Tag Archives: Michael Goulde

The Open Source Security Primer

our beautiful site

Open source software is both tempting and terrifying for many small to mid-size business owners. Tempting because it’s cheap up front and comes without those licensing fees. Terrifying because of the perception that it’s easier to hack. “There’s absolutely no evidence that open source is any less secure than commercially licensed software,” says Michael Goulde, a senior analyst from Forrester Research, who estimates 55-60 percent of all businesses use at least some open source software. Goulde goes on to dispel the two most popular concerns about open source software: Anyone can look at the source code. The worry here is that “anyone” can be any hacker who wants to wreak havoc. “Bad eyes can see the code, but good eyes can see it, too. If a vulnerability is found, then there’s a whole community of developers literally all over the world to fix it. It’s essentially under peer review,” says Goulde. It’s written by amateurs who don’t care about security. Goulde says that used to be true, but with the more established applications that is hardly the case anymore. Most open source developers are professionals with some even employed by the likes of IBM, Hewlett-Packard, and Sun Microsystems. One size doesn’t fit all “Open source is a very broad area. You can’t make a single judgement about it. Some areas of applications are quite mature, while others are not,” says Yefem Natis, a distinguished analyst from Gartner, a Stamford, Conn. IT research group. Natis advises business owners to be more cautious when it comes to open source applications like portals and business tools such as business process management (BPM), customer relationship management (CRM), and enterprise resource planning (ERP) systems. Operating systems and application servers, on the other hand, are more established and safer to use. Goulde, however, is less cautious and even sees open source as a unique opportunity for many small to mid-size businesses. “The amount of functionality you get from the open source versions of these technologies, like CRM, ERP, and BPM tools, is just right for many small to mid-size businesses. And, it’s affordable. Similar products that are commercially licensed are more likely to be priced beyond their reach,” says Goulde. The argument for open source safety For all the debate, a business owner has to wonder why not just play it safe and stick with the commercially licensed software.  Here are some of the advantages of open source applications that may make it too tempting to pass up: It’s cheap.  Not having to pay licensing fees can obviously be a huge savings. Don’t forget, however, it still has to be maintained. Open source is not completely free! It’s easier to integrate with other applications. Open source is written to support standards, rather than proprietary code (like Microsoft applications written to support other Microsoft applications, for example). This means fewer headaches combining it with other products from a mixture of vendors. It’s easier to get serviced. Since the code is freely available, there are more businesses and consultants around to help with service and maintenance. More choices mean more competition to get your service contract. More competition, of course, means a cheaper service contract. More innovation. Since its open source, there’s an open field of developers working on new versions with new features. This can mean both more innovation and more interesting innovations. How to play it safe Feeling more tempted than terrified? Here’s what a business can do to take the open source plunge with minimal risk: Know where the software is coming from. There are often many, many places to download these applications. Companies need to verify the source as reputable and safe. Always check references. Use a consultant. This is especially important for most small to mid-size businesses with little or no in-house IT staff. Its money well spent to hire someone who knows the most established applications, their best download sources and how to install them. At the very least, work through a reseller who can guarantee the source of the software. Plan on having ongoing support. “Open source is often in a more raw form, compared to commercially licensed software. Therefore, it requires more expertise to fine tune it to make it work with the business,” Natis says. “Support is a must.” For those businesses still feeling more terrified than tempted, here are some final unsettling words from Natis: “Open source is so widespread nowadays, some businesses are already using it bundled into other products without knowing it.”

Is PHP the New Java?

Fast and cheap, the programming language PHP has won small business converts in recent years though critics say one of its biggest selling point — ease of use — makes it less robust than some of its competitors. PHP, short for Hypertext Preprocessor, is now the fifth most-popular coding language in the world, according to TIOBE, the Dutch research firm. Like Sun Microsystem’s coding language, Java, PHP is designed for developing Web-based applications. While PHP can be used to power a number of such applications, a small business would likely use it to create a shopping cart, a bulletin board, or an ordering system on its website. But PHP is considered to be easier to master than the others. Part of the reason is cost. Since PHP is open source, there are no royalties to pay and, since it works on any operating system, a small business could theoretically write applications in PHP for free. (Sun Microsystems recently made Java open source, as well.) In practice, a firm is likely to use an integrated development environment (IDE) that edits, debugs, and analyzes code when writing PHP. PHP is catching on Though no one has a definitive number for PHP penetration among small business, Forrester Research pegs it at around nine per cent. Michael Goulde, an analyst with Forrester, says that number is growing and there’s a good reason. “It’s much easier than learning a programming language like Java,” he says. “It’s pretty forgiving.” InTicketing, a San Rafael, Calif., firm that sells concert tickets for itself and others, has been using PHP for about six years. “We chose it because it’s the most adaptable and fastest language that can be used to build real world, scalable solutions,” says Marc Urbaitel, chief technology officer and co-founder of InTicketing, which has fewer than 100 employees. By “fast,” Urbaitel means it processes faster than other coding languages. Urbaitel says he uses an IDE product called Zend Studio, which now sells for $300, but aside from that there wasn’t much money to lay down. Viable alternative to Java Zend Studio is one of the main sources of income for Zend, a Cupertino, Calif., firm run by Andi Gutmans, one of the founders of PHP. Gutmans says PHP is a viable alternative to Java. “The biggest problem with Java is it’s very complex and development takes a lot longer,” says Gutmans, who adds that Wikipedia, among other Web 2.0 applications, uses PHP. By contrast, PHP is frequently billed as “easy,” but Goulde cautions that that doesn’t mean that a layman can just jump in and start coding away. “It’s not for someone who had only used FrontPage before,” he says, referring to the Microsoft Web-page creation software. But what makes PHP “easy” can also make applications written on it perform poorly compared to those written in other programming languages, such as C, C++, C# or Java, Goulde says. “It can lead to bad programming practices,” he says. “Because it will allow faulty scripts to keep running, bugs may be found and erroneous results might occur.” Gutmans contends that C is actually a bigger cause of bugs than PHP. Still, Urbaitel has used C before and likes PHP better. “I moved over because of the speed,” he says.

The Hidden Costs of Open Source

When businesses hear the term “open source” software, it often translates into another word: free. And while open source code technically is just that — free for all to use — it doesn’t mean that there are never any costs associated with deploying open source. To understand the payoffs of utilizing the growing array of open source applications, experts say it pays for small and mid-size businesses to do their homework on the cost analysis front. “The philosophy of open source is more about freedom — to look at the code, modify it, and that there’s no copyright,” says Michael Goulde, senior analyst for Forrester Research, of Cambridge, Mass. “Companies can save money on their expenses, especially if they don’t need all the bells and whistles that a commercial software package has. An open source package might have all they need.” Still, he warns that there are hidden costs of open source and small and mid-size businesses “can get in over their heads really quickly.” Many businesses say cost is not even a factor when moving to open source. They simply pick the best technology for the job. But companies should consider the following before committing: No. 1: Packaged open source comes with a price Some open source software comes shrink-wrapped in a box just like commercial counterparts. For instance, Red Hat Linux subscriptions and training can cost thousands of dollars. Or SugarCRM, a popular open source customer management program, costs from $40 to $75 for the Commercial or Professional versions. It charges $855 to host and manage the application with a monthly maintenance fee. Sometimes migrating to open source — as with any IT overhaul — could mean that a company needs to buy new hardware.  Still, Bruce Perens, a longtime open source evangelist and vice president at Source Labs, of Seattle, an open source provider, says most small and mid-sized businesses don’t need commercial open source products. The Ubuntu OS, for example, is not difficult to install and is free. “You can run it and not get a support contract and not pay anyone,” he says. No. 2: Support isn’t always free Open source communities are known for being supportive and helping with problem solving — for free. In fact, experts say the support offered by open source communities is often better and more in-depth than commercial software companies’ “1-800” numbers. Yet when it comes to using community-developed open source applications, being able to get on-demand technical support is a concern for some small and medium-size businesses. “Support is always a concern, no matter what kind of product it is,” says Bernard Golden, CEO of system-integrator Navica, a San Carlos, Calif. systems integrator and author of Succeeding with Open Source. In this case, businesses can hire a local company to provide open source support or to manage updates just like they might when using Microsoft Windows. Red Hat support packages for Linux can cost anywhere from $349 to $18,000. Goulde adds that small businesses should seek outside support if IT administration is not their strong suit: “When they start trying to download it themselves and support it themselves and stay on top of all the changes, that gets hard. They need somebody to guide them.” No. 3: Consultants can cost you True, open source code is free. But, if a small business doesn’t have an information technology staff to research, implement and maintain it, the firm might need help, Golden says. “If they don’t have a lot of tech savvy, they should find a partner or service provider who is open source aware and supportive,” he says. When a vendor installs open source, it also has terms of service to stand behind. Free downloads don’t. Perens says if a small business wants to get its feet wet, at the very least, there are free open source products out there that mimic off-the-shelf packages, such as Open Office. “The people who really needed supported open source, are the larger businesses,” he says. “If you’re getting big enough that you need support outside of your company, get it locally and find a local consulting firm that is willing to support Linux. The price corresponds with the level of support.”

Does Open Source Software Make Sense for Your Business?

our beautiful site

Despite its technical mystique, open source software holds a lot of appeal for small and medium-sized businesses. And no wonder: It’s free. Free as in no off-the-shelf, licensing, or upgrade fees having to be paid to a software maker. And although open source code is by nature developed by a collaborative community of programmers, experts say it’s becoming more mainstream and that non-technical end users can increasingly take advantage of open source software.  “The open source folks are coming from a small business background — they wrote this software for themselves and they have an affinity for the small and mid-size users,” says Bruce Perens, a long-time open source evangelist and vice president at Source Labs, a Seattle-based company that offers support for open source deployments. “When I wrote my open source software, I was a one-person consulting business and the needs of small businesses were paramount to me.” Still, many businesses have concerns about using open source, such as worrying about whether or not it comes with tech support, how to deploy it, or how to even start researching the possibilities. So how can small and medium-sized businesses evaluate whether open source software is right for them? Experts offer this advice: Step 1: Evaluate your business needs Whether you need a simple word processing program or a customer relationship management (CRM) application, small businesses need to approach evaluating open source software solutions the same they would commercial software, says Bernard Golden, CEO of Navica, a San Carlos, Calif. system-integration company, and the author of Succeeding with Open Source. “The thing that makes sense is to look at their needs and what functionality they are looking for — then they can see whether open source fits their needs,” Golden says. “I would ask are there things you need to do for your business or would like to do but feel you can’t do because of the cost of software? In those cases it would make sense to look for open source alternatives. In almost every category of software there are open source packages that are very capable.” Step 2: Explore open source options Companies in the business of developing Web applications or software are probably already dabbling in open source — or even developing it. But you don’t have to be a high-tech firm to delve into open source. For instance, Perens points out that there is an open source package that is free to download and compatible with Microsoft Office, dubbed OpenOffice. Mozilla’s Firefox is an open source Web browser that is growing in popularity for its tabbed browsing and ability to block pop-ups. Or a business can try Thunderbird, a free open source e-mail program by Mozilla. Open source repositories that IT staff can check out include SourceForge.net, Codehaus, or Freshmeat.net. Although some Linux open source operating systems, such as Red Hat, come packaged with a price tag just like Windows, Perens says small businesses don’t have to necessarily plunk down the cash. The small business users who are less tech savvy could start with Ubuntu, which boasts the tagline: “Linux for human beings.” Perens says the Ubuntu OS is easy to install and use. It’s updated every six months and includes server and desktop software that can be installed from a single CD. Step 3: Determine if you need outside help If a small or medium-size business already uses outside consultants to deploy, manage or support their IT system, they can consider doing the same when it comes to open source — especially if they are concerned about not having someone to call if something breaks. “Vendors and consultants use open source to add value, but the SMB doesn’t have to be concerned as long as the reseller is standing behind it,” says Michael Goulde, a senior analyst with Forrester Research, of Cambridge, Mass., who’s written several reports on the trend toward enterprise use of open source. “It’s tempting to do it yourself because it’s free. SMBs can get in over their heads really quickly.” Perens says if a small business’s open source application is mission critical to consider using managed servers by an outside vendor. “And if you’re getting big enough that you need support outside of your company, get it locally and find a local consulting firm that is willing to support Linux. For a small business, or one with fewer than 1,000 employees, local support is the best deal.” If a small firm isn’t tech savvy, Golden aggress that it should look into finding a partner or service provider who is open source aware and supportive. Still he says: “Support is always a concern, no matter what kind of product it is. For most open source products you can find commercial support if you want it. You can also get community support from open source forums, which are tremendous resources and can even be far better than an 800 number that you get with commercial products.”