The Software Risk Report

Software Risk Report continues

noreply@blogger.com (Ernest M. Park) — Mon, 04 Jan 2016 06:26:00 +0000

It has taken a great deal of effort, but we are back. All of our historic posts have been copied to the new site, and new content is being added specific to open source software, technology risk and cyber threats.

2008: The Risk Report

noreply@blogger.com (Ernest M. Park) — Tue, 13 Jan 2009 19:15:00 +0000

The Research Group has developed

tools that objectively track and report on operational risk associated with software applications, operating systems and hardware.

I have seen a number of “Most Risky” lists that seem to be subjective and crafted by nothing more than a few Google searches and a popularity contest. In response, here is a "Top 10" list, filtered for Applications, sorted by overall vulnerability per issue, weighted by age of issue.

Top 10 Applications

Microsoft Internet Explorer
Mozilla Firefox
PHP
Mozilla Seamonkey
Mozilla Thunderbird
Microsoft Office
Apple Quicktime
BEA Weblogic Server
Apple Safari
Joomla

Top 25 Overall

Why 25? It is easier to show that software risk is time sensitive, objective and accurate with a larger list. My current list as of this week tracks 14813 products from almost as many vendors.

Our risk metrics are collected automatically and sorted. Members of the team correct discrepancies introduced by bad data, and then the results are generated using statistical queries on MySQL.

http://nvd.nist.gov is the official datasource for the risk information.

The ordered output is generated by an algorithm that scores a weighted value for each CVE based on the risk and age of that CVE, and then totals all the weighted CVEs across the life of a product. Such total scores are then compared one to another. In this way, an application that has been out for a very short time could make the top of the list if it had more security issues of high criticality over its release life than most applications.

The complete report segments out software by type (hardware, application, OS, platform), license (commercial, FOSS) and is generated weekly. The results are then compared to NVD’s Workload Index calculation in order to give an IT manager an accurate understanding of resource requirements to manage software issues. The report is available for a reasonable fee. To subscribe to the complete report, send an email to risk_report@airius.com.

Top 25 Software

Apple Mac OS X
Microsoft Internet Explorer
Linux Kernel
Mozilla Firefox
Sun Solaris
Microsoft Windows 2000
Apple Mac OS X Server
Microsoft Windows XP
PHP PHP
IBM AIX
Microsoft Windows Server 2003
Mozilla SeaMonkey
HP HP-UX
Mozilla Thunderbird
Microsoft Office
SuSE SuSE Linux
Microsoft Windows NT
Apple Quicktime
FreeBSD FreeBSD
BEA Systems WebLogic Server
Red Hat Linux
Gentoo Linux
Debian Debian Linux
Apple Safari
Joomla Joomla

UPDATE: For the FOSS (free and open source software) list, go to https://fossbazaar.org/content/2008-risk-report-foss.

What does this mean?

The lists review vulnerabilities reported historically to the National Vulnerability Database and sorts them. The reported vulnerabilities are weighted by their individual risk, then weighted by their historic age, where newer issues are more relevant than older issues, all else being the same.

The "percentage" is a relative metric, where the "most vulnerable" application for a report is scored 100%. All other software is scored relative to the 100%.

Is this software bad?
No. What you see is that open source and proprietary software both have issues. The risk seems to directly correlate with the complexity of the software type. Operating systems are inherently very complex, and always are very high on reported vulnerabilities. Notice that regardless of the license type, the level of relative risk is comparable by software type. What this seems to indicate is that complex software takes diligent effort to write, debug, and manage in an operational environment, regardless of the licensing that the software is distributed under. My team has tracked the resolution intervals relative to reported issues. What we saw as we started monitoring the publicly available data is that a well used and available forum drives awareness to issues, and indirectly facilitates rapid resolution for complex software, regardless of licensing.

So which application is the worst?

Software risk is a way of highlighting the management requirements imposed by software within an environment. Complex software may impose a greater management load than simple software. Tracking risk and vulnerabilities is a way that security and infrastructure managers can predict and deploy people and processes to actively manage the issues associated with certain types of software.

Risky software is not bad?
Tires wear out over time, asphault roads need to be repaved frequently, roofs need to be replaced, plumbing leaks once in a while. The requirement to maintain systems and to expect systems to require greater maintenance based on what these systems do is normal. Expecting software to be without issues is unreasonable and naive.

Risk is good?

Of course it is. If risk management is a process of ongoing maintenance, a healthy and interactive commnity participating in the discovery and reporting of risk issues improves the software. Failing to manage complex software, regardless of free or proprietary licensing, that is risky.

What do I do?

Complex software needs to have strong support and an active community. It is a greater risk to use a complex application that has no reported vulnerabilities than one that has many issues. Use the best software for the task. It may be risky, based on discovered issues. Understand that if your management process includes testing, validation of reported issues, and application of patches as available, your risk is incredibly low. If you can update your running software within 30 days of patch releases, your exposure is minimal, and you have an objective process to use complex and quality software within your environment.

Define Policies and Enforce Them

Software exists to facilitate the identification of software and services. Know what you are using, understand what the average work effort is to manage the installed software in your environment, and then set policies to monitor the active management of such software.

Summary

Sotware is asked to do many things. Complex software is asked to do many complex and critical things. More quality software is created by less people, in less time and with less resources. Is the software worse than it ever was? No. The power of the community works to expose these issues and drive resolutions quickly. Accept the fact that software is evolutionary, put a management process in place to take advantage of the input from the community (testing, validation, qualitative review, network and security policy, education), apply qualified patches.

Clear information about software issues reduces operational risk if such information is put to use. The applications for which no information exists pose the greatest threat to security. Without community oversight and review, unknown applications have the opportunity to mistakenly slide under the radar while being large potential threats.

The riskiest software is the software that you don't know about.

************************************************************

Notable Mention

The Research Group actively takes submissions from visitors regarding stories, FOSS issues and project announcements. We are amazed at the number of submissions we have gotten to date, but even more so, we are incredibly grateful to over 150 core contributors who have devoted their time and resources at helping us provide up-to-date information. Send your stories and announcements to rdgroup@airius.com.

We are proud to have hosted over 80 interns in the last year from the leading schools in the United States. If you would like to be considered for an internship, please send a note to rdgroup@airius.com. You will receive instructions regarding how to apply.

************************************************************

Subscription

For more information, go to http://gpl3.blogspot.com/. To stop receiving these weekly mailings, please send a message to rdgroup@airius.com with the subject "unsubscribe:gpl3". To start receiving these weekly mailings, please send a message to rdgroup@airius.com with the subject "subscribe:gpl3".

The Research Group (rdgroup@airius.com)

Ernest Park

Credits:

http://nvd.nist.gov

http://en.wikipedia.org/wiki/Vulnerability_(computing)

What happened to the GPL Project Watch List

noreply@blogger.com (Ernest M. Park) — Tue, 13 Jan 2009 18:53:00 +0000

In October 2008, our research project was hit with the same economic crunch that has been affecting businesses throughout our country. The members of the Research Group are proud of what we delivered for more than a year, and we are glad that we were given the opportunity to deliver this significant information.

In April 2007, my team proposed the possibility of tracking the adoption and use of existing and new FOSS licensing. A month later, we started to build the database and write the web application for the search site. The team of researchers started crawling the internet manually and using specialized tools that we built to find indications of use of the new GPLv3 license. By July 2, as of our first post, we found 82 projects that announced GPLv3 releases as of June 29, 2007. While the start seemed lackluster, overall adoption has been consistent over observed time, averaging 200 new GPLv3 project releases monthly, with over 4000 current FOSS releases under GPLv3.

We started tracking GPLv3 information as of June 29, 2007, and continued to do so for 15 months. Our team included over 50 research interns from schools throughout our country, the project managers and me. We successfully provided clear and objective information regarding the acceptance and use of the new GPLv3 license, and extended the scope of our interest to report news and trends as well.

Our reports explained licensing, copyright, best practices, and garnered a strong readership over the time that we managed this information. While there are methods to collect and manage this information using automated tools, we found enough errors and imprecision in the data to raise doubt and uncertainty in the quality of data that is not manually reviewed. We built tools to optimize our ability to review data, but we still qualified all data that made it into our database.

We are now self sponsored and accepting sponsorship and contributions. The site will start publishing on a regular basis as before, and we hope to deliver timely and topical information. If you would like to help, contact us at sponsor@airius.com .

************************************************************

Notable Mention

************************************************************

Subscription

For more information, go to http://gpl3.blogspot.com/. To stop receiving these weekly mailings, please send a message to list@airius.com with the subject "unsubscribe:gpl3". To start receiving these weekly mailings, please send a message to list@airius.com with the subject "subscribe:gpl3".

The Research Group (rdgroup@airius.com)

Ernest Park

Edwin Pahk

Antony Tran

Kevin Howard

Credits:

1929 Stock Market Crash
President George Bush and Barack Obama

GPL Project Watch List for Week of 10/24

noreply@blogger.com (Unknown) — Mon, 27 Oct 2008 06:38:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for October 18th to October 24th 2008.

This Week:

Week Summary
New Projects
The Next Step for FOSS Adoption
User Contributions

This week our GPL v3 count is at 3349 GPL v3 projects, an increase of 112 GPL v3 projects. The AGPL v3 count is at 181 AGPL v3 projects. The LGPL v3 number is at 400 LGPL v3 projects, an increase of 55 LGPL v3 projects.

New project conversions this week include:

Hibersap: Hibersap is a small framework that offers an abstraction layer on top of the SAP Java Connector (JCo). It maps Java classes to SAP function modules using Java Annotations and reduces the technical code to call a function in a SAP back-end system.

Voice Mail Viewer for Asterisk: Visual voicemail viewer for Asterisk/AsteriskNOW written in PHP. Users log in with their extension and v/m password and can download messages with the web browser.

jwaBlogger: jwaBlogger is social links/blogging software, that can easily be added to your website. jwaBlogger provides full HTML support, RSS and Atom feeds, a most popular blog entry history, and more. Example at: http://www.jwablogger.org.

********************************************************************************

FOSS users are becoming increasingly apathetic regarding the proactive management of software obtained for nominal cost. The recent Debian example comes to mind, where for an extended period of time, OpenSSL within it had been modified with a code checking tool. Such modification removed a programmatic element important to the generation of the key, such that the total possible key combinations were effectively reduced to a fraction of the total unbroken possibilities. This problem existed for nearly two years, with countless users depending on the code, using vendor solutions to test for the same things, and yet this went undetected.

Our government is embracing FOSS publicly, yet I have heard horror stories. They do not understand the management requirements of software delivered without a vendor, yet they have the same expectations.

http://www.gcn.com/online/vol1_no1/47320-1.html?page=1

Without a defined and active process for the ongoing and diligent public management of software, our government could be stepping into FOSS unprepared. If their motivation is cost, they will under staff the management resources that should be diligently testing all software. While I hope that they are going to staff for increased management requirements in the use of FOSS, there is no assurance either way. What makes the situation even more difficult is that there is no clear process or method for the government to implement that will offer a high degree of quality in FOSS investments.

What is lacking is not the desire to check. The responsibilities tied to the development of a FOSS project no longer ends when the project is compiled. Quality assurance and validation steps are so critical to the ongoing build process that the community needs to be part of it. Commercial vendors do not release code until it has survived a series of tests. Commercial vendors have liabilities to protect their investment, and do so through structured testing and processes, since their money is better spent in quality assurance than in remediation and legal actions afterwards.

FOSS needs a repeatable, measurable, verifiable and public checklist of testing and processes performed by the community in a "trusted" manner to safeguard the code that we all depend on. A public forum allows all of us to check an application, see which tests have been performed and which have not, allows us to contribute to the process, and qualify the contributions of others.

While the code is transparent, who has the skills and ability to look at it with the depth and creativity required these days? We need to make the management and ongoing qualification of open source software a community effort. By having the community actively involved in all pieces of quality assurance, we will have a greater understanding for the complexity in certifying code for distribution, and we will be able to verify that such work has been done.

The answer is not just to engage professional services, or use open source software that is financially backed by a large vendor. Since we lack transparency into the detailed, complex and ever changing process for testing software components, we are better to choose commercial solutions with contracts that put liability on the vendor. Additionally, mitigating the unknown risk of the use of FOSS with service contracts undermines some of the core principles of FOSS. If our only solution is to engage services, our freedoms in the use of FOSS are being undermined due to our inability to use the community to grasp, understand, constrain and manage the problem.

NIST sponsors http://cwe.mitre.org, the Common Weakness Enumeration. It is a database for identifying and describing in a common language, programmatic and architectural weaknesses within software, hardware and operating systems. It provides a reasonable starting point from which to build processes upon.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-0166

http://cwe.mitre.org/data/definitions/310.html

If we use a public and transparent process for the certification of FOSS, continuing in the spirit of how the code was developed, the strength of the community can actively participate in the management of unknown risk in software. We as a community can impose basic qualitative requirements on software packages. This community involvement in the validation of the code is a natural progression of the popularity and ubiquitous nature of FOSS in our computing lives.

In conclusion, the solution for software quality assurance is in the control of the user community. We need a public process to define, manage and implement validation processes, as well as a community effort to invite an ongoing process to post those results. If our professional services suppliers are worthy of their role of managing open source usage, they should be actively posting their tests, their reviews, their reports. If they do not have the requisite skills to help us manage this problem, we need a better process, and better providers, to help us manage this challenge and it is not going to get any easier soon. We owe this to ourselves, the success and health of our financially strained businesses worldwide, and our national and international security to get this right.

****************************************************************************
We appreciate all the contributions that have been made, either through our form on our web page or by email, and we also like to hear why you are changing your project's license as in the email above. It gives us more insight into which direction license trends are moving. We will continue to post up user contributions to our blog each week, and we may quote parts of your emails. If you wish the email to remain private, just mention so and we will not disclose any part of it.

Link Partners
If you are willing to copy and tranlate the content weekly, please let me know - you will receive the content as soon as it is available, and you site will be listed as a translation. I can send you a bit of tracking code so that you get credit for your contribution to the readership of this site
Post your link on the bottom of the blog page.

Send me a note at rdgroup@airius.com that you are using some or all of the content
I will make sure that we host links to your sites, and we will be able to use your content within this site as well.

************************************************************

Notable Mention

The Research Group actively takes submissions from visitors on updates on new GPL v3/LGPL 3 projects. We are amazed at the number of submissions we have gotten to date, but even more so, we are incredibly grateful to over 100 core contributors who have devoted their time and resources at helping us provide up-to-date information.

************************************************************

Subscription

For more information, go to http://gpl3.blogspot.com/.

To stop receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "unsubscribe:gpl3".

To start receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "subscribe:gpl3".

************************************************************

Our Sponsor, Palamida, Inc.

The GPL3 project, sponsored by Palamida, Inc (http://palamida.com/ ), is an effort to make reliable publicly available information regarding GPLv3 license usage and adoption in new projects.

The opinions expressed within the GPL3 Information Blog are exlusively those of Ernest Park, the subjects interviewed and the contributing authors, and are not intended to reflect the positions of Palamida, Inc and its employees.

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License .

************************************************************

Palamida was launched in 2003 after its founders learned first-hand what happens when companies don't have full visibility into the code base of their software applications based on Open Source Software. Their experiences inspired them to create a solution to streamline the process of identifying, tracking and managing the mix of unknown and undocumented Open Source that comprises a growing percentage of today's software applications. Palamida is the industry's first application security solution targeting today's widespread use of Open Source Software. It uses component-level analysis to quickly identify and track undocumented code and associated security vulnerabilities as well as intellectual property and compliance issues and allows development organizations to cost-effectively manage and secure mission critical applications and products.

For more information about FOSS management solutions, go to http://palamida.com/, or send a note to sales@palamida.com.

Please mention the GPL3 site when you reach out to Palamida.

The Research Group (rdgroup@airius.com)

Ernest Park
Edwin Pahk
Antony Tran
Kevin Howard

GPL Project Watch List for Week of 10/17

noreply@blogger.com (Unknown) — Sat, 18 Oct 2008 19:49:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for October 13th to October 17th 2008.

This Week:

Week Summary
New Projects
Open Office 3: The Spread of Open Source
User Contributions

Consistent Conversion
The GPLv3 License continues to be popular after over a year since its release. Conversion rates have stayed consistent as projects continue to use GPLv3 to protect the freedom of their software.

This week our GPL v3 count is at 3334 GPL v3 projects, an increase of 97 GPL v3 projects. The AGPL v3 count is at 181 AGPL v3 projects. The LGPL v3 number is at 370 LGPL v3 projects, an increase of 25 LGPL v3 projects.

New project conversions this week include:

DbUpdater: A customizable tool to implement the database schema version control. It can be used with any DBMS.

r3alm: R3alm is a third version of Realm, a simulation game where you develop a community, through characters. Each character can be assigned actions, and have statistics. In addition, your civilization has statistics such as food, population, etc.

rjudge: rjudge is a problem test tool for Olympiad in Informatics. We have finished the development of rctl - the coreutil of rjudge. We have put it into public and we want to receive more feedback.

********************************************************************************

Open Office 3: The Spread of Open Source

The long awaited Open Office 3 has just been released and it has caused openoffice.org's servers to be overloaded. The open source software is, for those of you who do not already know, a free alternative to Microsoft Office. This is build 9358, RC 4, of Open Office 3 and has been named the final version of the program as reported by crn.com. After its release last week, one of my coworkers went to download the program to check licensing information, but the site was too busy for him to access the download. It seems his predicament was shared by many other people who were eager to obtain a copy of the new suite. The popularity of open source is definitely growing, and in this instance it looks like demand exceeded supply (in terms of bandwidth that is). Open Office has grown to a point where it has become a formidable competitor to Microsoft Office in market share and in features.

From what I have heard and read about so far it seems that this release of Open Office has been improved greatly, making it a great time for anyone considering adopting to actually do it. Open office is capable to open Microsoft Office 2007 applications, which makes it worth it right there. There are many other free Office readers out there, but the quality of this suite will make it stand out from all the others. Other features such as an improved Spell Check in Writer have been added. The GUI has also been made more presentable, although still not as fancy as Microsoft Office, which can be a good or bad thing depending on how annoyed you are by GUI.

In an article I wrote two weeks ago, the current economic situation is making it even more beneficial to migrate to open source software. The high traffic for Open Office 3 is proof that more people are adopting open source software. Microsoft has even given kudos to Open Office, saying that it is a bigger competitor than Google Apps. As to whether that is a direct compliment to Open Office or indirect insult to Google Apps is up for interpretation, but regardless Open Office is getting more and more attention from the public and commercial companies. With recession looming, free software should be looking very appealing compared to proprietary software.

People's resistance to change is hindering open source adoption. Even though there are many benefits to open source, the majority of people are still hesitant to change their software and learn the new program. But Open Office really tries to make the shift as easy as possible. Being able to read Microsoft Office documents and emulating many of their features reduces how much a person has to learn if they want to switch over. With the ease of adoption, open source benefits, and low cost, now is really the time for Joe the Computer User to try open source, starting with Open Office.

-Antony Tran

Reference:

http://www.crn.com/software/211200503

http://www.techradar.com/news/computing/microsoft-open-office-a-bigger-rival-than-google-apps-476243

http://www.yellmalta.com/y/YellTopStories/tabid/94/selectmoduleid/527/ArticleID/495/reftab/36/Default.aspx

http://blogs.zdnet.com/open-source/?p=2997

GPL Project Watch List for Week of 10/10

noreply@blogger.com (Unknown) — Sat, 11 Oct 2008 19:03:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for September 26th to October 3rd 2008.

This Week:

Week Summary
New Projects
Follow up: Jacobsen and US Copyright Law
User Contributions

Making Progress
If you haven't noticed already, we'd like to welcome back a member to our team, Antony Tran. After a brief hiatus, he has agreed to come back on board to help us manage the blog and GPL3 project. Welcome back.

This week our GPL v3 count is at 3237 GPL v3 projects, an increase of 22 GPL v3 projects. The AGPL v3 count is at 181 AGPL v3 projects. The LGPL v3 number is at 345 LGPL v3 projects, an increase of 51 LGPL v3 projects.

New project conversions this week include:

Multigrid Contact Detection: libmgcd is a multigrid contact detection (MGCD) library

euFileUpload: A module to upload files. To be used in web-based applications. Written in PHP

luckybackup: A powerful, fast and reliable backup & sync tool.

********************************************************************************

I wrote about FOSS licenses and U.S. Copyright law back in June, prior to the case of Jacobsen v. Katzer coming out in mid-August:

http://gpl3.blogspot.com/2008/06/gpl-v3-watch-list-is-intended-to-give.html

To update that post a bit, the Jacobsen decision deserves mention. The case dealt with code licensed under the Artistic License 1.0 which was used in another project without complying with the terms of the license. See the link below on techlawjournal.com for more background. The central question of the case was whether the terms of the license were "conditions" that limited the scope of the copyright license, as opposed to "covenants" which define the terms for the use of the code. The court concluded the terms were "conditions."

While this may seem insignificant or merely a semantic non-issue, the remedies available for noncompliance with the "condition" of an open source license form the basis of the entire FOSS movement. The significance is that if a "condition" is broken or not followed, the person who broke or did not follow the particular condition is no longer entitled to use of the software under the license terms and such use is therefore copyright infringement. A remedy for copyright infringement is injunctive relief which means the violator can be prevented from further use of the software under the license or be required to follow the conditions if further use is desired.

If a "covenant" is broken or not followed, such violation is considered merely a violation of a contract term, which means the remedy is monetary and *not* injunctive. In that case the violator would still have a license to use the software and would merely have to pay contract damages.

Injunctive relief allows copyright holders who license their works under FOSS licenses to preserve the desired attribution, modification and distribution rights, which protects the openness of the code and preserves the rights of downstream users to have access to the code for research, learning or improvement. Having this decision on the books, with its clear discussion not only of the license in question, but also of the FOSS movement and its benefits, will only help the movement grow.

-Kevin Howard

References:

http://www.techlawjournal.com/topstories/2008/20080813.asp

http://radar.oreilly.com/2008/08/landmark-case-upholds-open-sou.html

http://www.lessig.org/blog/2008/08/huge_and_important_news_free_l.html

****************************************************************************
We appreciate all the contributions that have been made, either through our form on our web page or by email, and we also like to hear why you are changing your project's license as in the email above. It gives us more insight into which direction license trends are moving. We will continue to post up user contributions to our blog each week, and we may quote parts of your emails. If you wish the email to remain private, just mention so and we will not disclose any part of it.

Link Partners
If you are willing to copy and tranlate the content weekly, please let me know - you will receive the content as soon as it is available, and you site will be listed as a translation. I can send you a bit of tracking code so that you get credit for your contribution to the readership of this site
Post your link on the bottom of the blog page.

Send me a note at rdgroup@airius.com that you are using some or all of the content
I will make sure that we host links to your sites, and we will be able to use your content within this site as well.

************************************************************

Notable Mention

The Research Group actively takes submissions from visitors on updates on new GPL v3/LGPL 3 projects. We are amazed at the number of submissions we have gotten to date, but even more so, we are incredibly grateful to over 100 core contributors who have devoted their time and resources at helping us provide up-to-date information.

************************************************************

Subscription

For more information, go to http://gpl3.blogspot.com/.

To stop receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "unsubscribe:gpl3".

To start receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "subscribe:gpl3".

************************************************************

Our Sponsor, Palamida, Inc.

The GPL3 project, sponsored by Palamida, Inc (http://palamida.com/ ), is an effort to make reliable publicly available information regarding GPLv3 license usage and adoption in new projects.

The opinions expressed within the GPL3 Information Blog are exlusively those of Ernest Park, the subjects interviewed and the contributing authors, and are not intended to reflect the positions of Palamida, Inc and its employees.

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License .

************************************************************

Palamida was launched in 2003 after its founders learned first-hand what happens when companies don't have full visibility into the code base of their software applications based on Open Source Software. Their experiences inspired them to create a solution to streamline the process of identifying, tracking and managing the mix of unknown and undocumented Open Source that comprises a growing percentage of today's software applications. Palamida is the industry's first application security solution targeting today's widespread use of Open Source Software. It uses component-level analysis to quickly identify and track undocumented code and associated security vulnerabilities as well as intellectual property and compliance issues and allows development organizations to cost-effectively manage and secure mission critical applications and products.

For more information about FOSS management solutions, go to http://palamida.com/, or send a note to sales@palamida.com.

Please mention the GPL3 site when you reach out to Palamida.

The Research Group (rdgroup@airius.com)

Ernest Park
Edwin Pahk
Antony Tran
Kevin Howard

GPL Project Watch List for Week of 10/03: Financial Crisis and Open Source

noreply@blogger.com (Unknown) — Sat, 04 Oct 2008 03:02:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for September 26th to October 3rd 2008.

This Week:

Week Summary
New Projects
Financial Crisis: How will it affect Free and Open Source software?
User Contributions

AGPL v3 Momentum
We have noticed an increase in AGPL v3 numbers this week, which shows that the interest in the AGPL v3 is still growing. It is a relatively small license compared to the GPL v3, but is finding its niche in the market. Recently we were also contacted by a user of our site about our AGPL v3 information, who is looking to developer psychology related services using AGPL v3 software. It just goes to show that the AGPL has caught the interest of a select group of people and can be used in a wide range of fields.

This week our GPL v3 count is at 3215 GPL v3 projects, an increase of 31 GPL v3 projects. The AGPL v3 count is at 181 AGPL v3 projects, up 51 projects. The LGPL v3 number is at 294 LGPL v3 projects.

New project conversions this week include:

C/C++ Libraries: Collection of C and C++ libraries, and C++ classes under the GNU Lesser General Public License. This collection includes all versions that are under the GNU LGPL, even if a newer version is available.

PeerSE: This is a Java based xBase engine to read write and update dbf files. Using the package's classes and methods programmers can process dBase III and IV files and some clones (e.g. Clipper/FoxPro) along with index and tag files and the individual fields.

Zimplit CMS: Zimplit is the easiest Content Management System (CMS) ever made. It is extremely lightweight, simple and customizable. Zimplit consists only one file. No database needed. With Zimplit you can edit any HTML/CSS page.

********************************************************************************

Financial Crisis: How will it affect Free and Open Source software?

The current financial and credit crisis on Wall Street has had a global affect on the economy that we have not seen since the Great Depression. The economic downturn has hurt nearly all sectors of the economy, the tech industry being no exception. So in these times of uncertainty, it is obvious that IT companies of all sizes will be looking for anyway to reduce costs, one of them being the implementation of open source software. Will this economic crisis be somewhat positive by accelerating the use of open source?

According to Matt Asay from CNET the answer is yes across the board. In an informal poll he performed, he asked various open source companies how the failing economy has been affecting their sales. Some might think that with the Dow Jones Industrial Average down 4000 points over the past year, these open source companies would have headed in the same direction with everyone else. However, every company that Matt Asay polled is recording record sales. It is not surprising to us or to Matt that companies are shifting from expensive proprietary software to cost efficient open source software, but it did take us back that every single company that Matt polled is doing so well. It solidifies the fact that open source companies are in a different market and a different business.

Open source has always been the underdog when competing for commercial business. There might have been too much fear or misinformation about what open source is and how it works, and before the economy began to fall, there was no reason to fix that which was not broken. But hard times call for drastic measures and for these companies to reevaluate their business models and spending. Companies can save hundreds of thousands of dollars by switching over to open source software and lose little to none functionality, perhaps even gaining in functionality. In an article entitled Five programs you can afford in a financial meltdown, Steven J. Vaughan-Nichols lists open source alternatives to popular proprietary software programs. Almost every piece of software has an open source counterpart these days and it is becoming more costly to ignore them. Perhaps one of the biggest myths about open source software is that it is a lesser product when in actuality it is just a different product built a cheaper way. The largest costs to implementing open source software, and what I suspect has held the conversion back for so long, is relearning, retraining, and readjusting the business model for the new open source software. But these costs are more time and effort than actually cash spending, and with the economy in the state that it is in, this is no time to be lazy.

The times are changing and are changing fast with what is going on in politics, the world, and the economy. The opportunity for open source to go mainstream is drawing near due to factors such as the falling economy and advancements in online technology such as Web 2.0 and cloud computing, mentioned in last weeks article. This may be a bit cynical, but it seems fitting that as capitalism is failing, open source is benefiting. Open source, which came out of the free software movement, was anti-capitalism and sought to free developers and users from the grips of proprietary software. It really is no surprise that open source is doing well during this financial crisis.

-Antony Tran
-Edwin Pahk

References:

http://www.eweek.com/c/a/Linux-and-Open-Source/Financial-Crisis-Offers-Opportunity-for-Linux-Open-Source/
http://www.thevarguy.com/2008/09/30/will-the-financial-crisis-boost-open-source/
http://news.cnet.com/8301-13505_3-10057441-16.html
http://www.computerworld.com.au/index.php/id;97976866;fp;4;fpid;1968336438

****************************************************************************
We appreciate all the contributions that have been made, either through our form on our web page or by email, and we also like to hear why you are changing your project's license as in the email above. It gives us more insight into which direction license trends are moving. We will continue to post up user contributions to our blog each week, and we may quote parts of your emails. If you wish the email to remain private, just mention so and we will not disclose any part of it.

Link Partners
If you are willing to copy and tranlate the content weekly, please let me know - you will receive the content as soon as it is available, and you site will be listed as a translation. I can send you a bit of tracking code so that you get credit for your contribution to the readership of this site
Post your link on the bottom of the blog page.

Send me a note at rdgroup@airius.com that you are using some or all of the content
I will make sure that we host links to your sites, and we will be able to use your content within this site as well.

************************************************************

Notable Mention

The Research Group actively takes submissions from visitors on updates on new GPL v3/LGPL 3 projects. We are amazed at the number of submissions we have gotten to date, but even more so, we are incredibly grateful to over 100 core contributors who have devoted their time and resources at helping us provide up-to-date information.

************************************************************

Subscription

For more information, go to http://gpl3.blogspot.com/.

To stop receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "unsubscribe:gpl3".

To start receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "subscribe:gpl3".

************************************************************

Our Sponsor, Palamida, Inc.

The GPL3 project, sponsored by Palamida, Inc (http://palamida.com/ ), is an effort to make reliable publicly available information regarding GPLv3 license usage and adoption in new projects.

The opinions expressed within the GPL3 Information Blog are exlusively those of Ernest Park, the subjects interviewed and the contributing authors, and are not intended to reflect the positions of Palamida, Inc and its employees.

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License .

************************************************************

Palamida was launched in 2003 after its founders learned first-hand what happens when companies don't have full visibility into the code base of their software applications based on Open Source Software. Their experiences inspired them to create a solution to streamline the process of identifying, tracking and managing the mix of unknown and undocumented Open Source that comprises a growing percentage of today's software applications. Palamida is the industry's first application security solution targeting today's widespread use of Open Source Software. It uses component-level analysis to quickly identify and track undocumented code and associated security vulnerabilities as well as intellectual property and compliance issues and allows development organizations to cost-effectively manage and secure mission critical applications and products.

For more information about FOSS management solutions, go to http://palamida.com/, or send a note to sales@palamida.com.

Please mention the GPL3 site when you reach out to Palamida.

The Research Group (rdgroup@airius.com)

Ernest Park
Edwin Pahk
Antony Tran
Kevin Howard

GPL Project Watch List for Week of 09/19

noreply@blogger.com (Unknown) — Tue, 30 Sep 2008 05:28:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for September 12th to September 19th 2008.

This Week:

Week Summary
New Projects
Interop 2008 and Open Source
User Contributions

Moving along

Thanks to the hard work of the research team, we have noticed an increase in project conversion. This week our GPL v3 count is at 3184 GPL v3 projects, an increase of 184 GPL v3 projects. The AGPL v3 count is at 130 AGPL v3 projects. The LGPL v3 number is at 294 LGPL v3 projects, an increase of 8 LGPL v3 projects.

New project conversions this week include:

Ongame Hand Converter: Ongame Hand Converter is a tool to convert poker hands, played at a skin of the Ongame poker network, into a more readable format. This can be useful if you want to discuss your hands with others, for example at a forum.

PyMaTi: PyMaTi is a simple and easy to use GUI for numerical and scientific computing in Python. It surrounds well know packages NumPy and Matplotlib and provides possibility to immediately play with numerical python from intuitive user interface.

StorYBook: Are you novelist, writer or author? StorYBook is a scene-based software for all creative writers that helps to organize your story. StorYBook assists you in structuring your book.

*************

Interop 2008 and Open Source

This year's Interop exhibition in New York City has just ended a little over a week ago from September 15^th to September 19^th. Interop is a tech expo where more than 300 leading technology exhibitors come to show off their stuff. It is a good look into what is coming up in IT in the near future from business leaders such as IBM, Cisco, Oracle and many others. So what was the big buzz at this year's exhibition? Two of the largest subjects that came up were Web 2.0 and cloud computing. High speed internet is spreading to more homes everyday and will soon be as common as cable TV, so it is no surprise that the experimental fields of Web 2.0 and cloud computing are the main focus of the IT community. It is no doubt that these new areas of IT will affect open source and also be affected open source software.

First off, IBM revealed their Center for Social Software, which is a collaboration between IBMers, clients, partners, students and others at their Cambridge Massachusetts location to further research Web 2.0 applications. The center will test new and current Web 2.0 tools to enhance their usage for business networks. Their goal at IBM is to use Web 2.0 to better connect people so that information can be access easier. Bob Picciano, general manager of IBM's Lotus Software believes that workers are going through an information overload trying to locate information. However, Web 2.0 should help ease the overload by connecting people to share information over social networks. By using social networking at the work place, efficiency can be boosted and increase productivity.

On the other side of the booth, Cisco was taking on virtualization and cloud computing. Cloud computing has been a hot button topic over the past year. People are still wondering what exactly it is and how we are going to get there. Marie Hattar of Cisco Systems outlined the workings of virtualization and said it will evolve into cloud computing. With both technologies her concern was security, advising companies to start small and plan ahead for security. As cloud computing continues to evolve, the commercial side of it will rely heavily on security and trust. If consumers are storing data on a virtual machine that can be accessed from any computer, it opens the door to a multitude of security risks and concerns. The companies offering these cloud services are going to have to convince their customers that their data will be save from attack on their servers.

Both Web 2.0 and cloud computing are going to affect and be affected by the open source market. Novell's CEO Ron Hovsepian said, "To us the future of IT is based on open source and open standards". Open standards are already widespread in wikis and social networking sites such as facebook. Much of Web 2.0 was and is being built on open source software. Web 2.0 is still in its early stages and the space and need for open source software is growing quickly. Cloud computing is also a space that open source software should take off in. Many open source software already generate revenue by providing the software for free but charging for the service. Cloud computing will be on demand and service based. Saas is a large market place for open source software as people are migrating from paying for the software to paying to the service. While these new experimental fields are coming to the main stream there are going to be many opportunities for open source software to gain a foothold on the market place.

-Antony Tran

References:

http://www.interop.com/

http://www.crn.com/software/210602265

http://www.crn.com/networking/210602222

http://www.internetnews.com/dev-news/article.php/3772276/Interop+Its+All+About+Collaboration.htm

http://www.informationweek.com/news/services/hosted_apps/showArticle.jhtml?articleID=210602225

GPL Project Watch List for Week of 09/12

noreply@blogger.com (Unknown) — Mon, 15 Sep 2008 08:12:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for August 29th through September 12th, 2008.

This Week:

Week Summary
New Projects
FOSS issues and the 2008 U.S. Presidential Race
User Contributions

3000 Project Milestone

After over a year of tracking GPL3 adoption, we would like to announce that 3000 projects have adopted version 3 of the GNU GPL License. The strong adoption rate represented by this milestone shows the continued acceptance of this license by the Open Source and Free Software communities. We'd like to thank everyone that has been involved with this project. Without your hard work, none of this would've been possible.

This week our GPL v3 count is at 3000 GPL v3 projects, an increase of 69 GPL v3 projects. The AGPL v3 count is at 130 AGPL v3 projects. The LGPL v3 number is at 286 LGPL v3 projects, an increase of 13 LGPL v3 projects.

New project conversions this week include:

MLE - Mobile Learning Engine: MLE - The Mobile Learning Engine is a learning application for mobile phones written in Java (J2ME). It enables you to use your phone at anytime and at anyplace for computer-aided, multimedia-based learning. It is a content independent engine.

DataSync Suite: DataSync Suite is an open source platform for integrating tools like Zimbra, SugarCRM, Joomla, and KnowledgeTree. The tool is focused on a single sign-on, application data integration, and fast, flexible deployment.

EPG Record: This is a perl-gtk application to get a channel list from a dvb card, display it, and allow complex filtering of view. It also has extensive multi-channel recording capabilities based on the EPG display shown

*************
FOSS issues and the 2008 U.S. Presidential Race

There are many important issues in this presidential race. This is not a politically oriented blog, so we take no position and will leave the heated discussions for others, but we are interested in technology and software, so seeing as how technology is an "issue" in this political race, we thought we'd attempt to summarize where the candidates appear to stand on various technology issues related to software and code.

Neither candidate specifically mentions open source on his web page, but several prominent technology-related issues are common to both that can have an impact on software: Net neutrality, intellectual property protection and open standards with respect to online access to government services.

Net Neutrality
This issue deals with equal access to the Internet (no restrictions on types of devices or platforms) and equal opportunity to utilize the Internet once accessed. The availability of these two types of equality and openness provided by the original architecture the Internet is the primary reason so much innovation has occurred in technology and software over the last 30 to 40 years. Imagine if new, innovative devices had to be "approved" before being able to access the Internet, or if two software developers in a garage somewhere had a small web site that could never be found on the net because "prioritized" traffic bought by large media or existing commercial software companies drowns out the smaller players.

Both candidates appear to promote the idea of net neutrality, but take different approaches. John McCain does not support prescriptive regulation that would require net neutrality, preferring to allow a more "open marketplace" environment to provide a variety of choices to consumers. Barack Obama supports some type of legislation to protect the concepts embodied by net neutrality, namely to prevent network access providers from discriminating against those who won't or can't pay for "premium" access.

Intellectual Property Protection
This type of protection was originally intended to promote innovation and protect inventors and creators. It seems that more and more, our intellectual property laws are being used by content owners offensively to restrict others instead of to promote innovation and creative uses of existing ideas. However, some form of intellectual property protection is necessary to allow inventors and creators to profit from their work, so this is a delicate balance that must be managed.

Both candidates state they want to protect the IP rights of inventors and creators, both domestically and internationally. Both appear to recognize the balance between the extremes of content protection and the promotion of innovation, and that may be the extent of what we will hear about this issue.

Open Access to Government Services
This issue is pretty straightforward, but its implementation could say a lot about the attitude of each candidate toward technology. Most every government agency now has a web site that provides information to anyone who visits. Both candidates support this, and support expanding this type of access and increasing the participation of the citizenry in the process of government through increased access to broadband services.

Barack Obama's web site mentions the phrase "universally accessible formats" when it describes making government data available online. This is a critically important phrase, and is how open source can tie into this, as well as other technology issues. A "universally accessible format" is not necessarily an "open source" one, but by definition, open source formats should be universally accessible. The advantage of the open source philosophy here is that anyone can see the parameters and requirements of a particular format, and the particular format itself does not need to be tied to any particular entity, company or developer. A "format" that is "closed source" and proprietary is not available for scrutiny, customization or interpretation, and may be available only to developers within a single entity or company.

When handling the data of a government entity that will presumably continue operating for many generations to come, the ideal way to provide such data is in a format that is open and available to everyone. This includes backwards compatibility for older formats. Proprietary closed formats created by one entity or company create a disadvantage for those wishing to read data in a particular format that was discontinued years ago when the company that created the format went out of business.

Conclusion
While technology is one of the issues on the table for both candidates, other bigger issues will likely overshadow it this election. However, keep the ideas of equal access, the balancing of protection and innovation, and open standards in mind in the coming months when evaluating your candidate.

-Kevin Howard

References:
http://www.barackobama.com/issues/technology/
http://www.johnmccain.com/Informing/Issues/cbcd3a48-4b0e-4864-8be1-d04561c132ea.htm
http://en.wikipedia.org/wiki/Net_neutrality
http://news.cnet.com/8301-13578_3-9864581-38.html

****************************************************************************
We appreciate all the contributions that have been made, either through our form on our web page or by email, and we also like to hear why you are changing your project's license as in the email above. It gives us more insight into which direction license trends are moving. We will continue to post up user contributions to our blog each week, and we may quote parts of your emails. If you wish the email to remain private, just mention so and we will not disclose any part of it.

Link Partners
If you are willing to copy and tranlate the content weekly, please let me know - you will receive the content as soon as it is available, and you site will be listed as a translation. I can send you a bit of tracking code so that you get credit for your contribution to the readership of this site
Post your link on the bottom of the blog page.

Send me a note at rdgroup@airius.com that you are using some or all of the content
I will make sure that we host links to your sites, and we will be able to use your content within this site as well.

************************************************************

Notable Mention

The Research Group actively takes submissions from visitors on updates on new GPL v3/LGPL 3 projects. We are amazed at the number of submissions we have gotten to date, but even more so, we are incredibly grateful to over 100 core contributors who have devoted their time and resources at helping us provide up-to-date information.

************************************************************

Subscription

For more information, go to http://gpl3.blogspot.com/.

To stop receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "unsubscribe:gpl3".

To start receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "subscribe:gpl3".

************************************************************

Our Sponsor, Palamida, Inc.

The GPL3 project, sponsored by Palamida, Inc (http://palamida.com/ ), is an effort to make reliable publicly available information regarding GPLv3 license usage and adoption in new projects.

The opinions expressed within the GPL3 Information Blog are exlusively those of Ernest Park, the subjects interviewed and the contributing authors, and are not intended to reflect the positions of Palamida, Inc and its employees.

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License .

************************************************************

Palamida was launched in 2003 after its founders learned first-hand what happens when companies don't have full visibility into the code base of their software applications based on Open Source Software. Their experiences inspired them to create a solution to streamline the process of identifying, tracking and managing the mix of unknown and undocumented Open Source that comprises a growing percentage of today's software applications. Palamida is the industry's first application security solution targeting today's widespread use of Open Source Software. It uses component-level analysis to quickly identify and track undocumented code and associated security vulnerabilities as well as intellectual property and compliance issues and allows development organizations to cost-effectively manage and secure mission critical applications and products.

For more information about FOSS management solutions, go to http://palamida.com/, or send a note to sales@palamida.com.

Please mention the GPL3 site when you reach out to Palamida.

The Research Group (rdgroup@airius.com)

Ernest Park
Edwin Pahk
Kevin Howard

GPL Project Watch List for Week of 08/22

noreply@blogger.com (Unknown) — Tue, 26 Aug 2008 15:30:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for July 25th through August 22nd, 2008.

This Week:

Week Summary
New Projects
Are Software Patents Incompatible With Open Source And Free Software Ideals?
License Proliferation: Less is more, one is best
User Contributions

The GPLv3 team

We would like to thank everyone for their continued support of the GPL3 project. Currently, we are transitioning not only managers, but the GPLv3 collection team as well. Along with former manager Antony Tran and current manager Edwin Pahk, the GPLv3 project has been maintained and supported by a number of interns checking hundreds of projects daily to provide the OSS community a reliable source for GPLv3 adoption. As we move forward, we will be restaffing our team and reviewing our approach. We thank you for your patience during this time.

This week our GPL v3 count is at 2931 GPL v3 projects, and increase of 56 GPL v3 projects. The AGPL v3 count is at 130 AGPL v3 projects. The LGPL v3 number is at 273 LGPL v3 projects.

New project conversions this week include:

Voice Keyboard: Voice keyboard/dictation. Aims to be a total substitute for a keyboard. Spell out words letter by letter (using code: alpha, bravo, ..). Arrow keys, modifiers work. Speak whole words (but whole word accuracy is not good). Attach commands to some words.

OpenModeller: openModeller is a static spatial distribution modelling tool originally conceived to predict species distribution (fundamental niche).

Sudoku Savant: A simple GUI-driven application to solve and generate sudoku puzzles through logical means. Also supports manual solving, with pencil marks and cell colouring. Should be able to solve any standard sudoku from a newspaper or magazine.

*************
Are Software Patents Incompatible With Open Source And Free Software Ideals?

The following discussion includes descriptions of legal concepts. This is not intended, and should not be interpreted as, legal advice. If readers have questions about software law, copyright or patents, please consult an appropriate attorney.

In the context of open source and free software, copyright is quite possibly a necessity as many, if not all, open source and free software licenses are based on United States copyright law or copyright concepts. Copyright protects original creative works, which includes software code. Copyright protects a particular form of expression. Defining and protecting such creative works allows the author to receive appropriate attribution for the work as well as a certain level of profit, if that is what the author desires. The terms of a copyright license can be used to "enforce," or protect certain rights as well as restrict rights, and this is one of the main purposes of open source and free software licensing.

The concept of patent is similar to copyright, but based on a different rationale. Patents have historically been granted to inventions in the form of a physical device or a particular process that performs some specific task in a new and useful way. As opposed to copyright, which protects a particular expression of an idea, patent protects the process, the machine or operating object itself that performs the useful task. The concept of patent protection has been extended to include software code. While code has no physical manifestation, when written, arranged and executed in a specific way it certainly creates a process that can accomplish a useful task, so the argument has been made that software is patentable.

Both copyright and patent holders can grant licenses for their various works and inventions, so why the controversy over software patents? The granting of a patent gives the patent holder a complete monopoly on whatever process the patent covers. This leads to one aspect of patents that is very different from copyright, which is there is no "fair use" of patented processes. Without a license, one simply cannot use a patented process or arguably anything substantially similar to the patented process. This in itself goes against the desire to encourage the sharing of code and ideas among programmers that is at the heart of the open source and free software movements.

Patents can have an anticompetitive effect also. The system for obtaining a patent as it currently exists is extremely expensive, often requiring an attorney who has specialized knowledge of the subject area covered by the proposed patent as well as years of time to obtain approval of the patent. In this regard, the system favors corporations with large budgets. Virtually no small developers have the ability to go through this process from a financial perspective, to say nothing of having to wait years before being able to actually put out a final, patented product. Another argument against software patents is that they can be used "offensively" by larger companies via patent lawsuits to impede developers of competing products. Not only is the time and expense required to defend a patent lawsuit enormous, the penalties for infringing a patent can be equally daunting.

Some OSS developers have begun creatively using their own software patents in a "defensive" manner by dedicating the patents to a "patent commons" to protect the code from being patented by others and enforced offensively against OSS developers, while protecting its use by the community. Others in the OSS community have taken it upon themselves to police software patents by looking for ways to invalidate some patents, such as by finding and publicizing "prior art," which is an example of the existence of the patented process or method prior to the granting of a particular patent. The existence of prior art puts the "inventiveness" of the patent into question, and can lead to revocation of the patent.

The ease of obtaining a copyright, as well as the ability to protect the rights granted to downstream developers via OSS licensing terms, makes it the best method for preserving OSS ideals. Patents appear to have too many costs, both practically and financially, to be useful in encouraging the sharing and development of software code. This is a complicated issue with many polarized viewpoints. See below for links to just some of these.

References and further information:

http://endsoftpatents.org/
http://en.wikipedia.org/wiki/Software_patent_debate

http://perens.com/Articles/Patents.html
http://www.advogato.org/article/7.html
http://w2.eff.org/patent/wp.php

http://papers.ssrn.com/sol3/papers.cfm?abstract_id=997191&rec=1&srcabs=851306

-Kevin Howard

****************************************************************************

License Proliferation - less is more, one is best

On August 23rd, 2008 ernest.park says:

Chris DiBona from Google suffered the slings and arrows of the OSS community when he rejected the AGPLv3 license for Google Code repository, citing license proliferation as one of hte reasons. Looking back, Chris challenged the wisdom of OSI years ago when he was on their board, still at the time fighting against yet another license.

An open source software license is specifically a copyright focused on types of use permitted for electronic media.

By introducing yet another license, it create more complexity to explain, understand, and enforce the use of software governed by these licenses.

The reality is that lack of clarity and confusing, or internally contradictory terms, makes the license potentially limited in worth, as the cost to actually enforce that license increases.

If we look at any open source software license, we realize that they all are governing copyright specific to the use of software.

Use type -
1. Copying: This is the term popularized by Free Software Foundation to describe the act of moving the software from a point of distribution to a local computer, solely for the purpose of personally using the software.

2. Distribution: Once software has been collected from a distribution point, the act of making it available, either by itself, repackaging, bundling, modifying configuration files specific to a platform, and then making the resulting software available for others to "copy".

3. Modification: When a user takes code that has been copied, and implements changes to the source code, such that the program is changed, and then makes the code available through a distribution channel for others to "copy".

4. Other: This refers to license clauses that set restrictions on actions of software uses for actions outside of the direct use, as described above, of the software. Typical "other" language defines restrictions of special restrictive language specific to the use of the original developer's name and branding in marketing done by a distributor/modifier of software copied.

Restrictions -
1. Limitations of liabilities, as is clauses
2. Advertising restrictions
3. Licensing fees, shared revenue, restriction of revenue activities
4. Export restrictions
5. and so on
6. Downstream licensing on modified code

"Restrictions" govern "use" type. Many restrictions also only exist for specific use type.
Revenue restrictions, downstream licensing requirements, and triggered by modification, and or distribution, as example.

Therefrore, if you are copying and distributing, many restrictions don't even apply.

In summary, open source software licensing has become needlessly complex, FUD evolves around rumors of compatibility and interoperability without consideration and understanding of use types and specific restrictions. Open source licensing is a copyright with specific use considerations, restrictions and terms defined within the license, rahter than by copyright law. The thousands of licenses that exist have complicated the issue of using open source software far too much than the issue requires. Practically, we need only one license that specifies the use types and associated governance. Anything beyong one simple license that we can clearly explain the use and restrictions around open source software fails the future use and growth of the adoption of such software.

Ernest Park
http://the-opensource.blogspot.com
http://gpl3.blogspot.com

*************************************************************************

We appreciate all the contributions that have been made, either through our form on our web page or by email, and we also like to hear why you are changing your project's license as in the email above. It gives us more insight into which direction license trends are moving. We will continue to post up user contributions to our blog each week, and we may quote parts of your emails. If you wish the email to remain private, just mention so and we will not disclose any part of it.

Link Partners
If you are willing to copy and tranlate the content weekly, please let me know - you will receive the content as soon as it is available, and you site will be listed as a translation. I can send you a bit of tracking code so that you get credit for your contribution to the readership of this site
Post your link on the bottom of the blog page.

Send me a note at rdgroup@airius.com that you are using some or all of the content
I will make sure that we host links to your sites, and we will be able to use your content within this site as well.

************************************************************

Notable Mention

The Research Group actively takes submissions from visitors on updates on new GPL v3/LGPL 3 projects. We are amazed at the number of submissions we have gotten to date, but even more so, we are incredibly grateful to over 100 core contributors who have devoted their time and resources at helping us provide up-to-date information.

************************************************************

Subscription

For more information, go to http://gpl3.blogspot.com/.

To stop receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "unsubscribe:gpl3".

To start receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "subscribe:gpl3".

************************************************************

Our Sponsor, Palamida, Inc.

The GPL3 project, sponsored by Palamida, Inc (http://palamida.com/ ), is an effort to make reliable publicly available information regarding GPLv3 license usage and adoption in new projects.

The opinions expressed within the GPL3 Information Blog are exlusively those of Ernest Park, the subjects interviewed and the contributing authors, and are not intended to reflect the positions of Palamida, Inc and its employees.

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License .

************************************************************

Palamida was launched in 2003 after its founders learned first-hand what happens when companies don't have full visibility into the code base of their software applications based on Open Source Software. Their experiences inspired them to create a solution to streamline the process of identifying, tracking and managing the mix of unknown and undocumented Open Source that comprises a growing percentage of today's software applications. Palamida is the industry's first application security solution targeting today's widespread use of Open Source Software. It uses component-level analysis to quickly identify and track undocumented code and associated security vulnerabilities as well as intellectual property and compliance issues and allows development organizations to cost-effectively manage and secure mission critical applications and products.

For more information about FOSS management solutions, go to http://palamida.com/, or send a note to sales@palamida.com.

Please mention the GPL3 site when you reach out to Palamida.

The Research Group (rdgroup@airius.com)

Ernest Park
Edwin Pahk
Kevin Howard

GPL Project Watch List for Week of 08/08

noreply@blogger.com (Unknown) — Tue, 12 Aug 2008 00:28:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for July 25th through August 8th, 2008.

This Week:

* Week Summary
* New Projects
* Software and Security: Social Responsibility in the Open Source Software Community
* User Contributions

A Project Transition

We would like to say farewell to the maintainer of this blog for the past year, Antony Tran, who has left our team to pursue other endeavors. We wish him only the best. Edwin Pahk, who has been with this team for over a year now, will be taking over his position. Due to management and team transition, our collection numbers and blog have been a little slow these past two weeks.

This week our GPL v3 count is at 2875 GPL v3 projects, and increase of 29 GPL v3 projects. There was speculation as to whether the AGPL v3 would draw projects from the GPL v3 conversion rates, but this does not seem to be happening. The AGPL v3 count is at 130 AGPL v3 projects. The LGPL v3 number is at 273 LGPL v3 projects.

New project conversions this week include:

* Disk Manager: disk manager is a CD/DVD archiving tool. It storys the directory contents of any media so you can search it later. Its also designed as file explorer which makes it easy to find big files. Windows Version supports native file context menus.

* PDFResurrect: PDFResurrect is a tool aimed at analyzing PDF documents. The PDF format allows for previous document changes to be retained in a more recent version of the document, thereby creating a running history of changes for the document. This tool attempts to extract all previous versions while also producing a summary of changes between versions. It can also "scrub" or write data over the original instances of PDF objects that have been modified or deleted, in an effort to disguise information from previous versions that might not be intended for anyone else to read.

* Smuxi: Smuxi is a flexible, cross-platform IRC client for advanced users, targeting the GNOME desktop.

Software and Security: Does a Social Responsibility exist in the Open Source Software Community?

When I first learned of open source software and its many advantages (most importantly because it was free and I was in college), the first thought that came to my mind was, is it safe? How can I trust a program if hackers can see exactly what I'm using and exploit it? I viewed the security of open source software to the equivalent of handing over the schematics of a bank vault to a robber. But as I continued to learn about open source software I realized that this is a common misconception and that open source software has the potential to be even more secure than proprietary software.

How can open source software be more secure? To put it simply, open source software allows anyone to access the source code, which allows more people can view and test the software for its weaknesses and vulnerabilities. Sure, hackers can find things wrong with it, but general users can do the same. Imagine a 1000 people testing and finding weaknesses in a piece of software vs. the 10 people on a security team working for a proprietary company. One can see the definite potential of OSS becoming more secure.

Even though there is great potential in OSS being more secure than proprietary software, there is a big difference between potential and what actually is being done. Here is a scenario to think about. What if someone has access to a piece of software, and knowing that everyone else has the same access, ended up doing nothing to see whether the software has vulnerabilities thinking that someone else will do it. What if an entire community ended up with this mentality? Although a scenario like this may not be plausible, the social dilemma can still exist. In order for the OSS security model described above to work, there is a social responsibility that must be felt by the community in order to provide secure software to all. The question is does this social responsibility exist?

An experiment was conducted by our team leader, Ernest Park, concerning a vulnerability that was found in the program BIND. Emails were sent out to 41 projects that had BIND or the possibility of BIND in the code, asking maintainers and security teams about whether the vulnerability was addressed and how it was remedied. We received responses from 9 of these maintainers/security teams and of those only 4 contained any significant or relevant information. The lack of response indicates more than anything, that these maintainers and security teams have no obligation to respond to the community concerning security issues with their software. This raises a serious question about the social responsibility that open source software maintainers have towards the security of their projects. Where if at all does the responsibility for security lie?

It appears that in the end, users of the software must be ultimately responsible for their own security. This is primarily due to the fact that the OSS community is governed mostly by licenses that absolve the developer from any kind of liability. A service market has arisen comprised of people dedicated to maintaining and fixing software vulnerabilities, but as we have seen from the experiment above, they don't have any real obligation to anyone to explain how they are securing software. While the OSS market is as transparent as ever, how do we trust people that don't disclose how they secure software with no liability to the user, to secure our software? As open source presents itself as a legitimate alternative to developing one's own software, companies will be burdened with a greater responsibility to understand what they are inserting into their code and IT systems. This burden may discourage companies as well as other users to trust OSS and the benefits it provides. As stated by Joseph Jarzombek in a previous conversation with us,

"Joe Jarzombek: The OSS community still needs a mature and widely-recognized OSS governance regime. If organizations were to adopt OSS, then our acquisition and security personnel need to become more OSS-savvy. They would need to establish an OSS security expert role for verifying and enforcing OSS conformance to organizational requirements and policy."

Is this the best solution to address OSS security and can something like this be accomplished? Unfortunately for an idea as free as open source, everyone's opinion about what the community is differs. Until a singular view can be established, security will continue to be an issue that will limit the effectiveness of open source software in today's market.

-Edwin Pahk

References:
-Goertzel-Jarzombek-OSS_Security SwA.ppt

Thanks for the Continued Support and Contributions
Our database is partly maintained by our team of researchers as well by the contributions that are received from the community. Here is a submission we received last week through our web interface:

******************************

**********************************************
launchpadlib

Description:
A free Python library for scripting Launchpad through its web services interface.

Newest Release:
Pre-Release
****************************************************************************
We appreciate all the contributions that have been made, either through our form on our web page or by email, and we also like to hear why you are changing your project's license as in the email above. It gives us more insight into which direction license trends are moving. We will continue to post up user contributions to our blog each week, and we may quote parts of your emails. If you wish the email to remain private, just mention so and we will not disclose any part of it.

Link Partners
If you are willing to copy and tranlate the content weekly, please let me know - you will receive the content as soon as it is available, and you site will be listed as a translation. I can send you a bit of tracking code so that you get credit for your contribution to the readership of this site
Post your link on the bottom of the blog page.

Send me a note at rdgroup@airius.com that you are using some or all of the content
I will make sure that we host links to your sites, and we will be able to use your content within this site as well.

************************************************************

Notable Mention

The Research Group actively takes submissions from visitors on updates on new GPL v3/LGPL 3 projects. We are amazed at the number of submissions we have gotten to date, but even more so, we are incredibly grateful to over 100 core contributors who have devoted their time and resources at helping us provide up-to-date information.

************************************************************

Subscription

For more information, go to http://gpl3.blogspot.com/.

To stop receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "unsubscribe:gpl3".

To start receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "subscribe:gpl3".

************************************************************

Our Sponsor, Palamida, Inc.

The GPL3 project, sponsored by Palamida, Inc (http://palamida.com/ ), is an effort to make reliable publicly available information regarding GPLv3 license usage and adoption in new projects.

The opinions expressed within the GPL3 Information Blog are exlusively those of Ernest Park, the subjects interviewed and the contributing authors, and are not intended to reflect the positions of Palamida, Inc and its employees.

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License .

************************************************************

Palamida was launched in 2003 after its founders learned first-hand what happens when companies don't have full visibility into the code base of their software applications based on Open Source Software. Their experiences inspired them to create a solution to streamline the process of identifying, tracking and managing the mix of unknown and undocumented Open Source that comprises a growing percentage of today's software applications. Palamida is the industry's first application security solution targeting today's widespread use of Open Source Software. It uses component-level analysis to quickly identify and track undocumented code and associated security vulnerabilities as well as intellectual property and compliance issues and allows development organizations to cost-effectively manage and secure mission critical applications and products.

For more information about FOSS management solutions, go to http://palamida.com/, or send a note to sales@palamida.com.

Please mention the GPL3 site when you reach out to Palamida.

The Research Group (rdgroup@airius.com)

Ernest Park
Edwin Pahk
Kevin Howard

GPL Project Watch List for Week of 07/25

noreply@blogger.com (Unknown) — Mon, 28 Jul 2008 23:07:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for July 11th through July 18th, 2008.

This Week:

Week Summary
New Projects
Software 101: Open Source vs. Free Software Movement
User Contributions

Back on Track
Over the past few weeks we were backed up in our GPL3 numbers due to some maintenance issues on the Sourceforge website. We have spent this past week catching up and with the hard work of the team we have almost caught up on our data.
This week our GPL v3 count is at 2846 GPL v3 projects, and increase of 38 GPL v3 projects. There was speculation as to whether the AGPL v3 would draw projects from the GPL v3 conversion rates, but this does not seem to be happening. The AGPL v3 count is up 5 projects bringing it to 130 AGPL v3 projects. The LGPL v3 number is at 273 LGPL v3 projects, up 1 project from last week.

New project conversions this week include:

JabberCommander: JabberCommander is a tool made in Java that makes a connection between the computer and a Jabber Client (eg. Google Talk) allowing the user to send order to the computer: launch programs and scripts, retrieve the output of certain commands (ls,ps,dir...)

SocialDNS: SocialDNS is a novel naming infrastructure for locating information in the World Wide Web. It is an open network of Web servers that maintain and resolve domain names under a new URL scheme (go://).

Cadmium: Cadmium is a Java port of the Objective Caml virtual machine. It is part of the OCaml-Java project.

Software 101: Open Source vs. Free Software Movement
While both the Open Source software as well as the Free Software Movement has been in existence for quite some time now, some of you may be wondering, what's the difference? Don't both ideas basically proclaim free software for all? While some may see both ideas basically reach the same conclusion of free software for everyone, philosophically the ideas are very different. This was most evident in our conversation with Richard Stallman. He is quick to point out the differences when he stated, "You've described the activity using the ideas associated with the term "open source". The free software movement's goal is not even included in that description."

So then, what is the difference between open source and free software? The Free Software Movement started in 1983 as a social movement proclaiming that software should be free for all and that proprietary software is ethically and morally wrong. The social issues behind the free software movement made some uncomfortable leading to the founding of the Open Source Software movement in 1998, which viewed the availability of free software and open source code as a development methodology, focusing the practical applications of free software rather than the social and political aspects. On the GNU website, the Free Software Movement briefly explains the difference,

"The fundamental difference between the two movements is in their values, their ways of looking at the world. For the Open Source movement, the issue of whether software should be open source is a practical question, not an ethical one. As one person put it, "Open source is a development methodology; free software is a social movement." For the Open Source movement, non-free software is a suboptimal solution. For the Free Software movement, non-free software is a social problem and free software is the solution."

While both movements have been in existence for some time now, what of the future of these movements and their affect on the software market? We see that the availability of source code as a development model definitely has upside, but what of the social aspects? With proprietary software so deeply entrenched in the mainstream market, will the increasing influence of open source software also strengthen the Free Software Movement? These are some of the questions that we hope will be answered in the near future. If you have any comments please feel free to respond. Thank you.

-Edwin Pahk
References:
http://gpl3.blogspot.com/2008/06/gplv3-one-year-anniversary-edition.html
http://www.gnu.org/philosophy/free-software-for-freedom.html

Thanks for the Continued Support and Contributions
Our database is partly maintained by our team of researchers as well by the contributions that are received from the community. Here is a submission we received last week through our web interface:

******************************

**********************************************
Muldis Rosetta

Description:
The Muldis Rosetta DBMS framework is a powerful but elegant system, which makes it easy to create and use relational databases in a very reliable, portable, and efficient way. This "Rosetta" file provides a 10,000 mile view of the Muldis Rosetta framework as a whole, and the detail documentation for each component is included with that component. The distribution containing this "Rosetta" file is the Muldis Rosetta core distribution.

Newest Release:
Muldis-Rosetta-0.7.0
****************************************************************************
We appreciate all the contributions that have been made, either through our form on our web page or by email, and we also like to hear why you are changing your project's license as in the email above. It gives us more insight into which direction license trends are moving. We will continue to post up user contributions to our blog each week, and we may quote parts of your emails. If you wish the email to remain private, just mention so and we will not disclose any part of it.

Link Partners
If you are willing to copy and tranlate the content weekly, please let me know - you will receive the content as soon as it is available, and you site will be listed as a translation. I can send you a bit of tracking code so that you get credit for your contribution to the readership of this site
Post your link on the bottom of the blog page.

Send me a note at rdgroup@airius.com that you are using some or all of the content
I will make sure that we host links to your sites, and we will be able to use your content within this site as well.

************************************************************

Notable Mention

The Research Group actively takes submissions from visitors on updates on new GPL v3/LGPL 3 projects. We are amazed at the number of submissions we have gotten to date, but even more so, we are incredibly grateful to over 100 core contributors who have devoted their time and resources at helping us provide up-to-date information.

************************************************************

Subscription

For more information, go to http://gpl3.blogspot.com/.

To stop receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "unsubscribe:gpl3".

To start receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "subscribe:gpl3".

************************************************************

Our Sponsor, Palamida, Inc.

The GPL3 project, sponsored by Palamida, Inc (http://palamida.com/ ), is an effort to make reliable publicly available information regarding GPLv3 license usage and adoption in new projects.

The opinions expressed within the GPL3 Information Blog are exlusively those of Ernest Park, the subjects interviewed and the contributing authors, and are not intended to reflect the positions of Palamida, Inc and its employees.

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License .

************************************************************

Palamida was launched in 2003 after its founders learned first-hand what happens when companies don't have full visibility into the code base of their software applications based on Open Source Software. Their experiences inspired them to create a solution to streamline the process of identifying, tracking and managing the mix of unknown and undocumented Open Source that comprises a growing percentage of today's software applications. Palamida is the industry's first application security solution targeting today's widespread use of Open Source Software. It uses component-level analysis to quickly identify and track undocumented code and associated security vulnerabilities as well as intellectual property and compliance issues and allows development organizations to cost-effectively manage and secure mission critical applications and products.

For more information about FOSS management solutions, go to http://palamida.com/, or send a note to sales@palamida.com.

Please mention the GPL3 site when you reach out to Palamida.

The Research Group (rdgroup@airius.com)

Ernest Park
Antony Tran
Edwin Pahk
Kevin Howard

GPL Project Watch List for Week of 07/18

noreply@blogger.com (Unknown) — Sat, 19 Jul 2008 04:27:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for July 11th through Juky 18th, 2008.

This Week:

Week Summary
New Projects
Sourceforge Now Lists GPLv3 and LGPLv3
User Contributions

Catching Up
Over the past couple of weeks, Sourceforge has been doing some maintenance and updates. This backed up some of their data which we use to keep track of the GPL3 numbers. However, as mentioned in our last blog, their last push has updated their files and has added some new licenses, which we will go over in a section below. So now we are catching up on our data collection to bring them back up to date. Three weeks worth of Sourceforge data is quite a lot and will take us a week or two to update. But we do not expect that the rate has changed much during the down time, so the last two weeks of slow numbers should balance out with the next two weeks of high numbers, averaging a rate of approximately 50 GPL v3 projects.

This week our GPL v3 count is at 2808 GPL v3 projects, and increase of 57 GPL v3 projects. There was speculation as to whether the AGPL v3 would draw projects from the GPL v3 conversion rates, but this does not seem to be happening. The AGPL v3 count is up 5 projects bringing it to 125 AGPL v3 projects. The LGPL v3 number is at 272 LGPL v3 projects, up 7 projects from last week.

New project conversions this week include:

OpenCms Scripting Language Integrations: This project integrates other scripting and dynamic languages than JSP into OpenCms. It also provides hooks for an easy integration of future languages.
jquantum: jQuantum is a Java program to simulate a quantum computer, to design quantum circuits, and to visualize the execution of quantum algorithms.
Java Application Template Portal: JAT is an easy to extend Java framework. It supplies modular and flexible basic functionalities to develop Web and/or standalone applications.

GPLv3 and LGPLv3 Now on Sourceforge
After the release of the GPLv3 and AGPLv3 many repositories made a separate license category for the new licenses, such as Freshmeat and Rubyforge. Sourceforge, however, did not at the time for reasons unknown to us. Perhaps they wanted to see if the license would catch on before changing their already gigantic database to take on a new license. Perhaps they felt the generic GPL category they had at the moment was sufficient for all GPL versions. Whatever the reason, it kept them from distinguishing between the GPLv2 and the GPLv3, that is until this week.

Now projects hosted on Sourceforge have the option to distinguish their GPL and LGPL version. The options developers have to choose from now are between "GNU General Public License (GPL) " and "GNU General Public License version 3.0 (GPLv3) ", as well as their LGPL counterparts. As you can see the distinction is between a generic form of the license name and one specific to version 3 and not between version 2 and version 3. This means that developers have the option to specify that they are using version 3 but do not necessarily have to. We cannot assume that the projects using the generic GPL category are using the GPLv2. It would be a mistake to do so since there are still thousands of projects that are using the GPLv3 and are still listed under the the generic license name. It will take a while for more of the projects to migrate to these new license categories since they have just been implemented this week. It also is a possibility that many will never migrate over since the generic listing covers all versions. For this reason we are going to keep our eye on both categories to see if developers actually do change their license listing. I believe that they will and that the GPLv3 listing will fill up quite quickly. As of this week there are only about 20 projects in the new license category but I expect this to grow at an increasing rate.

Though we do not know why Sourceforge did not create a separate license listing for the GPLv3 from the beginning, the creation of it now does show that the license has gained enough significance in its own right. The GPLv3 has gained many supporters as we have shown through our data and this new development continues to prove what we have been saying all along, the GPLv3 is an important new license. Some developers may not care about the difference between the GPLv2 and the GPLv3, but there crucial differences between the two and how they can be used. This is most evident by all the controversy that revolved around the GPLv3 when it was released that still goes on today. We are glad that Sourceforge has chosen to differentiate between these licenses on their site so that developers can specify how they would like their projects to be used. The previous grouping of all the versions made the terms of the projects on Sourceforge listed under the GPL ambiguous, but now projects can specify their version, at least for the GPLv3. Perhaps if the migration goes well, the generic license will be changed to GPLv2.

References:
http://sourceforge.net/index.php

-Antony Tran

Thanks for the Continued Support and Contributions
Our database is partly maintained by our team of researchers as well by the contributions that are received from the community. Here is a submission we received last week through our web interface:

****************************************************************************
Omnidic

Description:
Omnidic is a free open source dictionary / translator for mobile phones.It works on mobile phones compatible with java (MIDP 1.0 and MIDP 2.0). The program can contain several dictionaries at the same time. For the use of the Omnidic it is not necessary connection to Internet, the dictionaries are saved in mobile.

Newest Release:
Omnidic-1.0.zip
****************************************************************************

Link Partners
If you are willing to copy and tranlate the content weekly, please let me know - you will receive the content as soon as it is available, and you site will be listed as a translation. I can send you a bit of tracking code so that you get credit for your contribution to the readership of this site
Post your link on the bottom of the blog page.

Send me a note at rdgroup@airius.com that you are using some or all of the content
I will make sure that we host links to your sites, and we will be able to use your content within this site as well.

************************************************************

Notable Mention

The Research Group actively takes submissions from visitors on updates on new GPL v3/LGPL 3 projects. We are amazed at the number of submissions we have gotten to date, but even more so, we are incredibly grateful to over 100 core contributors who have devoted their time and resources at helping us provide up-to-date information.

************************************************************

Subscription

For more information, go to http://gpl3.blogspot.com/.

To stop receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "unsubscribe:gpl3".

To start receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "subscribe:gpl3".

************************************************************

Our Sponsor, Palamida, Inc.

The GPL3 project, sponsored by Palamida, Inc (http://palamida.com/ ), is an effort to make reliable publicly available information regarding GPLv3 license usage and adoption in new projects.

The opinions expressed within the GPL3 Information Blog are exlusively those of Ernest Park, the subjects interviewed and the contributing authors, and are not intended to reflect the positions of Palamida, Inc and its employees.

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License .

************************************************************

Palamida was launched in 2003 after its founders learned first-hand what happens when companies don't have full visibility into the code base of their software applications based on Open Source Software. Their experiences inspired them to create a solution to streamline the process of identifying, tracking and managing the mix of unknown and undocumented Open Source that comprises a growing percentage of today's software applications. Palamida is the industry's first application security solution targeting today's widespread use of Open Source Software. It uses component-level analysis to quickly identify and track undocumented code and associated security vulnerabilities as well as intellectual property and compliance issues and allows development organizations to cost-effectively manage and secure mission critical applications and products.

For more information about FOSS management solutions, go to http://palamida.com/, or send a note to sales@palamida.com.

Please mention the GPL3 site when you reach out to Palamida.

The Research Group (rdgroup@airius.com)

Ernest Park
Antony Tran
Edwin Pahk
Kevin Howard

GPL Project Watch List for Week of 07/04, 4th of July Edition

noreply@blogger.com (Unknown) — Fri, 11 Jul 2008 23:29:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3/AGPLv3 adoption for June 27th through July 4th, 2008.

This Week:

Can OSS Secure of Our Nation?

Trust but Verify

Software Security Perspectives from Joe Jarzombek from The Department of Homeland

Richard Stallman comments - update

Followup - Google Code Repository

Weekly Count

Can Open Source and Free Software Impact the Security of Our Nation?

In this issue of our blog we see it fitting that we focus on our nation and the security of it through open source. The United States was founded on principals of freedom, so it makes sense that now we look towards "free software" to protect her. However, a question that beckons to be asked is, is open source ready to protect the United States' networks, or is the democratic development and decentralized distribution potentially our downfall? There are obvious benefits to open source software, but at the same time there are flaws to it that need to be addressed before it can be considered secure enough for government's systems.

The recent Debian OpenSSL issue has brought much needed attention to the security of open source software. For those of you unfamiliar with the Debian OpenSSL security problem, on May 13th, 2008 http://www.metasploit.com/ announced that OpenSSL distributed in Debian-based systems had a line of code removed with drastically reduced the number of encryption keys and made them predictable. "Instead of mixing in random data for the initial seed, the only "random" value that was used was the current process ID." This affected releases that were distributed between September 2006 and May 13th, 2008. The code was removed because of incompatibility issues between Valgrind and OpenSSL. This security bug would have large repercussions if the government was using one of those Debian releases. Imagine our nation's security reduced to only 32,767 possible encryption keys that were also guessable.

Now one of the arguments for open source is that their are more eyes looking over the code, since the code is openly available to be reviewed and changed by the community. This is true and one of the reasons that this bug was discovered. The open source system of discovering bugs is beneficial in that the number of people reviewing the code is far greater than proprietary software. But as the Debian OpenSSL case shows us, it might take up to two years before it is discovered or at least published. With in the past two years, this bug may have already been discovered and not published, with the finder exploiting the bug for all that time. The problem with community review is that it is a voluntary choice and not an obligation.

With proprietary software, there are fewer people looking over the code, but they are more obligated to find bugs since they are being paid by their employer to do so. I am not saying that proprietary software is necessarily more secure than open source software. The Debian OpenSSL bug could have gone by for two years in a proprietary model just the same, since the number of eyes on the code is drastically less due to the closed source code. So perhaps the solution to open source being used by the organizations are bounty systems, such as the $500 dollar bounty Mozilla offers for bug discovery, for bugs that are found in OSS that they are using. Another solution would be to have proprietary third party software analysis to review the security of open source code. Ultimately using open source code has many time and functionality benefits that would be foolish to ignore, but seeing as it is America's security on the line, extra steps must be implemented to ensure the code is safe to use in exchange for the "free" software.

References
http://www.metasploit.com/users/hdm/tools/debian-openssl/
http://www.debian.org/security/2008/dsa-1571
http://www.linux.com/feature/135270
http://research.swtch.com/2008/05/lessons-from-debianopenssl-fiasco.html

Trust but Verify (from :http://the-opensource.blogspot.com/2008/07/trust-but-verify.html)

Ronald Reagan
Farewell Address to the Nation, Oval Office, January 11, 1989

"If they persist, pull the plug. It's still trust but verify. It's still play, but cut the cards. It's still watch closely. And don't be afraid to see what you see."

http://www.reaganlibrary.com/reagan/speeches/farewell.asp

This is a file from the Wikimedia Commons. The description on its description page there is shown below. Commons is a freely licensed media file repository.

This is the first time that I have had the justification to quote the late President Ronald Reagan to make an obvious point. In the Debian example, the open source community trusted that someone else would look and find the problem. Users believed that the power of community review would reduce the risk of using the software. Users were lulled into a complacency whereby nobody felt the obligation to "verify". Just like when an accident happen, we cannot all just assume that someone else will call 911, offer assistance, get involved. If we accept the socialism of free software, then we must mutually accept the responsibilities associated with the use of such software, or we must impose the obligations of these responsibilities onto the vendors that offer service agreements for such software.

I in no way single out open source software from proprietary software. The point is that just because there is nobody to blame does not mean we cannot look for problems. In the use of open source software, we must be prepared to know how to look, qualify the process by which software is checked and validated, and then centrally and proactively share this information.

Forums exist for the distribution of risk issues, and copious amounts of data has been amassed to allow management of complex environments. Regardless of whether the applications being used are "open source" or proprietary, objective rules and guidelines must be put in place and enforced in order to assure that the power of the community actually means something.

I tend to believe that long past are the days when each user would be forced to review source of any distribution prior to compiling for one's own platform. We as users find it too easy to download the bits, decompress and run. We entrust that in the community of users, someone else will find the problem. This complacency to decentralized responsibility can lead to big problems. The use of open source alternatives to prorietary software is not more risky, it just imposes objective responsibilities and processes that must be abided to in order for open source solutions to continue offering an advantage in the workplace.

Users need to realize that nothing comes free. If we look at the real savings of open source software as that of time, the budget usually allocated to the purchase of commercial solutions can be spent to provide diligent review and management of "open" applications, following documented guidelines, with results of such copious review being continually shared with the community.

Software Security Perspectives with Joe Jarzombek from The Department of Homeland Security (from: http://the-opensource.blogspot.com/2008/07/software-security-perspectives-with-joe.html)

Joseph Jarzombek serves as Director for Software Assurance in the Policy and Strategic Initiatives Branch of the National Cyber Security Division (NCSD) within the Department of Homeland Security (DHS). He hosts and sponsors many public-private collaboration efforts focused on software security. He recently spoke at the AIE Conference on Military Open Source Software, and he shared his perspectives on “Security Considerations in the Use of Open Source Software". The following is my commentary and his words from the conference. Joe Jarzombek also provided the presentation for readers to download.

Ernest Park: The weakness in blind trust of a decentralized community was clearly pointed out with the Debian issue. Without objective mandatory and measurable delivery against processes, software flaws can go unnoticed for periods of time. Joe, is this an example of existing complacency in the use of open source software, and who should accept responsibility for this major security oversight?

Joe Jarzombek: The OSS community still needs a mature and widely-recognized OSS governance regime. If organizations were to adopt OSS, then our acquisition and security personnel need to become more OSS-savvy. They would need to establish an OSS security expert role for verifying and enforcing OSS conformance to organizational requirements and policy.

Ernest Park: It seems like a well organized group with political or financial motivations could wreak havoc on our country using open source software to open the doors to an attack. Is the government concerned about open source applications being used to hide intentionally hidden trojans and coding flaws, such that institutions using such software can be exposed to highly targeted attacks?

Joe Jarzombek: As part of enterprise risk management, organizations should evaluate the trustworthiness of suppliers, and that includes enhanced due-diligence to better understand the pedigree or provenance of the software and the capabilities of the suppliers to deliver secure products and services before acquiring any developers' OSS. Generally the significant OSS projects are maintained by well known developers in the community. They would have to make sure the project team monitored each developer's initial contribution or only his/her later modifications and updates. Their process would also need to include checks/controls to establish developers' identities and trustworthiness. The developers' geographical locations, nationalities, affiliations, ideologies, and loyalties are also easier to obtain with OSS. On OSS projects, it's often possible to discover developers' identities (at least who they claim to be). The same is not true of many proprietary software projects/developers.

Ernest Park: The FLOSS, OSS, FOSS, free software, open source community is a non-centralized ‘socialist’ network. Does the lack of perceived central responsibility pose a higher obligation of risk awareness and mitigation on enterprise users of these applications?

Joe Jarzombek: First, people should understand that many of the issues identified with OSS are equally true for proprietary software. The ability to determine pedigree/provenance should be one factor, but not the only factor, in decision-making on whether or how to proceed with software security evaluation. If there is inadequate information then there needs to be deeper security analysis, vulnerability mitigation and environment-level isolation and constraints to separate “not yet trusted” from “more trusted” software. If there is no pedigree/provenance information then that has sometimes been used as a reason to reject the software especially if it were to be used in national security systems with US only content requirements.

Ernest Park: Do you feel that enterprises are exposing themselves to undue risk if they choose to save money by using open source applications without budgeting for additional resources to manage and oversee such applications?

Joe Jarzombek: Many organizations are already looking into additional resources to manage and oversee applications that they might use. Several companies such as Palamida and Black Duck Software offer discovery programs that will find "hallmarks" in the source code, COTS products, and large software systems. Several companies now offer services that focuses on software security. We have also collaborated with vendors who have made a business out of scrutinizing OSS code, such as Fortify Software, Ounce Labs, Coverity, Cigital, and others. OSS "commodification" potentially provides the best of both worlds: OSS design/code openness and vendor support.

Ernest Park: I have run into some efforts to increase usage of open source within government. Has DHS been involved with these efforts, and is any policy defined to assure high operational security for all applications going forward?

Joe Jarzombek: DHS has sponsored the Vulnerability Discovery and Remediation Open Source Hardening Project in which Coverity, in collaboration with Symantec and Stanford University, evaluated popular OSS to discover and remediateexploitable vulnerabilities.. In this project 40+ OSS packages, including Linux, Apache, MySQL, Perl/Python/PHP were evaluated for vulnerabilities. 11 packages were remediated.

Ernest Park: What should we be doing as a minimum to insure that we are diligent, responsible technology users and proud citizens defending our homeland?

Joe Jarzombek: The broader stakeholder community needs to be security-aware with a better appreciation of just how much our enterprise missions are more at risk because of exploitable software. These risks have to be mitigated during development and in use. We need more security-informed procurements. As consumers we need to exercise more due-diligence in selecting software suppliers and products More comprehensive software diagnostic capabilities need to be used by developers and testers. Also problems that are found need to be reported as soon as possible so that they can get fixed immediately, ideally before code is released. And users should also keep their software up to date by installing the latest patches.

Ernest Park: Has anyone assembled a best practices guideline for using your data sources to more securely and proactively manage our computing environments?

Joe Jarzombek: Our DHS Software Assurance “Build Security In” website offers many publicly available resources which are free to download. BSI at https://buildsecurityin.us-cert.gov/ offers several sound practices from respected practitioners of software security. David A. Wheeler is well know for his contributions in OSS endeavors. He has released papers and projects on OSS and security, including "Open Source Software (OSS) and the U.S. Department of Defense (DoD) – Webinar". If people are interested in further collaboration on software security practices, I would invite the to join us in future Software Assurance Forums and working group sessions which are publicized on our BSI web site under Events.

Ernest Park: We are repeatedly told that the next big attack will come via the internet. What steps can I do to empower myself, my fellow software users and my country to proactively defend, and more predictively manage my environment?

Joe Jarzombek: Software users should, as a minimum, perform a security evaluation on the programs they choose to use that answer these questions:

Are the software's security assumptions consistent with the security assumptions made by and about the component that the software will implement?

Can unused functions and interfaces be removed, disabled, or fully isolated without affecting the correct execution of other functions?

Does the software expose and provide access paths (intended or unintended) to its vulnerabilities?

What are the common exploitable weaknesses in the code, and what form of static or dynamic code analysis has been performed to determine the resiliency of that code?

The open design and source code availability of OSS should make security evaluation easier.

References:

http://ttcus.com/oss/

The Military Open Source Software Conference

April 21-22, 2008

-Goertzel-Jarzombek-OSS_Security SwA.ppt

Weekly Count, Sourceforge Backed up

If our numbers seem lacking this week, its because they are. One of our largest sources of data is backed up at the moment. Sourceforge seems to have stopped updating files past June 22. Once SF is caught up on their files to the present, our numbers will catch up to the expected rate. We emailed the maintainers at Sourceforge and that they informed us that they have located the problem. They notified us that he problem will be fixed within the next couple days when they make their next push. For this week, the GPL v3 count is at 2751 GPL v3 projects. The LGPL v3 count remains at 265 LGPL v3 project. And the AGPL v3 number is up 3, bring the total to 120 AGPLv3 projects.

***********************************************************************************

Richard Stallman comments - update
In my last post (http://gpl3.blogspot.com/2008/06/gplv3-one-year-anniversary-edition.html), I included comments from Richard Stallman in an "interview" section. I had hoped that Mr. Stallman would welcome the opportunity to comment on an objective, non-commercial, free effort to openly track adoption rates of GPLv3 related licensing in new software releases over its first year. Instead, through a series of email exchanges, Mr. Stallman indicated more of a philosophical disdain with this information effort, and a dislike for Palamida, the company that continues to generously sponsor this effort.

It seems that Mr. Stallman has clear views with how "free" software needs to be described, referred to, counted.

Richard Stallman: "The free software movement is not merely personal. It is a political movement like the environmental movement, the civil rights movement, etc."

Mr. Stallman contacted me after, asking me to clarify his comments clearly in the context in which they were elicited.

Prior to 6/29/08, I asked a series of questions, and did inform him that his responses would be published in their entirety. From an email exchange between Mr. Stallman and I that followed the publication on 6/29/08:

ernest park: I can clarify the post. As a note, I was very clear with my intention to publish all of your words, unedited, which I did.

richard stallman: You invited me to contribute something and said you would publish it unedited. But I did not do that; I instead said why I did not want to.

ernest park: Redhat, MySQL, Sun, IBM - and others all generously sponsor the existence of open source projects through their proprietary commercial activities.

richard stallman: I am an activist for free software and freedom; open source is not what I support.

It is clear that Mr. Stallman and I do not see eye to eye. While the various GPL (v2, v3, etc) are specific to the non-commercial aspects of the code, and the availability of the underlying code, aka source code, his position is of "free software being more of a philosophical movement rather than a legal construct around the use and propagation of community developed software.

Followup - Google Code Repository
My views on the licensing restrictions at http://code.google.com/ changed significantly after our talk with Chris DiBona (http://gpl3.blogspot.com/2008/06/gplv3-one-year-anniversary-edition.html). His position of license proliferation is a practical argument. When we see all the licenses out there with prohibitive and vague language, contradictory language, or possibly hidden agendas, perhaps Chris is heading in the better overall direction.

I always think that Creative Commons has always had it right. There is no confusion with what a CC license allows or does not allow. If licenses for open source software were standardized into a simple menu format like CC, how many distinct permutation would really be required? Would the OSS community be better served with less licenses that are clear, with defined interaction and use conditions?

It is a shame that OSI (http://www.opensource.org/licenses) does not require documented interoperability for approval. In this way, even OSI has been party to the unfortunate proliferation of licenses that say similar things, do not cooperate with each other, and create more confusion and complexity for use. As an interesting point, Chris used to be a member of OSI, and consistently lobbied for less approved licenses. OSI approval should really mean much more than the fact that the document passed a spell check (I am being sarcastic).

Chris and I agree on this issue - less licenses with clear terms and documented interoperability will protect the future utility of open source software.
********************************************************************************************************

Missing Week, and what's new?

Time off
We all took a week off for July 4th. It seems that our time off was aligned well to other issues in open source software. Sourceforge was having issues posting updated information, and as of recently, their information was still queued up. We contacted friends at Sourceforge right away, and they acknowledged that they discovered the issue and things would be back to normal.

Farewell Antony, welcome aboard Edwin
As of this week, Antony Tran is stepping down as Project Manager for the GPL3 Information Search site and blog. Antony has been with the Research Group for over a year, and has handled a number of significant research projects specific to open source software worldwide. He is taking time for himself, and may start the arduous process of interviewing at graduate schools.
The team will miss Antony's contributions and leadership. Starting over the course of the next few weeks, Edwin Pahk will take over project management duties for the information site starting next week. Edwin has been with our team for more than one year after graduating from Berkeley.

Change in format going forward
We accurately tracked GPLv3 adoptions over the last year, and despite quotations and interpretations in all directions, I have to say that the integration of GPLv3 variants in project releases was and continues to be at a steady and growing rate, with over 3000 releases using GPLv3, AGPLv3 and LGPLv3 in the last year, and nearly 7000 "or later" releases. The focus of this information site is moving more into the future of open source - news, security, topical stories. You may have noticed over the course of the last few months the addition of interviews. We will continue the interview format, and are eager to continue to make sure you "read it hear first".

If you wish to participate in an interview, or if you want information from me, please send a note to rdgroup@airius.com.

LINKS BACK - Please help!
We ENCOURAGE you to copy the content of this site. The Creative Commons license asks only for non-commercial use, and credit. I would like to ask that you also cooperate with the requests herein without my requiring a modified license. Please send me a note if you do so regularly. This site is translated into half a dozen languages weekly that I can find, and on any week, I can find hundreds of partial or complete copies of the site content on other sites.

Feedburner - RSS of this site is available via subscription

Email - For those that want the content delivered, email delivery is available. Information about subscribing is on the bottom.

With the hundreds of copies of this site that go out weekly via subscription, along with the hundreds of copies on other sites, the stats are out of skew. We use Google Analytics to track usage. When the site is copied, the "tracking script" is not copied. As a result, while I can verify hundreds of links and potentially thousands of readers, Google Analytics does not know about it. Please help.

Send me a note at rdgroup@airius.com that you are using some or all of the content
I will make sure that we host links to your sites, and we will be able to use your content within this site as well.

********************************************************************************************************

Notable Mention

The Research Group actively takes submissions from visitors on updates on new GPL v3/LGPL 3 projects. We are amazed at the number of submissions we have gotten to date, but even more so, we are incredibly grateful to over 100 core contributors who have devoted their time and resources at helping us provide up-to-date information.

The Research Group (rdgroup@airius.com)

Ernest Park
Edwin Pahk
Kevin Howard
********************************************************************************************************

Subscription

For more information, go to http://gpl3.blogspot.com/. To stop receiving these weekly mailings, please send a message to rdgroup@airius.com with the subject "unsubscribe:gpl3". To start receiving these weekly mailings, please send a message to rdgroup@airius.com with the subject "subscribe:gpl3".

********************************************************************************************************

GPLv3 One Year Anniversary Edition 06/29/08

noreply@blogger.com (Unknown) — Mon, 30 Jun 2008 23:48:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3/AGPLv3 adoption for the past year.

This Edition:

GPLv3 - One Year Later
GPLv3 - 10,000 projects
Interviews

Conversation With Chris DiBona
Richard Stallman on Free Software vs Open Source
Words of Wisdom from Marco Barulli

Significant Adopters and Rejectors
To Sum it All Up
Counts for the Week

Happy Birthday GPL v3

It is said that in the act of scientific observation, that which one observes is permanently changed. My team and I were tasked on year with creating a way to objectively track the use of the GPLv3 license and variants within the global of non-commercial software. We spent about 6 weeks planning, researching, and developing tools, processes, documentation and the public site http://gpl3.palamida.com. On the front end, we run JBOSS, on the back, Ruby and MySQL. We do analytics with Pentaho, Groovy and Python, and we manage the content with Google Apps for Business, Mionet, Mesh, and Dropbox.

On June 29, 2007, we went live with 67 Ruby projects from Rubyforge, and by the first Friday, we went to 82. A year has passed, and this team has been staffed by interns from fine colleges around the country, senior project manager Kinyoshi Tokuyama, project managers Antony Tran and Edwin Pahk, senior programmer Chris Porter, and me.

Our goal from that first day was to objectively track the use of GPLv3 variants (GPLv3, LGPLv3, and "or later"), provide accurate counts and clear validation. For each of the more than 15,000 projects collected for this project from more than 500,000 reviewed, the sources were reviewed, proper license references and attributions verified, and the license text, unchanged, was identified. While we used some level of automation, we felt that there were problems that required lots of hands and eyes on the problem. Among these were missing license text, no license information in source headers, bad license links - GPLv2 projects that used URLs to refer to licenses rather than include the text.

We started distributing a weekly mailing, and published our first blog 7/2/07.Our hope was that transparency in our project would instill confidence in our objective results.

User contributions via web form, email and phone calls has been hundreds.

In all, a year later, we are still tracking the usage and adoption of GPLv3 and its variants, including the new AGPLv3. I wish to thank Palamida, Inc. for their generous sponsorship of this important source of information regarding the use and adoption of non-commercial software and related licenses. Their sponsorship allowed this project to run, and afforded us the ability to offer 12 internships to deserving graduate students.

---------------------------------------------------------------------------------------------------------------------------------------------------------------
GPLv3 - 10,000 projects. The numbers say it all

As of 6/29/07 / 6/29/08

Total repository based OSS community: 145,909 / 258,367(SF total divided by 70%)

Estimated Total active Projects: 21,886 / 38,755 (total divided by 15%)

Total active GPL: 18,166 / 32,167 (total active, divided by 77% GPL and 6% LGPL)

Estimated total GPLv3 conversion, including "or later": 13,079 / 23,160 (total active, divided by 77% GPL and 6% LGPL, divided by 72% estimated conversion rate)

Estimated current "or later" impact: 9,083 / 16,083 (50% of GPL)

NOTE - As I said before, in the act of observation, one permanently changes that which is observed. The total projects on Sourceforge today was 180857. One year ago, that number was 102,136. 6 weeks after the launch of the GPLv3 license, the number was 145,910. SF experienced a 40% increase in new projects in six weeks, and over 75% in one year. Did our observtion influence the creation of new projects? Did we draw attention to non-commercial software? Maybe.

The blog site has had thousands of users, hundreds of links to significant sites, we have been mentioned on significant industry sites and quoted objectively by analysts. I tend to believe that my team and I removed some of the FUD element around non-commercial software, and attracted a new set of eyes. I can't take credit for the sudden explosion in new projects 6 weeks after the GPLv3 was launched, but would we have ever noticed if I had not been observing?

The one statistic that have not modified is the active project metric. I actually think it is accurate, and reflects the continuing growing trend of usage of these projects over time.

Therefore:

Or later – 6,858 of 13,079 / 23,160 projected – 76% / 43%
LGPLv3 – 265 of 785 / 1390 projected – 34% / 19% (GPL conversion divided by 6%)
GPLv3 – 2,856 of 12,295 / 21,771 projected – 23% / 13% (GPL conversion divided by 94%) This does NOT include "or later"
GPL, not converted – 5086 / 9007 projected (GPL projects times (100% - 72% convert rate))

The use and creation of non-commercial, FLOSS, FOSS, Open Source, Free projects has increased at a rate more dramatic than any previous point in its measurable history
In the six weeks that followed the release of the GPLv3 license, overall new projects on Sourceforge increased by more than 40%
GPLv3 increased private and commercial awareness to the potential of non-commercial software for the better

All this in one year.

So, what is the summary?

Usage of the GPLv3 license variants has grown consistently with the growth in non-commercial projects as seen in the last year. I have read on sites not well informed about the lackluster reception for the GPLv3 license and its variants, citing a continued strong usage of the GPLv2. What is not brought up is the existence and continued growthof the use of the "or later" license condition, where, at the choice of the user, a user of licensed software can be governed by terms of the present license, or later (such as GPLv3). While it seems like a minor issue, it could become a larger one if a user of GPLv2, or later, code, introduces changes licensed under the GPLv3. In order to accept the changes, the subsequent code, if used, would become, GPLv3.

In the end, if we combine all the "or later" with the GPLv3 and variants, there are 9979 projects governed directly or indirectly by the current GPLv3 licenses.

Interviews
For this special edition of our blog, we found some key figures in the Free Software/Open Source community to share some thoughts with us. First we have Chris DiBona from Google Code, who answered some questions regarding their stance on license proliferation and the AGPL v3. Next, we were able to get some words from Richard Stallman from the Free Software Foundation, who gave us an interesting interview, commenting on the ideologies behind Free Software. And lastly, Marco Barulli from Clipperz gave us some insight on the future of open source software.

Conversation With Chris DiBona, Google's Open Source Programs Manager. (http://code.google.com) (06/29/08)

Ernest Park: The current rate of adoption of the AGPLv3 license is more than double that of the LGPLv3. Considering the fact that the AGPLv3 is the newest of the licenses above, I would contend that adoption is consistent, and that this license may be the first widely adopted license focused on ensuring the freedoms around web delivered services. Is it reasonable to see that AGPLv3 will surpass LGPLv3 in number of distinct licensed projects within the next year?

Chris DiBona: Maybe? I'd be surprised if this is the actual case. Nothing personal, but without knowing your sample size those numbers are next to useless. Our sampling of license popularity is based on our crawl of the internet, version control repositories inclusive. Not just individual and community repositories.

I might also point out that you're making an argument to halt support for lgplv3, not one to support agplv3.

I should also point out that I'm speaking specifically about support for the AGPL on code.google.com's project hosting system. We have AGPL projects in the Summer of Code and are substantive financial supporters of the FSF and SFLC.

Ernest Park: The AGPLv3 differs from the GPLv3 ONLY in section 13, providing language specific to address the conveyance that exists unique to SaaS. http://gpl3.blogspot.com/search?q=section+13. Therefore, do you think your resistance to AGPLv3 to date could be interpreted as a resistance to specific SaaS licensing?

Chris DiBona: No, it is a resistance to overall license proliferation. The benefits that the AGPL attempts to bring to SaaS is not worth the damage yet another license brings to the open source world. The AGPL clearly brings some interesting features to SaaS projects, and I remember when we were releasing Sourceforges code from VA Linux back in the day that some of the executives in the company were upset that other sourceforges' had popped up and not acknoledged the original or patched back. In the end, I don't think this is an actual problem. There are plenty of examples of Apache or BSD projects that continue to be industry leading evn though they are both quite permissive. Licenses clearly matter, but project innovation and leadership count for a lot more that the license a project might choose.

Ernest Park: With the time that has passed, have you reconsidered your position on hosting AGPLv3 licensed projects?

Chris DiBona: No. AGPL doesn't have enough adherents to change our position on hosing AGPL projects.

Ernest Park: What would you change of the AGPLv3 license in order to make it acceptable to Google's code repository? Remember, the only difference between GPLv3 and AGPLv3 is section 13, so I would suspect that any changes would focus here.

Chris DiBona: Section 13 is a mess. Until there is more history around compliance with section 13 and what it means to be compliant and where the linking stops the AGPL will not see much adoption. And that adoption is what would warrant it's inclusion.

Ernest Park: Comments from you in the past proposed that AGPLv3 had nominal usage. Given the facts on license usage in new projects, are you willing to reconsider your prior position claiming a nominal adoption (paraphrase)?

Chris DiBona: No, you are still working from the assumption that your numbers are significant. It is my opinion that they're not. 113 projects is less than the number of projects under any license registered on code.google.com or sourceforge on any single day.

Ernest Park: There are other licenses that Google currently supports with low overall projects, and with low numbers of releases under these licenses. In your effort to prohibit license proliferation, will you set license hosting guidelines for additional licenses with low current usage, or are you focusing such sanctions solely on the Affero GPLv3?

Chris DiBona: That's why we're retiring mpl support, as it too is underused. AGPL supporters seem to think this is something about the AGPL, when it is about fighting license proliferation on code.google.com. I have nothing really against the AGPL save the deleterious effects that yet another open source license brings to the open source software development movement.

Ernest Park: While I personally find the huge numbers of unclear and repetitious licenses useless, we either have to support them all, or support only those that satisfy specific criteria. I do think that you have attempted to outline criteria. It would be good if you objectively spelled out the criteria and made it available for review. While I am certain that the author of the "do good, not evil" license will protest along with much of the FOSS community, the commercial marketplace and developers going forward might appreciate fewer licenses with distinct and defined interoperability.

Chris DiBona: So I think that your company has a significant role to play in pan-license compliance support (obvious) so it is smart to build competency around the AGPL, but for now, it's not destined to be offered as an option at code.google.com

Ernest Park: One last question. From recollection, your position regarding license proliferation has not differed since your tenure with OSI. It seems that OSI could set the example for tightly constraining the proliferation of licenses - stop duplicate licenses, highly incompatible licenses, and in all, set a framework for the approval of a portfolio of licenses that together address specific licensing needs and desires by the creators and users of the content. Why did OSI never actually attempt to constrain "approved" licenses to meet a criteria beyond the license itself, like interoperability, or duplication of existing license?

Chris DiBona: Honestly? OSI is lacking dedicated personnel, which I believe is quite crippling. Without a dedicated staff, how can one expect them to summon the political will to be unpopular with the adherents of the licenses they'd deprecate (which I know all too well). I left the board a long time ago (to get my masters) but I still hold some hope that they'll turn osi around, which I define as 'deprecating a ton of licenses'.

****************************************************************************************************************
Richard Stallman on Free Software vs Open Source (06/29/08)

Ernest Park: It is the one year anniversary of a milestone for non-commercial software users and advocates. I accept and will publish that your views and mine differ, but it seems proper that your voice should be reflected on (this) site in response to the clear successful acceptance of the GPLv3, LGPLv3 and AGPLv3. Do you have any comments on the GPLv3 site and the progress that we've been maintaining?

Richard Stallman: In general, I'm rather unhappy with Palamida, both for terminology (it generally uses the term "open source", which stands for values I disagree with), and for substance (it promotes some non-free software).

Ernest Park: At the end of the day, free software, OSS, FLOSS, etc - there are a lot of names to describe non-commercial software made available in a framework that encourages participatory development, and a lot of opinions and points of view, many distinct, all personal. I believe that for the moment, we can both agree that our values differ in some specific ways. However, would you mind providing a comment less vague and subjective, focused more on the community acceptance and success of the GPLv3 family of licenses?

Richard Stallman: The free software movement is not merely personal. It is a political movement like the environmental movement, the civil rights movement, etc.

You've described the activity using the ideas associated with the term "open source". The free software movement's goal is not even included in that description. Thus, a thoughtful free software supporter knows better than to endorse the way the issue is framed by your site.

I fetched and read the last retrospective, and I got a bad feeling about the values that seem to be present in it. I would have to do a lot of work to identify why I see them there, and I am not sure that would do any good.

Note - The interview above was the result of four rather long emails. The interview was intended for the blog, and the summary above was edited directly from the email exchanges.

****************************************************************************************************************
Words of Wisdom from Marco Barulli (06/27/08)

Antony Tran: With tech at the forefront of our society, how do you envision open source
in the future, both in general and commercially?

Marco Barulli: Being security and privacy issues more and more relevant in our society I hope that the openness of the code that runs on our computers/phones/... will be no longer an option.

Antony: What needs to change in OSS for it to compete more aggressively with
commercial software?

Marco: More attention to the user experience.

Antony: Do you have any words of advice for our subscribers who are trying to
develop the next big thing?

Marco: Just do it. Don't waste time looking for seed investors, put your own money, time and energy into it. If you believe it is the next big thing, VCs will come.

---------------------------------------------------------------------------------------------------------------------------------------------------------------
Significant Adopters and Rejectors

Significant adopters
Clipperz
Clipperz was one of the first established projects to adopt the AGPL v3. Their backing of the AGPLv v3 showed that there was a niche of people who were and are dissapointed with the Saas loophole that was not closed in the GPL v3. They believe that software modified for services should also be required to release their code if they used open source software. Since their adoption for the AGPL v3 they have announced that they are planning on developing a suite containing projects licensed under the AGPL.

Open Office
Open Office was a large project that decided to adopt the LGPL v3. The LGPL v3, the less restrictive form of the GPL v3, has not had many big names taking on the license until Open Office. Just as with Clipperz and the AGPL v3, Open Offices showed that there was a group of people who wanted to update their license, but not take on all of the restrictions put in the GPL v3.

Ubuntu Launchpad
Ubuntu's Launchpad as not officially adopted the AGPL v3 yet, but it is a strong candidate for their project. If Launchpad were to adopt the AGPL v3, it may give the license the boost it needed to become a more significant license. And if more projects adopted the AGPL v3 it would help Clipperz develop their suite based around the AGPL.

Significant rejectors
Google Code Repository
The Google Code repository stirred things up when they announced that they would not host AGPL v3 projects. This week we were able to speak to Chris DiBona to ask him questions about why they did not want to host the license. The initial controversy revolved around their intentions behind rejecting the license. Some thought that Google Code did not want to host the license because it conflicted with their business model. But in our interview Chris stated that their intentions were to fight license proliferation. A few weeks back we also interviewed Marco Barulli from Clipperz on the issue, see (http://gpl3.blogspot.com/2008/05/gpl-project-watch-list-for-week-of-0523.html). Now both sides have been able to speak their minds' on the issue, so you, the reader, can make an unbiased decision on the subject.

---------------------------------------------------------------------------------------------------------------------------------------------------------------
Year Summary
Well, one year has passed since the release of the GPLv3 and LGPLv3. I'm not big on celebrating anniversaries just for the sake of time passing, but anniversaries do provide a convenient interval for measuring progress and events, so here are some of my thoughts on a few notable developments over the course of the GPLv3 and LGPLv3's one year of life so far:

Free and Open Source

In general, the past year has been significant for the world of Free and Open Source Software. The releases of the GPLv3, LGPLv3 and AGPLv3 garnered significant industry coverage and stimulated interest in the Free and Open Source Software movement in general. Sun's acquisition of MySQL in a $1 billion deal showed that software licensed under an open source license can be a viable part of "big business" in the software industry.

GPLv3/LGPLv3 – Released June 29, 2007

Increased focus on proper licensing documentation was a prominent issue early on in our coverage of the release and adoption of the GPLv3. Through our research on many projects, we found a noticeable number that had very little or sloppy documentation in their downloadable code and on the project's web site. Sloppy, outdated or nonexistent documentation, such as not including proper notice of the license, failure to provide a copy of the license or linking to the GPLv3 on the project web site when everything else in the distribution says GPLv2 is the governing license, weakens the ability of users and licensees to preserve the rights given to them by the GPL. At a minimum, I hope we were able to bring some visibility to this issue.

AGPLv3 – Released November 19, 2007

Released almost six months after the GPLv3 and LGPLv3, this may turn out to be the sleeper license hit in the years to come. With a growing shift in software toward a web-based "cloud computing" model, the AGPLv3 allows developers to choose to embrace the principles of openness and giving back as embodied in the GPLv3 with projects that are hosted remotely and interacted with remotely by users who never download the source code.

The announcement by Marco Barulli, co-founder of the Clipperz ( http://www.clipperz.com/ ) project, of the intent to develop an AGPLv3-licensed suite of web applications, was a great step forward and a positive boost for the visibility of the principles embodied in the license. See our interview with Marco in our May 23 blog post ( http://gpl3.blogspot.com/2008/05/gpl-project-watch-list-for-week-of-0523.html ).

-Kevin Howard
---------------------------------------------------------------------------------------------------------------------------------------------------------------
Counts for the Week
And of course our counts for the week, as we always do. The last week ended with 2721 GPL v3 projects, up 73 GPL v3 projects. The LGPL v3 count ended with 265 LGPL v3 projects, an increase of 14 projects. And lastly the AGPL v3 count ended with 118 AGPL v3 projects, 5 more than the week before.

---------------------------------------------------------------------------------------------------------------------------------------------------------------
Notable Mention
Palamida actively takes submissions from visitors on updates on new GPL v3/LGPL 3 projects. We are amazed at the number of submissions we have gotten to date, but even more so, we are incredibly grateful to over 100 core contributors who have devoted their time and resources at helping us provide up-to-date information.

The Research Group (rdgroup@palamida.com)

Ernest Park
Antony Tran
Edwin Pahk
Kevin Howard

********************************************************************************************************
For more information, go to http://gpl3.blogspot.com/.

To stop receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "unsubscribe:gpl3".

To start receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "subscribe:gpl3".

********************************************************************************************************

The GPL3 project, sponsored by Palamida, Inc (http://palamida.com/ ), is an effort to make reliable publicly available information regarding GPLv3 license usage and adoption in new projects. The work published on both sites listed below is licensed This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License .

********************************************************************************************************

Palamida was launched in 2003 after its founders learned first-hand what happens when companies don't have full visibility into the code base of their software applications based on Open Source Software. Their experiences inspired them to create a solution to streamline the process of identifying, tracking and managing the mix of unknown and undocumented Open Source that comprises a growing percentage of today's software applications. Palamida is the industry's first application security solution targeting today's widespread use of Open Source Software. It uses component-level analysis to quickly identify and track undocumented code and associated security vulnerabilities as well as intellectual property and compliance issues and allows development organizations to cost-effectively manage and secure mission critical applications and products.

For more information about FOSS management solutions, go to http://palamida.com/, or send a note to sales@palamida.com. Please mention the GPL3 site when you reach out to Palamida.

GPL Project Watch List for Week of 06/20/08

noreply@blogger.com (Unknown) — Sat, 21 Jun 2008 02:09:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for June 14th through June 20th, 2008.

This Week:

Week Summary
New Projects
Firefox 3
User Contributions

347 Days and Counting
In 9 days, the GPL v3 will have been out for a whole year, and our group will also hit its anniversary. This week we have passed 3000 GPL v3/LGPL v3/AGPL v3 projects, 3009 to be exact. Individually, the GPL v3 count is at 2648 GPL v3 projects, up 56 projects from last week. The AGPL v3 count is at 113 AGPL v3 projects, up 4 projects, and the LGPL v3 count remains at 251 LGPL v3 projects. It won't be much longer until the GPL v3 alone surpasses 3000 projects. Next week we will celebrate an early birthday for the GPL v3 and this group and recap on the significant events that have passed over the year.

New project conversions this week include:

Simple Server: A set of C++ classes to easily create a simple customizable multi-threaded TCP/UDP server application.
Gaia Ajax Widets: Gaia Ajax Widgets is an Ajax library for ASP.NET and Mono. It is a "high-level library", meaning it abstracts away JavaScript 100%, and the developer doesn't have to write anything other than his favorite .
multicronftp: Multi Cron FTP it's java utility used to execute ftp tasks over a set of hosts or schedule a single script in a cron-like fashion.

Firefox 3
This past Tuesday, Mozilla released the highly anticipated version 3 of their popular internet browser, Firefox. The release of Firefox, the second most popular browser on the market (only to Microsoft's Internet Explorer), started off with a bang, recording 8 million downloads over the first 24 hours. It is presumed to be a world record for "most software downloaded in a day", currently being reviewed by the Guinness Book of World Records.^[1] Created only 4 years ago by a small community of developers, Mozilla Firefox is now challenging Microsoft's Internet Explorer's throne to the browser market, making an even broader statement of the emerging prevalence of open source software in today's market.

Along with a number of bug fixes, Firefox 3 boasts an improved and faster interface, a few design tweaks and a number of new innovations, most notably the search by title function. This feature allows the user to search for previously visited sites by not only the website address, but also the title of the site making it easier for users to find previously viewed sites. A criticism of Firefox in its older releases is that they could hog memory over time, eventually forcing a browser restart. Firefox 3 needs a little less memory and doesn't keep nibbling away at your computer's resources over the day.^[2]Due to the open source nature of the browser, a key advantage of Firefox remains to be the availability of over 5000 add-ons on their site.

Although, the new features of Firefox 3 appear impressive, questions about the browser's security are somewhat left unanswered. Just hours after the release, security tool vendor TippingPoint was notified of a "critical vulnerability" affecting Firefox 3.0 and 2.0. The flaw could enable an attacker to run malicious code on a computer, the company said. Like other browser-based vulnerabilities, a person would have to click on a link in an e-mail or visit a malicious Web page to get infected.^[3] Although these issues may be somewhat alarming, it is a common misconception that because of the availability of its code as open source software, it is less secure than browsers like Microsoft's Internet Explorer.

Currently, Firefox garners 18.41% of the browser market, still significantly less than Internet Explorer's 73.75%, the most popular browser in the world.^[4] Although there is still a long way to go for Firefox to compete for the top spot, the fact that it has only been 4 years since Firefox's conception, as well as Microsoft's decided advantage by packaging Internet Explorer with Windows, makes Firefox's popularity and usage statistics that much more impressive. More so than the usage statistics, what was perhaps the most impressive aspect of Firefox 3's release was the coverage it received not only by tech and internet media, but by the major media outlets as well.

The progression and speed at which Firefox has been developing is a testament to the strength and benefits of the open source software market. Perhaps the most recognizable open source software name next to Linux, Firefox's importance in defining the future of software development will continue to be written by developers around the world. Thanks Mozilla, and keep up the good work.

-Edwin Pahk

References:

¹Associated Press. "Firefox 3: 8 Million Downloads in one day". The Dallas Morning News. 18 June 2008 <http://www.dallasnews.com/sharedcontent/dws/bus/ptech/stories/06_19_08dnbusDownloads.177b873f.html>

² Pegoraro, Rob. "Building a Better Browser: Firefox Keeps Innovating". The Washington Post. 19 June 2008 <http://www.washingtonpost.com/wp-dyn/content/article/2008/06/18/AR2008061802731.html>

³Gonsalves, Antone. "Firefox 3 Bugs Reported". InformationWeek. 19 June 2008 <http://www.informationweek.com/news/internet/browsers/showArticle.jhtml?articleID=208700715&subSection=All+Stories>

⁴ "Browser Market Share". May 2008 <http://marketshare.hitslink.com/report.aspx?qprid=0>

"http://www.austlii.edu.au/techlib/software/sino/

I noticed it had been released under GPLv3 after I downloaded the sources and
checked the licence.

This software has been developed and used for production purposes by Austlii
(http://www.austlii.edu.au/) for a number of years, and they ought to be
congratulated for making it available now under the GPL.

-Jason White"

Description:
Sino (short for "size is no object") is a high performance free text search engine written and maintained by Andrew Mowbray. It was originally written in 1995 and has been mainly used to provide production level search facilities for most of the Legal Information Institutes that form part of the Free Access to Law Movement.

Newest Release:
Sino Source (3.1.17)

****************************************************************************

Ernest Park
Antony Tran
Edwin Pahk
Kevin Howard

********************************************************************************************************
For more information, go to http://gpl3.blogspot.com/.

To stop receiving these weekly mailings, please send a message to http://www.blogger.com/rdgroup@palamida.com with the subject "unsubscribe".

********************************************************************************************************

The GPL3 project, sponsored by Palamida, Inc (http://palamida.com/ ), is an effort to make reliable publicly available information regarding GPLv3 license usage and adoption in new projects. The work published on both sites listed below is licensed This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License .

********************************************************************************************************

Palamida was launched in 2003 after its founders learned first-hand what happens when companies don't have full visibility into the code base of their software applications based on Open Source Software. Their experiences inspired them to create a solution to streamline the process of identifying, tracking and managing the mix of unknown and undocumented Open Source that comprises a growing percentage of today's software applications. Palamida is the industry's first application security solution targeting today's widespread use of Open Source Software. It uses component-level analysis to quickly identify and track undocumented code and associated security vulnerabilities as well as intellectual property and compliance issues and allows development organizations to cost-effectively manage and secure mission critical applications and products.

For more information about FOSS management solutions, go to http://palamida.com/, or send a note to http://www.blogger.com/sales@palamida.com. Please mention the GPL3 site when you reach out to Palamida.

GPL Project Watch List for Week of 06/13

noreply@blogger.com (Unknown) — Sat, 14 Jun 2008 04:17:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for June 7th through June 13th, 2008.

This Week:

Week Summary
New Projects
FOSS licenses based on US Copyright law
User Contributions

Two More Weeks...
Only two weeks until the anniversary of the GPL v3 license and the creation of this tracking project. We have come a far way and continue to bring relevant and accurate license information. We hope you have made use of our data and have enjoyed reading our blog.

This week our GPL v3 count is at 2592 GPL v3 projects, and increase of 59 GPL v3 projects. There was speculation as to whether the AGPL v3 would draw projects from the GPL v3 conversion rates, but this does not seem to be happening. The AGPL v3 count is up 7 projects bringing it to 109 AGPL v3 projects. The LGPL v3 number is at 251 LGPL v3 projects, up 9 projects from last week.

New project conversions this week include:

EasyVote: EasyVote is a new easy to use, secure and transparent cryptographic online voting scheme for small elections (up to 500 voters).
ERP4U: ERP4U / ERP for You / Enterprise Resource Planning for You -- Enterprise Resource Planning web based platform implemented on top of Ruby on Rails.
Bluetooth Remote: Control your computer using a bluetooth enabled mobile phone. Move the mouse cursor send key strokes and control the most common applications such windows media player, internet explorer, firefox.

The Open Source "Market" Killed the Tools Market
Though open source tools can be sold, many are offered for free by developers. The open source market is an odd one since the price of the code is, for the most part, just the time to download the software. The fact the most open source code is offered for free makes competition extremely hard you can imagine, which is a gripe of some commercial developers.

In a recent article, John De Goes argued that "The tools market is dead. Open source killed it." Open source has cut costs exponentially for developers, however they are restricted to the licensing terms of the code, which usually keeps it free and open. With so many open source tools now available for free, it restricts commercial companies from using price as a competitive tool since the open source alternative cost zero. So to be able to charge anything for a developer tool, the product would have to be significantly better than the open source alternative. Goes says that this also has a catch to this as well. The cost to learning a new IDE is quite high for most developers, since they are already use to the workings of their current one.

But is killing the tools market really such a bad thing. The death of the tools market was brought about from the birth of the open source market, and those in the open source market would argue that the benefits outweigh the loss. With open source, sharing code has eliminated countless hours rewriting code to do the same exact thing. And though this makes it nearly impossible to charge for your software, the creation of it is significantly easier.

Ohloh is a good site to put things into perspective. On their site, they show the projected cost of the project if it was done from scratch. Right away you can see that some projects would cost millions if not for open source. Subversion, for example, is projected to cost 5.2 million if a team was to write the code themselves. With these gains in cost efficiency, I would say the death of the tools market isn't so sad.

References:
http://www.ohloh.net/projects/subversion
http://tech.slashdot.org/article.pl?sid=08/06/10/0228220&from=rss

-Antony Tran

Thanks for the Continued Support and Contributions
Our database is partly maintained by our team of researchers as well by the contributions that are received from the community. Here is a submission we received last week through our web interface:

****************************************************************************
ApacheMap

Description:
The perl script parses a apache or apache2 combined access log for the IP addresses. It then looks up a Geo-Tag for those locations and if successful it adds them to a data file which the Google maps API then displays. So you get all your unique resolvable hits plotted on a map. From 0.3a onwards new style blue markers are used which contain information about the location when clicked on.

Newest Release:
apache-geo-map-0-6b.tar.gz
****************************************************************************

Ernest Park
Antony Tran
Kevin Howard

********************************************************************************************************
For more information, go to http://gpl3.blogspot.com.

To stop receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "unsubscribe".

********************************************************************************************************

The GPL3 project, sponsored by Palamida, Inc (http://palamida.com ), is an effort to make reliable publicly available information regarding GPLv3 license usage and adoption in new projects. The work published on both sites listed below is licensed This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License .

********************************************************************************************************

Palamida was launched in 2003 after its founders learned first-hand what happens when companies don't have full visibility into the code base of their software applications based on Open Source Software. Their experiences inspired them to create a solution to streamline the process of identifying, tracking and managing the mix of unknown and undocumented Open Source that comprises a growing percentage of today's software applications. Palamida is the industry's first application security solution targeting today's widespread use of Open Source Software. It uses component-level analysis to quickly identify and track undocumented code and associated security vulnerabilities as well as intellectual property and compliance issues and allows development organizations to cost-effectively manage and secure mission critical applications and products.

For more information about FOSS management solutions, go to http://palamida.com, or send a note to sales@palamida.com. Please mention the GPL3 site when you reach out to Palamida.

GPL Project Watch List for Week of 06/06

noreply@blogger.com (Unknown) — Sat, 07 Jun 2008 19:37:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for May 31st through June 6th, 2008.

This Week:

Week Summary
New Projects
FOSS licenses based on US Copyright law
User Contributions

Almost A Year Has Passed
The year has gone by quite quickly since the GPL v3 was first released. We have just entered into the month of the release, and it is only 23 days until a complete year has passed. It doesn't seem like we have been tracking the GPL v3 and its derivatives for a year, but it is more believable when you look at the count. Cumulatively, the GPL v3 and its derivatives have gained over 2800 adopters, which is an impressive number. Thousands of projects have, and now we can more confidently say thousands more will adopt the GPL v3, proving its significance in the open source community. The GPL v3 alone is now at 2533 GPL v3 projects, an increase of 62 GPL v3 projects. The AGPL v3 has gained 2 new projects, and is now at 102 AGPL v3 projects. And the LGPL v3 is now at 242 LGPL v3 projects. These numbers are considerably large and are still growing by the day. We will do a year summary to review all the key points over the past year for the anniversary of the GPL v3.

New project conversions this week include:

kjscompress: Command line tool to compress and obfuscate Javascript code and compress CSS code. (Based on KJS -- Javascript library included in KHTML.)
IT-Inventory: IT Inventory is a web based system for inventorying computers and other IT based equipment. You can also track repair orders for computers.
MySXP Open Platform: Application SAP like for win32, based on MySQL,and mixed with the egroupware politics and database compatibility.

FOSS licenses based on US Copyright law
Since most, if not all, US-based FOSS licenses are based on US Copyright law as defined in the US Constitution, all have this same "life of the creator plus 70 years" term, so length alone is not an advantage. Also, a work or creation is considered to be "copyrighted," at least under US law, as soon as it is "fixed in a tangible medium," which can mean bits saved on a magnetic disk. So while something may be "copyrighted," it is more difficult to enforce a copyright without a written registration with the US Copyright Office. Compare proving in a court of law that you "own" electronically distributed code merely by saying that you created it with being able to have documented proof that you are the author and registered the work on a particular date. To be in technical compliance with US Copyright law, and to maintain a copyright registration, the creator of a software project would probably have to periodically re-register the work as it grew and progressed, since adding new code is adding new "creative elements" which are in themselves copyrightable, but also change the original work enough so that it is something entirely different, thus requiring a new copyright.

In my opinion, it is actually a disadvantage to not license a work and leave it up to US Copyright law. If you look at the rights granted under US Copyright law ( http://www.copyright.gov/circs/circ1.html#wci ) you can see that the first three of those rights (right to reproduce, right to prepare derivative works, and right to distribute copies) seem to be pretty easily applicable to software code, but were obviously not originally conceived with electronic bits traveling around the Internet in mind.

So, not only do they not quite fit, they are fairly restrictive in terms of only granting any of these rights to the original creator of the work. So, before anyone can perform any of the "rights" related to the "work" granted to the original copyright holder, the original copyright holder must give permission. Combine the clunkiness of this method of permission with the instantaneous worldwide distribution system of the Internet and you have an unmanageable mess of trying to coordinate and keep track of who has what rights. Remind you of anything? Digital music?

FOSS licenses are written specifically for software code and define, to varying degrees, what can be done with that code and by whom. FOSS licenses are used by the holder of an original copyright in a creative software "work" to grant the permission ("license") mentioned above to others for others' use. FOSS licenses actually improve the efficiency of the open source movement. Keep in mind that the same rights granted under US Copyright law that are the foundation of FOSS licenses are the same rights that are the foundation of closed-source and proprietary licenses, so you can see that the structure of any given license can lead to dramatically different outcomes for what happens to software code depending on how various rights are granted or restricted.

-Kevin Howard

Thanks for the Continued Support and Contributions
Our database is partly maintained by our team of researchers as well by the contributions that are received from the community. Here is a submission we received last week through our web interface:

****************************************************************************
Gloss

Description:
Gloss is intended to be a drop-in replacement for the existing MythTV frontend. It is written in Python however uses the Clutter OpenGL framework with the intent of producing a visually richer interface than the existing MythTV frontend.

Newest Release:
gloss-0.1-rc1.tar.gz
****************************************************************************

Ernest Park
Antony Tran
Kevin Howard

GPL Project Watch List for Week of 05/30

noreply@blogger.com (Unknown) — Mon, 02 Jun 2008 04:12:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for May 24th through May 30th, 2008.

This Week:

New Projects
Clipperz Follow Up
AGPL v3 Hits 100 Projects
User Contributions

Congrats to the Grads
For those of you in school or have children that are, graduation has just passed for some or is soon approaching. We would like to congratulate all the graduates and wish you the best of luck in you career, especially if it involves open source *wink*.

This week our GPL v3 projects has grown to 2471 GPL v3 projects, which is in increase of 44 new GPL v3 projects. Our AGPL v3 count has just hit its first benchmark of 100 AGPL v3 projects, with the 5 new AGPL v3 projects that were added over the past week. And lastly, the LGPL v3 count is now at 236 LGPL v3 projects, in increase of 16 new LGPL v3 projects.

New project conversions this week include:

pion-platform: a development platform for Complex Event Processing (CEP)
freyrms: Based on OdinMS, FreyrMS strives to improve the functionality of the OdinMS Project.
domac: text edit/macro language, similiar to awk,sed, or m4. It can be embedded in other languages and allows comments anywhere, even inside instructions.

Follow up:

What is "zero-knowledge", and what does it mean to the growth of web services and information security?

From Marco Barulli, Clipperz

Dear Ernest, I'm happy to inform you that Richard Stallman finally agreed with the

"call for action" that I published on the Clipperz blog today.

It's a three step plan that combines free software (AGPL)

and the zero-knowledge architecture.

http://www.clipperz.com/users/marco/blog/2008/05/30/freedom_and_privacy_cloud_call_action

I am glad to say that you saw it here first.

Is this important? Sure it is. Marco Barulli is taking the risk of blazing the trail for web services developers to come. Is AGPLv3 the right license? Who knows. Is "zero-knowledge" the right architecture? Maybe yes, maybe no.

Zero-knowledge architecture is a web services framework in which secure information is distributed only to the endpoint, the service, through a secure and reliable framework that does not allow disclosure or residual existence of any user specific information.

In a service framework, providers enabling the connection from a user to the target service may have access to secure and potentially user specific data.

The zero knowledge architecture is one in which programmatic architecture and tools are put in place to hide and encrypt data in a format only usable by the intended service.

The AGPLv3 assures that the architecture and the source code is transparent and available for scrutiny, thereby insuring a clear implementation of secure practice that can be monitored and verified by the community.

While we as users get in the practice of complacency and trust, the idea of "zero-knowledge" allows the user to validate the secure and reliable implementation of security and data protection practices.

An interesting key point is the browser, our gateway to an OS neutral world of services.

The browser would need to let the user control how web service code, in this case, Javascript, is loaded, validated and run. While I can go into more detail here, Mr. Barulli does an excellent job of explaining here.

What is new here?
Clipperz is trying to provide an architectural guideline for how to develop and deploy web services that have an inherent high security, and a set of tools as a valuable starting point. Additionally, the idea that a user does not have to trust the developer or service provider for the protection of private data is smart. Is this novel? No. Is it needed? Of course. "Zero-knowledge" architecture is based on old ideas applied to a new web services paradigm. Trust nobody, encrypt, and double check everything. Clippers and the zero-knowledge concept is an old idea finding a proper place to start talking about transparent architecture which puts the responsibility of information security in the hands of the users. Is it perfect? Maybe yes, maybe no. It is licensed under AGPLv3, so Marco Barulli is inviting the community to grow what he started. Simple idea, great initiative. Well done.

AGPL v3 Hits 100 Projects
As stated in our project summary, the AGPL v3 has hit 100 projects by our count as of this week. This is an important benchmark for the license, seeing as it was uncertain if projects would want to adopt this derivative of the GPL3. 100 projects is by no means a large support group, out of the hundreds of thousands of projects, but it is a first step. This benchmark shows that the extra clause in the AGPL v3 that closes the ASP loophole, which requires "software as a services" to also release its code modifications is an important issue. Hitting this benchmark along with Clipperz proposed AGPL suite might just act as a catalyst to make the AGPL v3 a significant license in the open source community.

Thanks for the Continued Support and Contributions
Our database is partly maintained by our team of researchers as well by the contributions that are received from the community. Here is a submission we received last week through our web interface:

****************************************************************************
Sinatra

Description:
Sinatra is a free karaoke game for GNU/Linux. Sinatra puts your voice on top of the note sheet and gives you score for matching it good. Beat your own scores or battle in a duet, trio or quartet with friends and several microphones and sound cards. Sinatra was released February 16.

Newest Release:
Sinatra 1.0
****************************************************************************

The Research Group (rdgroup@palamida.com)

Ernest Park
Antony Tran
Kevin Howard

The GPL3 project, sponsored by Palamida, Inc (http://palamida.com ), is an effort to make reliable publicly available information regarding GPLv3 license usage and adoption in new projects. The work published on both sites listed below is licensed This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License .

For more information, go to http://gpl3.blogspot.com.

To stop receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "unsubscribe".

GPL Project Watch List for Week of 05/23, Special Interview With Marco Barulli From Clipperz

noreply@blogger.com (Unknown) — Sat, 24 May 2008 02:24:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for May 17th through May 23rd, 2008.

This Week:

Interview With Marco Barulli on Their New AGPL Suite
GPL v3 Numbers
New Projects

Interview With Marco Barulli on Their New AGPL Suite
This week we had the privilege of having a special interview with Marco Barulli, co-founder of Clipperz (http://www.clipperz.com/), who is working on a suite of web applications that are all under the AGPL. Clipperz, for those of you who are unfamiliar with the project, is a free and anonymous online password manager, and now they are working on a new open source project, and we have the first scoop. The Clipperz Community Edition was one of the first, if not the first, large project to adopt the Affero GNU General Public License and their group is a leading proponent of the license. In our interview, we gained insight to Clipperz stance on the AGPL, and we found out more information on their new suite.

Q: Why did Clipperz choose AGPL?

A: Clipperz source code has always been available under a reference
license in order to perform security reviews of our [online password
manager][1]. (Nobody should consider using a cryptography based
software solution that does not provide the source code! See the
[Kerckhoffs' principle][2].)

But then we felt that it was more appropriate to adopt an open source
license for several reasons:

1) coherence with our approach of complete transparency on any front:
code, money, strategies, ...

2) increase the chances to attract developers interested in writing
"zero-knowledge web apps" and improving the underlying crypto
libraries.

And eventually the advent of AGPL v3 provided the long awaited legal
framework for the protection of our code. Thanks FSF!

[1]: http://www.clipperz.com/
[2]: http://en.wikipedia.org/wiki/Kerckhoffs%27_principle

Q: Why are you launching a project that aims to build a suite of AGPL
licensed web applications?

A: Because today I can easily make my choices between Photoshop and Gimp,
Internet Explorer and Firefox, between free and proprietary software.
But the programs I use are steadily and quickly moving from my
computer to the web. In this transition I gain a lot (ubiquitous
access, seamless upgrades, reliable storage, ...), but I lose the
freedom to study, modify and discuss the source code behind my
programs.

Using web applications with an AGPL license, the above freedom is preserved.

You can think of this project as a GNU Project for the web, a set of
web applications that provides tools for the most common needs.
The suite should include: word processor, web chat, password manager,
wiki, address book, to do list, calendar, bookmark manager, ... But
each web apps must be released under an AGPL license! So forget
Google, del.icio.us, Plaxo, Meebo, ... at least unless they switch to
AGPL.

While the GNU Project was targeted mainly to software developers and
advanced computer users, the "AGPL suite" could bring free software to
the average user.

I'm aware it's a bold and probably not well thought out initiative,
but ... I like it!

Q: What is the link between this new project focused on AGPL and the
zero-knowledge architecture introduced by Clipperz?

A: The "AGPL suite" is only the first step on a path to bring more
freedom and privacy to the world of web applications.

At Clipperz we envisioned a new architecture paradigm called
"zero-knowledge web apps" (here a more [detailed description][3]) that
combines the idea of browser-based cryptography with a set of rules
focused on the "learn nothing" mantra.

[3]:
http://www.clipperz.com/users/marco/blog/2007/08/24/anatomy_zero_knowledge_web_application

The name was both an homage to cryptography (a "zero-knowledge proof"
is a standard cryptographic protocol) and a promise of a specific
relation between the application provider and the users. The server
hosting the web app would know nothing of its users, not even their
usernames!

Clipperz built its [online password manager][1] as the first
zero-knowledge web app and it worked quite well. Therefore it would be
wonderful to apply zero-knowledge techniques to each component of the
above "AGPL suite".

Converting an existing web applications to the zero-knowledge
architecture is not easy, but at Clipperz we have a considerable
experience on the subject and we will be happy to share our knowledge
and code base.

We grew accustomed to trust web applications with our data (bookmarks,
text documents, chats, financial info, ... and now [health
records][4]). Now it's time to to regain complete and exclusive
control of our programs and our data.
AGPL plus zero-knowledge architecture could do this!

[4]: http://googleblog.blogspot.com/2008/02/google-health-first-look.html

On to Our Numbers
We hope you enjoyed the interview with Marco Barulli. Maybe this early exposure to their new suite will bring more attention and projects to the AGPL to help them compile their suite. Speaking of which, our database now contains 95 AGPL v3 projects, up 9 AGPL v3 projects from last week and approaching its first benchmark of 100 AGPL v3 projects. The GPL v3 count is now at 2427 GPL v3 projects, an increase of 56 GPL v3 projects. And lastly, our LGPL v3 count is at 220 LGPL v3 projects.

New project conversions this week include:

cvtool / CVL: CVL is a library for image and data processing using graphics processing units (GPUs). Cvtool is a general-purpose computer vision tool that is based on the CVL library.
Celerity: Celerity is a JRuby library for easy and fast automation of web application testing.
OpenVista: OpenVista is the open-source version of VistA, which is an enterprise grade health care information system developed by the U.S. Department of Veterans Affairs (VA) and deployed at nearly 1,500 facilities worldwide.

Notable Mention
Palamida actively takes submissions from visitors on updates on new GPL v3/LGPL 3 projects. We are amazed at the number of submissions we have gotten to date, but even more so, we are incredibly grateful to the almost 100 core contributors who have devoted their time and resources at helping us provide up-to-date information.

The Research Group (rdgroup@palamida.com)

Ernest Park
Antony Tran
Kevin Howard

GPL Project Watch List for Week of 05/16

noreply@blogger.com (Unknown) — Sat, 17 May 2008 01:41:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for May 2nd through May 16th, 2008.

And We Are Back
As mentioned in our last posting, we have been making some changes to our database, so our numbers were stagnant up until yesterday. We have been changing our internal interface, to make our research more efficient and accurate. Most of the work is behind us now and our numbers are back up to date. For those of you who track our numbers carefully, you will have noticed the large jump in projects over the last couple days. That was partly from the completion of the changes as well as from inputing two weeks of data. We missed last weeks post due to the maintenance.

As of today, May 16th, our count for the GPL v3 is at 2371 GPL v3 projects. Since our last post, this is 160 new GPL v3 projects, which is the cumulation of over 2 weeks of projects. This matches with our estimate of approximately 50 projects per week. The AGPL v3 is still growing and is at 86 AGPL v3 projects, soon to hit 100 projects. And the LGPL v3 count is now at 219 LGPL v3 projects, up 19 projects since our last posting.

This Week:

New Projects
This Weeks Story: Storage and Computing "on the cloud"
See you later! LGPL's "or later" may be right now at discretion of the user.
User Updates

New project conversions this week include:

eyeEdu: eyeEdu is a web-based desktop (built from the eyeOS project), redesigned for the use of kids. Many applications are included that combine learning and fun, along with an intuitive kid-friendly interface.
AsmFile: AsmFile is a small and fast file manager written in assembler. It uses a two pane interface like "mc" and other file managers. AsmFile runs in a console or a terminal window.
Quakey: Quackey is a somewhat simplified but mostly feature-complete version of the Perquackey anagram word-building game.

Storage and Computing "on the cloud"

"Cloud services" such as online storage and computing resources have become a popular topic recently, with major players like Microsoft, Google and Amazon offering the use of fractions of their respective server farms to users. Amazon's Web Services ( http://www.amazon.com/webservices ) appears to be the heavyweight so far, offering unlimited computing and storage capacity and no monthly minimum service charges – you pay for what you actually use. However, it is oriented toward developers, not the regular consumer. Amazon's service is divided into a number of different functions developers might need, such as virtual computing environments, simple database querying, storage and a message queue service. These services are fully operational, not limited beta programs. Google's App Engine ( http://code.google.com/appengine/) is also available to developers, making Google's computing infrastructure available to them using Google's development tools. Google's App Engine is available only on a limited basis at this time.

A small sub-industry is developing around making developer-oriented resources like Amazon's available to consumers. Developers of products such as JungleDisk ( http://jungledisk.com/ ) an online backup and storage application, and DropBox ( currently in beta, http://www.getdropbox.com/ ), a content sharing and collaboration tool, write consumer-friendly front-ends to interface with Amazon's underlying cloud infrastructure.

Consumer-oriented storage services are also available. Microsoft's SkyDrive ( http://skydrive.live.com/ ), Microsoft's Live Mesh (coming soon - http://mesh.com/), AOL's Xdrive ( http://www.xdrive.com/ ) and Yahoo's Briefcase ( http://briefcase.yahoo.com/ ) are four examples from major players. These services are free, though storage space is limited (SkyDrive - 5GB, Live Mesh - 5GB, Xdrive - 5GB, Briefcase - 30MB) and allow users to upload files directly to the service, almost as if the service were an additional hard drive available to the user.

It will be interesting to see to what extent users and developers are willing to allow a third party store and manage their data and computing processes. One huge benefit to doing so is that users and developers have access to virtually unlimited computing and storage resources, available on-demand, which is paid for as it is used. No need to invest in your own server farm. It is unclear at this point whether any FOSS licensing issues will arise as a result of a user's local application interfacing with a cloud-based computing resource. For pure storage-type applications there doesn't appear to be any potential for FOSS licensing conflicts, but it is possible that a cloud-based infrastructure resource that plays a significant role in a tightly integrated computing process including local computing resources may warrant consideration of such licensing issues.

-Kevin Howard

References:
http://www.techcrunch.com/2008/04/15/cloud-file-services-springing-up-everywhere-but-wheres-my-gdrive/

http://blog.jungledisk.com/2008/05/06/another-cloud-storage-provider-enters-the-fray/
http://blogs.sun.com/jonathan/entry/opensolaris_amazon_mysql_and_glassfish

See you later! LGPL's "or later" may be right now at discretion of the user.

In July of last year, I posted an explanation of the reason that we give such significance to the "or later" option associated to the use of a GPL license. http://gpl3.blogspot.com/2007/07/gplv3-overwhelming-support-if-you-know.html. Matt Asay supported my well researched position on the impact of "or later". http://www.cnet.com/8301-13505_1-9798242-16.html

While I always want to believe that developers use our research and analysis of FOSS licensing, this is an example that was posted on the site. The biggest issue here is not that JasperReports is available under LGPLv3. the problem is that OSS licensing can be so complex that thinly staffed and over-worked development teams can unintentionally overlook how a license is implemented, the results of which can have unexpected implications.

As of this week, there are 6739 projects with releases licensed under GPL "or later". While I am sure that a number of these are representative of the support and solidarity that many developers have for FSF and GNU licenses, there may be a large number that are accidentally released under the latest GPL, at the user's choice.

***************************************************************************************************
Verified against version 2.0.5 on 5/16/08.

From JasperReport.java

/*
* ============================================================================
* GNU Lesser General Public License
* ============================================================================
*
* JasperReports - Free Java report-generating library.
* Copyright (C) 2001-2006 JasperSoft Corporation http://www.jaspersoft.com/
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307, USA.
*
* JasperSoft Corporation
* 303 Second Street, Suite 450 North
* San Francisco, CA 94107
* http://www.jaspersoft.com/
*/

******************************

******************************************************************************

This is from the LGPL v2.1, found at http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html

Note the specific language from section Titled "TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION", section 0 , which reads . . .

"Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. "

__________________________________

Taken from a comment posted on http://gpl3.blogspot.com/2008/04/gpl-project-watch-list-for-week-of-0418.html

Nick Halsey said...
A quick correction - JasperSoft has not yet adopted v3 of either the GPL or LGPL, though we are currently studying this option. Currently we license JasperReports under LGPL v2, and the rest of the JasperSoft Business Intelligence Suite under GPL v2.
April 23, 2008 7:36 PM
_______________________________________

After reviewing the information above, in this example, JasperReports version 2.0.5, licenses to a user to distribute and modify under the specific terms and conditions of the "GNU Lesser General Public License as published by the Free Software Foundation; either

version 2.1 of the License, or (at option) any later version", like version 3.

question: Is JasperReports release version 2.0.5 available under the terms and conditions of the LGPL v3?

While the developers chose to license the use of the software to be governed by the terms of the LGPL v2.1 and have not distributed an LGPLv3 release, it is possible that developers could download and redistribute JasperReports under LGPL v3.

answer: At the discretion of the users, as permitted within the terms of the license for JasperReports, maybe.

- Ernest Park

References:
http://hritcu.wordpress.com/2007/01/06/gplv2-or-later/

http://web.archive.org/web/20060620100612/http://www.fsf.org/licensing/licenses/gpl-faq.html#VersionTwoOrLater

Thanks for the Continued Support and Contributions
Our database is partly maintained by our team of researchers as well by the contributions that are received from the community. Here is a submission we received last week through email:

****************************************************************************
Métamorphose

"Hello,

....ust wanted to let you know my program is now on gpl3 since the last release earlier this year. The newer alpha version is also on v3.

cheers

- ianaré sévi"

Description:
A cross platform file and folder mass renamer, allows many different renaming operations in a GUI. Features include search and replace (with RE), insert, numbering, date/time, id3 & EXIF tag read, change length, get all files in sub-dirs, undo/redo, etc.

Newest Release:
1.1.0 stable
****************************************************************************

Ernest Park
Antony Tran
Kevin Howard

GPL Project Watch List for Week of 05/02

noreply@blogger.com (Unknown) — Fri, 02 May 2008 19:53:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for April 26th through May 2nd, 2008.

Site Under Going Maintenance
This week, as well as next week, our site will be undergoing maintenance to clean the database, standardize entries, and validate information. Our numbers will vary over this time period as we sort all the information out. Do not take the count on our site as a hard number, for now it is more of a place holder while we are fixing things up.
The numbers may fluctuate up and down a bit until we finish the validations and the migration to a new platform. During this time, if you have and questions about the numbers or any other topic that we have covered, please contact us at rdgroup@palamida.com or post a comment. We are happy to answer any individual questions while our general information is under construction.

New project conversions this week include:

OdinMS: OdinMS attemps to replicate the functionality of a Maple Story game server. It's fully cross platform due to its Java nature.
Catalyst Blackberry Plugin: Blackberry plugin allows synchronize Contacts and Calendar with Funambol server. This program is based on Funambol Blackberry Plugin Community Edition v. 3.0.8.
SpringSource Application Platform: SpringSource Application Platform is a completely module-based Java application server that is designed to run enterprise Java applications and Spring-powered applications with a new degree of flexibility and reliability.

Sourceforge Affero GNU Public License Listing
With the recent conflict with Google not hosting Affero GNU Public License version 3, people have been looking for other places to host their AGPL3 projects. One repository that does allow for this license is probably the first one most programmers would check, Sourceforge.net. I would like to clear up an issue that has not yet become a big problem, but may cause some confusion in the future. Sourceforge, in the past, has not supported the previous versions of the AGPL. The "Affero GNU Public License" was recently added to support the variant of the GPL v3, so it would not be correct to place AGPL v1 licenses in this category. More solid evidence for this is that the AGPL v1 is not a GNU license. Only the GPL v3 variant of the AGPL is a GNU license, therefore the "Affero GNU Public License" listing on Sourceforge.net should only be used for projects under the AGPL v3. This may cause confusion because their is no version attached to the category, but the "GNU" part of the license indicates that it should be used for the AGPL v3.

Notable Mention
Palamida actively takes submissions from visitors on updates on new GPL v3/LGPL 3/AGPL3 projects. We are amazed at the number of submissions we have gotten to date, but even more so, we are incredibly grateful to the almost 100 core contributors who have devoted their time and resources at helping us provide up-to-date information.

The Research Group (rdgroup@palamida.com)

Ernest Park
Antony Tran
Kevin Howard

GPL Project Watch List for Week of 04/25

noreply@blogger.com (Unknown) — Sat, 26 Apr 2008 03:02:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for April 19th through April 25th, 2008.

Happy Earth Day
In this green week where we support the protection of our environment, it is nice to work in the open source community that shares the same principals of efficiency and waste reduction. Over the past week 9 new AGPL v3 projects have been added to our database, which is a 13% increase in AGPL v3 projects, bringing the total to 77 AGPL v3 projects. The GPL v3 had a slow week with 28 new GPL v3 projects being added, bringing its total to 2212 GPL v3 projects. This is much lower than the average rate for the GPL v3, but it is only one data point. However, we are interested to see if the AGPL v3 redirects projects that would have adopted the GPL v3 or if projects that are currently under the GPL v3 switch over the the AGPL v3. This will be difficult to analyze, but we are keeping a close eye on the numbers to see if there are any significant shifts.

This Week:

New Projects
AGPL Booster

New project conversions this week include:

sgeng: Fully AJAXed and JSONed Web CMS. Fast and easy site creation. Content, news, messages, users management. Accounting, commenting, banning, tabs, simple BB-codes, news, inter-user messaging system and on-site searching systems.
InterLDAP: InterLDAP is a collection of modules designed around directories.
Butterfly Organizer: Butterfly Organizer is a PHP/MySQL solution for organizing web accounts. Butterfly Organizer has a simple and intuitive menu which helps you control the entire application.

GNU Affero General Public License May Get a Boost
Ubuntu's Launchpad may adopt the AGPL, as stated in a recent article by Matt Asay. This could be the project AGPL needs to get its foot in the open source door. As with the GPL v3, the key issues to its adoption is how many and who. Just as important as how many projects are adopting a license, is who is adopting. The two are linked and perpetuate the other, which is why it is important to keep an eye on both figures. As we have seen in the past weeks, the numbers are slowly but surely gaining for the AGPL but it is still lacking in big name support. Clipperz, a relatively large project, is already licensed under the AGPL, but more large projects need to adopt the license for it to take off as a license. Perhaps the fast rate of adoption of the AGPL, as well as all the press, brought Ubuntu's eye to the AGPL, but surely if Launchpad decides to use the license the rate will increase further.

References:
http://www.cnet.com/8301-13505_1-9927910-16.html?part=rss&tag=feed&subj=TheOpenRoad

Notable Mention
Palamida actively takes submissions from visitors on updates on new GPL v3/LGPL 3 projects. We are amazed at the number of submissions we have gotten to date, but even more so, we are incredibly grateful to the almost 100 core contributors who have devoted their time and resources at helping us provide up-to-date information.

The Research Group (rdgroup@palamida.com)

Ernest Park
Antony Tran
Kevin Howard

GPL Project Watch List for Week of 04/18

noreply@blogger.com (Unknown) — Sat, 19 Apr 2008 01:29:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for April 4th through April 18th, 2008.

AGPL v3 is Growing
Our database is being adjusted for the support of the AGPL v3 which is why there may be small inconsistencies last week and this week, but they will be sorted out by our next blog. This week our current GPL v3 count is at 2184 GPL v3 projects, an increase of 77 GPL v3 projects. Our LGPL v3 number is now at 200 LGPL v3 projects, an increase of 12 LGPL v3 projects.

Now onto our recently added license the AGPL v3. Last week our database contained 55 AGPL v3 projects. This week we are at 68 AGPL v3 projects, which is an increase of just over 20%. This is a significant increase percentage wise, even though it is only a 13 project increase. However, our prediction is that the adoption rate will rise in number and decrease in percentage as the current amount in the database grows.

This Week:

New Projects
Saas Story
LGPL v3 Hits 200
User Updates

New project conversions this week include:

cmsimple: CMSimple is one of the smallest, smartest and most simple Content Management Systems under the GPL or AGPL licence.
neo4j: Neo is a netbase — a network-oriented database — that is, an embedded, disk-based, fully transactional Java persistence engine that stores data structured in networks rather than in tables.
shogiserver: A Java-based server for the Japanese chess variant "Shogi". Features both a Java-based client and a Java-based server. The idea is to emulate the functionality of the popular Go server KGS (ability to play, observe, store, and review games in a group).

Its OK to Say No
With the recent release of the GNU Affero General Public License version 3 there has been controversy around open source repositories. The problem within the community is that certain repositories will not support particular licenses. But this has always been a problem with all repositories. Repositories are lacking in license options, as there is not a single repository that supports all and every version of licenses.

On the repository side, they are allowed to run their sites however they would like, under the terms that they see fit. Each repository has their own terms or are for particular languages or have some other standards that the projects hosted on it must abide by. The repositories set their rules and the projects in the open source community will join the hosting site that best fits their needs. There will be a natural sorting of all the projects into the existing repos. However, there can be problems once there is a change to open source, such as the AGPL v3. By introducing a new license, repositories must make a decision as to whether or not that license fits the standards by which they run their site by.

This is the main issue that we would like to discuss. It is perfectly fine for repositories to set their own guidelines, in fact they should, so that projects can be hosted on a site that fits their needs. However, when there is a change in the open source space, repositories should be swift and decisive in their decision on how they will handle it. For example, with the release of the AGPL v3 the Google Code repository stated that they would not host the license because it was not OSI-approved. However, when the license did become approved, they said they did not want to host the license because it was not popular enough. Given that both reasons were probably based in their belief of fighting license proliferation, this caused confusion and uncertainty for the projects hosted on the site and in the open source space in general. We would like to suggest that repositories are clear and decisive when there are changes in FOSS, whether it be a yes or no. This would help control the complications that come about with things such as new licenses.

References:
http://groups.google.com/group/google-code-hosting/browse_thread/thread/1714c5c0ef5d9f9f/7d59a938d295bb8f

LGPL v3 Hits 200
As of this week there are now 200 projects that are licensed under th LGPL v3. The LGPL v3 is a derivative of the GPL v3 that has less restrictions than the original. Some projects adopted the license because of this reason, and it has slowly gained a small market share in FOSS. Some projects that have adopted the LGPL v3 are Jaspersoft and OpenOffice.

The LGPL has served OpenOffice.org well, so the move to LGPL v3 seemed very logical. LGPLv3 is actually almost identical to GPLv3, but with an additional clause limiting the scope of the requirement to release source code under the same license. (http://blogs.sun.com/webmink/entry/openoffice_org_goes_to_lgplv3).

There are many license available for projects these days, and it is important for them to choose one that will protect their code as they see fit. Since there was controversy around the GPL v3 when it was released, concerning its requirements, the LGPL v3 may be better for those who are looking for a little more licensing freedom, while retaining the protection against software patents of the GPL v3.

Thanks for the Continued Support and Contributions
Our database is partly maintained by our team of researchers as well by the contributions that are received from the community. Here are some submissions we received last week through our online form:

****************************************************************************
CDS-PhP

Description:

CDS-PhP Lets bring service technical management of a computer, you can manage earnings equipment workshop, keep track of RMA, generating orders armed and maintain a stock of spare parts.

Newest Release:
CDS-PhP 3.0 Version
****************************************************************************
GNU SIP Witch

Description:
GNU SIP Witch is a pure SIP-based office telephone call server that supports generic phone system features like call forwarding, hunt groups and call distribution, call coverage and ring groups, holding, and call transfer, as well as offering SIP specific capabilities such as presence and messaging. It supports secure telephone extensions for making calls over the Internet, and intercept/decrypt-free peer-to-peer audio and video extensions. It is not a SIP proxy, a multi-protocol telephone server, or an IP-PBX, and does not try to emulate Asterisk, FreeSWITCH, or Yate.

Newest Release:
sipwitch-0.1.0.tar.gz

****************************************************************************

Ernest Park
Antony Tran
Kevin Howard

GPL Project Watch List for Week of 04/11/2008

noreply@blogger.com (Unknown) — Mon, 14 Apr 2008 06:08:00 +0000

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for April 4th through April 11th, 2008.

Tracking AGPL v3
This week we have incorporated the AGPL v3 projects we have found over the past months. We will continue to track this license to see how it progresses, seeing as it also has its fair share of controversy, much like the GPL v3. We have put the 55 AGPL v3 projects that we have found thus far into our system. We have also performed another audit on our database to take out any projects in error, so the numbers will be a little shorter than expected. In the last week we have also added 29 GPL v3 projects as well as 9 LGPL v3 projects. The AGPL has never been a large license, but since this version closes the ASP loophole, who some believe to be a flaw in the GPL v3, it is stirring up the community and may draw more adopters than its previous versions. Additionally, for those of you looking for a public forum to announce your next project version, check out our reader contributions regularly under "User Updates" herein.

This Week:

New Projects
Lucky Number 13 - Affero GPLv3 and interpreting Section 13
AGPL v3 and the Google Code Repository
User Updates

New project conversions this week include:

CiviCRM: CiviCRM is an open source and freely downloadable constituent relationship management solution.
Clipperz Community Edition: Clipperz Community Edition allows you to host on your own server a web service identical to Clipperz online password manager.
eyeOS: an Open Source Platform designed to hold a wide variety of Web Applications over it.
Funambol: Mobile 2.0 messaging, powered by open source.
picoplog: Picoplog is a minimalistic photoblogging tool. Picoplog's major strength is its simplicity: posting a photo is done by just uploading it to your web space.

Lucky Number 13 - Affero GPLv3 and interpreting Section 13
"Software as a Service" (SaaS) and "remote network interaction" are the latest catchphrases in software distribution. What's different, though, is that a "distribution" of code is not really taking place in these situations. At least not in the sense of an entire application being downloaded to a user's machine before being installed and used. The GNU Affero GPL version 3 (AGPLv3) was created in order to address this particular usage/interaction model.

The AGPLv3 has substantially the same license terms as the GNU General Public License version 3 (GPLv3) with the exception of Section 13, which deals with remote network interaction and the use of AGPLv3-licensed code with GPLv3-licensed code. We will limit this discussion to the remote network interaction portion of that section.

The majority of the "copyleft" power of the GPLv3, and consequently the AGPLv3 is the automatic application of its license terms to downstream recipients to whom a copy of the licensed source code has been "conveyed." The GPL/AGPL define convey as:

To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.

What is interesting is that the sharing of source code as stated in Section 13 of the AGPLv3 is not based on this definition of "convey." Instead, it appears to give users a new right to an opportunity to receive such source code if such source code is 1) modified; and 2) users interact with it over a computer network (if the modified version supports such interaction):

Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software.

The Free Software Foundation has clarified what it means to "interact with [the software] remotely through a computer network" on its FAQ for the GPL:

If the program is expressly designed to accept user requests and send responses over a network, then it meets these criteria. Common examples of programs that would fall into this category include web and mail servers, interactive web-based applications, and servers for games that are played online.

If a program is not expressly designed to interact with a user through a network, but is being run in an environment where it happens to do so, then it does not fall into this category. For example, an application is not required to provide source merely because the user is running it over SSH, or a remote X session.

So it appears that, in a SaaS arrangement, if a developer modifies the underlying AGPL-licensed source code for the program that the opportunity to receive such source code must be prominently offered to all users who interact with the program remotely over a computer network. Since the requirement that a developer prominently offer such users this opportunity is not based on "conveying" the program's source code, it also appears that if a developer merely uses an existing program without modification that the requirement to prominently offer to users the opportunity to receive the original source code does not exist.It will be interesting to see how SaaS developers, vendors, users and others actually interpret and use these provisions in the AGPLv3 as the license is adopted and used.

-Kevin Howard

References:
http://www.gnu.org/licenses/agpl.html
http://www.gnu.org/licenses/gpl-faq.html#AGPLv3InteractingRemotely
http://egofood.blogspot.com/2008/03/updates-soc-orgs-selected-funabol-ceo.html

AGPL v3 and the Google Code Repository
Since the release of the AGPL v3 in November, there has been some head butting with some members of the open source community and those who run the Google Code repository. Closing the ASP loophole, some say, threatens the business model that Google was built on. By closing the loophole, if Google wanted to use a project under the AGPL v3, they would have to release any changes they make to the code for use as a service as well as distribution.

*************************************************************************
"Makes perfect sense (that Google does not support the AGPL v3) , really. Google has made bazillions of dollars using free software in their backend without having to release any of their modifications back into the world. Something like the AGPL which requires server-side modifications to also be released is a direct threat to their way of doing business. Refusing to add AGPL to the list of open source licenses on Google Code to help promote is unsurprising, and in fact expected."

-Russel Beattie
*************************************************************************

However, the staff at the Google Code repository is taking a considered approach to managing the various projects hosted there and their associated licenses. One method of doing this is not hosting projects with code licensed under every new OSS license that is released. If they hosted projects under every new custom license that maintainers submitted there would eventually be a glut of dead projects with unusable licensing terms, a condition unfortunately too common at existing popular FOSS repositories. They recognize and address the fact that new licenses need time to be put into practice and used before they are more fully understood and worthy of support. The AGPL contains new terms that deal with a new software usage model, so from the perspective of the Research Team, Google Code is merely proceeding cautiously.

*************************************************************************
"Basically the answer is when I (Chris DiBona, Open Source Programs Manager, Google Inc.), Fitz, Greg or the team think it is popular enough. I know you guys think we don't like it for nefarious reasons, but what you're missing is we dislike -all- new licenses that
are unpopular. They lead to bifurcation of the open source development
world and that is a high price to pay.

I (Chris DiBona) personally think the AGPL is deeply flawed, and I've commented on
that on my own blog and on others, but that really -doesn't- matter.
If the AGPL gets to be popular, like lgpl or bsd popular, than we'll
certainly offer it as an option on code.google.com, but until then,
it'll be a judgment call on our part. One you might not agree on, but
that's okay."

-Chris DiBona
*************************************************************************

We are not going to choose sides in this debate, but what we will do is provide unbiased AGPL v3 adoption numbers to help resolve this issue. Both sides have made their points, and hopefully our research will provide the necessary data to end this controversy.

References:
http://www.russellbeattie.com/blog/google-hates-the-agpl-not-surprising
http://www.clipperz.com/users/marco/blog/2008/04/04/clipperz_not_welcome_google_code
http://groups.google.com/group/google-code-hosting/browse_thread/thread/1714c5c0ef5d9f9f/7d59a938d295bb8f

User Contributions
Our database is partly maintained by our team of researchers as well by the contributions that are received from the community. We have received email contributions to our R&D Group email (rdgroup@palamida.com) of projects moving to the AGPL v3 license. Here are the two contributions we received last week:

******************************************************************************************
Picoplog "Dear Palamida researchers,
I'd like to inform you of another project that is using the AGPL. It's a photoblogging tool, its name is Picoplog. http://daubau.it/picoplog/

Like many others, we chose the AGPL because we're aware of the infamous "ASP loophole". We don't like companies bypassing the spirit of the GPL in that way."

Description:
Picoplog is a minimalistic photoblogging tool. Picoplog's major strength is its simplicity: posting a photo is done by just uploading it to your web space.

Newest Release:
Picoplog 0.9.1 Alpha - Released on March, 29 2008

******************************************************************************************
Clipperz Community Edition
"Hi, I would like to inform you that Clipperz Community Edition has been recently released under an AGPL license. Clipperz is a web-based password manager. Learn more here: http://www.clipperz.com/. "

Description:
You can think of Clipperz as your web Rolodex, a card index where you can enter any sort of confidential data without worrying about security. It can be used to store and freely organize passwords, confidential notes, burglar alarm codes, credit and debit card details, PINs, software keys, …

Clipperz does solve the “password fatigue” and make the Internet the most convenient and safe place to store private and sensitive data. However since passwords are the most common type of sensitive information that you need to protect, we added a lot of functionalities to make Clipperz the best online password manager.

Newest Release:
Clipperz Community Edition, version revision 003 is available from SourceForge.net.

*************************************************************************

We appreciate all the contributions that have been made, either through our form on our web page or by email, and we also like to hear why you are changing your project's license as in the email above. It gives us more insight into which direction license trends are moving. We will continue to post up user contributions to our blog each week, and we may quote parts of your emails. If you wish the email to remain private, just mention so and we will not disclose any part of it.

Much Appreciated,

Palamida R&D Group

Notable Mention
Palamida actively takes submissions from visitors on updates on new GPL v3/LGPL 3 projects. We are amazed at the number of submissions we have gotten to date, but even more so, we are incredibly grateful to the almost 100 core contributors who have devoted their time and resources at helping us provide up-to-date information.