Open Source in Android Apps:

Transcription

1 Open Source in Android Apps: Tips for Becoming a Good Open Source Citizen AnDevCon Kim Weins, SVP Marketing, OpenLogic

2 What You ll Learn! How much open source is used in mobile apps?! What level of compliance with open source licenses?! Why should I be concerned?! What should I do about it? 2

3 About OpenLogic OpenLogic helps enterprises to successfully and safely acquire, deploy, support and control all of the free and open source software they use.! Scanning Tools! Open Source Audits! Open Source Support

4 Mobile Apps Depend on Open Source Open Source is Used in 88% of Android Apps & 41% of ios Apps Source: OpenLogic Mobile Research 9/2010 4

5 Mobile Apps Depend on Open Source Mobile Apps Open Source YUI SQLite JSON cocos2d ichabber wz_graphics jquery Selenium Boost OpenSSL Rhodes MWFeedParser PhoneGap 5

6 But 6

7 Compliance Concern Mobile Apps Aren t Consistently Complying with Open Source Licenses 7

8 Research Methodology! Scanned 635 Top Apps with OSS Deep Discovery! 123 Android Apps! 512 ios Apps! Picked top paid and free apps across categories! Identified 68 Apps with GPL, LGPL or Apache! 52 with Apache! 16 with GPL/LGPL! Examined those apps for compliance with key obligations 8

9 Four Areas of Compliance Analyzed Apache GPL/LGPL Provide copy of license Provide copy of license Notices/Attributions Provide source code 9

10 Failure to Comply Do Not Comply 71% Comply 29% 71% of Apps using Open Source under GPL, LGPL and Apache do not comply Source: OpenLogic Mobile Research 3/

11 Compliance by Platform 27% Comply 71% of Apps using Open Source 32% Comply under GPL, LGPL and Apache do not comply Android ios Source: OpenLogic Mobile Research 3/

12 REALLY? Do I need to care? 12

13 Three Reasons to Comply 1. It s the right thing to do 2. Protect your IP 3. Money in your pocket 13

14 It s The Right Thing to Do Free software but please comply 14

15 Protect your IP Copyleft open source licenses can impact licensing of your IP 15

16 Protect your IP Open Source under Copyleft license Linking Your code Derivative work? Depends on the license and how you combine the code 16

17 Money in Your Pocket Non-compliance can result in: Takedowns Injunctions Lawsuits Legal costs 17

18 Takedown Requests to Android Market Feb 2011 = 206 Takedown Requests Source: Chilling Effects Clearinghouse, Takedown Complaints for Android Market 18

19 Takedowns: Open Source Copyright Violation Example of complaint to Google re GPL violation. Source: Chilling Effects Clearinghouse 19

20 More Than A Theoretical Risk: Legal Action Source: Ars Technica Source: cnet Source: The Inquirer Free Software Foundation has been active in GPL enforcement. 20

21 More Than A Theoretical Risk: Bad PR? Source: Network World Source: Matthew Garrett 21

22 OK, OK I get it. 22

23 How to Become A Good Open Source Citizen 1. Understand open source licensing 2. Create an open source policy 3. Track all open source usage 4. Conduct a scan or audit of your code 5. Develop a compliance checklist 23

24 1. Understand OSS Licensing! Official definition of OSS license! Approved by the Open Source Initiative (OSI)! Currently over 60 approved licenses! Key Criteria! Free distribution! Source code is available! Derived works are allowed! Non-discrimination 24

25 Categorizing Open Source Licenses Liberal Copyleft No Strings Strings Attached Traditional Open Source Additional Clauses! MIT/X! W3C! Original BSD! Apache Software License! Eclipse Public License! GNU GPL! GNU LGPL! GNU GPL v3! Common Public License! Mozilla Public License! SISSL! IBM Public License 25

26 Dependency Issues Impact Licensing! OSS often depends on or bundles other OSS! Need to look at all the dependencies and bundled projects and their licenses! Important: The licenses may not be the same!! Example:! Geronimo (Apache license) uses MySQL (GPL) through the MySQL driver (formerly LGPL but now GPL) 26

27 2. Create an Open Source Policy! Things to include! Licenses allowed! Approval processes! Audit and compliance processes! Considerations! Keep it lightweight! Don t let fear guide you 27

28 3. Track all Open Source Usage: Why?! Know what you are using! Best practices for software asset management! Identify opportunities for sharing or savings! Find out what open source is being used so you can leverage expertise, support, etc. across teams! Legal & compliance! Validate that you are complying with licenses! Be able to determine impact of license changes! Provide an audit trail for regulatory compliance! Assess impact of lawsuit or IP infringement! Maintenance! Be prepared to handle security patches or critical issues! Able to plan for maintenance updates! Support! Understand level of support necessary! Share support resources (whether internal or external) 28

29 3. Track all Open Source Usage: What?! What open source packages are used! What versions are used! The exact source/object code! Where you got it from (source)! What license it s under! What applications it s used in! What machines they are used on! What operating system they are used with! Whether the project is internal, external or for distribution! When distributed and to whom! Approval trail who approved, when approved, for what purpose 29

30 4. Conduct a scan or audit of your code! Outcome of an OSS audit:! List of open source packages! List of open source licenses! List of license obligations! List of licenses that may have conflicting terms! Options! Scanning tools! Manual review! Audit services

31 5. Develop a compliance checklist! Create a compliance checklist:! Notices in code and/or documentation! Source code provided in proper way! Is there an EULA for your product?! If there are conflicts or compliance is not possible:! Can you live without this code?! Is there an alternative to the code?! Can you contact the author and ask for an exception/different license?! Risk management:! What is likely to get litigated?! What are your sticking points that prevent perfect compliance?

32 Thanks!! Slides?! Learn more! To receive details of 32