Click here to close now.

Welcome!

Microservices Expo Authors: Sematext Blog, Baruch Sadogursky, Elizabeth White, Liz McMillan, Carmen Gonzalez

Related Topics: Open Source Cloud, JAVA IoT, Microservices Expo, Containers Expo Blog

Open Source Cloud: Article

Buying Proprietary Software?

Protect your organization from open source surprises

Open source software has probably been the biggest driver of complex software solutions in the last decade. Access to a large variety of quality, peer-reviewed software has accelerated product development, reduced product introduction intervals and lowered the costs for producers of software and for those of us who leverage third-party software in our projects.

Many of us have heard about the trouble that organizations have come across when using open source improperly... remember Cisco/Linksys, Katzer, and the BusyBox chronicles? You may think that your organization is safe because you are buying proprietary software. However, if your software supplier unknowingly incorporated open source into its product, your organization may face unexpected legal and financial consequences arising from open source licensing obligations and the resulting intellectual property infringement claims. The good news is that there are various tools available at your disposal that can assist your organization in protecting itself from such open source surprises, such as contractual measures such as representations and warranties and indemnities; and extra-contractual tools such as software audits and a structured Open Source Software Adoption Process (OSSAP).

Some Basics About Commercial Contracts Relevant to Software Purchases
Commercial contracts include various provisions that protect and allocate risk among buying and selling parties. Among the most important are representations and warranties ("reps and warranties") and indemnities. Reps and warranties are assurances made by one party that are intended to provide certainty to the other party that relies on them. For example, a hypothetical software company ("Softco Supplier") may represent and warrant that it owns all of the intellectual property rights in the software it sells. If Softco Supplier does not in fact own all of the intellectual property rights in the software, the buyer ("Softco Buyer") has a right to claim damages for Softco Supplier's misrepresentation.

However, in many instances it is impossible for contracting parties to fully guarantee the accuracy of a statement. In these cases, parties opt to provide reps and warranties that are qualified by the knowledge of the party providing them. These types of reps and warranties can be problematic from the perspective of the party that seeks to rely on them. We will return to this in the following section, which specifically deals with the application of reps and warranties, and indemnities to open source.

Indemnities provide security against losses that are triggered by the occurrence of contractually specified events. Unlike reps and warranties, recovery from indemnities is not contingent upon whether a misrepresentation was made. In our example, if Softco Supplier (the "indemnitor") indemnifies Softco Buyer (the "indemnitee") for any intellectual property infringement claims against the software being sold, then in the event that such claims arise, Softco Supplier is obligated to compensate Softco Buyer for its losses.

Reps and Warranties vs. Indemnities in an Open Source World
In the software procurement context, it's important for buyers to determine whether open source code is incorporated into the software that is being purchased. The primary reason for this is that open source license obligations are binding. Failure to comply could have a diminishing impact on software value, as some open source cannot be mixed into products that have trade secret value. In addition, if a buyer purchases software without the knowledge that it includes open source, the buyer runs the risk of commercializing the product in a manner that violates the license that covers the open source code. This can leave the buyer exposed to costly intellectual property infringement claims.

The recent focus on open source reps and warranties and indemnification is linked to the growing instances of intellectual property infringement claims involving open source software. As courts in the United States, Germany and elsewhere have acknowledged the enforceability of open source licenses, notable violators have succumbed to costly settlements, and enforcement organizations such as the Free Software Foundation have become more aggressive in launching suits.

Because of the immense financial and legal implications of intellectual property infringement suits, a software buyer will often require its supplier to represent and warrant that the software being purchased does not contain any open source code. If open source is later discovered in the software, the buyer is entitled to seek damages from the supplier for the breach of the representation. However, as mentioned earlier, it's often difficult for contracting parties to fully attest to the accuracy of a representation. This situation arises in instances in which the contracting party experiences knowledge gaps. In these cases, a contracting party will seek to limit its liability by narrowing the representation to apply to the knowledge that it possesses. Taking our earlier example, if Softco Supplier had acquired code from a third party, or engaged in outsourcing of programming, it may not be positioned to fully attest to the fact that the software it sells does not contain any open source. As a result, Softco Supplier will represent and warrant that ‘to the best of its knowledge, open source is not incorporated into the product.' In this case, Softco Buyer is only entitled to damages if it can show that Softco Supplier knew that its representation was untrue at the time that it was made. If this fact cannot be established, Softco Buyer is left without a remedy for any losses arising from Softco Supplier's misrepresentation.

Unlike reps and warranties, recovery from indemnities is not contingent upon whether a misrepresentation was made. Thus, if Softco Supplier indemnified Softco Buyer for open source infringement claims against the software, Softco Supplier would be obligated to fully cover the losses arising out of any such claims. In this case, it would be irrelevant whether Softco Supplier had knowledge of the presence of open source, as liability is triggered by the occurrence of the contractually specified event (the presence of open source) rather than the misrepresentation made by Softco Supplier.

Buyer's Duty
Another important distinction between reps and warranties and indemnities in our example is in relation to the duty imposed on Softco Buyer to mitigate its own loss. Common law imposes a requirement on parties relying on reps and warranties to take action to mitigate their own losses. In the context of open source reps and warranties, once a software buyer becomes aware that open source is embedded in the software, the buyer must take action to minimize its loss, for example by immediately replacing the code, or making the code freely available. In contrast, there is no parallel requirement for the beneficiaries of indemnities to mitigate their own losses.

Software Audit Can Minimize Exposure
Although open source reps and warranties and indemnities can provide software purchasers with remedies for losses arising from intellectual property infringement suits, they cannot shelter the buyer from being sued in the first place, or from experiencing the loss of goodwill in relation to litigation. As a result, reps and warranties and indemnities should not be regarded as due diligence replacements. Rather than taking the risk of open source surprises, software purchasers can engage resources (internal or external) that have the ability to analyze software to determine the presence of open source prior to executing the purchase.

A software audit entails code scanning aimed at detecting third-party and open source code. After the scanning stage, the purchaser is provided with an audit report detailing the identified code and associated license obligations. Performing such audits at the pre-purchase stage allows the buyer to understand whether the license obligations of the open source code are in line with the intellectual property policies of its organization, and if not, then the buyer is positioned to request the supplier to replace the code in question, or to engage an alternate supplier.

Software Audit in the Supply Chain
One of the contexts in which software audits are particularly beneficial is in the supply chain. Shortly after Cisco acquired Linksys in 2003, it was faced with an infringement suit relating to the use of GPL covered code in its router firmware. It turned out that the infringing chipset was provided to Linksys by Broadcom, which in turn outsourced the development to a third party. As a part of the settlement that was reached, Cisco was forced to make the infringing source code freely available on its website, appoint an open source compliance officer, and make a monetary contribution to the Free Software Foundation. As the Cisco case suggests, software audits can be a helpful tool at the pre-purchase stage when dealing with a supply chain context in which the immediate supplier has little control or knowledge over the code pedigree of the final product.

Review of Available Contractual Tools
Software purchasers have contractual tools (reps and warranties, and indemnities) at their disposal to protect their organizations from open source liabilities; however, it is important to remember that not all tools provide equal protection. While reps and warranties can provide the buyer with a remedy against misrepresentation, in instances where these assurances are qualified by the knowledge of the supplier, the buyer may be left without recourse. From this perspective, indemnities offer increased protection to software purchasers concerned about intellectual property infringement claims in relation to the use of open source.

Open source indemnities are also beneficial in comparison with reps and warranties, as they do not impose an obligation upon the party relying on them to take any action to minimize their own losses in the event of a breach.

Although open source reps and warranties and indemnities can provide software purchasers with means of recovery from intellectual property infringement claims, these contractual measures provide for an imperfect after-the-fact solution to a problem that lends itself well to management practices that would reduce the risk in the first place. Structured open source license management practices and software audits aimed at identifying third-party and open source code and ensuring open source compliance provide an optimal level of protection. These tools provide certainty regarding code pedigree, and enable software purchasers to avoid the negative consequences arising from intellectual property infringement suits.

More Stories By Diana Marina Cooper

Diana Marina Cooper obtained a BA in Politics and Governance and a MA in Globalization Studies. She is currently a JD Candidate (2013), and is pursuing a concentration in Law and Technology. Follow Diana @Diana_M_Cooper

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@MicroservicesExpo Stories
The release of Kibana 4.x has had an impact on monitoring and other related activities.  In this post we’re going to get specific and show you how to add Node.js monitoring to the Kibana 4 server app.  Why Node.js?  Because Kibana 4 now comes with a little Node.js server app that sits between the Kibana UI and the […]
How can you compare one technology or tool to its competitors? Usually, there is no objective comparison available. So how do you know which is better? Eclipse or IntelliJ IDEA? Java EE or Spring? C# or Java? All you can usually find is a holy war and biased comparisons on vendor sites. But luckily, sometimes, you can find a fair comparison. How does this come to be? By having it co-authored by the stakeholders. The binary repository comparison matrix is one of those rare resources. It is edite...
As the world moves from DevOps to NoOps, application deployment to the cloud ought to become a lot simpler. However, applications have been architected with a much tighter coupling than it needs to be which makes deployment in different environments and migration between them harder. The microservices architecture, which is the basis of many new age distributed systems such as OpenStack, Netflix and so on is at the heart of CloudFoundry – a complete developer-oriented Platform as a Service (PaaS...
T-Mobile has been transforming the wireless industry with its “Uncarrier” initiatives. Today as T-Mobile’s IT organization works to transform itself in a like manner, technical foundations built over the last couple of years are now key to their drive for more Agile delivery practices. In his session at DevOps Summit, Martin Krienke, Sr Development Manager at T-Mobile, will discuss where they started their Continuous Delivery journey, where they are today, and where they are going in an effort ...
There is no question that the cloud is where businesses want to host data. Until recently hypervisor virtualization was the most widely used method in cloud computing. Recently virtual containers have been gaining in popularity, and for good reason. In the debate between virtual machines and containers, the latter have been seen as the new kid on the block – and like other emerging technology have had some initial shortcomings. However, the container space has evolved drastically since coming on...
The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long development cycles that produce software that is obsolete at launch. DevOps may be disruptive, but it is essential. The DevOps Summit at Cloud Expo – to be held June 3-5, 2015, at the Javits Center in New York City – will expand the DevOps community, enable a wide...
Cloud Expo, Inc. has announced today that Andi Mann returns to DevOps Summit 2015 as Conference Chair. The 4th International DevOps Summit will take place on June 9-11, 2015, at the Javits Center in New York City. "DevOps is set to be one of the most profound disruptions to hit IT in decades," said Andi Mann. "It is a natural extension of cloud computing, and I have seen both firsthand and in independent research the fantastic results DevOps delivers. So I am excited to help the great team at ...
Container technology is sending shock waves through the world of cloud computing. Heralded as the 'next big thing,' containers provide software owners a consistent way to package their software and dependencies while infrastructure operators benefit from a standard way to deploy and run them. Containers present new challenges for tracking usage due to their dynamic nature. They can also be deployed to bare metal, virtual machines and various cloud platforms. How do software owners track the usag...
Enterprises are fast realizing the importance of integrating SaaS/Cloud applications, API and on-premises data and processes, to unleash hidden value. This webinar explores how managers can use a Microservice-centric approach to aggressively tackle the unexpected new integration challenges posed by proliferation of cloud, mobile, social and big data projects. Industry analyst and SOA expert Jason Bloomberg will strip away the hype from microservices, and clearly identify their advantages and d...
The 4th International Internet of @ThingsExpo, co-located with the 17th International Cloud Expo - to be held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA - announces that its Call for Papers is open. The Internet of Things (IoT) is the biggest idea since the creation of the Worldwide Web more than 20 years ago.
SYS-CON Events announced today that MetraTech, now part of Ericsson, has been named “Silver Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9–11, 2015, at the Javits Center in New York, NY. Ericsson is the driving force behind the Networked Society- a world leader in communications infrastructure, software and services. Some 40% of the world’s mobile traffic runs through networks Ericsson has supplied, serving more than 2.5 billion subscribers.
SYS-CON Events announced today that O'Reilly Media has been named “Media Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9–11, 2015, at the Javits Center in New York City, NY. O'Reilly Media spreads the knowledge of innovators through its books, online services, magazines, and conferences. Since 1978, O'Reilly Media has been a chronicler and catalyst of cutting-edge development, homing in on the technology trends that really matter and spurring their adoption...
SYS-CON Events announced today that EnterpriseDB (EDB), the leading worldwide provider of enterprise-class Postgres products and database compatibility solutions, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. EDB is the largest provider of Postgres software and services that provides enterprise-class performance and scalability and the open source freedom to divert budget from more costly traditiona...
Do you think development teams really update those BMC Remedy tickets with all the changes contained in a release? They don't. Most of them just "check the box" and move on. They rose a Risk Level that won't raise questions from the Change Control managers and they work around the checks and balances. The alternative is to stop and wait for a department that still thinks releases are rare events. When a release happens every day there's just not enough time for people to attend CAB meeting...
The 5th International DevOps Summit, co-located with 17th International Cloud Expo – being held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA – announces that its Call for Papers is open. Born out of proven success in agile development, cloud computing, and process automation, DevOps is a macro trend you cannot afford to miss. From showcase success stories from early adopters and web-scale businesses, DevOps is expanding to organizations of all sizes, including the...
Node.js and io.js are increasingly being used to run JavaScript on the server side for many types of applications, such as websites, real-time messaging and controllers for small devices with limited resources. For DevOps it is crucial to monitor the whole application stack and Node.js is rapidly becoming an important part of the stack in many organizations. Sematext has historically had a strong support for monitoring big data applications such as Elastic (aka Elasticsearch), Cassandra, Solr, S...
Buzzword alert: Microservices and IoT at a DevOps conference? What could possibly go wrong? In this Power Panel at DevOps Summit, moderated by Jason Bloomberg, the leading expert on architecting agility for the enterprise and president of Intellyx, panelists will peel away the buzz and discuss the important architectural principles behind implementing IoT solutions for the enterprise. As remote IoT devices and sensors become increasingly intelligent, they become part of our distributed cloud en...
I read an insightful article this morning from Bernard Golden on DZone discussing the DevOps conundrum facing many enterprises today – is it better to build your own DevOps tools or go commercial? For Golden, the question arose from his observations at a number of DevOps Days events he has attended, where typically the audience is composed of startup professionals: “I have to say, though, that a typical feature of most presentations is a recitation of the various open source products and compo...
In this Power Panel at DevOps Summit, moderated by Jason Bloomberg, president of Intellyx, panelists Roberto Medrano, Executive Vice President at Akana; Lori MacVittie, IoT_Microservices Power PanelEvangelist for F5 Networks; and Troy Topnik, ActiveState’s Technical Product Manager; will peel away the buzz and discuss the important architectural principles behind implementing IoT solutions for the enterprise. As remote IoT devices and sensors become increasingly intelligent, they become part of ...
This is the final installment of the six-part series Microservices and PaaS. It seems like forever since I attended Adrian Cockroft's meetup focusing on microservices. It's actually only been a couple of months, but much has happened since then: countless articles, meetups, and conference sessions focusing on microservices have been delivered, many meetings and design efforts at companies moving towards a microservices-based approach have been endured, and five installments of this blog series ...