The Case against Open Source

Every now and then I'm up pretty early on a Wednesday morning and if my Squeezbox radio happens to be on I'm probably going to hear at least part of Randal Schwartz's weekly window into all things Open Source, Floss Weekly.

Randal's a nice enough guy and if we're honest one of a scarce few real geeks left on TWIT...

So I listen for awhile.  That is, up until the content ends and the propaganda starts...

The premise of Open Source is sound enough.  It's community driven often filling a need that's either not being adequately addressed by more traditional offerings or breaks new ground.  It also gives budding tech types somewhere to try out their ideas without fear of running afoul of someone else's copyright.  Of course it also has the frequent advantage of being free of charge in hopes of continuing development and maximizing distribution.

It's how Linux, Apache Web Server and Wordpress came to be. 

Considering much of what you see on the web depends on at least one of those open source projects there's a strong case for community driven alternatives.

Which would normally be the end of the story but for the past few years where a number of projects have been taking aim at the enterprise.  Everything from telephony to CRM is in the mix.

Which is fine so long as you've got support for them.

And there's the rub....

In the landscape of current technology solutions you really have two options.  You can pay a lot of money now for somebody else's pre-packaged whatever or try an Open Source alternative and pay someone to make it work later.

That is the dichotomy of so-called "Open" and "closed source" projects. 

Open source sprang from the belief that software development should not be a dark art kept in bowels of some mega corporation who controls its every permutation.  Anyone who's dealt with botched Microsoft updates bringing their business to a standstill can identify with that.

The Microsoft's of the world may be more user friendly and better supported but they're by no means perfect.  

Customization is limited and new features often only come with a new version which starts a whole new round of checkbook bleeding.

That's supposedly one of the advantages of Open Source.  Being community driven, changes happen more quickly and development is more responsive to the user base.  But what is perceived as a strength becomes a weakness when you realize that the word "community" can easily be replaced by "mob rule."

Just because updates come along more frequently doesn't mean the problem you're having gets resolved or the feature you want will show up. The squeaky wheel gets the grease as they say and if your problem isn't at the top of the community's list of priorities you're pretty much out of luck.

There's also the possibility that an update actually makes a problem worse or breaks unrelated services.  Something very common especially in the Linux world.

Of course you could always try to fix it yourself. There's plenty of White Papers, community forums and support avenues available.  Or at least that's the sales pitch.

The real story is that White papers, those tomes of wisdom, are written by developers... for developers.   If you don't speak the language they're little more than insomnia cures.  Ever read a phone book?  It's like that.

Riveting...

Community forums?  Those are fun too.  Populated by the equally afflicted and rarely served.  You may get lucky and get an answer but most of the time it's just a lot of wailing followed up by arrogant guru types belittling hapless victims for not reading the white paper more closely.

So much for the "community"

How about support directly from the development team? 

See above...

Even if there are thousands of contributors to a project, development usually ends up being controlled by a select few.  Infighting is frequent and is the primary reason you see so many variants of the same core project.  It splinters the community and makes support even more difficult.

Established projects aren't immune from the chaos and code rot either. Take the example of the popular open source web hosting control panel Zpanel.  Zpanel is a free alternative to the commercial Cpanel product offering a similar experience for far less cost (as in free).  

Unfortunately, it hasn't been updated in a year and much of the functionality is broken leaving users flailing while the "official" support team remains silent.

It's gotten so bad that the dev team actually shut down the public support forum shortly after a user reported a security issue to them which even when proven was subsequently denied.  In short a promising stable project has become broken due to ego and neglect.  A post-mortem that's all too common.

Still, If you want to sign up with Zpanel's official maintainer, Hostwinds, you may get some support, if you pay for it.  They call it "Premium" support and require a paid Hostwinds account.

Let's also remember that Open Source devotees often cite superior security of their wares.  That can be true but only so long as somebody's paying attention.  Apache has had numerous security flaws for example so too has OpenSSL and lest we forget the granddaddy of them all a BASH shell vulnerability that went unchecked for 20 years.  Yes, technically BASH isn't Open Source but its code is and it's maintained the same way.

Don't get me wrong, there's nothing wrong with paying for support.  It's been the foundation of many Independent consultants for years. 

What is wrong is foisting an unstable product on a hapless user base and then charging them to fix your own mistakes.  

Even Microsoft will refund a support charge if they find out it's their problem.

In the case of Zpanel their only response to the charge is that it's a product created on their own free time and thus isn't a priority.

So much for pushing the state of the art...

Read the next excerpt I took straight from Opensource.com, a leading Open Source publication...

Doesn't "open source" just mean something is free of charge?

No. This is a common misconception about what "open source" implies. Programmers can charge money for the open source software they create or to which they contribute. But because most open source licenses require them to release their source code when they sell software to others, many open source software programmers find that charging users money for software services and support (rather than for the software itself) is more lucrative. This way, their software remains free of charge and they make money helping others install, use, and troubleshoot it.

In other words, if you expect the same kind of experience you get from closed sources you're going to pay for it either in time or money.  Nothing is free.

There's a common quip when describing the "Free" nature of Open Source.  They say it's "Free" as in speech not "Free Beer."

Cute but oversimplified.

In a world built on consumerism, free speech doesn't hold a candle to free beer.   Besides, If you accept the Open Source view of freedom then "free speech" ends up unintelligible gibberish.

Which coincidentally is a lot like your support options.

There are just far too many projects out there that are the very antithesis of usability unless you're the type that likes to write Apache modules for fun.  Many are bleeding edge offering promise but in any other realm they'd be considered an "Alpha" release.

Do they really want me to put my neck on the line for an ideology?

I'll put it this way.  If you're ok with rolling out a "Developer Preview" of the Windows operating system (aka: Beta) to your entire enterprise then you're probably ok trusting that same enterprise to poorly supported open source software.

There's a history in Open Source that goes beyond just sticking it to the establishment.  It hearkens back the days when computer guys had all the answers.

Open source is where the gurus go.  You can trace its roots to the custom applications that literally held business hostage in the early days of enterprise computing.  Back then business wanted computerization but there were very few who knew how to make it work.  There were no Microsoft's just hardware and a few people that knew how to press the right buttons and work the magic.  Those people held the keys to the kingdom tightly.

The inroads of Windows and Mac operating systems in the early 90's eliminated the need for such exalted wizardry.  Any bright kid with a couple of exam cram books could run an enterprise.  The wizard gurus were none too pleased to see their grip on power loosening.

Ok so that's a bit melodramatic but there was definitely a lot of ego bruising going on when the PDP-11's got kicked to the curb.  I'm in danger of flying off on a tangent that sounds like something found in a Tolkien trilogy so I'll just wrap up this thought with this. 

There's a reason there's so much bile hurled at the likes of Microsoft by the Open Source community.  Contrary to the marketing, It's not about some David vs. Goliath battle.  It's simpler than that.  It really comes down to ego and wanting back the days when the Uber Geek held all the cards.

Control the Information and you control the world. 

They eschew anything "packaged" instead touting the virtue of getting one's hands dirty.  To hell with those "lazy" users wanting everything "handed" to them.  Every child should know C-Sharp by the age of 3!

They don't get it.  They just can't understand why everyone doesn't want to be a part-time software engineer.  Which is the root of the attitude and the reason why Open Source tends to have a narcissistic vibe even while proclaiming the democracy of a community.

If the masses will not be turned they will be ruled...

Phew!

Who knew it was so political!

It's not all bad, however, and there are good ideas and good projects out there but there's no guarantee they'll stay that way.  Projects can start out with lofty aspirations but most are just some poor Joe looking to fix his own issues.  Once the problem is solved the project is abandoned.  

As such, the world of Open Source is a wonderful laboratory but little more.  A place to try new approaches and work out the bugs but not to trust an entire enterprise to unless someone has taken it to the next level as in the example of Red Hat Enterprise Linux (RHEL. )

Even then a competent talent pool to administer it will be much shallower than its competition and more expensive since it's still a niche skill set.

The bottom line is this.  No business should be held hostage by what is all too often the product of a hobbyist's whim who got inspiration from an Internet forum.  

Yes there are serious Open Source initiatives out there but most of them aren't ready for prime time and if their devs are honest with themselves, never will be. 

Open source is great for advancing the art but artists make bad businessmen.  

Why Heartbleed Happened

Originally published on Kupeesh!

So what's up with all this HeartBleed nonsense?

What could possibly be behind the greatest crisis in Internet security since the invention of phishing emails?

How could this possibly happen?  What could possibly jeopardize the security of thousands of websites and secure services we take for granted like Google, Tumblr and even banking sites?

I have an easy answer and it points right back to the Achilles heel of Open Source. 

While proponents will argue the merits of solutions that don't come from commercial sources the one inescapable fact of Open Source software is that it's developed under mob rule.

Therein lies the problem. 

While nobody questions the benefits of Open Source software like cost and ease of customization, proponents tend to gloss over the fact that some projects are better managed than others.

Take the case of OpenSSL.  It's the foundation for thousands of web services like Google, Yahoo and even your bank.   Except that somebody wasn't minding the store and for two years the mechanism that was supposed to secure your communications...didn't.

The flaw was inadvertently discovered by Google's Neel Mehta during a routine security sweep but the flaw had been in existence for 2 years.  Overlooked by one of OpenSSL's core developers, Stephen N. Henson, the vulnerability came as the result of additional but apparently untested new functionality known as a Heartbeat for OpenSSL.  The functionality was supposed to function as little more than an "I'm still here!" beacon to whatever service you're connected to.  

The short of it is this...

The problem comes from not bothering to check that what's sent matches what was requested.  A crafty hacker can take advantage by continually sending heartbeat requests claiming to be of a certain size but not actually being that size.  The server dutifully responds by sending back a response of the claimed size to the client and inadvertently dumping the contents of its memory to fill the otherwise empty space of the response.  The contents of which have been shown to contain user credentials among other compromised information.

It's apparently a simple fix but it's taken two years for anyone to notice. 

Meanwhile, nobody knows how long the bad guys have been aware of the flaw.  How can something like this get by the supposed vigilance of security gurus and major corporations alike? 

I can tell you how, it's endemic, it's cultural and it's arrogance...

It's a misguided belief that oversight of a product is best left to a community regardless of its qualifications to do so.  A community that frequently finds itself more concerned with the technical wizardry of its products than the users who deploy them

It's the same mindset that's kept other Open Source offerings like Linux in the shadows of Windows.  Let's be honest here.  You can only stomach so many unintelligible whitepapers or narcissistic support forum posts before you just give up.  The inmates are indeed running the asylum...

Heartbleed shines a light on the failure of the Open Source community in that it lays open the lack of even the most basic oversight of a critical and widely used service.  It's not so much about the failure of OpenSSL but rather that nobody including its chief stewards noticed the problem for two years.

This is nothing less than a reality check on the entire Open Source community.  One that should be raising questions in anyone that relies on their wares.