevalence. These licenses carry restrictions that will impact commercial software projects that corporations undertake-either for internal use or for re-sale-if open-source code is used, the Burton Group report notes.

Burton Group analyst Gary Hein, who authored the report, points out that "users, too, should be concerned if open-source software is used to build mission-critical internal applications since these applications may find their way outside the company, either as commercial projects or perhaps as connectors that enable collaboration and integration with customers and suppliers."

In discussing the report, Hein said his goal was not to argue against using open-source software, but to point out the many risks that are often overlooked when IT departments become enthralled with the idea that open-source always signifies "free" and "freedom."

"There's no such thing as a free lunch," Hein adds. Labor, service and support also have to be figured into the equation for using open source within an organization. In general, open-source licensing and the lack of legal indemnification against intellectual property violations are issues that any organization wishing to use open source must explore.

Hein notes that open-source software is sometimes mistakenly referred to as "public domain" which implies there's no copyright holder and people are free to do whatever they wish with the software. Open source, though, is a copyrighted work released under a liberal yet specific software license.

Only the copyright holder is legally entitled to pursue action against a perceived license violation, but according to the Burton Group, disputes about violations of open-source use are typically resolved through "a relatively successful strategy for license violations: peer pressure."

This may lead to "badgering through e-mail or Web postings, and by threatening product boycotts." The report adds: "In general, most violations are unintentional and are quickly resolved, with the offending party either removing the code in question, or complying with the open-source software license and releasing their modifications back to the open-source community."

Corporations that include Tivo, Dell, Linksys and nVidia are among several that have felt the pressure of the open-source community in such disputes and have taken action to respond.

To obtain the report, contact the Burton Group at www.burtongroup.com.

Back to Security Notes

Comments

Post a comment

Name:


E-mail address:


URL:


Comments:


Remember info?