is ground that has been covered extensively before and open source vendors have done a good job in recent years to get their houses in order. I don't want to go over that again here. The short answer has to be that if you are concerned about IP issues related to open source software, hire a lawyer to double-check.

A more significant issue going forward could be educating businesses about the potential benefits of contributing back to open source projects, as well as the processes through which they can do so.

Encouraging customer contributions to open source projects is an area that the open source vendors have not been particularly good at to date, as noted by Red Hat's CEO, Jim Whitehurst. In fact it is one of the significant issues relating to how enterprises adopt open source software that has not been adequately addressed.

If you are a CIO and you are using open source, I believe that you fundamentally need to focus on the copyright provenance of the code. Although a lot has been written about patents and open source, the fact is that software patents can be used to attack any project, organization, company, distributor and user in the software industry if their owner has the resources and the willingness to do so. And no one but the very largest of companies have the resources to either search for or indemnify against all of the patents that any interesting software product might read against. When you combine that with the fact that most software patents are questionable along with the existence of patent trolls, worrying about patent lawsuits is, in my view, akin to worrying about a bird flu pandemic. Completely out of your control, disastrous if it happens, but in the meantime life (and business) must go on. And all that energy your legal department spends fretting over the possibility could be more effectively applied elsewhere.

More simply: the software patent regime in the United States is horribly broken, but there is nothing intrinsic to using open source that makes it any more or any less broken.

Checking for copyright provenance is really around getting comfort that the open source projects that you are using can demonstrate that they know where they got their code from. At Eclipse we pour a lot of resources into this. Three full-time people, one of whom is a lawyer, spend their time reviewing the origin of Eclipse’s code, but even more importantly reviewing the open source projects that we use in Eclipse projects. We are checking things like: are there legal agreements that document the IP flow, are the origins of bug fixes and other contributions documented and do they review in turn the license and copyright compatibility of the components they are using? Doing this requires experience and time, but it is extremely valuable to the Eclipse ecosystem. Companies building products on or using technology from Eclipse can do so with greater confidence in the copyright provenance of what they are using.

Over time, we have built up quite a library of analyzed projects and we’ve even pondered whether this might be a resource that we could share with our members.

The potential pitfalls of open source licenses depend on what kind of license the project uses.

There are two basic kinds of licenses:

1. Free-beer licenses (e.g., Apache): which place minimal restrictions on how the source code is used.


2. Freedom-isn't-free licenses (e.g., GPL): such as GPL which require anyone who modifies the source code to redistribute their modifications under the same license.

The problem with free beer licenses is that they provide no incentive for a commercial company to provide long term support and upgrades. This is fine when the company behind the project has deep pockets and non-economic reasons to support the project. For example, IBM supports Eclipse because they want to keep Microsoft tools out of the data center.

The problem with freedom isn't free licenses is that they restrict the adoption of the project and hence endanger the growth of the community. Because users are more restricted in what they can do with the open source code, they may be more inclined to use a different product with a more permissive license.

By and large, all the commercial open source companies are moving to GPL-based licenses. Otherwise they could see big competitors swoop in and suck up all their work into a competiting offering.