Feeds

The real reason most source is closed? Open is hard

We have the desire. But not the means

Website security in corporate America

Open...and Shut As much as 95 percent of the world's software is written for internal, enterprise use, rather than by vendors for sale, a point famously made by Eric Raymond in The Cathedral and the Bazaar. Much of this software, in turn, has no proprietary value for the enterprises that develop it. So why isn't the world deluged with enterprise-written open-source software? Why do so many CIOs gladly use open source but not contribute to it?

Because open source is hard. Really, really hard.

I've been relearning this lesson lately as I've helped advise a senior IT executive at a Fortune 500 company. His team dearly wants to open-source some promising code it has developed, code that serves a need within his own large enterprise but could be of significant value to a wide array of enterprises.

But they can't.

Again, it's not for lack of desire or effort. They've bought into Red Hat CEO Jim Whitehurst's call to unlock the treasure trove of isolated, enterprise code. And they're trying hard to meet the basic elements of successful open-source projects: code modularity, great documentation, permissive licensing, etc.

So what is holding them back? More than anything else, project governance and community leadership. Among the elements of successful open-source communities (warning: PDF), it's critical to have a governance model that promotes open, meritocratic leadership within the project. It's equally important to kickstart the project with a project leader (think: Linus Torvalds) that can inspire outside developers to contribute.

This is where things go off the rails for my enterprise friend, and I'd argue where things almost always go awry for enterprise contributions of internally-developed enterprise code. It's hard enough to run the gauntlet legal departments set up: while vendors are used to the idea of indemnifying customers for use of their software, enterprise IT is not. Few legal departments want the potential risk associated with releasing code that is generally a) not directly driving their business and b) potential lawsuit bait.

It's just not worth it.

But even if one can circumnavigate these legal hang-ups, the leadership conundrum remains. In part because of other legal hang-ups. For example, even if one open-sources one's code under an open-source license that disclaims responsibility for the code, management of the project is like waving a banner to would-be litigants that screams, "Sue me! I'm in charge of this code!" So enterprises are likely to try to find a partner of some kind to take over management of the open-source code. But unless this partner has a strong desire and self-interest in seeing the code community thrive, they're unlikely to do an adequate job.

All of which leaves us with a gargantuan pile of closed-source code that is unlikely to ever be open-sourced.

There are, however, other options beyond a full open source approach.

Perhaps a better bet is simply to release software as open source…but within the firewall. This doesn't enable an enterprise to tap into the value a global community could provide, but it does at least provide some code reuse benefits within the enterprise.

Another option is to contribute resources to existing open-source projects. This removes the burden of leadership and governance of a project, and it dramatically decreases legal exposure. Neither option will placate open sourcerers who insist that any and all software be contributed to the global pool of open-source code. But then, such people have never tried to overcome the significant hurdles that impede enterprise IT from releasing its code into the wild. Open source is hard, precisely because it requires significant human investment, and is ineffective to the extent that it's simply code "thrown over the wall." ®

Matt Asay is senior vice president of business development at Strobe, a startup that offers an open source framework for building mobile apps. He was formerly chief operating officer of Ubuntu commercial operation Canonical. With more than a decade spent in open source, Asay served as Alfreso's general manager for the Americas and vice president of business development, and he helped put Novell on its open source track. Asay is an emeritus board member of the Open Source Initiative (OSI). His column, Open...and Shut, appears three times a week on The Register.

Choosing a cloud hosting partner with confidence

More from The Register

next story
'Windows 9' LEAK: Microsoft's playing catchup with Linux
Multiple desktops and live tiles in restored Start button star in new vids
Not appy with your Chromebook? Well now it can run Android apps
Google offers beta of tricky OS-inside-OS tech
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
iOS 8 release: WebGL now runs everywhere. Hurrah for 3D graphics!
HTML 5's pretty neat ... when your browser supports it
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
NHS grows a NoSQL backbone and rips out its Oracle Spine
Open source? In the government? Ha ha! What, wait ...?
Google extends app refund window to two hours
You now have 120 minutes to finish that game instead of 15
Intel: Hey, enterprises, drop everything and DO HADOOP
Big Data analytics projected to run on more servers than any other app
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.