The most popular and comprehensive Open Source ECM platform
Let us know more
Open Source: The Reputational Hit by the Log4J Flaw
Users were skeptical and slow to accept. Commercial vendors were scornful. Those were the early days of Open Source when many businesses were hesitant to adopt Open Source software. It took a while, maybe twenty years. But adoption of Open Source software ultimately boomed.
A whitepaper by PwC in 2022 estimated that 87 percent of large companies used Open Source software. Other similar surveys have tried to estimate the number too of the percentage of businesses using open source, with results ranging within the 60-90 percentiles.
Paul Cormier, president and CEO of Red Hat, said that “while the open source development model may have started in the playground of developers, hackers and visionaries decades ago, we’ve moved far past that. It’s now a mainstream part of commercial software development and the engine for consistent innovation – from the server room to public clouds to the edge and beyond.”
But then in December 2021, the Log4J vulnerability was reported. The problem had security teams around the world scrambling. Actually the vulnerability was first introduced in the Log4J in 2013. It took nearly eight years to be discovered. Cyber experts called the exploit “the single biggest, most critical vulnerability ever”.
Mike Parkin, engineer at Vulcan Cyber, said that “views on open source code swing back and forth depending on many factors, and they continue to do so. Historically, open source software has offered better security and more transparency, but a major vulnerability like Log4j can tarnish that reputation.”
And it seems to have been a blemish for Open Source. A survey by Anaconda found that 40 percent of IT professionals interviewed said that since the Log4J exploit was announced that they had scaled back on their use of open source software. Additionally, 31 percent of respondents said that vulnerabilities are the biggest challenge to the open source community.
It’s likely that this will be a temporary setback for open source, but for many it has been a wake up call.
