Open Source is no panacea, but neither is it public enemy #1
Susan Perschke wrote a column in Network World yesterday called “Watch Out for FOSS Advertising”. Since it was the “top pick” in the Open Source Subnet, I thought I would have a read. The article describes 5 reasons why one should be wary to deploy open source. But to my way of thinking, these reasons have already been many times debunked. Lets look at each of them:
1. The true cost of open source software is actually high and certainly not free. The only thing high here would be anyone thinking there are no costs involved in deploying and maintaining any software, open source or not. Nobody plops software out of the box and it just works without some costs involved. Whether it be implementation costs or 20% or higher yearly maintenance fees for commercial software it is pretty naive to think that the only costs involved in deploying software is for the software itself. In this regard there is no difference between open source or closed source. To point out that open source software has costs of implementation and maintenance is kind of obvious and is hardly devious or misleading.
2. The complexity of open source licenses. Yes open source licenses are complex. When was the last time you actually read the fine print on the commercial license that came with your commercial software? Probably never, but if you did you will find that it is not exactly like reading the Sunday comics either. However, OSI approved licenses have been approved by the OSI and you can take some solace in knowing that someone who knows what they are doing and has the open source consumer in mind has at least bothered to read all of the fine print. That is more than we can say about most commercial licenses which are so one sided that they border on unconscionable.
3. Open Source business models come next. Perschke says that those evil commercial open source vendors make their FOSS versions hard to install, with crappy documentation and no or little support. Never mind that companies like Red Hat spend millions of dollars making sure the open source versions of their product are quality offerings that millions of people use. To me this is just FUD plain and simple. Yes maybe some companies do this. Let me give you a caveat. When was the last time you called Microsoft, HP, Adobe or Oracle for support? I hope you didn’t have your product more than 90 days, otherwise whip out your credit card. Isn’t it a bigger crime when commercial software is hard to install, has crappy documentation and offers little to no free support? That is OK because they are charging you and you should expect it? Doesn’t seem to make sense to me.
4. Increased security risks. Of course you know this is the one that really got my goat. Are you kidding me? This is what the article says:
• The source code is readily available for hackers to analyze and exploit, thus increasing the attack surface of the product
• Vulnerabilities reported by users on public support forums are also open to scrutiny and exploitation
• Users who install open source using default options frequently fail to implement even rudimentary security precautions, such as changing the default password or removing the install directory which may point to sensitive database or network information
• Because of the community development of open source projects, inadequately screened third parties may be allowed to submit add-ons or even make changes to the production code base, hiding viruses or root kits that can spread quickly and infect many customer systems before the vendor can discover them and fix the problem
We have all heard the source code is available to hackers story before. This is the security by obscurity argument and frankly has been shown to not hold much water. One reason is that because the code is open you can easily see if changes were made if you wanted to. Equally without merit is the vulnerabilities reported on public forums are open. No, better to have zero days that only the hackers know about? By putting a vulnerability out in the open it shines a light on it and chances are the community will respond faster than most commercial companies. The default password and default options arguments are also empty. Why, do users change passwords and default options more in commercial software than they do in open source? No way, no how. That is just plain old FUD. Finally the evil 3rd parties who submit code to a project. I suppose this could happen, but most projects today don’t admit code to the main tree until it has been fully vetted.
So in fact I would say that what Perschke wrote is exactly opposite of the truth. Open source software is actually more secure because it is open and of the many eyes on it.
5. Lastly the IP issue. Yes, if you are making changes to code the issue of IP is a one that needs to be dealt with. You run into this more in open source than in commercial because in commercial you can’t make any changes to the code. So at least with open source you have the ability to change and modify. Whether you own that changed code or have to contribute it back is subject to the license you are working under.
