If An Open Source App Rises in a Company, Does Anybody Hear?

by Sam Dean - Jun. 24, 2009Comments (3)

When an open source application or platform gains traction in a company, does the I.T. department necessarily drive that? Not always, as Rich Green, Executive VP of Software at Sun Microsystems, confirmed for us in our interview with him. "We regularly meet with CIOs of large companies who had no idea that their staffs downloaded and deployed MySQL," he told us. "Seeing grassroots adoption of MySQL is one of the most gratifying parts of my job," he added. Early results from a small survey done by OpenLogic appear to support the idea that this often happens because of no formal procedures for tracking open source usage.

OpenLogic recently conducted a webinar with open source business and strategy consultancy Olliance Group, attended by 33 people, and OpenLogic reports that more than half of them came from Fortune 500 companies. The webinar included an audience poll, which yielded these results, according to OpenLogic:

On a scale of 1-5, how open is your company towards the use of open
source software (check one)?
1 - No usage of open source allowed - 0%
2 - Open source used only if no other solution exists - 29%
3 - Open source allowed when it is superior to other solutions - 12%
4 - Open source and proprietary solutions have equal footing - 41%
5 - Use of open source preferred when available - 18%

What techniques do you use to track open source usage in your company
(check all that apply)?
1 - No formal inventory at all - 19%
2 - Self-reporting per project - 33%
3 - Self-reporting on a global scale - 8%
4 - Manual audits of self-reported inventories - 22%
5 - Automated code scanning tools - 17%

Of course, OpenLogic makes software for governance and compliance when using open source software, and the sample size in the webinar was not large, but this is one of many examples I've come across supporting the notion that there aren't formal ways to track actual open source usage in many businesses. One-fifth of respondents to the second question above reported "no formal inventory at all" for open source usage. Jonathan Schwartz, CEO of Sun, and many others have reported similar findings.

One has to wonder how close the various market share reports on open source usage are to reality. The data we see on open source usage from companies is usually reported by I.T. staff personnel, who may or may not be aware of actual usage.

OpenLogic has also posted a slideshow with further data from the webinar. You can find it here.

Previous: Eclipse Foundation D...Next: Red Hat Invests and ... Browse Blog

by Khürt Williams on Jun. 24, 2009

Great. So one of the internal non-IT functions was downloading and using unsupported software. When something goes wrong (unpatched vulnerability exploited etc) who gets blamed?

0 Votes

by Randy Clark on Jun. 24, 2009

@Khurt - good point. I guess the same set of guys who would be responsible internally for writing code. In this case, however, the community should be able to rapidly patch the vulnerability. Say the marketing department downloads and installs a wiki that gets an injection attack due to a vulnerability. Well, chances are they are not the first ones to see that, and they should have patches available. The same guys who set it up can patch the system, hopefully. What happened when Outlook was exploited? Who was responsible for patching systems there? Was it Microsoft that provided support, or just a patch?

0 Votes

by Khürt Williams on Sep. 26, 2009

Randy, when non-IT functions download and install their own software without approvals, security review, formalized change processes and disaster recovery planning it is usually the IT folks who get placed on the hook. I've seen it over and over again.

0 Votes