The Long Tail Of Open Source

As I think I mentioned in a previous post, last week I was out in San Francisco for the first UNITED Security Summit which was hosted by Rapid7, Firemon, Veracode and a few other security companies. While there I had a chance to sit down and speak with HD Moore, the lead developer of Metasploit which Rapid7 acquired a while back, Mike Tuchen, CEO of Rapid7 and Tas Giakouminakis, CTO and co-founder of the company. One of the things we discussed was the Magnificent7 100k Open Source funding project that the company announced previously.

As you can imagine, all three executives were very enthusiastic about the program. All three mentioned that what impressed them most was the breath of open source solutions that are being nominated for the program.  All three mentioned that the eventual winners of the prize may have open source projects that have very little to do with Rapid7’s business today.  I asked them how did that make them feel, knowing that their money will go towards supporting open source security projects that won’t be directly beneficial to Rapid7.  To a man, all three said that this was fine. In fact it was more than fine, it was what open source was all about.  That the “good karma” of supporting these projects would somehow find its way back to them.  This is if you will, the long tail of open source.

While there are commercial open source companies whose sole model is based on supporting and offering premium features to open source projects which they support, the idea of supporting open source just to support open source is ultimate allure of the model. Rapid7 is not alone in this belief either.  I have spoken to other companies who inherently understand that by supporting open source, even if the connection to your own business model is more of a dotted line, rather than a solid one, they will benefit in the long run.  Early commercial supporters of Linux have been rewarded handsomely by the market for instance.

So in the case of the Magnificent7 Rapid7 is full speed ahead without any thought to how they will be able to commercially profit from the open source project. In some way Tuchen says it is a bit of a payback too. Open source has been very, very good to the company. The Metasploit project really was a significant step forward for the company.  Talking to HD Moore, it was a big step for the project it well. They had 25k users at the time Rapid7 acquired the project and now have over 125k.  In addition to Metasploit, Rapid7 also has acquired or financially supported the W3AF and the “John the Ripper” project.  So in Tuchen’s line of thinking if anything does come out of this next round of open source investment, it is almost gravy. But he is sure that some way, somehow the company will reap the benefit of the Magnificent7.

In the meantime we should see the winners announced for the project shortly. Stay tuned as I am sure I will write up each of them.