Why Pay When You Can Use 'Openly'

Does open-source software have greater security issues compared to paid licenses?

Open-source software is notably used by large group of IT experts on cost and customization platform. While it comes on board with security issues as well, a quantitative measure of security is very difficult for open software. Opening the source of existing systems, will at first increase their exposure which is a critical security challenge, unless it is customized to the best. Immunity from outside hacking attacks is one of the major concerns for Open Software. Vulnerability tests for Open Software indicates the looming issues.

One of the key issue is that open-source exposes the source code to examination by everyone, both the attackers and defenders, and reasonable people disagree about the ultimate impact of this situation. Handling security issues need constant analysis and monitoring. Evaluating security track records before adaption is a must to do a check. Availability of customization for open software also gives you liberty to modify it to best suit your requirement and meet security standards.

What are the industry best practices in terms of open-source software and paid software?

It has lot to do with operations and usage criticality. I can see a slight change in the trend since information and support availability through forums is much better than earlier days. Best practice includes need evaluation and a thorough benchmark analysis for free software and paid software. Testing in a planned test IT environment is the best thing to do before making decision and deployment.

Customization needs best skill set to do the job, if not in-house, one can look for external commercial help to meet specific requirements. When open-source software is effectively evaluated, deployed, and managed, it can serve as a viable alternative to proprietary software.

What are the advantages and constraints with each of these models?

Open-source software surely has one major advantage and that is customization to meet any organizations specific needs, availability of the source code makes it easier for others to customize; often the entire OSS community can benefit from such changes. Use of OSS provides more decision points, not just in software but also in support and hardware, and more choices lead to greater flexibility. While if we talk about the proprietary software, their vendors usually do not allow users to alter or customize their products, and mature PS products offer more features than their OSS counterparts. PS vendors often structure products as suites instead of modules and store user content in proprietary formats, making it difficult to replace the product.

Also, the support costs in OSS are comparatively low due to competitive market forces into software support, but external support is only available for a fee, and it might be difficult to identify sources of paid support for uncommon OSS products. Support is also available via the huge OSS product's user community while in any PS support is either included in the license cost, as with term licenses, or available for an additional annual fee. The only source of external support is the PS vendor, and the lack of alternatives reduces user leverage during negotiations.

Also, some PS products have user groups that have formed around them; these groups can be a useful channel for support. In OSS licenses do not provide the user with IP indemnification, but it may be available from vendors such as RedHat or Novell SUSE for a fee but in PS it is possible to negotiate with a PS vendor to provide indemnification. On the other hand, a major disadvantage of OSS is that it can be easily exploited by malicious users, while in any PS it is more difficult for malicious users to determine how to exploit potential vulnerabilities. OSS products require sustained community participation from skilled programmers to remain viable.

In terms of innovation and deployment, what is your opinion about a viable option?

I would safely bet on paid software. I would go by it for trusted support, timely upgrades, R&D and reliability ownership to an extent.

It is generally commented that open-source software has greater security issues compared to paid licenses. What are your views on this?

Open Software is usually developed from free mind perspective by a set of individuals; hence, in my views, handling of security issues is compromised. It is also not tested from robustness or scalability aspects as a result of which, there could be bigger holes. Generally, these holes are covered up over the years, once someone starts using the same. On the other hand a paid software is supposed to be tested and certified to handle such issues. More so it is also tested in ideal condition.

In your opinion, what is the industry best practice in terms of open-source software and paid software?

According to me, industry best practice is paid software, however on an account of cost pressure and identification of non-critical areas in organization, open software is catching big waves in the current IT infrastructural scenario. There are some specialized companies which are picking up popular open software and creating support model around the same.

In your opinion, what is the industry best practice in terms with open-source software and paid software?

Advantages are clear, Open Software is free or priced lesser as compared to paid, however the constraint in Open Software is its support, scalability, robustness and future feature upgrades. Paid software has a clear advantage over here, however it comes with heavy price, hence there is always a compromise model (in-between model).

In terms of innovation and deployment, what in your opinion is a viable option?

In terms of innovation it is Open Software, which takes the cake, however deployment is challenging, especially in case you have a spread out business model. Paid plays a very good role in deployment, however its innovation is dependent on its creator hence it generally lags in feature race.
I would recommend a balanced approach between the two, critical applications/systems needs to be on a paid model, however non-critical applications/systems can be migrated to open systems.

Revathi Raghavan
revathir@cybermedia.co.in