The Wayback Machine - https://web.archive.org/web/20151030132033/http://openwebdeveloper.sys-con.com/node/1181405

Click here to close now.





















Welcome!

Release Management Authors: Jnan Dash, Liz McMillan, Lori MacVittie, Gilad Parann-Nissany, Carmen Gonzalez

Related Topics: Containers Expo Blog, Linux Containers, Open Source Cloud, Release Management , Cloud Security

Containers Expo Blog: Article

Open Source Compliance: Getting Started Guide

What are the challenges faced when establishing a compliance program? What best practices exist?

This article discusses Open Source compliance and the challenges faced when establishing a compliance program, provides an overview of best practices, and offers recommendations on how to deal with compliance inquiries.

Introduction
Traditionally, platforms and software stacks were built using proprietary software and consisted of various software building blocks that came from different companies with negotiated licensing terms. The business environment was predictable and potential risks were mitigated through license and contract negotiations with the software vendors. In time, companies started to incorporate Open Source software in their platforms for the different advantages it offers (technical merit, time-to-market, access to source code, customization, etc).

With the introduction of Open Source software to what once were pure proprietary software stacks, the business environment diverged familiar territory and corporate comfort zones (Figure 1). The licenses of Open Source software licenses are not negotiated agreements. There are no contracts signed with the software providers (i.e., Open Source developers). Companies must now deal with dozens of different licenses, and hundreds or even thousands of licensors and contributors. As a result, the risks that used to be managed through license negotiations must now be managed now through compliance and engineering practices.

A new computing environment necessitating Open Source compliance due diligence

Enter Open Source Compliance
Open Source software initiatives provide companies with a vehicle to accelerate innovation through collaboration with a global community of Open Source developers. However, accompanying the benefits of teaming with the Open Source community are very important responsibilities. Companies must ensure compliance with applicable Open Source license obligations.

Open source compliance means that users of Open Source software must observe all the copyright notices and satisfy all the license obligations for the Open Source software they use. In addition, companies using Open Source software in commercial products, while complying to the terms of Open Source licenses, want to protect their intellectual property and that of third party suppliers from unintended disclosure.

Open Source compliance involves establishing a clean baseline for software stack or platform code and then maintaining that clean baseline as features and functionalities are added. Failure to comply with Open Source license obligations can result in:

  • Companies paying undisclosed amount of money for breach of Open Source licenses.
  • Companies being forced by third parties to block product shipment and do product recalls.
  • Companies being mandated by courts to establish a more rigorous Open Source compliance program  and appoint a “Open Source - Compliance Officer” to monitor and ensure compliance with Open Source licenses
  • Companies losing their product differentiation and intellectual property rights protection when required to release source code (and perceived trade secrets) to the Open Source community and license to competitors royalty-free.
  • Companies suffering negative press and unwanted public scrutiny as well as damaged relationships with customers, suppliers and the Open Source community.

Lessons Learned

There are three main lessons to learn from the Open Source compliance infringement cases that were made public to date.

  • Ensure that your company has an Open Source management infrastructure in place: Open Source compliance is not just a legal exercise or checking a box. All facets of the companies are typically involved in ensuring proper compliance and contributing to the end-to-end management of Open Source software.
  • Make Open Source compliance a priority before product ship: Companies must establish and maintain consistent Open Source compliance policies and procedures and ensure that Open Source license(s) and proprietary license(s) co-existence well before shipment.
  • Create and maintain a good relationship with the Open Source community: As a user of Open Source software, it is to your best advantage to create a good relationship with the Open Source community and demonstrate good will.  The Open Source community provides you with source code, technical support, testing, documentation, etc. Respecting the licenses of the Open Source components you are using is the minimum you can do in return.

Compliance Challenges

Companies face several challenges as they start creating the compliance infrastructure needed to manage their Open Source software consumption. The most common challenges include:

  1. Achieving the right balance between processes and meeting product shipment deadlines: Processes are important, however, they have to be light and efficient so that they're not regarded as an overhead to the development process and to avoid Engineering spending too much time than necessary on compliance activities.
  2. Thinking long-term, executing short-term: The priority of all companies is to ship the product(s) on time, at the same time as building and expanding their internal Open Source compliance infrastructure. Therefore, expect to build your compliance infrastructure as you go while doing it the right way and keeping in mind its scalability for future activities and products.
  3. Establishing a clean software baseline:  Establishing a clean software baseline is usually an intensive activity over a period of time. The results of the initial compliance activities include: A complete software inventory that identifies all Open Source software in the baseline,  a resolution of all issues related to mixing proprietary and Open Source code, and a plan on fulfilling the license obligations for all the Open Source software.

 

Building a Compliance Infrastructure

The following subsections examine the essential building blocks of an Open Source compliance infrastructure required to enable Open Source compliance efforts.

Open Source compliance building blocks

More Stories By Ibrahim Haddad

Ibrahim Haddad is a member of the management team at The Linux Foundation responsible for technical, legal and compliance projects and initiatives. Prior to that, he ran the Open Source Office at Palm, the Open Source Technology Group at Motorola, and Global Telecommunications Initiatives at The Open Source Development Labs. Ibrahim started his career as a member of the research team at Ericsson Research focusing on advanced research for system architecture of 3G wireless IP networks and on the adoption of open source software in telecom. Ibrahim graduated from Concordia University (Montréal, Canada) with a Ph.D. in Computer Science. He is a Contributing Editor to the Linux Journal. Ibrahim is fluent in Arabic, English and French. He can be reached via http://www.IbrahimHaddad.com.

Comments (1) View Comments

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


Most Recent Comments
kweins 01/14/10 03:22:36 PM EST

There is another free open source scanning tool (OSS Discovery by OpenLogic) that you can use to identify open source in your products or applications. You can download at www.openlogic.com.

@ThingsExpo Stories
The Internet of Things (IoT) promises to evolve the way the world does business; however, understanding how to apply it to your company can be a mystery. Most people struggle with understanding the potential business uses or tend to get caught up in the technology, resulting in solutions that fail to meet even minimum business goals. In his session at @ThingsExpo, Jesse Shiah, CEO / President / Co-Founder of AgilePoint Inc., showed what is needed to leverage the IoT to transform your business. He discussed opportunities and challenges ahead for the IoT from a market and technical point of vie...
SYS-CON Events announced today that Kurento will exhibit at the 17th International Cloud Expo®, which will take place on November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Kurento is an open source software development framework providing a media server written in C/C++, which embeds and externs GStreamer capabilities and makes possible to integrate WebRTC services with advanced media capabilities such as recording, mixing augmented reality and computer vision. Kurento also provides SDKs enabling developers to create Java and JavaScript applications consuming Kurento...
SYS-CON Events announced today that Chris Matthieu, Director of IoT Engineering at Citrix and co-founder and CTO of Octoblu, will keynote at the 17th International Cloud Expo®, which will take place on November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. His keynote "How We Built and Scaled an IoT Platform and Business" will focus on building an IoT platform and company. He will provide a behind-the-scenes look at Octoblu’s platform, business, and pivots along the way (including the Citrix acquisition of Octoblu).
SYS-CON Events announced today that TechTarget has been named “Media Sponsor” of SYS-CON's 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. TechTarget storage websites are the best online information resource for news, tips and expert advice for the storage, backup and disaster recovery markets.
Organizations already struggle with the simple collection of data resulting from the proliferation of IoT, lacking the right infrastructure to manage it. They can't only rely on the cloud to collect and utilize this data because many applications still require dedicated infrastructure for security, redundancy, performance, etc. In his session at 17th Cloud Expo, Emil Sayegh, CEO of Codero Hosting, will discuss how in order to resolve the inherent issues, companies need to combine dedicated and cloud solutions through hybrid hosting – a sustainable solution for the data required to manage I...
In today's enterprise, digital transformation represents organizational change even more so than technology change, as customer preferences and behavior drive end-to-end transformation across lines of business as well as IT. To capitalize on the ubiquitous disruption driving this transformation, companies must be able to innovate at an increasingly rapid pace.
DevOps is a software development method that places emphasis on communications between Software Engineering, Quality Assurance and IT Operations (SEQAITO ) with the goal to produce software and services to improve, increase the operational performance for the Enterprise. Communications is key not only between the SEQAITO team members but also the communication between the applications and the SEQAITO team. How can an organization provide the human communication and the application communication to the SEQAITO team to ensure the successful development, deployment of the application?
There's Big Data, then there's really Big Data from the Internet of Things. IoT is evolving to include many data possibilities like new types of event, log and network data. The volumes are enormous, generating tens of billions of logs per day, which raise data challenges. Early IoT deployments are relying heavily on both the cloud and managed service providers to navigate these challenges. In her session at Big Data Expo®, Hannah Smalltree, Director at Treasure Data, discussed how IoT, Big Data and deployments are processing massive data volumes from wearables, utilities and other machines...
Internet ready devices are becoming increasingly common, yet architecturally they often still act like point-to-point networks. Meanwhile, containers are making rapid deployments across networks painless, but knowing where and when to deploy them to meet market demand is just as critical. In his session at 17th Cloud Expo, Matt Torrisi, Customer Success Operations at Dyn, will discuss what the public internet in the middle really looks like, and how operators can build their networks for better performance and security.
Bsquare's Director of Products, Dave McCarthy, will deliver a presentation from the main stage of the fourth annual @ThingsExpo, addressing the audience of IoT and cloud executives, vendors, media and analysts on "The Business Case for IoT." Bsquare will also demonstrate how its business-oriented IoT platform, DataVTM, adds intelligence and connectivity to remote corporate assets, and then utilizes the data generated to improve business outcomes such as uptime, asset utilization, warranty and maintenance cost reduction, and business and regulatory compliance.
Those in the industry have been working hard to sweeten the deal again - efforts have been made to bring WebRTC into the mainstream and as a result the technology is experiencing a rebirth. Thanks to those who have remained dedicated to improving the situation for those around them, WebRTC is finally starting to fulfill the original expectations that were had of it. Both the technology and the support networks have been built up to make experimenting with it again a pleasure, not a pain. WebRTC has grown up.
"BSQUARE is in the business of selling software solutions for smart connected devices. It's obvious that IoT has moved from being a technology to being a fundamental part of business, and in the last 18 months people have said let's figure out how to do it and let's put some focus on it, " explained Dave Wagstaff, VP & Chief Architect, at BSQUARE Corporation, in this SYS-CON.tv interview at @ThingsExpo, held Nov 4-6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
We are reaching the end of the beginning with WebRTC, and real systems using this technology have begun to appear. One challenge that faces every WebRTC deployment (in some form or another) is identity management. For example, if you have an existing service – possibly built on a variety of different PaaS/SaaS offerings – and you want to add real-time communications you are faced with a challenge relating to user management, authentication, authorization, and validation. Service providers will want to use their existing identities, but these will have credentials already that are (hopefully) i...
WebRTC defines no default signaling protocol, causing fragmentation between WebRTC silos. SIP and XMPP provide possibilities, but come with considerable complexity and are not designed for use in a web environment. In his session at @ThingsExpo, Matthew Hodgson, technical co-founder of the Matrix.org, discussed how Matrix is a new non-profit Open Source Project that defines both a new HTTP-based standard for VoIP & IM signaling and provides reference implementations.
Who are you? How do you introduce yourself? Do you use a name, or do you greet a friend by the last four digits of his social security number? Assuming you don’t, why are we content to associate our identity with 10 random digits assigned by our phone company? Identity is an issue that affects everyone, but as individuals we don’t spend a lot of time thinking about it.
The promise of IoT is to have all things connected, feeding data and pushing content and solutions. This connectivity and the data from it has the potential to provide richer customer experiences, better business results, and much more informed consumers. So what happens when we take what is personal and enhance it with technology? Tile enables people to choose the things that matter most to them, and make those things connected. No other mass market IoT device does that at scale. In his session at @ThingsExpo, Guilherme Chapiewski, VP of Engineering at Tile, will speak about his vision for d...
Disruption in the communications ecosystem is creating a market opportunity for Cloud Real-Time Communications (RTC) platforms. We expect this market to represent a $4.5 billion opportunity by 2018. Cloud RTC Platforms are cloud services that enable mobile and web developers to integrate communications into their applications with just a few lines of code. Via REST APIs and SDKs Cloud RTC Platforms enable developers to easily integrate voice, messaging and video calling into mobile and web applications supporting more contextual conversations. These tools have the potential to change in how we...
WebRTC: together these advances have created a perfect storm of technologies that are disrupting and transforming classic communications models and ecosystems. In his session at WebRTC Summit, Cary Bran, VP of Innovation and New Ventures at Plantronics and PLT Labs, will provide an overview of this technological shift, including associated business and consumer communications impacts, and opportunities it may enable, complement or entirely transform.
Contextual Analytics of various threat data provides a deeper understanding of a given threat and enables identification of unknown threat vectors. In his session at @ThingsExpo, David Dufour, Head of Security Architecture, IoT, Webroot, Inc., will discuss how through the use of Big Data analytics and deep data correlation across different threat types, it is possible to gain a better understanding of where, how and to what level of danger a malicious actor poses to an organization, and to determine the measures to implement to prevent future occurrences.
WebRTC services have already permeated corporate communications in the form of videoconferencing solutions. However, WebRTC has the potential of going beyond and catalyzing a new class of services providing more than calls with capabilities such as mass-scale real-time media broadcasting, enriched and augmented video, person-to-machine and machine-to-machine communications. In his session at @ThingsExpo, Luis Lopez, CEO of Kurento, will introduce the technologies required for implementing these ideas and some early experiments performed in the Kurento open source software community in areas ...
 


@BigDataExpo Blogs
Millennials are increasingly using technology to assist in their product research and purchase decisions, forcing retailers to rethink and reshape their marketing strategies. Millennials. The Millennial Generation. Generation Y. Whatever you want to call them, this progressive group has forced retailers to transform their view and strategy on in-store experiences. In other words, Millennials have arrived on the scene expecting a whole new style of shopping, challenging the retail industry to launch interactive techniques to capture and retain members of the younger generation.
Organizations already struggle with the simple collection of data resulting from the proliferation of IoT, lacking the right infrastructure to manage it. They can't only rely on the cloud to collect and utilize this data because many applications still require dedicated infrastructure for security, redundancy, performance, etc. In his session at 17th Cloud Expo, Emil Sayegh, CEO of Codero Hosting, will discuss how in order to resolve the inherent issues, companies need to combine dedicated and cloud solutions through hybrid hosting – a sustainable solution for the data required to manage I...
Over the past few years, there has been an explosion in the volume of data. To tackle this big data explosion, there has been a rise in the number of successful Hadoop projects in enterprises. Due to the large volumes of data, the emergence of Hadoop technology, and the need to store all soloed data in one place, has prompted a phenomenon among enterprises called: Data Lake.
I am not a data scientist or an expert in knowing how to build candlestick charts from historical stock prices. I am however a data enthusiast and it fascinates me when I hear people talk about Big Data, like they invented it. Sorry, no offense meant, but really how did we just jump to Big Data without even creating an understanding about any kind of data? Information in any shape, form or face is a brilliant resource. We work with information every day and, if you look at it, nothing runs without information. Every business of every size across the world works on information – even the small...
WebRTC: together these advances have created a perfect storm of technologies that are disrupting and transforming classic communications models and ecosystems. In his session at WebRTC Summit, Cary Bran, VP of Innovation and New Ventures at Plantronics and PLT Labs, will provide an overview of this technological shift, including associated business and consumer communications impacts, and opportunities it may enable, complement or entirely transform.
We live in a microwave culture. I use this phrase often when discussing business needs with clients, especially in the context of leveraging technology to address those needs. Sometimes I will get a puzzled look, other times I will get some head nods in agreement and understanding. When I use this phrase, I’m talking about how the microwave has affected our culture from an end-user expectation perspective. There is an expectation of getting what I want when I want it, and an immediacy built into that expectation. The microwave turned hours into minutes, and minutes into seconds. There tends to...
Riak TS is focused to handle time series application needs. It can do fast read/write to IOT devices, there in is its strength. It also targets financial and economics data as well as in scientific research applications. This is straight from Riak TS: "Riak TS automatically co-locates, replicates, and distributes data across the cluster to achieve fast performance and high availability. The unique master-less architecture enables near-linear scale using commodity hardware so you can easily add capacity as your time series data grows."
Contextual Analytics of various threat data provides a deeper understanding of a given threat and enables identification of unknown threat vectors. In his session at @ThingsExpo, David Dufour, Head of Security Architecture, IoT, Webroot, Inc., will discuss how through the use of Big Data analytics and deep data correlation across different threat types, it is possible to gain a better understanding of where, how and to what level of danger a malicious actor poses to an organization, and to determine the measures to implement to prevent future occurrences.
The potential of big data is only limited by the creative thinking of your business stakeholders, and that may be the most important concept in the “thinking like a data scientist” process. The “thinking like a data scientist” process guides the business stakeholders into envisioning how big data can optimize their key business processes, create a more compelling customer engagement and uncover new monetization opportunities. But neither the business stakeholders, nor the data scientists, can likely do that envisioning entirely by themselves.
The goal for many organizations now is to make analytics a natural part of most—if not every—employee’s daily workflow. Achieving that objective typically requires a shift in the corporate culture, and ready access to user-friendly data analytics tools.
Today, we’re going to talk about the Internet of Things and Big Data. Bear with me here. This isn’t going to be some vague, half-cocked article bogged down by buzzwords and vagaries. Instead, what we’re going to do is take a close look at both technologies - what they actually are and what they actually do - in regards to how they’re changing enterprise. More importantly, we’re going to put forth an explanation of how inextricably the two are connected - and how, by understanding that connection, one’s business can set itself well ahead of the competition. Sounds pretty good, doesn’t it? Let...
The Internet of Things has dramatically changed the way we analyze behavior and is now in the process of boosting the way we use energy. Smart technologies are bursting into the retail space with solutions speaking to brands on improved marketing efforts, customer engagement, and optimization of floor plans. But one question has risen out of the chatter: How can the Internet of Things (IoT) improve energy efficiency? Not simply for retailers, but for commercial environments and homes (smart or not) as well?
The United States spends around 17-18% of its GDP on healthcare every year. Translated into dollars, it is a mind-boggling $2.9 trillion. Unfortunately, that spending will grow at a faster rate now due to baby boomers becoming an aging population, and they are the largest demographic in the U.S. Unless the U.S. gets this spiraling healthcare spending under control, in a few short years we will be spending almost 25% of our entire GDP in healthcare trying to fix people’s failing health, instead of spending it somewhere else where it is desperately needed. Obviously, we can’t stop the aging popu...
The security devil is always in the details of the attack: the ones you've endured, the ones you prepare yourself to fend off, and the ones that, you fear, will catch you completely unaware and defenseless. The Internet of Things (IoT) is nothing if not an endless proliferation of details. It's the vision of a world in which continuous Internet connectivity and addressability is embedded into a growing range of human artifacts, into the natural world, and even into our smartphones, appliances, and physical persons. In the IoT vision, every new "thing" - sensor, actuator, data source, data con...
Had Mark Twain lived today, we might hear him utter the oath lies, damn lies, and analytics. Statistics to be sure may still be used to distort the truth – but now with the sudden explosion of big data, analytics threaten the same fate. I’m not talking about intentional distortion here – that’s another story entirely. Rather, the risk of unintentional distortion via data analytics is becoming increasingly prevalent, as the sheer quantity of data increases, as well as the availability and usability of the analytics tools on the market. The data scientists themselves aren’t the problem. In fac...



Tweets by @BigDataExpo



About Release Management
Open Web Developer's Journal assists Web developers in learning how to leverage open APIs in their own code, on their own websites, and in their own businesses.

ADD THIS FEED TO YOUR ONLINE NEWS READER Add to Google My Yahoo! My MSN