Black Duck Blog

Peter Vescuso
Executive Vice President of Marketing and Business Development
pvescuso@blackducksoftware.com
Free software vs. open source software? It’s a frequent ideological debate in the media. Matt Asay, a CNET reporter and VP of Business Development at open source company Alfresco, had a good blog on this recently called “Free software is dead. Long live open source” at:
http://news.cnet.com/8301-13505_3-10361785-16.html?tag=mncol;title

Comparing free software to open source software is difficult and, fortunately for most developers, irrelevant. One is more of a social movement (free software) and the other is more of a development approach (open source software). The reason it’s mostly irrelevant to developers is pragmatism: developers are busting their butts to create some cool new innovation and what they care about is finding good code they can use.

We’ve been talking about pragmatism and open source software for some time now at Black Duck. Pragmatism sounds like a dry topic, but for software developers it represents a smarter way of getting work done. Finding good code to use — whether it’s described as free and/or open source, where it meets business requirements — speeds development in today’s multi-source development model, reduces costs, and frees developers to be more creative. It’s not an ideological discussion – it’s a pragmatic decision to use the best code available, regardless of source, as long as it meets requirements for functionality, security and quality.

The trick, of course, is managing free and open source software in today’s multi-source development process. Licensing, quality, security, and code provenance are areas of uncertainty that must be managed when using any software component. Process and policy are necessary, but not sufficient, to deal with these challenges; technology is needed to support decision making, process automation and governance of components over an application’s lifecycle.

Choosing “free software” vs “open software” is not a question a developer will often wrestle with, but rather “does this code meet my requirements” and “can I/my company comply with the stated license obligations?” For companies using free and open source code in their development streams, ideology is a distraction, pragmatism is a best practice, and management is a necessity.

Phil Odence
Vice President of Business Development
podence@blackducksoftware.com
The “new pragmatism” that we’ve been sensing whenever we get out to industry events was also evident at the LinuxCon 2009. Although incredibly passionate, the Linux community seems little interested in religious debates. There were a few jabs at Microsoft, but so too was Richard Stallman the brunt of a couple of jokes. On the question of give and take of open source, Linus was quoted as saying something like, “There are no parasites, only future contributors.”

Passions were more directed at the practicality of getting things done. When on a panel and asked about the best feature added to Linux this year, Linus said it wasn’t a functionality he was happiest with, it was a step improvement in the Linux development process. In fact, there was a lot of discussion about managing the complexities of community development and the parallels to distributed development in organizations. The Linux Foundation’s Ted Ts’o (a subsystem maintainer) shared an interesting vignette about talking to a chief architect at Microsoft and being struck by how similar development works in the bowels of Windows.

Several companies spoke pretty freely about their own internal processes clearly evidencing what we call multi-source development and the governance/compliance challenges that come with it. IBM’s OSS head, Bob Sutor, candidly mentioned that even at his company (which is as sophisticated in this area as any) open source use is growing so rapidly that they need to retool to their 4th generation of governance process. Esteban Rockett and John Ellis focused a session on the evolution Motorola has gone through in this area and mentioned Black Duck as a key tool for them.

The most fun session was a keynote by Noah Broadwater, VP of IS at Sesame Workshop. Accompanied by Elmo and Cookie Monster dolls, he talked about the incredible work they are doing for kids around the world. They are able to pull it off on a shoestring thanks to the leverage of open source in development. With a total IT staff of 13 (mostly customer support and including only 2 developers) they’ve built a world-class educational website with Liferay, Alfresco and MySQL on top of SUSE that recently won an Emmy! (http://bit.ly/UcY7f) Very impressive and inspiring. Keep your eyes on the Google logo on Nov 10, Big Bird’s 40th birthday.

Peter Vescuso
Executive Vice President of Marketing and Business Development
pvescuso@blackducksoftware.com
I just returned from the Open Source in Mobile (OSiM) conference in Amsterdam. It was an exciting and informative event, and provided a unique view of an industry in the midst of an open source revolution. More than any other industry, the mobile sector is aggressively leveraging open source to propel the rapid pace of innovation they require – after all, the next generation of computing is at stake here. Web-based companies such as Google, Amazon, Facebook, and Twitter led the way in the use of open source for infrastructure. But sophisticated mobile devices and the complex service networks behind them are stretching and testing open source at new levels.

Listen to a podcast of my thoughts and observations about the OSiM conference here.

For me, the key takeaways from OSiM are the new pragmatism and sophistication in the use of open source in multi-source development, and the significant success OSS has enabled in terms of innovation.

In general, wide-eyed idealism seems to have given way to a more practical approach. Participants seemed eager to dispel naïve notions of open source as “perfect and free” (a quote from Art Landro – more below), and focus on the real and significant benefits it enables along with the strategy required for success.

I was at OSiM last year in Berlin, which bubbled much more with unbridled enthusiasm for OSS. Little of that this year, and no ideological debates, but plenty of “here’s what it really takes to be successful” with open source.

The best expression of this pragmatism was offered by Art Landro, EVP of WW Field Op’s at MontaVista. Art put his finger on the pulse of the conference when he reflected that “the general misperception of open source is that it’s perfect and free.” Art and MontaVista spend their waking hours addressing imperfections (and running WW Field Op’s breeds pragmatism J). Art offered that Linux has 5,000 contributors and 11 million lines of code with 20,000 changes made every day. With all those moving parts, there is clearly a need for MontaVista to provide a rock solid embedded Linux platform that allows developers the freedom to focus on their work rather than the underlying O/S.

But Art was only one of many voices of pragmatism. Christy Wyatt, VP of Motorola’s Mobile Software Platform and Ecosystem, expanded on what it takes to be successful with open source. Moto has reduced their mobile platforms from around ten to just two or three, and chose Android as one of the foundations for the future. But Moto doesn’t spend any less on development now that they’ve bet heavily on OSS. From Christy’s perspective, the #1 benefit is the flexibility and innovation afforded by Android. “Given the complexity of our platforms there’s plenty of opportunity to do open source badly and spend as much as on proprietary software…the value of open source is not that’s free, it’s the innovation it enables and the community development model.” Nokia, who doesn’t support Android, would likely agree with Christy: Moto introduced a new mobile platform based on Android in record time of 11 months, little more than half the time of traditional proprietary platforms.

Another presentation with a very practical bent was given by Mal Minhas, CTO of the LiMo Foundation call “Mobile Open Source Economic Analysis [http://www.limofoundation.org/images/stories/pdf/limo%20economic%20analysis.pdf]. Mal reviewed analysis he’s done on what it would cost to develop various open source projects used in many mobile solution stacks such as the Gnome Tool Kit (cost $30M), Gsteramer ($45M) and Webkit ($89M). Recognizing the potential of community development to create powerful foundation platforms, Mal made an appeal for cooperation on under-developed areas/functions that can help propel the success of mobility – geo location (GeoClue), telephony (ofono) and UI framework (Clutter). As most of these technologies are in the process of moving below the value line, they no longer constitute differentiation/value add, and therefore, represent natural areas for cooperation.

I had a good discussion with Adriaan de Groot of the Free Software Foundation – Europe (FSF-E). FSF –E are planning a series of workshops in 2010 to counsel corporate lawyers and development management on open source best practices. FSF-E has a decidedly pragmatic view of that embraces all types of open source licenses and their role in commercial development. These workshops will be well received.

I participated on a panel discussion on “convergence” with Itai Dadon of Texas Instruments, Lars Kurth of the Symbian Foundation, Michel Piquemal of Access, and John Riordan of Constant Dialog AG. Convergence is happening in many dimensions including devices and services between desktops, netbooks, and Smartphones, as well as convergence of the traditional fixed-wireline-broadband networks, all enabled by open source and open standards.

Statistics from the mobile industry are always fascinating and reflect how rapidly computing is changing. A few noteworthy stats:

– 4.7 billion people are now covered by wireless
– More people access the Internet with wireless devices than from computers
– 50% of mobile traffic in the US is with social networking sites
– A high-end Smartphone today has as much computing power as powerful desktops from 2000

It’s clear that phone calls are now an incidental part of the utility of mobile devices.

Open source is fundamentally changing software development and new product innovation and there’s no better industry than mobile to watch it work its magic.

Hats off to Informa for putting on a top notch event – this is one of the best business-oriented open source conferences I’ve attended.

Eran Strod
Director of Product Marketing
estrod@blackducksoftware.com

I noticed in the first week of August, the GPL version 2 open source license dropped below the 50% share mark for the first time since we started tracking this data in 2007. Up until this point, a majority of open source projects were using the GPLv2 license, but GPLv2 share has eroded pretty steadily over the last year+. In July 2008, GPLv2 was used by 57.7% of all projects. Today it stands 8% lower at under 49.6% (which means roughly 100,000 projects). During the same period, LPGL 2.1 is down about 1% and GPLv3 is up 3.4%.

That is not to say that the GPL is going away. GPL version 2 is still by far the most widely used open source license. At over 49% of all OS projects, it is used by four times more projects than the number two license which is the LGPL version 2.1 (9.5%). Collectively the GPL family of licenses accounts for more than 65% of all open source projects in the Black Duck KnowledgeBase.

The top 10 licenses cover 93% of all projects versus 94.2% in July 2008. This tells me that developers are still creating boutique licenses. In the 8/14/09 KnowledgeBase update to our customers (Black Duck Protex), there is a catalog of 1,698 open source licenses. This means that we have found and cataloged over 200 new licenses in the last year. Some of these licenses are copyleft-class.

As someone who is passionate about open source, I can’t say enough about the FSF and the incredible contribution that they have made to the industry (and the world) in creating the GPL family of licenses. I am a little concerned that GPLv2 appears to be falling in share faster than GPLv3 is growing. I am more concerned that the leaders of the open source industry haven’t put more emphasis on Affero class licenses which strengthen the copyleft in client-server applications. In data that we get from the Black Duck Knowledgebase and from mining searches on Koders.com, it’s clear that all technologies associated with web applications (JavaScript, PHP, Ruby, … ) are on the rise.

You can view open source license usage mined directly from the Black Duck Knowledgebase on our license resource page.
http://www.blackducksoftware.com/oss/licenses#top20

Tim Yeaton
President and CEO
tyeaton@blackducksoftware.com

The Codeplex Foundation announcement by Microsoft is a reflection of and reinforcement of the continuing trend toward multi-source development, and a new pragmatism on the part of developers. I spend a lot of time with our customers, all of whom are development organizations of one type or another. Every sizeable development shop I visit is engaged in some level of multi-source development – integrating open source code with ISV and internally developed code to speed development and reduce costs. I call it the “new pragmatism” because, given the economics of open source and its other benefits, commercial development organizations can’t afford to reinvent the wheel when proven code is readily available…especially when they are working in a tight budget environment, with no relief on the development backlog. And since most development shops are working in some fashion with Microsoft code, tools, or applications, it seems equally pragmatic that Microsoft find a way to embrace open source in a more significant way. An interesting fact from Black Duck’s experience: of all the downloads of the free IDE plug-ins from our open source code search site www.koders.com, 75% are for Microsoft Visual Studio. That says to me that there is significant interest in Microsoft tools and code from a large portion of the development community that is also using open source.

There are many voices in the open source community, and in many quarters Microsoft is viewed with significant skepticism. But in this pragmatic, budget-constrained, multi-source world we live, commercial developers care less and less about ideology or even Microsoft’s motives. What they care about is finding the right code for the job and having the creative freedom to use it – and that’s what Black Duck is working to enable. Developers also care about honoring intellectual property rights and the intentions of the original authors…they want to play by the rules and to respect the rights of authors to dictate the rules for use of their code.

Microsoft continues to demonstrate more seriousness about embracing open source, in the context of multi-source application development. One example is their Codeplex repository. It has grown significantly in popularity over the last year recently reaching 10,000 projects, which suggests it is meeting a customer/developer need. The Codeplex Foundation looks like another step along this path…in particular, potentially addressing the need they’ve identified – enabling discussion and ultimately broader commercial adoption of open source.

People will rightly question Microsoft’s motives for creating the Codeplex Foundation. The fact that they created an independent foundation indicates that they have thought about some of the underlying issues. And to look back at some relevant open source history, if Codeplex evolves the way the Eclipse Foundation did, which in its early days was staffed and championed by IBM, it could grow to take on a meaningful role regarding multi-source development in the open source community.