{"id":2914,"date":"2012-04-18T07:00:01","date_gmt":"2012-04-18T15:00:01","guid":{"rendered":"http:\/\/www.formtek.com\/blog\/?p=2914"},"modified":"2012-04-18T07:00:01","modified_gmt":"2012-04-18T15:00:01","slug":"open-source-the-good-bad-and-ugly-studies-in-two-extremes","status":"publish","type":"post","link":"https:\/\/formtek.com\/blog\/open-source-the-good-bad-and-ugly-studies-in-two-extremes\/","title":{"rendered":"Open Source: The Good, Bad and Ugly — Studies in Two Extremes"},"content":{"rendered":"

When top-class Open Source tools and applications (think software like Linux, Apache Web Server, PostgresSQL and PHP)\u00a0went head to head against similar proprietary software, a recent survey found that Open Source bested or equaled the quality<\/a> of their proprietary cousins. \u00a0The Open Source community hailed these findings from Gartner and Coverity.<\/p>\n

But think again. \u00a0Things aren’t that simple in the world of Open Source. \u00a0Head on over to SourceForge <\/a>or Google Code<\/a> and you’ll find thousands of Open Source projects. \u00a0After looking at some of the Open Source options available, it’s not that hard to come to the conclusion that not all Open Source projects are created equal. \u00a0Many posted Open Source projects are abandoned, incomplete, or generally not well maintained. \u00a0Some companies like Black Duck Software<\/a> specialize in characterizing \u00a0Open Source projects, identifying the activity of the project, the licensing, and known defects.<\/p>\n

So while the Gartner\/Coverity report characterizes Open Source as often a more desirable option than proprietary software, it’s not too surprising that there may be another point of view, especially since there are so many faces to Open Source software. \u00a0Another recent report, one by Sonatype and Aspect Security<\/a>, for example, presents a very different picture.<\/p>\n

In particular, Sonatype focuses on the problem of businesses that build applications out of Open Source components but don’t bother then to keep track of which components they’ve used. \u00a0And, because of that, they are often unaware when vulnerabilities are found with the components that they’re using. \u00a0Even if the Open Source component is fixed by the community and the vulnerability is removed in a new release of the OSS code, developers who have already used that component and have moved onto their next project may not be keeping track of components in the project that need to be updated. \u00a0Tim O’Brien, writing on the Sonatype blog<\/a>, call the problem “shocking”.<\/p>\n

The Sonatype report finds that even high-profile Open Source projects like Google Web Toolkit, Spring MVC, Struts 1.X. and Hibernate have had serious vulnerabilities. \u00a0As many as 50 percent of the largest corporations are estimated to be running applications that are flawed due to vulnerabilities in the Open Source components from which they were created. \u00a0That guess is based on the fact that 80 percent of large companies have said that they are building applications based on Open Source components.<\/p>\n

Jeff Williams<\/a>, CEO of Aspect Security, said that “The data clearly shows that organizations consume huge numbers of vulnerable libraries. This is a wake-up call for software development organizations. \u00a0 While the numbers from this report are alarming, the take-away is clear — open-source software is critical to forward-thinking development organizations, but there must be education and control to accompany its usage.”<\/p>\n

Andrew Aitken<\/a>,\u00a0Founder and Managing Partner of Olliance Group (now Black Duck Software), countered the conclusions<\/a> of the Sonatype report saying that\u00a0\u201cit\u2019s unfortunate to see this and we disagree with the tone of the study inferring that open source is low quality and risky. \u00a0All software has vulnerabilities, and this study doesn\u2019t compare open source to other code. It just says open source has ‘x’, \u00a0and there have been many studies showing that OSS is higher quality than most other code.”<\/div>\n
\"Digg<\/a><\/div>
\"Reddit<\/a><\/div>
\"Stumble<\/a><\/div>
\"Buzz<\/a><\/div>
\"Vote<\/a><\/div>
\"Share<\/a><\/div>
\"Bookmark<\/a><\/div>
\"Kick<\/a><\/div>
\"Shout<\/a><\/div>
\"Share<\/a><\/div>
\"Bookmark<\/a><\/div>
\"Post<\/a><\/div>
\"Google<\/a><\/div><\/div>","protected":false},"excerpt":{"rendered":"

When top-class Open Source tools and applications (think software like Linux, Apache Web Server, PostgresSQL and PHP)\u00a0went head to head against similar proprietary software, a recent survey found that Open Source bested or equaled the quality of their proprietary cousins.…<\/span><\/p>\n

Read more ›<\/a><\/div>\n

<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[24],"tags":[],"class_list":["post-2914","post","type-post","status-publish","format-standard","hentry","category-open-source"],"_links":{"self":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts\/2914","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/comments?post=2914"}],"version-history":[{"count":0,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts\/2914\/revisions"}],"wp:attachment":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/media?parent=2914"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/categories?post=2914"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/tags?post=2914"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}