How not to get sued by open source coders

A Fasken Martineau DuMoulin lawyer says many firms do not teach workers how to manage open source software. CIPPIC weighs in

A recent ruling by the U.S. Federal Appeals Court, stipulating that open source licenses are subject to copyright laws, will mean that businesses will have to exercise added due diligence when integrating open source code in the products they develop, according to legal experts.

The ruling stems from a claim of copyright infringement by an open source developer whose code was distributed through the open source Artistic License, and claims that those license requirements were not met by a company that incorporated that code into its product.

The court subsequently ruled that copyright holders "who engage in open-source licensing have the right to control the modification and distribution of copyrighted material.”

Read More Article...

Beware open-source violations lurking in your code

Make sure proprietary, open-source code remain separate

IT organizations that feel safe from open-source licensing violations might be wise to check their code anyway, because open-source components are rapidly seeping into applications by way of offshore and in-house developers taking shortcuts, as well as a growing population of open-source-savvy grads entering the workforce.

"With all of these new aspects, open source is something companies are going to have to get their heads around," says Anthony Armenta, vice president of engineering at Wyse Technology Inc., a maker of thin clients.

It's not just about unearthing open-source code that's in violation of licensing, either. Open source must be managed like any other software component as security vulnerabilities arise and patches become available. Wyse has been using Palamida Inc. to track its open-source usage for the past year. Palamida checks code bases against a 6TB library of known open-source projects, fingerprints and binary files.

Read More Article...

Open Source Code = Insecure Code?

Research released by application security vendor Fortify (www.fortify.com) in July 2008 has highlighted security flaws in commonly used open source applications, some of which are being installed and deployed by large enterprises and government organisations.

The paper, "Open Source Security Study - How are Open Source Development Communities Embracing Best Security Practices?" reports on research undertaken by Fortify into the security of open source projects.

A range of projects were examined ranging from the Derby relational database through to the JBoss application server and the OpenCMS content management server. The projects were analysed using Fortify SCA, a static analysis tool used to detect security flaws in software code. Any major security issues identified by the tool were then checked manually to confirm the finding.

Flaws were uncovered that spanned two or three generations of product, showing a lack of attention for up to 1 year. Across the range of projects analysed, issues per 1000 lines of code (KLOC) ranged from 0.27 through to 178.2. Cross site scripting and SQL injection class attacks were prevalent and clearly still show that developers are missing these code security problems.

Read More Article...

Sun: We screwed up on open source

Many open-source developers remain sceptical as regards Sun, because their memories of the company focus on its interactions with the community in 2001-02.

Sun's chief open-source officer, Simon Phipps, now concedes that was a period in which Sun "screwed up".

Speaking in a recent interview with ZDNet.co.uk sister site Builder AU, Phipps explained the situation in which Sun finds itself: "Open-source developers have been much more sceptical of Sun; a lot of open-source developers don't remember the fact that Sun was pretty much the first open-source start-up, in 1982."

"All they can remember is what happened in 2001-02 when, to be quite frank with you, we screwed up. We alienated a large group of open-source developers by the attitudes we had of the community back then," said Phipps.

In order to remedy the alienation, Phipps said Sun is "leading by changing behaviour, rather than by just saying good words".

Read More Article...

Is open source only good for undermining competitors?

I usually try very hard to not write about IBM. But the following from Matt Asay requires a reply.

Regardless, IBM isn't in the habit of open sourcing technology in which it has a lead or at least a strong position, such as it does with DB2. IBM strategically invests in open source to undermine the margins of its competitors, not its own.

Really? Take a look into OSGi, SCA, Apache HTTP Server or the countless other open source projects into which IBM has open sourced technology. This technology didn't undermine competitors; it helped customers and competitors alike (and let's not forget that competitor contributions helped IBM).

Read More Article...

Sun Moves Gingerly Toward Open SOA Platform

In a bid to woo smaller companies and independent developers, Sun Microsystems (NASDAQ: JAVA) has incorporated open source elements within today's release of Java Composite Application Platform Suite (CAPS) 6, the latest version of its suite for building service-oriented architecture (SOA) products.

CAPS 6 blends open source code from the Open ESB (define) project with the closed code of the 5.x set of releases.

It is architected around the Java Business Integration (JBI) standard, which "reduces vendor lock-in -- when things go south with one vendor, enterprises can move to another because their value is in the content, and not the middleware," Mark Herring, Sun's vice president of software infrastructure marketing, told InternetNews.com.

JBI is a Java-based standard that facilitates SOA (define) integration of Java-based applications.
Read More Article...

UK developers favour open source

The majority of UK developers working with proprietary platforms would prefer to work in an open source environment if given the choice, according to a report from Kingpin Intelligence.

A survey of 400 developers from Kingpin's database revealed that 62 per cent of those who do not use open source for professional purposes prefer to use it when outside work.

More than two fifths of respondents also believe that the 'Lamp' software stack (Linux, Apache, MySQL and PHP) threatens established proprietary platforms.

"This research confirms increasing interest in open source technologies in the UK developer community," said Claire Roy, head of research at Kingpin Intelligence.

"The cost and flexibility benefits of using open source technologies are appealing for developers and organisations in the current financial climate."

However, the report also concluded that existing licences and client requirements are hampering migration.

Quality control is also an issue. Fewer than a third of respondents believe that the open source development process produces higher quality software than Windows-type environments.

Source : http://www.vnunet.com/

Open source code crawling with fewer bugs

The quality of open source code has improved over the last two years, according to an audit sponsored by the US Department of Homeland Security.

The security and quality of more than 250 open source projects - including Apache, Linux, Firefox and PHP - was assessed using code analysis tools from Coverity as part of the federal government's Open Source Hardening Project. Coverity set up a scan site that invited individual developers to put their code through its paces with its static source code analysis tool, Coverity Prevent.

The same approach was used to analyse 250 popular open source projects, containing more than 55 million lines of code, on a regular basis. This analysis revealed a 16 per cent reduction in "static analysis defect density" across popular projects over the last two years, reflecting the discovery of 8,500 individual defects. The site divides open source projects into rungs on a ladder based on how far each project gets in fixing bugs.

Read More Article...

Tags: BPO Services | Outsource Medical Billing | Medical Billing Services | Medical Coding | Medical Transcription | Medical Transcription Services | CAD Drafting | CAD Design | CAD 3D Modeling | CAD Engineering | CAD Rendering | AutoCAD Drawing

Open source code examined

Coverity finds improvements during project to examine more than 55 million lines of code

A code analysis of popular open source software projects has revealed that the quality and security of open source software continues to improve.

In its "Scan Report on Open Source Software 2008," Coverity analyzed more than 55 million lines of code on a recurring basis from more than 250 open source projects. Detailed Tuesday, the project utilized the Coverity Prevent static source code analyzer and was done during a two-year period. Some of the projects analyzed included the Apache Web server, Linux, Firefox, and the Samba file and printer sharing system. Scripting languages such as PHP and Ruby were examined as well.

"We run the source code through our static analysis tool, which identifies certain types of software defects for them and developers can look at the result," said David Maxwell, open source strategist for Coverity.

Coverity in its analysis found that open source developers are interested in code quality and making efforts to make it better and more secure, Maxwell said.

"We can see from the statistics many developers are quite passionate about writing good code," Maxwell said.

Read More Article...

How to Mitigate the Risks Associated with Open Source Code

The use of open source code is on the rise. It provides developers flexibility, efficiency and cost-effectiveness. We have seen, though, that the acquiring companies that are buying assets are not paying close attention to the risks involved. These risks include buying software assets that may include open source code, but may contain limitations on the right to sell or license the software.

In the last decade, use of open source software has risen from the basement of the weekend code warrior to the high-rise of enterprise development strategist. This surge in corporate popularity can be attributed to the cost-effectiveness, efficiency and reliability of open source code. Yet, use of open source code presents risks--especially for a company acquiring technology assets that include open source code.

Does that mean that the risks outweigh the benefits? Probably not. A few years ago, most companies took a conservative approach, attempting to avoid open source code at all costs. Today, that approach is outdated. The market has since developed means of mitigating the risks associated with using open source code.

Read More Article...