Feeds

Penguin program promises license vaccination

Phone and device makers get enterprise input

SANS - Survey on application security programs

A program to help keep software and device makers on the right side of open-source licensing law has been unveiled by the Linux Foundation.

The Open Compliance Program includes tools, training, consulting, and self-assessment to help you comply with the myriad of open-source licenses.

Linux Foundation executive director Jim Zemlin told The Reg that the program provides a ready-made mechanism for companies to understand and deal with licenses.

The program will make it cheaper for companies to use Linux because they'd no longer need to hire attorneys as back-up in potential licensing disputes, or to police code in the first place.

Also, organizations would be able to save time that might otherwise be spent rewriting code.

"The industry wants to use the code and comply with the licenses. The magic is: 'How to I get from point A to point B' — this is what we provide," Zemlin said.

The program has received support from 25 organizations ranging from Adobe, Intel, IBM, and Google to Eucalyptus Systems, SugarCRM, NEC, and Sony.

Eben Moglen, founder and chairman of the Software Freedom Lawcenter, said in a statement supporting the program that it would make best operational practices for compliance more accessible for ordinary people.

"Participation in this program, along with necessary legal advice and training, should allow any organization to meet its FOSS [Free and Open Source Software] license compliance responsibilities completely, at very low cost," he said.

The program features tools to check dependencies and find differences in source code components on a bill of materials, a self-assessment checklist that'll help organizations evaluate their own state of compliance, the creation of an XML schema that'll standardize the way open-source and Linux components are reported on a bill of materials, and training and education from Linux Foundation legal experts on the fundamentals of open-source licensing and training.

The push comes as device makers adopt Linux and open source code to power gadgets to satisfy the exploding consumer market. Such devices include components from a range of embedded-chip, UI, middleware, and network makers — meaning that more companies are coming into contact with open-source licenses, whether they know it nor not.

And violations do occur. The Software Freedom Conservancy last week won $90,000 in damages for willful infringement of GPLv2 from Westinghouse Digital Electronics over its illegal distribution of the Unix utility BusyBox in HDTV systems.

The win was a first, and SFC has 14 similar GPL actions lodged against Best Buy, Samsung Electronics America, and JVC America, among others.

Linux and open source are popular on devices because their open code means that device makers are free to customize and aren't tied in to a single vendor's product roadmap, while the lack of licensing charges means they can achieve greater margins.

According to Zemlin, the program means that organizations no longer need to rely on individual tools, or on ad-hoc means of finding out what licenses are used before it's too late.

"We've seen from our members and non-members a massive amount of requests to help them with that complexity and leverage the knowledge for that new mobile industry from the enterprise members of the Linux Foundation," Zemlin said.

"You see point solutions to manage the legal aspect of using open source such as code-scanning tools and going to outside legal counsel, but each of those are like: 'Take two Aspirin and call me in the morning'," he added.

"We are looking at more of a vaccination — a way to make license-compliance violations a thing of the past." ®

Top three mobile application threats

More from The Register

next story
OpenBSD founder wants to bin buggy OpenSSL library, launches fork
One Heartbleed vuln was too many for Theo de Raadt
Got Windows 8.1 Update yet? Get ready for YET ANOTHER ONE – rumor
Leaker claims big release due this fall as Microsoft herds us into the CLOUD
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Ubuntu 14.04 LTS: Great changes, but sssh don't mention the...
Why HELLO Amazon! You weren't here last time
Patch iOS, OS X now: PDFs, JPEGs, URLs, web pages can pwn your kit
Plus: iThings and desktops at risk of NEW SSL attack flaw
Next Windows obsolescence panic is 450 days from … NOW!
The clock is ticking louder for Windows Server 2003 R2 users
Batten down the hatches, Ubuntu 14.04 LTS due in TWO DAYS
Admins dab straining server brows in advance of Trusty Tahr's long-term support landing
Red Hat to ship RHEL 7 release candidate with a taste of container tech
Grab 'near-final' version of next Enterprise Linux next week
Apple inaugurates free OS X beta program for world+dog
Prerelease software now open to anyone, not just developers – as long as you keep quiet
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.