Issue No. 06 - November/December (2005 vol. 22)
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/MS.2005.157
Bart Massey , Portland State University
Greg Goth , freelance writer
Open Source Business Models: Ready for Prime Time
Five years after IBM signaled open source software was ready for any enterprise by putting its full corporate support behind Linux, the open source ecosystem has matured into a shoulder-to-shoulder companion for commercial proprietary software. A new tapestry of community resources, venture capital, and informal networks of open source veterans championing new applications is being woven through industries and academia.
According to Matt Asay, Novell's director of open source strategy, "99.99 percent of the products in the world's economy, whether it's salt or the chair you sit in, are commoditized. It doesn't have anything to do with some 'magic formula.' In the past, the software industry got away with selling software based on this magic formula 'you can't get anywhere else.' As the industry grows up, there will still be 10 to 20 percent of the market that needs an intellectual-property differentiator at the application layer, but for most of the information technology enterprises buy, what they should be buying is what they should have been buying all along—service and support."
Signs of acceptance
One illustration of the market's acceptance of open source as business-ready is the success of SpikeSource ( www.spikesource.com), a San Francisco-based startup founded in 2003 by former Oracle president Ray Lane and Murugan Pal while both were at technology venture firm Kleiner Perkins Caufield & Byers. SpikeSource tests, certifies, and integrates open source components in the LAMP (Linux-Apache-MySQL-Perl/Python/PHP) stack. Nick Halsey, vice president of sales and marketing, says the company had to triple its target for number of annual downloads.
"It's a nice sign of the ongoing maturity of the market," Halsey says. "People have stopped asking if they should use open source software, and they're asking, 'How should I use open source software and what open source components should I use?' So we're really moving from the 'whether' to the 'how.'"
So attractive has open source software become that even the healthcare industry, long considered a laggard in terms of IT innovation, is seeing the first inklings of industry-specific savings and innovation through open code. One example is Vista, a clinical-management suite originally developed by the US Department of Veterans Affairs. Medsphere ( www.medsphere.com), a startup founded by two brothers who saw Vista's market-making potential when they were medical students, obtained Vista through a US Freedom of Information Act request and modified it license-free. Vista costs roughly half the price of existing commercial enterprise-scale medical-management systems, so it's attracting customers such as small community hospitals that had been priced out of the market. It's also attracting significant seed money from influential venture capital firms Azure Capital, Thomas Weisel Venture Partners, and the Wasatch Venture Fund.
"The story was really compelling," says Medsphere cofounder Scott Shreeve. "Here's this proven system, installed everywhere, 200,000 people a day use it, 85 percent of the doctors trained in the US have been exposed to it—and it took us 18 months to turn any heads."
With opportunity comes competition
Yet this new era of opportunity also promises a concomitant amount of competition between startups and old-line vendors, between license types, and even between open source and proprietary applications under the same corporate umbrella. Savvy developers and IT buyers will have to do more complex due diligence on a wide variety of applications. Industry experts say that in facing this complex new ecosystem, project managers will have to combine information from their established partners with the new community-based resources coming online to make the best decisions for their particular circumstances.
"For example, IBM has been outstanding in its leadership in the open source space, not just in tools but across the board," says Tony Wasserman, executive director of the Center for Open Source Investigation (COSI) at Carnegie Mellon University West, the Silicon Valley-based branch of the renowned engineering institution. "But here's a sample of some of the complexity the market is beginning to feature—look at IBM's acquisition of Gluecode [a company making an open source Java application server]. It lets them have a response to JBoss, but will it cannibalize WebSphere, too? There could be the same problem in the database space. Will Derby, which IBM developed as Cloudscape but is now open source through Apache, take away from DB2 and Informix and other things they sell?"
Of course, IBM didn't turn the Cloudscape code over to the Apache Foundation to lose business. Jon Prial, IBM's vice president for management information software, explained in a statement issued by the company why IBM decided to release Cloudscape shortly after LinuxWorld 2004. "By open-sourcing Cloudscape, IBM hopes to accelerate development of Java-based applications and drive more innovation around Linux and Java," Prial said. "So expanding this market expands the market for high-value IBM middleware, hardware, and services. We think it will especially create new business opportunities in areas such as embedded database applications, small business solutions, and Java and Web-based applications."
Wasserman says this is an example of the careful metrics companies must develop to ascertain which open source applications to deploy at various layers of the stack.
The cream rises
However the new ecosystem might establish itself, the people behind this industrywide "second wave" of open source software in the enterprise intend to firmly cement the "free" software model to the bedrock of the free market. Veterans of the first wave of open source popularity, characterized by the corporate acceptance of Linux, are nurturing new higher-level applications and fostering more business-ready evaluation methodologies.
One representative of this core group of innovators is Larry Augustin. Augustin, one of the industry's best-known open source champions, founded VA Linux and SourceForge.net, the world's largest open source development community. He sits on the board of directors of JBoss, the world's most popular Java application server. He also serves on the steering committee of Business Readiness Rating ( www.openbrr.org), a new community-based open source evaluation metric, and since January 2005 has been Medsphere's chief executive officer. And SpikeSource's Halsey says many executives unfamiliar with the licensing and support intricacies of the open source model, and daunted by the sheer number of open source applications available, might do well to start their investigation by looking at the relatively small number of people with proven track records and the like number of applications with significant enterprise deployment.
"Look at the concentration of force and mass," Halsey says. "There are 350-plus content management systems, but 10 of them are used 90 percent of the time."
JBoss ( www.jboss.com) might be the open source application vendor with the most dominant "force and mass" story thus far. Founded by Marc Fleury in 1999 as an open source Enterprise JavaBeans alternative, the company grew steadily through 2004. At that point, says Shaun Connolly, JBoss's vice president of product management, the company rocketed to prominence. It picked up US$10 million in venture capital and introduced companion products to its Java application server under the brand of Java Enterprise Middleware Server (JEMS). The company's global workforce has grown from 25 at the beginning of 2004 to 140. Yet Connolly says that Fleury learned the Internet bubble's lessons well and that the company's rapid growth is by no means a demonstration of irrational exuberance. Instead, its growth is based on a business model that combines software that developers like for its functionality, a license that partners like for its flexibility, and a revenue model that customers like for its cost-effectiveness.
Within two years, JBoss became the fastest-growing Java application vendor in the industry. In 2002, just 36 percent of 1,425 subscribers to SD Times had heard of JBoss; by 2004, 76.8 percent of respondents recognized the company. In 2002, just 13.9 percent of those companies used JBoss's application server; by 2004, 34.8 percent did. In contrast, by 2004, IBM's WebSphere had 33.9 percent of the market, BEA's WebLogic had 28.7 percent, and Oracle had 22 percent ( www.jboss.com/pdf/bzresearch_study.pdf).
Connolly says a key element of JBoss's popularity is the company's licensing scheme, the GNU Lesser General Public License. The LGPL lets developers bundle their own code with the existing open source code, but they must supply back to the community only the changes they've made to the JBoss LGPL libraries. Additionally, Connolly says the company's emphasis on a subscription business model rather than a consulting model keeps costs low for JBoss while ensuring customers they will get the latest updates and tools. The company also hires key committers—those OS developers who have dedicated the most time and talent to a particular project—to JBoss projects.
"The reason for that is, we need to give that guarantee to the customer that if we issue a patch, it's not a fork or one-off, that it will also apply to the latest versions when they upgrade," Connolly says. "When IT shops make these deployment decisions, they're thinking in matters of years, and they like that assurance."
Old vs. new, and a community metric
One of the more interesting battles that might play itself out in the near term is whether developers and customers choose start-up LAMP stack clearinghouses such as SpikeSource or opt to continue or begin relationships with well-established companies such as Hewlett-Packard, IBM, and Novell, which have begun concerted efforts themselves to provide customers with the most robust new open source applications.
"I actually think if the Novells and HPs and others can get nimble enough to deliver, they'll own that space, as far as the certified stack goes," Connolly says. The factor behind his reasoning is that the startups aren't the projects' originators, so customers might be concerned about timely patch management.
"And they don't own the customer, like HP and Novell have a lot of enterprise customers, so that's going to be the challenge," Connolly says.
However, SpikeSource's Halsey says the established vendors also have vested interests in certain components that might not be in a developer's or customer's best interests.
"If you're Novell, you're very interested in making sure things run in a SUSE Linux environment, for example, and not really all that interested in making sure they run in a Windows or Red Hat Linux environment. We're the only company that isn't already in a camp, whether they're oriented around a database or application server or a Linux distribution. Our job is to be the Switzerland of open source software components. We test things across all platforms and operating systems and languages. We don't care if you're using C, Java, Perl, PHP, or Python, or doing it on Red Hat or SUSE; we test to make sure everything runs with everything and against everything."
In carrying the "Switzerland" concept further, SpikeSource has also thrown its full weight behind the Business Readiness Rating initiative. BRR's other founding members include Intel, CMU West, and O'Reilly CodeZoo. In essence, BRR, which was announced in early August 2005, quickly assesses top-level questions concerning factors such as the licensing model a given application uses, how many reference works are available for it, and its use of open standards. Beyond this quick assessment, the BRR uses 12 assessment categories such as functionality, security, and stability, on which users rate the application on a scale of 1 to 5. COSI's Wasserman is quick to point out that the BRR isn't intended to be a popularity contest or "Zagat guide" to software.
"We're not going to publish these ratings; we're not going to be the Michelin guide to software. It's going to be—it has to be—a community-based effort, and companies and consultants are going to go out and tweak the factors we've put out there. They'll decide which products are worthy of evaluation. They may do it privately. The BRR is really just a framework, the mechanism you can use. I don't know how it'll play out."
Halsey says the new efforts behind open source will sharpen performance by both new and established vendors and might uncover hidden gems that benefit established enterprises in niche deployments and developing industries and economies at large.
"What open source software really does is open up the low end of the market, and it certainly changes dynamics on the global stage," he says. "What you can do in the Third World now that they could never afford to do with technology before, that's really going to change things. What happens on Wall Street probably won't change as much as what happens in Brazil, and China and India."
Opening the Mainstream: O'Reilly OSCON 2005
Open source software is growing up. I'm fairly sure that the 2005 O'Reilly Open Source Conference is evidence of this. I'm just not sure of what "growing up" means. OSS has been a different kind of baby, in many ways, from any the high-tech world has seen so far. And now OSS is entering its teen years, and we're beginning to see signs of the adult that will emerge. Recent OSCONs have been something of a coming-of-age party for OSS, and OSCON 2005 was no exception.
A mainstay character of OSS is the 20-something male anime fan. Sure enough, I thought I saw plenty of these at OSCON 2005. It's equally apparent, however, that increasing age, maturity, and above all growth and dilution are slowly thinning their ranks. Of the more than 2,000 people attending OSCON 2005, a large fraction wouldn't have been able to pick Perl creator Larry Wall out of a lineup of SVG illustrations. In fact, one of the main exhibitors this year was Gibson Guitars, which generously donated a number of fine guitars as promotions—they were a big hit of the show. When I asked one of their representatives what their connection to OSS was, the answer was a quick "I have no idea."
Many OSCON technical events actually took place at free satellite conferences around the Portland area. I attended the Drupal Content Management Systems Conference at Portland State University. While the technical content there was terrific, it was evident that the event's focus was on attracting new users and developers to Drupal and related projects and on providing a venue for local Drupal developers (many of whom were unable to afford the time or expense of attending OSCON) to meet with each other and with Drupal team leaders. Similar events were held around other technologies, such as the PHP programming language. These events provided an important bridge between the development communities, their users, and the interested public.
A rising tide
Social tides increasingly ebb and flow in the OSS community. The vendor party, long a staple of technical conferences, reached a new height at OSCON 2005. As expected, the free flow of alcohol and conference "schwag" (logo-stamped promotional items) was accompanied by a free flow of ideas, opinions, and contacts that ultimately strengthen the community.
A theme you might have noticed is the large number of freebies. Indeed, this was the most active and generous vendor group I've seen at any conference since the dot-bomb. Confidence in the OSS community's economic prospects seems at a several-year high, the job market for technical OSS professionals is turning back into an employee's market, and large companies that have focused on proprietary solutions are turning to OSS (for more on this, see the " Case Study: Open Solaris" sidebar). This last trend, in particular, seems to be driving the tchotchke boom. Companies such as Computer Associates, Sun Microsystems, and Intel are marketing OSS in the ways that have worked for them in the proprietary software market—this is a bonanza for OSS developers unaccustomed to this sort of largesse.
Software development practices, techniques, and products (open source or otherwise) have never suffered from an excess of true innovation. A lot of software presented in OSCON talks and vendor exhibits looked like clones of proprietary products. Indeed, Computer Associates' OSS release of the Ingres database is ultimately a rerelease of a semi-OSS product commercially co-opted many years ago. The biggest hits of the show, however, were several applications that represent fundamentally new approaches and improvements.
The Asterisk OSS telephony control software, for example, is taking over the small private branch exchange (PBX) solution marketplace. As Asterisk was put through its paces in OSCON tutorials and talks, it became apparent that this software is more than just a clone of commercial PBXs. The ability to integrate client computing, voice over IP, and a wide variety of commodity hardware to form new telephony solutions will foment a telephone revolution, in the bottom-up way only OSS can accomplish. Ultimately, Asterisk will disruptively impact businesses and business models both in the telephony provider and user spaces. This OSS disruptive innovation was a common theme at OSCON.
The phrase "Web 2.0" was on many folks' lips at OSCON. (O'Reilly has an upcoming "Web 2.0 Conference" that focuses solely on this topic.) Google had a highly visible presence at OSCON and was widely cited as a pioneer of the next-generation Web. The Google-O'Reilly Open Source Award winner (one of five, each receiving US$5,000) in the Hacker category was David Heinemeier Hansson, the creator of the Ruby on Rails Web application development platform. Talk about Ruby on Rails was everywhere at OSCON this year. The reasoning seems simple: everyone wants to develop a killer Web 2.0 app, and Ruby on Rails seems to be an incredibly fast, easy way to go from idea to reasonable working database-backed custom Web site. Other solutions of this kind include PHP—more effort, but more expressive—and the Drupal Web content management system mentioned earlier—not so customizable, but little effort to get going. Many start-up businesses at OSCON focused on providing either Web 2.0 services or development and infrastructure tools to create the next-generation Web.
Someone at OSCON remarked that 2005 is "the year of the Linux desktop." Folks in the desktop developer community smile when they say that now, since various organizations have been saying it for at least the past five years. The truth of the matter is much more complicated. The X Window System technology on which the Linux desktop is built is now more than mature at 20 years of age, but until recently it provided a desktop primarily for technical users. Over the past five years, the overlying software's stability and richness have increased, through the introduction and maturing of the Gnome and KDE desktop environments, among other things. It now provides an environment that is often comfortable enough for nontechnical users. Novell's Miguel de Icaza gave a nice closing keynote demo of the Linux desktop's future. X over modern 3D graphics hardware is providing the last steps in a grand plan initiated by X development leader Keith Packard several years ago. Experimental versions of desktop Linux are now challenging, if not surpassing, the Mac's font rendering, multimedia capabilities, and eye candy user interface. While some usability hurdles remain, OSCON featured much excitement about this future.
The OSS conference circuit is beginning to stabilize, and O'Reilly seems to have found OSCON's place in it. An interview with O'Reilly's Susan Axtell confirmed my impressions as to the company's OSCON strategy, which is one of continued growth. OSCON had about 2,400 attendees this year, up from about 1,700 in 2004; the conference moved from a hotel venue to the Portland Convention Center, where it occupied one wing. If, as seems likely, the conference returns to Portland next year, O'Reilly will try to fill even more of the center.
OSCON aims to corner two general attendee markets. One is the OSS business community. O'Reilly's special business track was a big hit this year and will likely return next year. The other is the community of interested newbies: new developers, new users, and those who think they might want to be. A principal role of OSCON has always been to serve as a fan convention. In the days when it was still a Perl conference, folks would turn up just to meet Larry Wall, and folks still do. OSCON thus must continue to attract the luminaries of the OSS developer community, to keep attracting the business and newbie communities that are the bread and butter of its growth.
Is OSCON "the next Comdex"? After this year's show, Computerworld's Mark Hall suggested this. It's probably too early to tell, and the LinuxWorld Expo certainly has a strong claim to that title. Instead, I think OSCON has demonstrated the potential to be something more: a "Comdex with content," if you will. I enjoyed this year's OSCON and hope that the conference will continue to expand on this role.
Bart Massey is an assistant professor of computer science at Portland State University, where he teaches and researches open source, software engineering, and artificial intelligence. Contact him at email@example.com.