Open-source software has been about two things: passion and need. The passion comes from developers’ love of solving problems, creating new things and working with like-minded individuals. The need is about adding functionality to some existing software, or making a version of that software that is unencumbered (either free as in beer, or free as in speech, or both).
But today, a growing share of the open-source universe has been commandeered by large software organizations looking to commercialize an open-source project by offering proprietary add-ons, or through support and services. These companies—Oracle comes quickly to mind—might be seen as interlopers in the open-source community, viewing committers and contributors as nothing more than free (as in no cost) labor.
So, the question is: Are commercial open-source software and Free and Open Source Software at odds with each other, or is the relationship more symbiotic?
“I come down on the symbiotic side,” said Tim Yeaton, president and CEO of Black Duck Software, which has software to help developers understand open-source code more clearly and to deal with license and intellectual property issues.
“[Black Duck] can identify 300,000 consumable, downloadable open-source projects, with 30,000 new projects begun every year. In the grand scheme, it works like it always did. Developers still find each other on interesting sites that are useful to them. Ninety percent [of those projects] never get a commercial entity around them. Analysts suggest that more open-source contributors are being paid by [commercial] organizations. It’s not that the group of people who do it out of passion is shrinking; it’s just that the former is growing.”
Many experts agree that “professional open source” works best when a company comes in and respects the community that has grown around the project. “In the last decade, big vendors have consistently invested in open source for strategic business reasons, and they nurture the community for their interests,” said Paula Hunter, executive director of the Outercurve Foundation, an advocacy that facilitates the participation of professional developers in open-source projects.
“Look at Eclipse. It was founded and funded by IBM with very tight control. Then it shifted to a non-profit governance model, and IBM loosened its control. Now, users and committers are more comfortable that the longevity of projects would remain intact and meet the needs of developers, rather than the commercial interests of IBM.”
The issue of control over a project is a potential flashpoint for trouble, said Jim Jagielski, chairman of the open-source Apache Software Foundation. “In corporate environments, the list of requirements and features isn’t derived from the need of the masses. It’s derived from ‘What can we sell?’ At some level, companies have to give up control.
“When [professional] open source understands the user community, it’s incredibly successful,” he continued. “But companies that try to wrest control, to fit the project into a pattern of traditional software development, are the ones who have problems.”
This wrestling for power seems to occur when companies backing open-source projects become more successful and attract venture funding. “That’s when there’s a real push for them to get more control and be the exclusive company behind the codebase,” Jagielski said.
Sam Ramji, vice president of strategy at API management software provider Apigee and a member of the Outercurve Foundation’s board of directors, said that venture capitalists look for ways to reduce risk. “If a project is deployed, attracting developers and attracting users, then you know there’s a ready-made adoption market,” he said.
The Apache Way
Personal involvement in a project remains crucial to an open-source community, Jagielski said. Apache bases its decisions on who can commit code to a project and who can help create a path on that person’s investment in the work, whether the developer is paid or doing work voluntarily. “If they’re just coding on their job, Apache sees them as committers but not invested enough to have an impact on direction,” he said.
“It’s not so much who pays you, but do you have a personal interest in the code? Are they active on mailing lists? Do they speak at conferences? Do they update wiki pages? If not, it’s just a paying job, and the whole drive of what open source is about would be gone.”
Companies who come into Apache to commercialize projects know what the rules are, Jagielski said. “The [Apache] license was written the way it was to present a wide range of business opportunities to use the codebase, and not have to release back the ‘special sauce’ part. We’ve always been incredibly pro-business. You have to make it easy for companies to leverage it.”
But companies coming into open source have a responsibility too, he said. “They must be open and honest with the community, that they’re still welcomed contributors on whatever projects the companies are leveraging.” It’s critical that companies demonstrate that they are not just pulling out developer talent while giving nothing back to the community, he added.
The most successful professional open-source projects are the ones that get life from the community, Black Duck’s Yeaton pointed out. “Look at Drupal and Hadoop. In both cases, the community built momentum first. It started with a robust, high-growing community of contributors and users. That won’t change because organizations are commercializing around it.
“Cloudera hired the [Hadoop] project creator. They’re looking to build value without violating the community model,” Yeaton added. “If you come in and violate that, you run the risk of splintering the community.”
Oracle blind to vision
Oracle has done just that with its stewardship of Java, MySQL and now Hudson as it has run roughshod over existing communities. The database and packaged software giant assumed control of these open-source communities with its purchase of Sun Microsystems.
“You would think they’d have a better understanding of what open source is and working with a community,” Jagielski said. “With Java and Hudson, it seems obvious that the whole idea of open-source being a community-led effort is something they don’t grasp very well.”
With Java, MySQL and even Solaris (the open-source operating system created at Sun), there is “a cultural conflict between developers and the commercial entity who wants to profit,” said Apigee’s Ramji.
“Take Solaris. Putting a dot-org on it doesn’t mean it’s a non-profit effort. It was owned and controlled by Sun, and that impacted the development community heavily. It was clear who controlled Solaris.”
Because of Oracle’s heavy-handed tactics, new open-source projects—forks, to be more precise—have sprung up around MySQL (the MariaDB project, which shares the same codebase) and Hudson (as yet unnamed as Oracle asserts its rights to the name).
“Conflicts come when the developer’s ability to change code or dictate it is abrogated,” Ramji said. “A code repository with the companies controlling access is a point of conflict. MySQL developers who have been working on that project for a long time now have no say in where the project is going to go. Developers will flee and look for other projects.”
Sara Ford, manager of the Ohloh community site for Black Duck Software, learned first-hand what it takes to engage open-source developers when she was a Microsoft manager charged with building the CodePlex organization. “When I first went into the community, at first everyone was extremely receptive, if not shocked and amazed,” she said.
“At OSCON 2006, people would look at my badge and make comments about Microsoft, like, ‘What are you doing here?’ I was there to learn and take back knowledge. I said to them, ‘If you want to help make Microsoft a better place for open source, give me information to take back.’ ”
The adoption of open source was foreign to Microsoft, she acknowledged. “It involved a change in the development process. We’d be going public with source very early on, even before we would say it’s ready for release.”
Ramji agreed that open source marks a general shift in how software is developed in commercial organizations. “The initial assumption is that we can use open source to get the job done, work collaboratively and be geographically distributed. That’s a fundamental difference from 10-15 years ago, and would have been considered radically aggressive then.”
Ford added that “open source was the natural progression in making software in general better and more supportive.”
One thing that’s often overlooked when commercial entities come into open-source projects, or spin them out, is when there is not a clear agreement regarding intellectual property rights. “Where IP rights do not address shared ownership [between the company and the developer], that’s a flashpoint for a large-scale conflict,” Ramji said.
“Software is not a brick. It is not inanimate. There’s a process to updating software,” he continued. “The question is, what is the agreement that contributions are made under? Can developers patent their contributions? What is the correct IP structure, so the community and corporations continue to collaborate in a way that’s fair and equitable? It’s the governance process that has made Java so sick today.”
In most open-source projects, there are two levels of contributions: the copyright itself, which is a snapshot of the code; and the terms under which the contribution is made, Ramji said. “It’s the contribution license layer where problems come in,” he said. “You want to help people retain control of the projects they started.”
Where commercialization works best
Developers start these projects because they want to create software for people to use. These open-source communities are not geared up to provide consulting, service-level agreements, system integration and the like. In fact, Apache’s Jagielski said the open-source community is happy when companies come in to provide these added benefits.
“Any roadblock that would restrict adoption is something they’d want to see fixed,” he said. Commercial backing of open-source projects “has done an incredible amount to foster adoption in large enterprises.”
Ramji agreed that open-source software has become more mainstream through the backing of commercial organizations. “You can build the greatest airplane, but if it uses gas no one can source, and parts that only three people make, it wouldn’t have a market even if you could get from New York to London in an hour.”
Getting along is one aspect of success
Mik Kersten knows a thing or two about commercial open-source projects. He saw the AspectJ project go through leadership and sponsorship changes and remain strong.
In 1999, he joined the AspectJ project, which started as a commercial effort at Xerox PARC funded by the U.S. Defense Advanced Research Projects Agency, to create a hosting environment and tools for the community. “We set up an open-source hosting portal, with a bug tracker and mailing list—things that are very common today,” said Kersten, who also began the Mylyn project at Eclipse and has commercialized it at a company called Tasktop.
With AspectJ, the DARPA funding ended after a couple of years, but the community and committers remained. In 2003, the project moved into Eclipse.org as the first non-IBM effort on that site, said Kersten. “Adrian Colyer of IBM got interested in it, so they funded it for a time.”
Colyer later joined SpringSource (a division of VMware), and the investment behind the project moved again. “[Aspect-oriented programming] is still a core technology in the Spring stack,” Kersten said. “And VMware is now the commercial sponsor.”
AspectJ was so innovative, he said, “that if there was no commercial entity at each stage providing the salaries of the committers, it would not have survived.”
Commercial backing of open-source projects helps them grow in a way it otherwise wouldn’t, said Kersten. “If you want to grow a community, you need a marketing effort. Sites like Eclipse and Apache have existing marketing engines, so projects on those sites will get more eyeballs.”
But on the other side of that coin, Kersten learned that “open-source communities can transcend organizational and commercial boundaries.” Often, he said, a community feels more affinity toward the project leaders than to the company sponsoring it. This can create a mismatch between the organization that acquires the IP rights to the project and the leadership of the community, he warned.
“With AspectJ, we changed leadership when we changed organizations, from a Xerox PARC employee to an IBM employee,” said Kersten. That, he added, kept everything in sync.