Slashdot Mirror


Scanner Spots Open Source Installations

Mike writes "Information security firm OpenLogic has begun letting users download 'Discovery,' an application that scans Windows, Linux, and Solaris machines and attempts to identify open source software. The Discovery application claims to identify more than 5,000 versions of the top 900 open source packages. The scanning engine is able to detect open source installations whether they were installed explicitly or bundled with other software products. Kim Weins, vice president of marketing, says 'We developed it in response to customers not knowing what open source programs they were using.' I can't help but think that this a move to slyly demonize FOSS by scaring businesses into thinking they don't know what's on their PCs."

18 of 275 comments (clear)

  1. Doh by nokilli · · Score: 5, Funny

    You know, given the Vista experience, we're getting to the point where you know there's open source software afoot if the scanner simply runs without crashing something.

    --
    Censored by Technorati

    1. Re:Doh by jshriverWVU · · Score: 4, Insightful
      3) home basic edition. Considering that the bulk of sales are home basic edition, that is why it leaves an overall bad taste in the consumers mouth. How many computers can you buy from BB, Target, Walmart, Circuit City that has Vista Ultra Super Server edition loaded vs Home edition. As the name alone implies it's used for the home user and that is the biggest buyer.

      So if it sucks, then the bulk of Vista users are going to think it sucks.

  2. Two options by h2oliu · · Score: 3, Insightful

    1) It can be used to help companies ensure that they are being compliant with the various licenses [good].

    2) It can be used to "root out" those 'evil' open source applications [bad].

    Unfortunately I agree that option 2 is most likely as it is really used to search for applications and not code. Why you would want to search for explicitly open source, vs. just knowing what is on a corporate PC doesn't make a lot of sense to me.

    --
    Ok, I give up, why you?
    1. Re:Two options by freeweed · · Score: 4, Insightful

      Why you would want to search for explicitly open source, vs. just knowing what is on a corporate PC doesn't make a lot of sense to me.

      Because many companies have explicit policies forbidding open source, period.

      I've seen it get so stupid as to call it "shareware", ie: unlicensed software. The lack of a vendor really freaks out a lot of PHBs, and heck, a LOT of older IT folks who still are scared by open source. Don't forget, OSS is less secure because everyone can see the source code, and it's less reliable because you don't have a multi-billion dollar vendor backing you when things go wrong. (not sure if I really need the sarcasm tag with that last sentence or if it's obvious enough)

      --
      Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
    2. Re:Two options by jotok · · Score: 3, Interesting

      I work for a major security firm.

      All of our stuff is designed to run on 2k, 2k3, and Redhat, which as you are aware is essentially no different from Fedora (well, strictly speaking, it's no different from CENTOS) except that you buy support for it. That support is important. Large companies who pay $100m for a contract do not want to hear you say "I'll have this issue remedied just as soon as someone replied to my post on FedoraForums.org."

      I happen to think that, for instance, sourcefire has a superior IDS solution to ours. I know a lot of competent guys with that company. I like those guys. So without any malice I can tell you that when we had a bake-off with them, the deciding factor was that we knew how to deploy and manage a thousand-node sensor grid and they had not clue one.

      I say this just to illustrate that for, large corporate environments, it doesn't matter that FOSS solutions are "better." A lot of them are great, and I can think of plenty of situations where some Ubuntu workstations running OOo would suffice over Vista Business and Office 2007...except then you know down the road that company is going to want something out of left field, like encrypted home directories or , only, none of the techs they can afford know anything about setting it up. But they know that 5 years from now if they want some weird solution, probably one of the big vendors will be around to sell it to them, along with a consultant to walk the Remedy monkeys through troubleshooting it.

      I do not think that most of the people cheerleading for FOSS appreciate this. They just know that $DISTRO is neat, so obviously everyone who doesn't agree that it's perfect for a 10,000 seat enterprise network must be an "idiot." Le sigh!

  3. Free download but a form to fill prior download by Lord+Satri · · Score: 4, Informative

    I'm probably not alone curious and wanting to download this free app to (re)discover which OSS is installed on my computers... You can download it from here: http://www.openlogic.com/discovery/new_download_re gister.php?ls= and you need to give your name, email, location and some more before downloading the beast.

    1. Re:Free download but a form to fill prior download by $RANDOMLUSER · · Score: 4, Informative
      Sure, and while you're there, check out their page about "indemnification".

      Why Is Indemnification Important?
      There are many benefits to using open source software, but in some cases there are lingering legal concerns around deploying open source in the enterprise. In order for enterprises to fully embrace a broad range of open source software, they need to be able to deploy, manage and control open source while limiting the associated legal and compliance risks. For the first time, enterprises can now access indemnification coverage for a broad range of open source products from a single vendor.
      Let's try to make some money from FUD, eh?
      --
      No folly is more costly than the folly of intolerant idealism. - Winston Churchill
    2. Re:Free download but a form to fill prior download by $RANDOMLUSER · · Score: 3, Funny

      Sure, but the PHBs have heard Steve Balmer calling OSS/GPL "a cancer". Imagine the BSA kicking down your door and busting you for all those illegal copies of Firefox.

      --
      No folly is more costly than the folly of intolerant idealism. - Winston Churchill
    3. Re:Free download but a form to fill prior download by hazem · · Score: 3, Informative

      Actually, you're spreading a bit of FUD yourself.

      You can use OSS all you want and your IP is safely yours. It's only when you want to incorporate OSS software and code in your own code that you are then bound by the OSS terms.

      For example, you can:
      use OpenOffice to write all your documents
      use Gimp to do your image processing
      use vi/emacs to edit your source code
      use gcc to compile your program (be careful what you link to)
      use PDFMaker to generate PDFs from your programs
      use Firefox to browse the web
      use Thunderbird to handle your e-mail
      use apache to serve your web pages
      and so on

      and your code and works are still completely your own, free to distribute in any way you see fit.

      You are free to use OSS in any way and for any purpose. It's only when you want to redistribute it in some way (including incorporating it into your own work) that you incur any restrictions.

      I refer you to:
      http://www.gnu.org/licenses/gpl-faq.html#GPLOutput
      and
      http://www.gnu.org/licenses/gpl-faq.html#TOCWhatCa seIsOutputGPL

  4. Crickey by also-rr · · Score: 4, Funny

    I have 12,000 violations on my laptop. I better make out a check to the EFF before the bang the door down... what's the annual licensing fee on GPL software again?

  5. Inventorying OSS can help OSS by MSTCrow5429 · · Score: 5, Insightful
    "I can't help but think that this a move to slyly demonize FOSS by scaring businesses into thinking they don't know what's on their PCs."

    Looks to me that this is just a simple inventory tool so business has an idea of what's on their machines, and perhaps if they see that people, having appropriate account permissions on the PC, are voluntarily installing open source alternatives, say OpenOffice instead of MS Office, businesses may be more conducive to migrating to OSS, or at least openly accepting it.

    Business have no clue what's on their machines. That's why you have staff workers running around as admin all the time, and picking up literally thousands of instances of spyware/adware/malware. They just can't get enough toolbars and cute fluffy pointers.

    --
    Slashdot: Playing Favorites Since 1997
  6. What's with the paranoia? by The+Iso · · Score: 3, Insightful

    Why the accusatory last sentence? Open Logic is a company that provides services for open source products, and the impression I get from this tool is that it shows managers how much they already depend on open source.

    --
    "You don't need a weatherman to know which way the wind blows." - Bob Dylan
    1. Re:What's with the paranoia? by kindbud · · Score: 3, Informative
      Yeah, right.

      Why Is Indemnification Important?
      There are many benefits to using open source software, but in some cases there are lingering legal concerns around deploying open source in the enterprise. In order for enterprises to fully embrace a broad range of open source software, they need to be able to deploy, manage and control open source while limiting the associated legal and compliance risks. For the first time, enterprises can now access indemnification coverage for a broad range of open source products from a single vendor.


      http://www.openlogic.com/products/indemnification. php

      They're selling indemnification insurance. Open Logic is a capitalist enterprise, not some FOSS charity. They're in the business of monetizing FUD.

      --
      Edith Keeler Must Die
  7. On the more useful side by IPFreely · · Score: 3, Insightful

    It could also scan for and find Open Source software that was installed by a third party without proper compliance with the GPL. Install as much third party junk as you can, then scan to see who is using GPL software without compliance.

    --
    There is nothing so silly as other peoples traditions, and nothing so sacred as our own.
  8. I could've used this the other day... by oldosadmin · · Score: 3, Interesting

    You know, the interesting thing is, so many people are trolling this, but if you are, you must have never been through VC funding.

    I had to make a list of /ALL/ open source software used ANYWHERE in the company. Yeah. Sounds like fun, right? It sure was. Either way, this app could've made my life a lot easier. :(. Too bad I see it NOW!

    --
    Jay | http://oldos.org
  9. Could be a Good Thing by yancey · · Score: 3, Insightful

    I know in my own organization that management barely knows what the proprietary software does for them, much less the open source software. So this could be a really good thing if it causes IT managers, CIOs, CTOs, etc. to wake up and realize just how much of their business really runs on open source software. They might start treating it with a little more respect, even though much of it does not appear on their budget reports.

    --
    Ouch! The truth hurts!
  10. Why not .... by PPH · · Score: 4, Insightful

    ... build a scanner that inventories ALL software and catagorized it as OSS, unknown or proprietary/licensed? Odds are its the latter two that will come back and bite corporate IT departments in the *ss if not properly licensed.

    --
    Have gnu, will travel.
  11. Since they quoted me.. by Kim+weins · · Score: 5, Informative

    I just want to let you know OpenLogic is a big fan of source. Our mission is to enable companies to use more open source software. Our whole business is built around that proposition, so we are definitely not trying to get companies to remove FOSS. The reality is that enterprises we work with are already using lots of FOSS -- whether they realize it or not. However, the corporate legal, compliance, IT and architecture folks want to know that they have certain policies and procedures in place around open source -- especially for software that's going outside the company or software that's going into production. By getting certification, support and indemnification from OpenLogic, it allows the corporate compliance types to feel MORE comfortable about FOSS and therefore be more willing to let developers use FOSS. The reason that we developed this free tool is that when we talked to companies, they weren't really sure what FOSS they were using. For many companies, the asset management tools that they already have in place can not necessarily detect open source software. We wanted a simple tool that would let them create that inventory. As far as registration, we have been debating that internally and have some changes planned to reduce the barriers -- so stay tuned on that front. Kim Weins