2008: The Risk Report

The Research Group has developed

tools that objectively track and report on operational risk associated with software applications, operating systems and hardware.

I have seen a number of “Most Risky” lists that seem to be subjective and crafted by nothing more than a few Google searches and a popularity contest. In response, here is a "Top 10" list, filtered for Applications, sorted by overall vulnerability per issue, weighted by age of issue.

Top 10 Applications

1. Microsoft Internet Explorer
2. Mozilla Firefox
3. PHP
4. Mozilla Seamonkey
5. Mozilla Thunderbird
6. Microsoft Office
7. Apple Quicktime
8. BEA Weblogic Server
9. Apple Safari
10. Joomla

Top 25 Overall

Why 25? It is easier to show that software risk is time sensitive, objective and accurate with a larger list. My current list as of this week tracks 14813 products from almost as many vendors.

Our risk metrics are collected automatically and sorted. Members of the team correct discrepancies introduced by bad data, and then the results are generated using statistical queries on MySQL.

http://nvd.nist.gov is the official datasource for the risk information.

The ordered output is generated by an algorithm that scores a weighted value for each CVE based on the risk and age of that CVE, and then totals all the weighted CVEs across the life of a product. Such total scores are then compared one to another. In this way, an application that has been out for a very short time could make the top of the list if it had more security issues of high criticality over its release life than most applications.

The complete report segments out software by type (hardware, application, OS, platform), license (commercial, FOSS) and is generated weekly. The results are then compared to NVD’s Workload Index calculation in order to give an IT manager an accurate understanding of resource requirements to manage software issues. The report is available for a reasonable fee. To subscribe to the complete report, send an email to risk_report@airius.com.

Top 25 Software

1. Apple Mac OS X
   
2. Microsoft Internet Explorer
   
3. Linux Kernel
   
4. Mozilla Firefox
   
5. Sun Solaris
   
6. Microsoft Windows 2000
   
7. Apple Mac OS X Server
   
8. Microsoft Windows XP
   
9. PHP PHP
   
10. IBM AIX
    
11. Microsoft Windows Server 2003
    
12. Mozilla SeaMonkey
    
13. HP HP-UX
    
14. Mozilla Thunderbird
    
15. Microsoft Office
    
16. SuSE SuSE Linux
    
17. Microsoft Windows NT
    
18. Apple Quicktime
    
19. FreeBSD FreeBSD
    
20. BEA Systems WebLogic Server
    
21. Red Hat Linux
    
22. Gentoo Linux
    
23. Debian Debian Linux
    
24. Apple Safari
    
25. Joomla Joomla
    

UPDATE: For the FOSS (free and open source software) list, go to https://fossbazaar.org/content/2008-risk-report-foss.

What does this mean?

The lists review vulnerabilities reported historically to the National Vulnerability Database and sorts them. The reported vulnerabilities are weighted by their individual risk, then weighted by their historic age, where newer issues are more relevant than older issues, all else being the same.

The "percentage" is a relative metric, where the "most vulnerable" application for a report is scored 100%. All other software is scored relative to the 100%.

Is this software bad?
No. What you see is that open source and proprietary software both have issues. The risk seems to directly correlate with the complexity of the software type. Operating systems are inherently very complex, and always are very high on reported vulnerabilities. Notice that regardless of the license type, the level of relative risk is comparable by software type. What this seems to indicate is that complex software takes diligent effort to write, debug, and manage in an operational environment, regardless of the licensing that the software is distributed under. My team has tracked the resolution intervals relative to reported issues. What we saw as we started monitoring the publicly available data is that a well used and available forum drives awareness to issues, and indirectly facilitates rapid resolution for complex software, regardless of licensing.

So which application is the worst?

Software risk is a way of highlighting the management requirements imposed by software within an environment. Complex software may impose a greater management load than simple software. Tracking risk and vulnerabilities is a way that security and infrastructure managers can predict and deploy people and processes to actively manage the issues associated with certain types of software.

Risky software is not bad?
Tires wear out over time, asphault roads need to be repaved frequently, roofs need to be replaced, plumbing leaks once in a while. The requirement to maintain systems and to expect systems to require greater maintenance based on what these systems do is normal. Expecting software to be without issues is unreasonable and naive.

Risk is good?

Of course it is. If risk management is a process of ongoing maintenance, a healthy and interactive commnity participating in the discovery and reporting of risk issues improves the software. Failing to manage complex software, regardless of free or proprietary licensing, that is risky.

What do I do?

Complex software needs to have strong support and an active community. It is a greater risk to use a complex application that has no reported vulnerabilities than one that has many issues. Use the best software for the task. It may be risky, based on discovered issues. Understand that if your management process includes testing, validation of reported issues, and application of patches as available, your risk is incredibly low. If you can update your running software within 30 days of patch releases, your exposure is minimal, and you have an objective process to use complex and quality software within your environment.

Define Policies and Enforce Them

Software exists to facilitate the identification of software and services. Know what you are using, understand what the average work effort is to manage the installed software in your environment, and then set policies to monitor the active management of such software.

Summary

Sotware is asked to do many things. Complex software is asked to do many complex and critical things. More quality software is created by less people, in less time and with less resources. Is the software worse than it ever was? No. The power of the community works to expose these issues and drive resolutions quickly. Accept the fact that software is evolutionary, put a management process in place to take advantage of the input from the community (testing, validation, qualitative review, network and security policy, education), apply qualified patches.

Clear information about software issues reduces operational risk if such information is put to use. The applications for which no information exists pose the greatest threat to security. Without community oversight and review, unknown applications have the opportunity to mistakenly slide under the radar while being large potential threats.

The riskiest software is the software that you don't know about.

************************************************************

Notable Mention

The Research Group actively takes submissions from visitors regarding stories, FOSS issues and project announcements. We are amazed at the number of submissions we have gotten to date, but even more so, we are incredibly grateful to over 150 core contributors who have devoted their time and resources at helping us provide up-to-date information. Send your stories and announcements to rdgroup@airius.com.

We are proud to have hosted over 80 interns in the last year from the leading schools in the United States. If you would like to be considered for an internship, please send a note to rdgroup@airius.com. You will receive instructions regarding how to apply.

************************************************************

Subscription

For more information, go to http://gpl3.blogspot.com/. To stop receiving these weekly mailings, please send a message to rdgroup@airius.com with the subject "unsubscribe:gpl3". To start receiving these weekly mailings, please send a message to rdgroup@airius.com with the subject "subscribe:gpl3".

The Research Group (rdgroup@airius.com)

Ernest Park

Credits:

http://nvd.nist.gov

http://en.wikipedia.org/wiki/Vulnerability_(computing)

What happened to the GPL Project Watch List

In October 2008, our research project was hit with the same economic crunch that has been affecting businesses throughout our country. The members of the Research Group are proud of what we delivered for more than a year, and we are glad that we were given the opportunity to deliver this significant information.

In April 2007, my team proposed the possibility of tracking the adoption and use of existing and new FOSS licensing. A month later, we started to build the database and write the web application for the search site. The team of researchers started crawling the internet manually and using specialized tools that we built to find indications of use of the new GPLv3 license. By July 2, as of our first post, we found 82 projects that announced GPLv3 releases as of June 29, 2007. While the start seemed lackluster, overall adoption has been consistent over observed time, averaging 200 new GPLv3 project releases monthly, with over 4000 current FOSS releases under GPLv3.

We started tracking GPLv3 information as of June 29, 2007, and continued to do so for 15 months. Our team included over 50 research interns from schools throughout our country, the project managers and me. We successfully provided clear and objective information regarding the acceptance and use of the new GPLv3 license, and extended the scope of our interest to report news and trends as well.

Our reports explained licensing, copyright, best practices, and garnered a strong readership over the time that we managed this information. While there are methods to collect and manage this information using automated tools, we found enough errors and imprecision in the data to raise doubt and uncertainty in the quality of data that is not manually reviewed. We built tools to optimize our ability to review data, but we still qualified all data that made it into our database.

We are now self sponsored and accepting sponsorship and contributions. The site will start publishing on a regular basis as before, and we hope to deliver timely and topical information. If you would like to help, contact us at sponsor@airius.com .

************************************************************

Notable Mention

The Research Group actively takes submissions from visitors regarding stories, FOSS issues and project announcements. We are amazed at the number of submissions we have gotten to date, but even more so, we are incredibly grateful to over 150 core contributors who have devoted their time and resources at helping us provide up-to-date information. Send your stories and announcements to rdgroup@airius.com.

We are proud to have hosted over 80 interns in the last year from the leading schools in the United States. If you would like to be considered for an internship, please send a note to rdgroup@airius.com. You will receive instructions regarding how to apply.

************************************************************

Subscription

For more information, go to http://gpl3.blogspot.com/. To stop receiving these weekly mailings, please send a message to list@airius.com with the subject "unsubscribe:gpl3". To start receiving these weekly mailings, please send a message to list@airius.com with the subject "subscribe:gpl3".

The Research Group (rdgroup@airius.com)

Ernest Park

Edwin Pahk

Antony Tran

Kevin Howard

Credits:

1929 Stock Market Crash
President George Bush and Barack Obama

GPL Project Watch List for Week of 10/24

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for October 18th to October 24th 2008.

This Week:

• Week Summary
• New Projects
• The Next Step for FOSS Adoption
  
• User Contributions

This week our GPL v3 count is at 3349 GPL v3 projects, an increase of 112 GPL v3 projects. The AGPL v3 count is at 181 AGPL v3 projects. The LGPL v3 number is at 400 LGPL v3 projects, an increase of 55 LGPL v3 projects.





















New project conversions this week include:

• Hibersap: Hibersap is a small framework that offers an abstraction layer on top of the SAP Java Connector (JCo). It maps Java classes to SAP function modules using Java Annotations and reduces the technical code to call a function in a SAP back-end system.


• Voice Mail Viewer for Asterisk: Visual voicemail viewer for Asterisk/AsteriskNOW written in PHP. Users log in with their extension and v/m password and can download messages with the web browser.


• jwaBlogger: jwaBlogger is social links/blogging software, that can easily be added to your website. jwaBlogger provides full HTML support, RSS and Atom feeds, a most popular blog entry history, and more. Example at: http://www.jwablogger.org.

********************************************************************************

FOSS users are becoming increasingly apathetic regarding the proactive management of software obtained for nominal cost. The recent Debian example comes to mind, where for an extended period of time, OpenSSL within it had been modified with a code checking tool. Such modification removed a programmatic element important to the generation of the key, such that the total possible key combinations were effectively reduced to a fraction of the total unbroken possibilities. This problem existed for nearly two years, with countless users depending on the code, using vendor solutions to test for the same things, and yet this went undetected.

Our government is embracing FOSS publicly, yet I have heard horror stories. They do not understand the management requirements of software delivered without a vendor, yet they have the same expectations.

http://www.gcn.com/online/vol1_no1/47320-1.html?page=1

Without a defined and active process for the ongoing and diligent public management of software, our government could be stepping into FOSS unprepared. If their motivation is cost, they will under staff the management resources that should be diligently testing all software. While I hope that they are going to staff for increased management requirements in the use of FOSS, there is no assurance either way. What makes the situation even more difficult is that there is no clear process or method for the government to implement that will offer a high degree of quality in FOSS investments.

What is lacking is not the desire to check. The responsibilities tied to the development of a FOSS project no longer ends when the project is compiled. Quality assurance and validation steps are so critical to the ongoing build process that the community needs to be part of it. Commercial vendors do not release code until it has survived a series of tests. Commercial vendors have liabilities to protect their investment, and do so through structured testing and processes, since their money is better spent in quality assurance than in remediation and legal actions afterwards.

FOSS needs a repeatable, measurable, verifiable and public checklist of testing and processes performed by the community in a "trusted" manner to safeguard the code that we all depend on. A public forum allows all of us to check an application, see which tests have been performed and which have not, allows us to contribute to the process, and qualify the contributions of others.

While the code is transparent, who has the skills and ability to look at it with the depth and creativity required these days? We need to make the management and ongoing qualification of open source software a community effort. By having the community actively involved in all pieces of quality assurance, we will have a greater understanding for the complexity in certifying code for distribution, and we will be able to verify that such work has been done.

The answer is not just to engage professional services, or use open source software that is financially backed by a large vendor. Since we lack transparency into the detailed, complex and ever changing process for testing software components, we are better to choose commercial solutions with contracts that put liability on the vendor. Additionally, mitigating the unknown risk of the use of FOSS with service contracts undermines some of the core principles of FOSS. If our only solution is to engage services, our freedoms in the use of FOSS are being undermined due to our inability to use the community to grasp, understand, constrain and manage the problem.

NIST sponsors http://cwe.mitre.org, the Common Weakness Enumeration. It is a database for identifying and describing in a common language, programmatic and architectural weaknesses within software, hardware and operating systems. It provides a reasonable starting point from which to build processes upon.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-0166

http://cwe.mitre.org/data/definitions/310.html

If we use a public and transparent process for the certification of FOSS, continuing in the spirit of how the code was developed, the strength of the community can actively participate in the management of unknown risk in software. We as a community can impose basic qualitative requirements on software packages. This community involvement in the validation of the code is a natural progression of the popularity and ubiquitous nature of FOSS in our computing lives.

In conclusion, the solution for software quality assurance is in the control of the user community. We need a public process to define, manage and implement validation processes, as well as a community effort to invite an ongoing process to post those results. If our professional services suppliers are worthy of their role of managing open source usage, they should be actively posting their tests, their reviews, their reports. If they do not have the requisite skills to help us manage this problem, we need a better process, and better providers, to help us manage this challenge and it is not going to get any easier soon. We owe this to ourselves, the success and health of our financially strained businesses worldwide, and our national and international security to get this right.

****************************************************************************
We appreciate all the contributions that have been made, either through our form on our web page or by email, and we also like to hear why you are changing your project's license as in the email above. It gives us more insight into which direction license trends are moving. We will continue to post up user contributions to our blog each week, and we may quote parts of your emails. If you wish the email to remain private, just mention so and we will not disclose any part of it.

Link Partners
If you are willing to copy and tranlate the content weekly, please let me know - you will receive the content as soon as it is available, and you site will be listed as a translation. I can send you a bit of tracking code so that you get credit for your contribution to the readership of this site
Post your link on the bottom of the blog page.

Send me a note at rdgroup@airius.com that you are using some or all of the content
I will make sure that we host links to your sites, and we will be able to use your content within this site as well.

************************************************************

Notable Mention

The Research Group actively takes submissions from visitors on updates on new GPL v3/LGPL 3 projects. We are amazed at the number of submissions we have gotten to date, but even more so, we are incredibly grateful to over 100 core contributors who have devoted their time and resources at helping us provide up-to-date information.

************************************************************

Subscription

For more information, go to http://gpl3.blogspot.com/.

To stop receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "unsubscribe:gpl3".

To start receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "subscribe:gpl3".

************************************************************

Our Sponsor, Palamida, Inc.

The GPL3 project, sponsored by Palamida, Inc (http://palamida.com/ ), is an effort to make reliable publicly available information regarding GPLv3 license usage and adoption in new projects.

The opinions expressed within the GPL3 Information Blog are exlusively those of Ernest Park, the subjects interviewed and the contributing authors, and are not intended to reflect the positions of Palamida, Inc and its employees.

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License .

************************************************************

Palamida was launched in 2003 after its founders learned first-hand what happens when companies don't have full visibility into the code base of their software applications based on Open Source Software. Their experiences inspired them to create a solution to streamline the process of identifying, tracking and managing the mix of unknown and undocumented Open Source that comprises a growing percentage of today's software applications. Palamida is the industry's first application security solution targeting today's widespread use of Open Source Software. It uses component-level analysis to quickly identify and track undocumented code and associated security vulnerabilities as well as intellectual property and compliance issues and allows development organizations to cost-effectively manage and secure mission critical applications and products.

For more information about FOSS management solutions, go to http://palamida.com/, or send a note to sales@palamida.com.

Please mention the GPL3 site when you reach out to Palamida.


The Research Group (rdgroup@airius.com)

Ernest Park
Edwin Pahk
Antony Tran
Kevin Howard

GPL Project Watch List for Week of 10/17

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for October 13th to October 17th 2008.

This Week:

• Week Summary
• New Projects
• Open Office 3: The Spread of Open Source
• User Contributions

Consistent Conversion
The GPLv3 License continues to be popular after over a year since its release. Conversion rates have stayed consistent as projects continue to use GPLv3 to protect the freedom of their software.

This week our GPL v3 count is at 3334 GPL v3 projects, an increase of 97 GPL v3 projects. The AGPL v3 count is at 181 AGPL v3 projects. The LGPL v3 number is at 370 LGPL v3 projects, an increase of 25 LGPL v3 projects.




















New project conversions this week include:

• DbUpdater: A customizable tool to implement the database schema version control. It can be used with any DBMS.


• r3alm: R3alm is a third version of Realm, a simulation game where you develop a community, through characters. Each character can be assigned actions, and have statistics. In addition, your civilization has statistics such as food, population, etc.


• rjudge: rjudge is a problem test tool for Olympiad in Informatics. We have finished the development of rctl - the coreutil of rjudge. We have put it into public and we want to receive more feedback.

********************************************************************************

Open Office 3: The Spread of Open Source

The long awaited Open Office 3 has just been released and it has caused openoffice.org's servers to be overloaded. The open source software is, for those of you who do not already know, a free alternative to Microsoft Office. This is build 9358, RC 4, of Open Office 3 and has been named the final version of the program as reported by crn.com. After its release last week, one of my coworkers went to download the program to check licensing information, but the site was too busy for him to access the download. It seems his predicament was shared by many other people who were eager to obtain a copy of the new suite. The popularity of open source is definitely growing, and in this instance it looks like demand exceeded supply (in terms of bandwidth that is). Open Office has grown to a point where it has become a formidable competitor to Microsoft Office in market share and in features.

From what I have heard and read about so far it seems that this release of Open Office has been improved greatly, making it a great time for anyone considering adopting to actually do it. Open office is capable to open Microsoft Office 2007 applications, which makes it worth it right there. There are many other free Office readers out there, but the quality of this suite will make it stand out from all the others. Other features such as an improved Spell Check in Writer have been added. The GUI has also been made more presentable, although still not as fancy as Microsoft Office, which can be a good or bad thing depending on how annoyed you are by GUI.

In an article I wrote two weeks ago, the current economic situation is making it even more beneficial to migrate to open source software. The high traffic for Open Office 3 is proof that more people are adopting open source software. Microsoft has even given kudos to Open Office, saying that it is a bigger competitor than Google Apps. As to whether that is a direct compliment to Open Office or indirect insult to Google Apps is up for interpretation, but regardless Open Office is getting more and more attention from the public and commercial companies. With recession looming, free software should be looking very appealing compared to proprietary software.

People's resistance to change is hindering open source adoption. Even though there are many benefits to open source, the majority of people are still hesitant to change their software and learn the new program. But Open Office really tries to make the shift as easy as possible. Being able to read Microsoft Office documents and emulating many of their features reduces how much a person has to learn if they want to switch over. With the ease of adoption, open source benefits, and low cost, now is really the time for Joe the Computer User to try open source, starting with Open Office.

-Antony Tran

Reference:

http://www.crn.com/software/211200503

http://www.techradar.com/news/computing/microsoft-open-office-a-bigger-rival-than-google-apps-476243

http://www.yellmalta.com/y/YellTopStories/tabid/94/selectmoduleid/527/ArticleID/495/reftab/36/Default.aspx

http://blogs.zdnet.com/open-source/?p=2997

****************************************************************************
We appreciate all the contributions that have been made, either through our form on our web page or by email, and we also like to hear why you are changing your project's license as in the email above. It gives us more insight into which direction license trends are moving. We will continue to post up user contributions to our blog each week, and we may quote parts of your emails. If you wish the email to remain private, just mention so and we will not disclose any part of it.

Link Partners
If you are willing to copy and tranlate the content weekly, please let me know - you will receive the content as soon as it is available, and you site will be listed as a translation. I can send you a bit of tracking code so that you get credit for your contribution to the readership of this site
Post your link on the bottom of the blog page.

Send me a note at rdgroup@airius.com that you are using some or all of the content
I will make sure that we host links to your sites, and we will be able to use your content within this site as well.

************************************************************

Notable Mention

The Research Group actively takes submissions from visitors on updates on new GPL v3/LGPL 3 projects. We are amazed at the number of submissions we have gotten to date, but even more so, we are incredibly grateful to over 100 core contributors who have devoted their time and resources at helping us provide up-to-date information.

************************************************************

Subscription

For more information, go to http://gpl3.blogspot.com/.

To stop receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "unsubscribe:gpl3".

To start receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "subscribe:gpl3".

************************************************************

Our Sponsor, Palamida, Inc.

The GPL3 project, sponsored by Palamida, Inc (http://palamida.com/ ), is an effort to make reliable publicly available information regarding GPLv3 license usage and adoption in new projects.

The opinions expressed within the GPL3 Information Blog are exlusively those of Ernest Park, the subjects interviewed and the contributing authors, and are not intended to reflect the positions of Palamida, Inc and its employees.

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License .

************************************************************

Palamida was launched in 2003 after its founders learned first-hand what happens when companies don't have full visibility into the code base of their software applications based on Open Source Software. Their experiences inspired them to create a solution to streamline the process of identifying, tracking and managing the mix of unknown and undocumented Open Source that comprises a growing percentage of today's software applications. Palamida is the industry's first application security solution targeting today's widespread use of Open Source Software. It uses component-level analysis to quickly identify and track undocumented code and associated security vulnerabilities as well as intellectual property and compliance issues and allows development organizations to cost-effectively manage and secure mission critical applications and products.

For more information about FOSS management solutions, go to http://palamida.com/, or send a note to sales@palamida.com.

Please mention the GPL3 site when you reach out to Palamida.


The Research Group (rdgroup@airius.com)

Ernest Park
Edwin Pahk
Antony Tran
Kevin Howard

GPL Project Watch List for Week of 10/10

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for September 26th to October 3rd 2008.

This Week:

• Week Summary
• New Projects
• Follow up: Jacobsen and US Copyright Law
  
• User Contributions

Making Progress
If you haven't noticed already, we'd like to welcome back a member to our team, Antony Tran. After a brief hiatus, he has agreed to come back on board to help us manage the blog and GPL3 project. Welcome back.

This week our GPL v3 count is at 3237 GPL v3 projects, an increase of 22 GPL v3 projects. The AGPL v3 count is at 181 AGPL v3 projects. The LGPL v3 number is at 345 LGPL v3 projects, an increase of 51 LGPL v3 projects.
















New project conversions this week include:

• Multigrid Contact Detection: libmgcd is a multigrid contact detection (MGCD) library


• euFileUpload: A module to upload files. To be used in web-based applications. Written in PHP


• luckybackup: A powerful, fast and reliable backup & sync tool.

********************************************************************************

I wrote about FOSS licenses and U.S. Copyright law back in June, prior to the case of Jacobsen v. Katzer coming out in mid-August:

http://gpl3.blogspot.com/2008/06/gpl-v3-watch-list-is-intended-to-give.html

To update that post a bit, the Jacobsen decision deserves mention. The case dealt with code licensed under the Artistic License 1.0 which was used in another project without complying with the terms of the license. See the link below on techlawjournal.com for more background. The central question of the case was whether the terms of the license were "conditions" that limited the scope of the copyright license, as opposed to "covenants" which define the terms for the use of the code. The court concluded the terms were "conditions."

While this may seem insignificant or merely a semantic non-issue, the remedies available for noncompliance with the "condition" of an open source license form the basis of the entire FOSS movement. The significance is that if a "condition" is broken or not followed, the person who broke or did not follow the particular condition is no longer entitled to use of the software under the license terms and such use is therefore copyright infringement. A remedy for copyright infringement is injunctive relief which means the violator can be prevented from further use of the software under the license or be required to follow the conditions if further use is desired.

If a "covenant" is broken or not followed, such violation is considered merely a violation of a contract term, which means the remedy is monetary and *not* injunctive. In that case the violator would still have a license to use the software and would merely have to pay contract damages.

Injunctive relief allows copyright holders who license their works under FOSS licenses to preserve the desired attribution, modification and distribution rights, which protects the openness of the code and preserves the rights of downstream users to have access to the code for research, learning or improvement. Having this decision on the books, with its clear discussion not only of the license in question, but also of the FOSS movement and its benefits, will only help the movement grow.

-Kevin Howard

References:

http://www.techlawjournal.com/topstories/2008/20080813.asp

http://radar.oreilly.com/2008/08/landmark-case-upholds-open-sou.html

http://www.lessig.org/blog/2008/08/huge_and_important_news_free_l.html

****************************************************************************
We appreciate all the contributions that have been made, either through our form on our web page or by email, and we also like to hear why you are changing your project's license as in the email above. It gives us more insight into which direction license trends are moving. We will continue to post up user contributions to our blog each week, and we may quote parts of your emails. If you wish the email to remain private, just mention so and we will not disclose any part of it.

Link Partners
If you are willing to copy and tranlate the content weekly, please let me know - you will receive the content as soon as it is available, and you site will be listed as a translation. I can send you a bit of tracking code so that you get credit for your contribution to the readership of this site
Post your link on the bottom of the blog page.

Send me a note at rdgroup@airius.com that you are using some or all of the content
I will make sure that we host links to your sites, and we will be able to use your content within this site as well.

************************************************************

Notable Mention

The Research Group actively takes submissions from visitors on updates on new GPL v3/LGPL 3 projects. We are amazed at the number of submissions we have gotten to date, but even more so, we are incredibly grateful to over 100 core contributors who have devoted their time and resources at helping us provide up-to-date information.

************************************************************

Subscription

For more information, go to http://gpl3.blogspot.com/.

To stop receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "unsubscribe:gpl3".

To start receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "subscribe:gpl3".

************************************************************

Our Sponsor, Palamida, Inc.

The GPL3 project, sponsored by Palamida, Inc (http://palamida.com/ ), is an effort to make reliable publicly available information regarding GPLv3 license usage and adoption in new projects.

The opinions expressed within the GPL3 Information Blog are exlusively those of Ernest Park, the subjects interviewed and the contributing authors, and are not intended to reflect the positions of Palamida, Inc and its employees.

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License .

************************************************************

Palamida was launched in 2003 after its founders learned first-hand what happens when companies don't have full visibility into the code base of their software applications based on Open Source Software. Their experiences inspired them to create a solution to streamline the process of identifying, tracking and managing the mix of unknown and undocumented Open Source that comprises a growing percentage of today's software applications. Palamida is the industry's first application security solution targeting today's widespread use of Open Source Software. It uses component-level analysis to quickly identify and track undocumented code and associated security vulnerabilities as well as intellectual property and compliance issues and allows development organizations to cost-effectively manage and secure mission critical applications and products.

For more information about FOSS management solutions, go to http://palamida.com/, or send a note to sales@palamida.com.

Please mention the GPL3 site when you reach out to Palamida.


The Research Group (rdgroup@airius.com)

Ernest Park
Edwin Pahk
Antony Tran
Kevin Howard

GPL Project Watch List for Week of 09/19

The GPL v3 Watch List is intended to give you a snapshot of the GPLv3/LGPLv3 adoption for September 12th to September 19th 2008.

This Week:

• Week Summary
• New Projects
• Interop 2008 and Open Source
  
• User Contributions

Moving along

Thanks to the hard work of the research team, we have noticed an increase in project conversion. This week our GPL v3 count is at 3184 GPL v3 projects, an increase of 184 GPL v3 projects. The AGPL v3 count is at 130 AGPL v3 projects. The LGPL v3 number is at 294 LGPL v3 projects, an increase of 8 LGPL v3 projects.

New project conversions this week include:

• Ongame Hand Converter: Ongame Hand Converter is a tool to convert poker hands, played at a skin of the Ongame poker network, into a more readable format. This can be useful if you want to discuss your hands with others, for example at a forum.


• PyMaTi: PyMaTi is a simple and easy to use GUI for numerical and scientific computing in Python. It surrounds well know packages NumPy and Matplotlib and provides possibility to immediately play with numerical python from intuitive user interface.


• StorYBook: Are you novelist, writer or author? StorYBook is a scene-based software for all creative writers that helps to organize your story. StorYBook assists you in structuring your book.

*************

Interop 2008 and Open Source

This year's Interop exhibition in New York City has just ended a little over a week ago from September 15^th to September 19^th. Interop is a tech expo where more than 300 leading technology exhibitors come to show off their stuff. It is a good look into what is coming up in IT in the near future from business leaders such as IBM, Cisco, Oracle and many others. So what was the big buzz at this year's exhibition? Two of the largest subjects that came up were Web 2.0 and cloud computing. High speed internet is spreading to more homes everyday and will soon be as common as cable TV, so it is no surprise that the experimental fields of Web 2.0 and cloud computing are the main focus of the IT community. It is no doubt that these new areas of IT will affect open source and also be affected open source software.

First off, IBM revealed their Center for Social Software, which is a collaboration between IBMers, clients, partners, students and others at their Cambridge Massachusetts location to further research Web 2.0 applications. The center will test new and current Web 2.0 tools to enhance their usage for business networks. Their goal at IBM is to use Web 2.0 to better connect people so that information can be access easier. Bob Picciano, general manager of IBM's Lotus Software believes that workers are going through an information overload trying to locate information. However, Web 2.0 should help ease the overload by connecting people to share information over social networks. By using social networking at the work place, efficiency can be boosted and increase productivity.

On the other side of the booth, Cisco was taking on virtualization and cloud computing. Cloud computing has been a hot button topic over the past year. People are still wondering what exactly it is and how we are going to get there. Marie Hattar of Cisco Systems outlined the workings of virtualization and said it will evolve into cloud computing. With both technologies her concern was security, advising companies to start small and plan ahead for security. As cloud computing continues to evolve, the commercial side of it will rely heavily on security and trust. If consumers are storing data on a virtual machine that can be accessed from any computer, it opens the door to a multitude of security risks and concerns. The companies offering these cloud services are going to have to convince their customers that their data will be save from attack on their servers.

Both Web 2.0 and cloud computing are going to affect and be affected by the open source market. Novell's CEO Ron Hovsepian said, "To us the future of IT is based on open source and open standards". Open standards are already widespread in wikis and social networking sites such as facebook. Much of Web 2.0 was and is being built on open source software. Web 2.0 is still in its early stages and the space and need for open source software is growing quickly. Cloud computing is also a space that open source software should take off in. Many open source software already generate revenue by providing the software for free but charging for the service. Cloud computing will be on demand and service based. Saas is a large market place for open source software as people are migrating from paying for the software to paying to the service. While these new experimental fields are coming to the main stream there are going to be many opportunities for open source software to gain a foothold on the market place.

-Antony Tran

References:

http://www.interop.com/

http://www.crn.com/software/210602265

http://www.crn.com/networking/210602222

http://www.internetnews.com/dev-news/article.php/3772276/Interop+Its+All+About+Collaboration.htm

http://www.informationweek.com/news/services/hosted_apps/showArticle.jhtml?articleID=210602225

****************************************************************************
We appreciate all the contributions that have been made, either through our form on our web page or by email, and we also like to hear why you are changing your project's license as in the email above. It gives us more insight into which direction license trends are moving. We will continue to post up user contributions to our blog each week, and we may quote parts of your emails. If you wish the email to remain private, just mention so and we will not disclose any part of it.

Link Partners
If you are willing to copy and tranlate the content weekly, please let me know - you will receive the content as soon as it is available, and you site will be listed as a translation. I can send you a bit of tracking code so that you get credit for your contribution to the readership of this site
Post your link on the bottom of the blog page.

Send me a note at rdgroup@airius.com that you are using some or all of the content
I will make sure that we host links to your sites, and we will be able to use your content within this site as well.

************************************************************

Notable Mention

The Research Group actively takes submissions from visitors on updates on new GPL v3/LGPL 3 projects. We are amazed at the number of submissions we have gotten to date, but even more so, we are incredibly grateful to over 100 core contributors who have devoted their time and resources at helping us provide up-to-date information.

************************************************************

Subscription

For more information, go to http://gpl3.blogspot.com/.

To stop receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "unsubscribe:gpl3".

To start receiving these weekly mailings, please send a message to rdgroup@palamida.com with the subject "subscribe:gpl3".

************************************************************

Our Sponsor, Palamida, Inc.

The GPL3 project, sponsored by Palamida, Inc (http://palamida.com/ ), is an effort to make reliable publicly available information regarding GPLv3 license usage and adoption in new projects.

The opinions expressed within the GPL3 Information Blog are exlusively those of Ernest Park, the subjects interviewed and the contributing authors, and are not intended to reflect the positions of Palamida, Inc and its employees.

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License .

************************************************************

Palamida was launched in 2003 after its founders learned first-hand what happens when companies don't have full visibility into the code base of their software applications based on Open Source Software. Their experiences inspired them to create a solution to streamline the process of identifying, tracking and managing the mix of unknown and undocumented Open Source that comprises a growing percentage of today's software applications. Palamida is the industry's first application security solution targeting today's widespread use of Open Source Software. It uses component-level analysis to quickly identify and track undocumented code and associated security vulnerabilities as well as intellectual property and compliance issues and allows development organizations to cost-effectively manage and secure mission critical applications and products.

For more information about FOSS management solutions, go to http://palamida.com/, or send a note to sales@palamida.com.

Please mention the GPL3 site when you reach out to Palamida.


The Research Group (rdgroup@airius.com)

Ernest Park
Edwin Pahk
Kevin Howard