Open Source

1
Open Source

• Ted Lamm
• Joe Wilson
• Shon Williams
• Matt Virus

2
Open Source

• Ted Lamm
• Joe Wilson
• Shon Williams
• Matt Virus

3
Strengths of Open Source

• Maintenance and Development
• Faster
• Cheaper
• Distributed
• Vast userbase

4
Strengths of Open Source

• Reliability, uptime, and Stability
• Testing
• Documentation
• Change Management
• Strong user community

5
Strengths of Open Source

• Security
• Large group of users
• Documentation
• Later discussion..

6
Strengths of Open Source

• Total Cost of Ownership
• Licensing Fees
• Development Fees
• Customization Fees
• Upgrades/associated fees
• Internal Talent Development
• Quick code changes

7
Myths of Open Source

• Once seen as flaky, cheap, and the work of
  amateur developers, open source software (OSS)
  has emerged as viable competition to its
  commercially manufactured counterparts.
• The following is a collection of some of the most
  widely held myths about open source software.

8
Myths

• Choosing Open Source is Better Because of the
  Price Tag
• One of OSS's most widely touted benefits is its
  price. Download the software, install it and
  don't pay a penny.
• companies cannot risk choosing an inferior
  solution to save money. OSS should not even be
  considered if it isnt at par with or better than
  commercial alternatives.

9
Myths cont.

• Open Source software doesn't cost anything so it
  can't be any good
• All OSS costs money to produce and some can cost
  a great deal to buy.
• The ease with which OSS can be audited leaves no
  hiding place for poor coders and the low cost of
  migration from one OSS product to another ensures
  a ferocious struggle to survive.

10
Myths cont.

• Going with OSS Grantees Huge Savings
• It is an accepted fact that there is no such
  thing as a free lunch.
• The big attraction of OSS is that there's a zero
  marginal cost of scale because open source
  doesn't require additional licenses as an
  installation grows. As a result, the cost per
  transaction plummets as you add more systems.

11
Myths cont.

• OSS has no Technical Support
• Most OSS projects have a large corps of
  developers, Internet mailing lists, archives and
  support databases all available at no cost.
  That's the good news.
• The not-so-good news is that there's no single
  source of information. A simple question may
  result in multiple, conflicting answers with no
  authoritative source.

12
Myths cont.

• If I give away my software to the open source
  community, thousands of developers will start
  working for me for nothing.
• There isn't a magical community waiting to jump
  on any new OSS project.
• Most OSS projects have a core of a few dedicated
  developers, a larger ring of a few hundred
  interested collaborators who provide problem
  reports, bug fixes, and occasional enhancements,
  and thousands or tens of thousands of users.

13
Myths cont.

• Open Source software is difficult to install and
  configure
• Appalling set-ups do exist in some Open Source
  products, and the average proprietary product
  does tend to be easier to install than the
  average Open Source product.
• Commercial Open Source applications are usually
  just as easy to configure as proprietary products
  of comparative functionality and maturity, i.e.
  insert a CD and click on an icon.

14
Myths cont.

• When you say Open Source you mean Linux
• The truth about this myth is that there are
  hundreds of thousands of OSS projects and only
  one of them is the Linux kernel.

15
Weaknesses of Open Source

• Free Software does not equal free software.
• Proprietary offers out of the box functionality.
• Open source can be difficult to install and
  configure.
• Learn the software before you place the product
  on a business scale.
• Benefits of open source turn into weaknesses.

16
Weaknesses cont.

• 2. Enterprise Level Implementations are
  difficult.
• Mom and pop software.
• Usually does not scale to a large level.
• Recoding and further customization is needed.
• Time money are a necessity.

17
Weaknesses cont.

• 3. Lack of service level guarantees and
  commercial support.
• No one will service your machine.
• Cannot hold a bigger company responsible.
• Fees are incurred for service level agreements.
• Open source turns proprietary.

18
Weaknesses cont.

• 4. Functionality, or lack thereof.
• Tough to keep up with proprietary software.
• Businesses constantly call for bigger and better
  features, which is hard for open source to meet.
• Competition does not drive the functionality to a
  higher level.

19
Weaknesses cont.

• 5. Usability, or lack thereof.
• Functionality, and architecture are primary
  concerns.
• GUI vs. Command line
• Intimidating to users.
• Lack of documentation.
• Okay where do I start?

20
Weaknesses cont.

• 6. Customization
• Over investing in customization business
  hazard.
• Customizing doesnt always pay off.
• Priority matrix on customizing.
• ROI?

21
Weaknesses cont.

• 7. Versions / Varieties
• Backwards compatibility?
• How to choose a flavor?
• Should I upgrade?
• Difficult managerial decisions.

22
Weaknesses cont.

• 8. Undetermined Future
• Is the open source solution going to last?
• Customer base vs. Community base.
• Need time and resources.
• Dependent and independent all at the same time.
• Weigh out weaknesses before making decisions.

23
Open Source Security

• Classical Security Literature (1970s)
• Open Design
• Flaw Remediation
• Time to patch
• The Age Old Question

24
1970s Classical Security Literature

• The Saltzer/Schroeder Paper
• The Protection of Information in Computer
  Systems
• Eight design principles
• Open Design
• The design should not be secret.
• Do not depend on the ignorance of potential
  attackers.
• Implement specific and easily protected
  mechanisms.
• Widely distributed systems cannot maintain their
  secrecy.

25
Security by Obscurity

• Security by Obscurity
• The belief that secret and/or proprietary systems
  are more secure because the mechanisms are not
  publicly exposed.
• Do you think that this idea holds water?

26
Security by Obscurity

• Why it doesnt work
• Code isnt necessary for the discovery of flaws
• Reference a certain company in Redmond, WA that
  shall remain nameless
• Reinventing the wheel
• Peer reviewed and accepted mechanisms vs. new
  proprietary technology.

27
Flaw Remediation

• Patching
• Time to patch
• Time between flaw discovery and patch
  availability
• Open Source Hours to Days
• Closed Source Months
• Why?
• Control
• Involvement
• Community
• Ownership

28
The Age Old Question

• Microsoft Windows or Linux?
• Thoughts
• The truth about security

29
In Conclusion

• Open source vs. closed source
• Not the topic for debate
• Importance of informed decisions
• Consider facts
• Examine consequences
• Make the best choice