Open Source a $1 Billion Business, But Just Beginning

Speaking at the opening of Red Hat Summit 2012 to a gathering of more than 3,000 people, Whitehurst began by looking backward, almost to the dawn of human history, to the invention of agriculture as the first industry as a collective endeavor by human beings to extract value from the land. From that time until the birth of the industrial revolution, he says, humans primarily generated value directly from a single physical asset: land. Around 1750 the industrial revolution began to alter that model as the machines humans created to extract value from the land became the primary source of value.

But it was nearly 60 years into the industrial revolution when innovation exploded at an unprecedented scale, and Whitehurst points to the invention of the screw-turning lathe as a direct factor. Humans had automated the process of creating fasteners. Those fasteners were driven by screwdrivers, and more important, he says, is that any screwdriver works with any screw (various head shapes not withstanding) no matter who manufactured them.

"Sixty years after the dawn of the industrial revolution, we finally got standardized piece parts," he says. "That standardization was critical to driving the next wave of innovation in the industrial revolution."
"If nuts and bolts at the time had been patentable, if you had to buy your screwdriver from the same company from which you bought your screws, the jet engine would not exist today," he adds. "The internal combustion engine wouldn't exist without standardized parts. The airplane wouldn't exist without the internal combustion engine."

And now, 60 years after the birth of the information age in which value has once again shifted from industrial assets to the underlying information assets, we are seeing a new form of componetization take hold.
"Sixty years after the invention of the computer, we are finally getting to standardized, componentized piece parts, which is cloud computing," he says. "It's so critical to driving the next wave of computing."
One of the core things cloud does is implode transaction costs, as the barriers to moving digital information from producers to consumers disappear. For some companies, that is a bad thing: He points to an image of a forlorn looking BlockBuster store with empty shelves. But while the change is painful for some, the combination of standardization, componetization and imploding transaction costs is the recipe for innovation, he says.

"We're seeing that in IT," he notes. He adds that venture capitalists who fund enterprise IT often speak to him of start-ups, saying, "These guys don't need more money anymore. They're just building the thing, putting it up on Amazon as software as a service&the cost of going to market has fundamentally changed."
But while open source is here and the default choice for many new projects, Whitehurst says the community must continue to push the frontiers of open source if the explosion of innovation is to continue.
"The decisions that you make, that we all make, that IT in general makes overt he next several years-are we going to have truly open architectures or will we just create the next Microsoft-is something that will be decided in the next several years," he says. "It's a battle we're going to have to continue to fight over the next several years."

Open Source PHP and Ruby on Rails Updated for Security

Busy week of patching continues as programming languages and frameworks get patched for security vulnerabilities.

This week has been a particularly busy one for IT professionals with Java and Microsoft updates. While those updates were mostly client side patches, server administrators aren't off the hook. The Ruby on Rails framework and PHP language both issued security updates this week addressing multiple vulnerabilities.

PHP 5.4.4 and PHP 5.3.14
PHP is a widely deployed open source language on web servers. According to a recent survey by w3techs, PHP is used by 78 percent of known websites, including major Internet properties like Facebook, Wikipedia and Wordpress.com

The two security flaws fixed in PHP 5.4.4 and PHP 5.3.14 are related to each other and could potentially enable an attacker to execute arbitrary code. The primary flaw, identified as CVE-2012-2143 is a security issue with the DES (Data Encryption Standard)implementation found within the PHP "crypt()" function.

A Red Hat bugzilla report on the flaw by developer Jan Lieskovsky, notes that the flaw was found in the way DES and extended DES based crypt() password encryption function performed encryption of certain keys. The flaw is that certain keys were truncated before being DES digested, which could potentially have enabled an authentication bypass.

The second flaw identified as CVE-2012-2386, is a vulnerability within the PHP phar extension. Phar enables entire PHP applications to be placed into a PHP Archive (phar) file.

"The vulnerability is caused due to an integer overflow error within the phar extension in the "phar_parse_tarfile()" function (ext/phar/tar.c) and can be exploited to cause a heap-based buffer overflow via a specially crafted TAR file," Security firm Secunia stated in its advisory.

Secunia warned that successful exploitation of the Phar vulnerability may allow execution of arbitrary code.

Ruby on Rails
Ruby on Rails (Rails) is a popular open source web framework, that powers many popular sites, including Github. Githubwas exposed as being at risk in March due to Rails vulnerability that has since been patched.

Rails 3.2.6 is now being patched for a pair of new vulnerabilities that could leave users at risk. CVE-2012-2694 details a Ruby on Rails Unsafe Query Generation Risk in Ruby on Rails risk while CVE-2012-2695 defines a Ruby on Rails SQL Injection vulnerability.

"Input passed to the Active Record interface via nested query parameters is not properly sanitised before being used in SQL queries," Secunia wrote in its advisory. "This can be exploited to manipulate SQL queries by injecting arbitrary SQL code."

They say "May the Best win". Google wins patent fight with Oracle

Judge William Alsup has become The Decider in what could become a landmark case in software intellectual property.

Chances are there might not be another lawsuit involving open source licensing and application programming interfaces for a long while. They're just too darn difficult to argue, explain and win.

Juries of regular people, by and large, do not understand the software development process and its licensing business, nor should they be expected to do so. They are peers to IT professionals as persons, but not as professionals. A case the nature of Oracle v. Google, which has been in the news for two months and has the potential to be a landmark case, would have been better served by a qualified jury that knows this topic.

But because that would open a can of worms in the U.S. court system that nobody even wants to consider, the courts proceed in the conventional manner.

Google Wins Second Round
Oracle learned firsthand, and the hard way, that it isn't such a simple proposition to nail a forker of open source software to the legal cross. In the closely watched Oracle v. Google trial on May 23, Google and the open source community logged into the record a solid legal victory when a 12-person jury unanimously found Google not guilty of infringing on two of Oracle's Java patents.

As my colleague Darryl K. Taft reported here in eWEEK, the jury found that Google did not infringe on the two Java patents that Oracle had asserted in the case—U.S. Patent No. RE38,104 and U.S. Patent No. 6,061,520.

The judge in the case, William Alsup, has dismissed the jury, but he still must decide on leftover issues from the copyright phase of the trial. Alsup said he would come to that determination within a week.

Those leftover issues involve Google's so-called "fair use" of the Java APIs. And they are very important. Turns out the jury of regular people couldn't agree as to whether Google overstepped its bounds in forking Java to help build its popular Android mobile device operating system a few years ago.

The truth, however, is this: Java has been forked hundreds, perhaps thousands of times in its 17-year history, by many developers. But those developers haven't been sued by a huge company with many lawyers like Oracle, either.

Forking Forgoes "Pure Java"
When Java gets changed for a specific purpose, it then forgoes the label "Pure Java" and is disowned by Oracle's Java franchise. No support, no updates, no nothing -- you're on your own. But it's still Java, it delivers code across the Internet, and it gets the job done most of the time.

That was the whole idea back in the early '90s, when Dr. James Gosling and his Sun Microsystems band of developers created the now-ubiquitous programming language. Gosling his gang designed Java as a key link to connect what he called "Big Hunk" servers to desktops, to cars, to mobile devices, to TVs -- to basically anything.

When Sun released Java to the open source community in 2006, it was not only a gift to the world, but it also was a nod to the fact that Java had already been copied and forked thousands of times in 11 years.

Java is so everywhere in the Internet, moving code from place to place and activating applications, that it has became an integral part of the infrastructure background, like XML or TCP/IP. It's just there, it works, and it keeps on working 24/7.

Java Taken for Granted?
Java is easy to take for granted, and Oracle knows it. It is simply trying to protect what it owns; it's just very difficult to prove negligence against a competitor when it comes to open source and APIs.

Java's APIs are the central issue in this trial. APIs are a combination of several components: software, instructions, best practices and techniques. And techniques are not copyrightable, so that begs the question: Are APIs in their entirely copyrightable?

That was the core of Oracle's case against Google. The jurors couldn't agree. So this now goes to The Decider: Judge Alsup.

Google and Oracle have both won parts of this case, but it isn't over until the judge sings. Even then, appeals may come into the picture. It's an important case.

Open source firm Opsview update IT monitoring lens

V4 gets enhanced data visualisation, dashboarding; Opsview Pro targets SMB market

Privately held, open source IT monitoring firm Opsview has revved its platform with data visualisation and dashboard technology, saying it better helps firm monitor their physical, virtual and hybrid cloud environments.

Opsview has around 19,900 customers using its free open source offering and a further 100 customers paying for all the bells and whistles as well as a support package in the shape of the Enterprise version.

Founder and CEO Michael Walton told CBR the company is also launching Opsview Pro, aimed at the small to medium business market and somewhere between the open core and Enterprise version in terms of features and functions.

V4 can monitor cloud-based applications from the likes of Salesforce.com by tapping into their published APIs. Walton said the focus of the latest release was around the front end - visualisation and dashboarding - as well as some performance tweaks. Improved customisation is said to make it easier for users to identify and diagnose system incidents.

Versus the competition from industry giants like CA, BMC, IBM and HP, Allen said the firm's relatively small size plays as an advantage as it can be more nimble, whilst its open core licensing model means there is a sizeable community of users who offer valuable feedback, add-ons and testing.

Walton claimed the firm doubled its revenue in the past 12 months and expects to double it again in the next 12. It will approximately double headcount this year to around 60 staff worldwide, predominantly in the UK, US and with some development staff in India.

Helping Walton guide Opsview's strategy on the board of directors is Stephen Kelly, formerly CEO of Chordiant in the US and then Micro Focus in the UK.

Describing Opsview V4 Walton said, "We have completely re-engineered Opsview to provide users with a more consistent and user-friendly experience. With more than 30 major enhancements in this new release, organisations will now be able to identify, diagnose and fix systems incidents with even greater accuracy and speed."

Opsview's customer roster includes Ericsson, Electronic Arts, Allianz, Binck Bank, Equiduct, Dimension Data, Irish Revenue, and Cornell and Yale Universities.