Skip to content


Gartner's FUD

November 17, 2008

Posted by: Glyn Moody


Good news:

New research has highlighted quite how pervasive open source software (OSS) has become, with 85 per cent of companies currently using OSS and the remaining 15 per cent expecting to in the next 12 months.

The findings come from a Gartner survey in May and June 2008, which covered 274 end-user organisations in Asia/Pacific, Europe and North America, and raise a series of management issues for businesses.

But wait, trust Gartner to find a cloud in every silver lining for open source:

The analyst group found that 69 per cent of companies surveyed lacked a formal policy for evaluating and cataloguing OSS usage. This could open up “huge potential liabilities for intellectual-property violations,” it warned.

Sounds serious, no? I mean, this open source must be pretty dangerous stuff if it entails “huge potential liabilities”.

So let's just unpick this statement a little. Unfortunately, I can't find any details on the Gartner site, so I'll have to make general statements about free software and licensing.

First, if companies are simply using open source software as-is, there are no “potential liabilities”: none, zero, zilch. I'd be willing to bet that this covers 90% of open source in companies today.

You can even make changes to the code and not make them public - provide you don't circulate them outside your company. It's only when you start combining open source code with other code that licensing issues might arise, but even here, the spectre of “huge potential liabilities” is nonsense.

Many licences freely allow this kind of code mixing; the main one that doesn't is the GNU GPL, which puts important constraints on how you can do it. So, let's assume that Gartner's terrible bogeyman is the prospect of infringing the GNU GPL.

Now, it's true that Richard Stallman can be a frightening vision when he gets cross, but the probability of him visiting you to haul you over the digital coals is precisely zero: he's a busy chap, and aside from the odd generic rocket, doesn't concern himself with infringements.

One person who does, is Eben Moglen, Professor of Law, Columbia Law School, Founding Director of the Software Freedom Law Center, and the legal brains behind the GNU GPLv3 . He's been the main man when it comes to GPL infringements for some time. This is what he told me a few years back about his general approach in these situations:

”About a dozen times a year,” Moglen says, “somebody does something [that] violates the GPL. Most of the time, they're doing so inadvertently, they haven't thought through what the requirements are. And I call them up and I say, 'Look, you're violating the GPL. What you need to do is this. Would you help us?'” The answer is invariably yes, he says.

So the reality of the situation is that the worst you are likely to get is quick phone call from Moglen. And since he is one of the most articulate people it has been my pleasure to encounter, I'd say that you'd probably even enjoy the experience. Only in the most extreme circumstances, where a company is wilfully and persistently infringing on the GPL will Moglen even begin to contemplate legal action.

Here's the truth, then: there are no “huge potential liabilities” involved with free software. It's very hard to infringe, and very easy to sort things out. You are far more likely to get sued for using dodgy copies of Microsoft's software. Gartner's negative spin on the inarguable facts of a massive and increasing open source uptake in companies is FUD, pure and simple. Ignore it.


Follow highlights from ComputerworldUK on Twitter
Sign up for our Daily Newsletter
The UK IT News widget Get it for your site!

<<newer entry | back to blogs indexolder entry>>

Advert

close

Email this article to a friend or colleague:




PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

close
  • This article is now being printed.
close

What are your views on this subject? Use the form below to post a comment on this article up to 1000 characters.


Characters remaining:

close

Click below to add 'Gartner's FUD' to your blog.



If you do not have a ComputerworldUK Account and would like to use this feature, please Register.

If you are a registered, logged-in user, this will post the title and first paragraph of this story to your blog to share with your readers.

What is this?

Comments received

Sam said on Monday, 17 November 2008

Of course, Gartner wants big enterprises to keep paying big bucks to subscribe to things like enterprise software licensing or asset management advisory services so you do have to consider that their public releases amount mostly to marketing of their subscription services,

As to Eben, I'm sure he's a nice guy but you're making a legal leap on a person's character, not on actual legal terms. Eben doesn't have to keep being nice and he may not even continue to hold his position in the future. A company that put code into GPL and doesn't like how someone else is abusing the GPL could take matters into their own hands if they don't think the SFLC is getting it done.

Honestly I'm equally convinced that Gartner is unbiased in what they wrote as I am that you really haven't effectively researched your response.

In court, the license itself supercedes any personal promise Eben might appear to be making with his friendly words. And Gartner is not surprisinginly, "selling" something.

phil said on Monday, 17 November 2008

"gartner" backwards is "rent rag"

Glyn Moody said on Monday, 17 November 2008

Well, my main point is that it's hard to infringe: you would need to incorporate code and then distribute outside your company - effectively, become a software house. I doubt whether the vast majority of enterprises would ever do this, because it's not what they do with software - they just use it.

Gartner's figures amount to scare-mongering based on the absolute theoretical maximum based on their survey, without taking into account the reality of the situation. It's really not helpful to companies.

Marc said on Monday, 17 November 2008

Gartner is obviously playing by the Microsoft playbook: warn about huge liabilities (with "for patent violations" implied, because that's the standard threat), but don't actually list any of those liabilities. The reason they don't list them is simple: there probably aren't any.

So it's FUD, but not the FUD you thought.

Glyn Moody said on Monday, 17 November 2008

Further interesting thoughts on the issues from Gianugo Rabellino here:

https://fossbazaar.org/content/barking-wrong-tree

Fat Pop Do Wop said on Monday, 17 November 2008

Relatively new to FOSS (about 2 years) I've actually read the GPL blurb. Not any MS blurb. Difference is the empowering FOSS is short enough to make sense of whereas EULA's by such as MS are deliberately wordy to keep all sorts of lawyers, advisers and Gartners in business.
@Sam - Gartner's FUD cannot possibly be unbiased, because even if you change the source code and then pass it on, all you have to do is also pass it back upstream. That wouldn't take a lawsuit to achieve, would it?

Mike Mixer said on Tuesday, 18 November 2008

Only with closed source software do you know the name of a teacher in Russia. I'm sure if that poor guy had been using bootleg open source* Sorry, laughing too hard to type.

Advert

WHITE PAPERS

  • Legal risks: Employee use of the internet and email
    Exploring the challenges facing IT Mangers today and vital steps to ensure safe internet an email use by employees.
  • Phishing for victims
    This White Paper examines the phenomenon of phishing. It explains the potentially catastrophic threat it presents to all kinds of organisation. Exploding some widespread myths, it lights up the murky waters where phishing first emerged and where it continues to evolve. But it also highlights what your business can do to blunt the threat.
  • Challenges and opportunities of PCI
    The control framework implicit in the Payment Card Industry Data Security Standard (PCI DSS) provides an enterprise structure for improving operational, security, and audit performance.
  • Social CRM comes of age
    Who is this “social customer”? What strategies and tools does the new breed of CRM provide to do something about this?
  • Risk Management: Protect and Maximize Stakeholder Value
    What has held organisations back from a broader adoption of risk management programs?
*