It’s No Myth: Compliance Is Good Business
Download as PPTX, PDF•1 like•1,422 views
This document discusses myths and realities around corporate use and compliance with open source software. It summarizes that while some myths suggest companies only use open source for free software and do not comply with licenses or contribute back, the reality is that many companies invest heavily in open source compliance programs and processes. It also notes that many companies actively contribute back to open source communities and foundations.
It’s No Myth: Compliance Is Good Business
- 1. © Black Duck 2012 It’s No Myth: Compliance Is Good Business Linux Collaboration Summit, 16 April 2013 Phil Odence, VP Business Development Black Duck @black_duck_sw
- 2. 2 © Black Duck 2013 Black Duck’s Perspective • Known for services; primarily a software company • Not an open source company per se • Very involved, but most products under commercial licenses • Serving (primarily) commercial companies • Software, Systems, Enterprise IT Organizations • Helping companies manage their use of open source @black_duck_sw
- 3. 3 © Black Duck 2013 Agenda Goal: To provide a bird’s eye view of open source/FOSS usage and compliance in companies • Evolving Relationship Between Commercial Companies and FOSS • Why open source? • Why comply? • Are they really? • What’s next? @black_duck_sw
- 4. 4 © Black Duck 2013 First of all… “Software is Eating the World.” Marc Andreessen (Netscape Founder) August ’11, Wall Street Journal And there’s a growing appetite for open source… @black_duck_sw
- 5. 5 © Black Duck 2013 …with the plate is heaping Source: Ohloh/Black Duck KnowledgeBase 2.7 billion files Nearly 1M de-duplicated projects 10+ million staff years of development 5000+ sites 2,200+ unique software licenses - 500,000.00 1,000,000.00 1,500,000.00 2,000,000.00 2,500,000.00 2006 2008 2010 2012 2014 FOSS Projects Projected Games UI @black_duck_sw
- 6. 6 © Black Duck 2013 OSS Adoption: Jeff Hammond circa early 2009 @black_duck_sw
- 7. 7 © Black Duck 2013 Olliance Consulting* Management Maturity Framework Developer driven Business strategy driven Ad Hoc Use Built-in Compliance Informal Guidelines Strategic OSS Use, Commun ity Leadership Explicit Policy, Tracking & Audting Process Automation, Co mmunity Participation OpenSourceAdoption *now a division of Black Duck @black_duck_sw
- 8. 8 © Black Duck 2013 Industry OSS Adoption ala Geoff Moore Innovators Majority OpenSourceAdoption @black_duck_sw
- 9. 9 © Black Duck 2013 Jeff Hammond circa late 2010 • OSS goal to means • 80% developers used • Reduced management gap • Don’t ask/tell to strategic • Waned concern about mission critical apps @black_duck_sw
- 10. 10 © Black Duck 2013 The Chasm is the Stuff of Myth Closed source is the evil empire You are a bunch of wookies If anyone knows we are using open source we’ll have to give up all our code They just want a free ride There’s no way to make money if I give away my software. No one cares about licenses unless they are getting sued Those guys don’t get it. • Chasm: Greek χάος means emptiness, vast void, abyss. Same as for “chaos” • Out of which grew the Chaoskamph myths • Explaining the clash between order and chaos in the world‟s creation • paraphrasing Wikipdia @black_duck_sw
- 11. 11 © Black Duck 2012 Why open source? Myth: You only love us cause we’re free (as in beer)
- 12. 12 © Black Duck 2013 Faster, Better, Cheaper Jeffrey Hammond, Forrester Open source is a „silver bullet‟ that allows simultaneous improvement along all three dimensions of the software „iron triangle‟ of cost, schedule, features. Cost FeaturesSchedule @black_duck_sw
- 13. 13 © Black Duck 2013 A bunch of good reasons… “Open source is ubiquitous, it’s unavoidable….having a policy against open source is impractical and places you at a competitive disadvantage” • Key Benefits • Flexibility • Modify, mix, reuse code • Innovation • Leverage FOSS and community • Cost Optimization • Reduce or eliminate acquisition costs Source: Mark Driver, Gartner Group It’s only #3 @black_duck_sw
- 14. 14 © Black Duck 2013 30% 80% Average Best in class Company Benefit: Less is More @black_duck_sw
- 15. 15 © Black Duck 2013 Real World Example “Over 80% of the software in our handsets is open source” Carl-Eric Mols, Head of OSS, Sony Mobile Communications @black_duck_sw
- 16. 16 © Black Duck 2013 Another: Large Commercial UK Bank Trading Application Delivered a new trading app but only had to do 28% of the work! @black_duck_sw
- 17. 17 © Black Duck 2013 …and then there’s customer acceptance • DoD CIO Letter… • To effectively achieve its missions, the Department of Defense must develop and update its software-based capabilities faster than ever, to anticipate new threats and respond to continuously changing requirements. The use of Open Source Software (OSS) can provide advantages in this regard. • Unfortunately, there have been misconceptions and misinterpretations of the existing laws, policies and regulations that deal with software and apply to OSS, that have hampered effective DoD use and development of OSS • I have asked the Director, Enterprise Services & Integration, to work with your staffs and identify other barriers to the effective use of open source software within the Department, so we can continue to increase the benefits from the use of OSS FOSS @black_duck_sw
- 18. 18 © Black Duck 2013 So… • The myth: • It’s all about the “free beer” • The reality: • It’s about: • Flexibility • Innovation • Co-opetition and Community • Recruiting • Support from customers • And, yes, Cost @black_duck_sw
- 19. 19 © Black Duck 2012 Why Comply? Myth: Companies don’t give a hoot (’cept maybe when they get sued)
- 20. 20 © Black Duck 2013 Software today is Multi-Source THE ENTERPRISE – TOOLS, PROCESSES Your Software Application Internally Developed Code Commercial 3rd-Party Code Outsourced Code Development OSS Communities Global 2000 organizations increasingly leverage code from a vast array of sources — including internally built, open source, outsourced, commercially built, and customized applications. - Melinda Ballou, IDC (sponsored by Black Duck @black_duck_sw
- 21. 21 © Black Duck 2013 The Fundamental Challenge “How ya gonna keep ’em down on the farm…?” @black_duck_sw
- 22. 22 © Black Duck 2013 Management challenges aren’t just legal • Key Benefits • Flexibility • Modify, mix, reuse code • Innovation • Leverage FOSS and community • Cost Optimization • Reduce or eliminate acquisition costs • Challenges • Technical Failure • Operational exposure • Needs to be audited, managed • Security Risks • Business exposure • IP Risks • Legal exposure “Open source is ubiquitous, it’s unavoidable….having a policy against open source is impractical and places you at a competitive disadvantage” Source: Mark Driver, Gartner Group It’s only #3 @black_duck_sw
- 23. 23 © Black Duck 2013 Managing Open Source = Proper SW Dev Mgmt • “There are plenty of other reasons beyond licensing that I want to understand what’s in our code” • CIO, Large Financial Services Firm • Security • Quality • Supportability • Community • Sarbanes Oxley Act Section 404 says you gotta know what software you got and who owns it • Fortune 500 tech companies- material risk in 10Ks @black_duck_sw
- 24. 24 © Black Duck 2013 And, if they want to get bought someday… 2009 2010 2011 2012 M&A Audits US Tech Deals OSS Compliance have become routine question in tech M&A Source: Black Duck / 451 Group @black_duck_sw
- 25. 25 © Black Duck 2013 Free’s not all that free Risk (all sorts) ComplianceProductivity Phil‟s (other) iron triangle No compliance means productive but risky Overly heavy compliance reduces risk, but may squash productivity @black_duck_sw
- 26. 26 © Black Duck 2013 So… • The myth: • Companies don’t care • And only pay attention to extreme measures • The reality: • Legal fear is a motivator • But companies’ overall risk management agendas align reasonably with open source governance • It’s just not all that simple @black_duck_sw
- 27. 27 © Black Duck 2012 Who complies? Myth: OK, but most companies don’t comply And, they may talk the talk, but…
- 28. 28 © Black Duck 2013 Companies invest heavily in compliance @black_duck_sw
- 29. 29 © Black Duck 2013 In the form of sophisticated governance processes @black_duck_sw
- 30. 30 © Black Duck 2013 …best practices, training, transformation @black_duck_sw
- 31. 31 © Black Duck 2013 ..,dedicated review boards and programs Open Source Program Office • Responsible for all open source activities and strategy across the company • Provides continuous training and consulting to HP product and project teams • Encourages contribution to the open source community • Sponsors numerous open source foundations (e.g. ASF, Linux Foundation, OpenStack) and events • Typically review 10 to 20 proposals per week from teams wanting to use and/or contribute to open source • Develops in-house tools to support the review and tracking of open source across the company • Promptly handle any compliance inquiries that come to our attention http://opensource.hp.com @black_duck_sw
- 32. 32 © Black Duck 2013 ….correct and corresponding code infrastructure “The Internet of objects would encode 50 to 100 trillion objects, and be able to follow the movement of those objects. Human beings surrounded by 1000 to 5000 trackable objects” @black_duck_sw
- 33. 33 © Black Duck 2013 OK, but do they waddle the waddle? @black_duck_sw
- 34. 34 © Black Duck 2013 Giving back is a “higher order skill” Engineering driven Business strategy driven Ad Hoc Use Built-in Compliance Informal Guidelines Strategic OSS Use, Commun ity Leadership OpenSourceAdoption *now a division of Black Duck @black_duck_sw Explicit Policy, Tracking & Audting Process Automation, Co mmunity Participation
- 35. 35 © Black Duck 2013 Companies certainly rock the Kernel • 75% Kernel developers are paid • 800 companies have contributed over time; 200 active as of 2012 • Red Hat, Intel, Novell, IBM, Texas Instruments, Broadcom, Nokia, Samsung, Oracle and Google • Jon Corbet’s 2012 annual report @black_duck_sw
- 36. 36 © Black Duck 2013 Financial Services Automotive Mobile Aerospace Polarsys Healthcare Community and Co-opetition Mozilla Eclipse Openstack The Foundation The Apache Foundation Networking @black_duck_sw
- 37. 37 © Black Duck 2013 Automotive may boast the most logos Ford contributes AppLink code to GENIVI Alliance GENIVI License Review Team @black_duck_sw
- 38. 38 © Black Duck 2013 And … I’m just sayin’ Microsoft is into open… @black_duck_sw
- 39. 39 © Black Duck 2013 Close to our hearts @black_duck_sw
- 40. 40 © Black Duck 2013 So… • The myth: • Companies don’t comply • And even if they do they don’t participate • The reality: • Some don’t • Many do • The world’s best companies invest heavily • And, more and more they are walking the walk @black_duck_sw
- 41. 41 © Black Duck 2012 Looking Forward and Conclusions
- 42. 42 © Black Duck 2013 Conclusion • The Companies/FOSS has evolved • Corporate usage has crossed the chasm • Companies have good business reasons to manage/comply • The best companies do comply • And are finding good business reasons to give back @black_duck_sw
- 43. 43 © Black Duck 2013 There may remain a philosophical schism, but... Software is all about delivering shareholder value Software is all about “free” Rather than question motivation, focus on results @black_duck_sw
- 44. 44 © Black Duck 2013 Check out where it’s going • Key trend toward internal OSS methods – 80% • Open source will make up >50% deployed code – 62% • “Lower Cost” – drops to #7 in importance • Attracting talent – #1 reason to engage • Company’s co-epetition will increase – 57% • 2013 Future of Open Source Survey Results show new trends in OSS • First ever webinar results panel is now available to view on- demand! • #FutureOSS @black_duck_sw