In my last two posts, I discussed the evolution of open source knowledge: where we came from, where are we now, and how did we get here. I provided some examples of common misunderstandings and knowledge gaps and suggested that such gaps may be due to the need to take action without taking as much time to prepare and plan as is optimal.  The sum total is that misconceptions and misunderstandings about open source persist both within and outside the software industry.

What is an open source software (OSS) bill of materials (BOM)? In the simplest terms, it is a list of the OSS components used in an application. But, it can actually be much more. Most OSS BOMs will, at a minimum, also contain the licensing information associated with each OSS component.

I am asked two very reasonable questions, on a very regular basis, by some very interesting people.

As a developer I'm always keeping my eye out for new technologies that can help me do my job better or faster. There's a saying in this industry: "work smarter, not harder." If I can use a piece of existing code instead of writing it from scratch, I will, unless there's a good reason not to. And diving into a new language, library, framework, or database can be like wearing a brand new pair of jeans. The novelty is exciting.

Commercial source code scanning tools have become quite the hot topic for CIO’s, software development managers, in-house counsel, and enterprise architecture teams over the last eight to ten years.   The emergence of these new technologies obviously has direct correlation to the maturity of open source software, which is now just as common as commercially-licensed software in medium to large enterprise data centers.  Additionally, the distribution of open source into the consumer market is undeniable making source code scanning a critical risk mitigation measure for all companies that are buying or selling modern technology.  Today’s article will briefly explain “noise reduction” and the process of using multiple matching techniques in a source code scanning tool.

In the first two weeks of April, I attended four distinct open source related events in three different cities and two countries. It will take months to ponder, absorb, and follow-up on all of the thought-provoking presentations, conversations, and feedback I participated in or received. In spite of the range of topics and agendas being covered along the way, there were a couple themes that reverberated.

Reuse

Automation

Future proofing

Open Source Management: Dealing with New OSS Releases

Apache HTTP Server: New Features for Version 2.4

Cloud Technology, Big Data & Hadoop

Preparing for Your First Cloud App

5 Ways an Open Source Governance Process Can Improve Your Organization

• At minimum, a general understanding of the basics of open source software

• Both the want and need to find and implement a solution

• The organizational drivers and resources to develop a solution to a problem or to enhance and compliment an existing system that lacks efficiency or accuracy

• Cross-functional approvals and resources from multiple departments

• Accurate and balanced vendor evaluation and selection criteria

• The organization understands and values all of the reasons included in the “want to” category and realizes that every day that passes without implementing some kind of process to proactively vet code bases for open source is increasing the exposure and risk of a “want to” turning into a “need to immediately.”  The final outcome of some of these projects might identify a very low level of risk and exposure.  Nevertheless, not actively addressing this potential (in order to determine risk) is a very dangerous approach to the use of open source software.

• The organization has unknown exposure to security vulnerabilities in old versions of open source or the organization has already had some kind of breach in security due to an outdated open source environment.

• There is a product road map or technology release schedule for the organization that has made an intentional  (or unintentional) decision, to distribute open source software in a commercial product or to use open source in a customer facing web site.

• The organization has been contacted by one of the governing bodies that are interested in enforcing license compliance -or- the individual author of an open source product has contacted the organization directly to inquire about the usage of their copyrighted software.  If this kind of inquiry goes unanswered the worst-case scenario is a suit eventually getting brought against the organization(s) in question for violating the license or copyright.

• There is a merger and acquisition (or divestiture) planned sometime in the calendar year and the assets to be acquired (or sold) have a known or high probability of including open source components.

• There has been significant turnover in the personnel that have been involved in the use of open source and collecting any voluntary information about the usage and associated licenses would be impossible.

• The organization outsources software development to a third party and:
  
  
  • The third party either disclaims any OSS usage but wont rep and warrant it in a contract (HUGE RED FLAG)
  
  
  • The third party discloses some amount of OSS usage but can not easily and quickly produce a list of components
  
  
  • The third party discloses OSS usage and delivers a bill of materials and associated licenses but the nature of the transaction(s) and distribution require additional due diligence.
  
  
  • The third party unknowingly includes open source in the product they develop.
  
  
  

• Where is open source used in the cloud (and where is it likely to appear)?


• What is the current landscape of open source licensing in the cloud?


• How does the cloud change the notion of software "distribution" (and what does this mean for open source licenses)?


• What are the major differences between open source compliance in the cloud vs. traditional computing models?


• What questions should you be asking when deploying open source to the cloud?