devopsy.kinsta.cloud

Tag: open source software

Helping the Little Guy: The Power of Open Source Software for Startups

It’s no secret that open source software holds many benefits for businesses looking to reap the rewards of these innovative, collaborative and incidentally free efforts of developers around the world. Even major companies such as Salesforce have opened up their software for developers to test, debug and improve. Other huge players that run on open source software include Netflix and Twitter. In fact, 78 percent of companies run on open source. So, what if I told you these benefits improve exponentially for startups using OSS to launch and scale their business?

Open source software has leveled the playing field so that even small startups can leverage advanced technologies, without needing the big budget to go with it. Here are the top ways that startups seriously benefit from running on open source software solutions.

Power and Control

Startups are always are running under strict budgetary restrictions as they’re just starting out. This means executing their business model in the most economical way, and open source software undeniably allows this by relieving businesses of the need to pay the expensive initial fees of proprietary software. In fact, Linux found that its users save up to 55 percent over commercial solutions, and Barclays bank reduced its software development costs by 90 percent using Linux.

While it’s likely that down the line they may have to spend money on support, training or bespoke development needs, these choices can be made as per their business plan and actual business traction, and deployed as and when needed.

Power in the form of expanded capabilities that comes from open source software is also in large part due to the community of talented programmers who build and craft the solution, allowing for quicker troubleshooting and accelerated development. Many hands can deliver powerful results.

Innovation, Productivity and Agility

Startups need to be able to experiment freely to understand what works for their business and what doesn’t. If this need to try different options is shackled down by high costs or contractual commitment, they won’t be trying out the necessary paths or making the necessary mistakes to understand which is the best route to take—not to mention the benefit of being able to take advantage of new tools as soon as they become available, especially before other big players that have developed their own proprietary software.

Open source software allows for this kind of agility, which breeds innovation. Without the requirement to follow the dictates of a particular vendor, startups can explore all the avenues that they need to, until they know the right way for them.

For example, startups working within AI will need to identify the algorithm that works best for their particular business needs. To identify these algorithms from the library, data scientists have to perform many trial-and-error iterations. This is usually followed by a detailed data analysis and discovery phase. Only after going through these iterative cycles will the data scientist have a full understanding of which algorithm to use, how best to slice and dice the data and how best to get the expected business results.

If it wasn’t for open source software, going through these cycles would be prohibitively expensive. This is how top companies were expected to create AI algorithms in the past—with huge expenses on manpower and resources. Now, these open source technologies are mature enough to apply predictably, making AI startups easier and cheaper to build.

Open source software helps startups take huge strides in their productivity levels, too. A study conducted by Frank Nagle, assistant professor of strategy at the Marshall School of Business at the University of Southern California, measured the impact of free open source software on productivity, especially since a growing number of businesses are increasingly using open source software as a key input.

The study found productivity either always increased or stayed neutral, as a result of open source software—the impact was never negative. For every 1 percent increase in the use of free open source software, profits can go up by $100,000. This is a “huge amount for small firms,” said Nagle.

Security and Reliability

Due to its public nature, the software’s source code is likely more reliable than anything built by independent groups of developers. And although open source software is not automatically more secure than proprietary programs, unlike closed solutions, open source software is transparent and available for inspection. So, by opening up the software and allowing anyone to fix broken code that might put it at a risk, companies can utilize the proactivity of the community to enhance the security of their programs.

Startups that are just starting out may be intimidated by the amount of open source software options that are out there, but this shouldn’t put them off—there’s a huge amount to gain by opting for open source technologies. Between saving on costs and resources, increased capacity for innovation and agility, and having the security of your systems granted by the open source software community and their dedication to great code, the options are countless for forward-thinking startups.

— DJ Das

February 28, 2019
Black Duck, HPE Partner to Protect Open Source
Open-source software has a number of significant benefits. For starters, it’s both free, which is hard to beat, and open, which means developers can customize or modify it to fit their needs. One issue with open-source software, however, is security. Black Duck has established itself as a leading tool for managing security of open-source tools—and now that protection is extended to HPE Security Fortify.

“Use of open source has increased dramatically in the last five years because it cuts development costs and accelerates time to market. Open source is ubiquitous worldwide and can comprise 50 percent or more of a large organization’s code base,” noted Black Duck CEO Lou Shipley in a press release announcing the HPE integration. “By integrating Black Duck Hub with HPE Security Fortify, customers will have visibility into and control of the open source they are using and also be able to identify known vulnerabilities. This allows them to better understand and reduce their security risks.”

Black Duck lists a variety of key features and benefits of the HPE Security Fortify integration:
- Deep Discovery of Open Source: Rapid scanning and identification of open-source libraries, versions, license and community activity powered by the Black Duck KnowledgeBase, a comprehensive open-source database containing information on more than 1.5 million open-source projects and more than 76,000 known open-source vulnerabilities.
- Comprehensive Identification of Open Source Risks: Create an inventory of all open source in use and a map to known security vulnerabilities, identifying and prioritizing the severity of the vulnerability and exploring remediation steps.
- Integrated Remediation Orchestration and Policy Enforcement: Open-source vulnerability remediation prioritization, mitigation guidance and automated policy management, allowing organizations to have visibility into their remediation efforts and manage their external and internal compliance mandates.
- Continuous Monitoring for New Security Vulnerabilities: Ongoing monitoring and alerting on newly reported open-source security vulnerabilities.
The problem with open-source software security isn’t the software itself—at least not in my opinion. It’s ownership and responsibility. With proprietary software there is no question of who is responsible for addressing any vulnerabilities and developing the necessary patches. But with an open-source project, where hundreds or thousands of developers are contributing to a single platform or application, nobody is truly responsible and, yet, everybody is.

Don’t get me wrong. In most cases and with most open-source applications flaws are addressed and fixes are developed and deployed very quickly. With some open-source code, though, that is not the case. Ultimately, the burden for ensuring that open-source applications are secure falls on the IT managers at the companies using the software.

An even bigger issue than open-source applications themselves is the use of code modules or snippets within other applications. Again, there is a huge benefit to being able to “crowdsource” code and leverage what you need from an open-source community, but if a critical vulnerability is later discovered and fixed in the originating code you also have to take responsibility for updating it in your custom code that uses it.

Jason Schmitt, vice president and general manager for HPE Security Fortify at Hewlett Packard Enterprise, said, “This integration with Black Duck complements our existing secure development and security testing solutions by providing the ability to view the results of open-source scanning alongside application security testing results to deliver a more complete and effective approach to managing application security.”

Open-source software is just about everywhere, which is why IBM, Microsoft, Red Hat, Docker and now HPE all have embraced the Black Duck Hub. Black Duck may not be the only option on the table, but it is the open-source security option that seems to have the most traction right now.
July 28, 2016
Black Duck Targets Open Source Code Security Flaws

Open source platforms and projects offer a wide variety of benefits for organizations and developers, but they also can introduce vulnerabilities if you’re not careful. That’s why Black Duck has released Security Checker, a free tool based on its Hub open source security tool to help you identify those vulnerabilities so your applications will be secure.

One of the advantages of open source is also a potential concern. Open source software has benefits from community cooperation and collaboration. More eyes and more hands contributing to the development allow for faster evolution and greater innovation. However, when all of the code is available to the public, and any developer can add or change the code, it also is an opportunity to introduce problems.

While theoretically it is possible for a malicious developer to intentionally add vulnerabilities or exploits, the collaborative nature of open source projects actually makes it less likely. Any obvious attempt to insert malicious code would be detected and thwarted by other developers. The communal nature of open source development is not infallible, though, as evidenced by recent major revelations such as Heartbleed.

Open source projects that are active and properly maintained address these issues fairly quickly. The problem, however, is that organizations and developers need to be able to easily determine whether their existing applications are affected and apply the appropriate patches and updates. There also are many open source tools that are not being actively developed or supported, which means known vulnerabilities may be left unfixed.

Security Checker from Black Duck can help minimize exposure to these risks and give organizations and developers an opportunity to address any known issues. The tool is a drag-and-drop solution that allows you to scan code contained in an uploaded archive file, such as a .tar or .zip file, or in a Docker image. Security Checker then generates a report that shows identified vulnerabilities and security issues.

A recent report from Black Duck found that 67 percent of audited applications contain known open source security vulnerabilities. More than a third of the vulnerabilities identified were classified as “severe.” The most notable finding, however, is that 10 percent of the applications surveyed still contain the Heartbleed vulnerability, which was discovered in April 2014.

“Applications represent the greatest level of risk on the security threat landscape, and we expect that Security Checker scan results will provide an ‘a ha moment’ for many open source users,” said Black Duck CEO Lou Shipley in a press release statement. “Their findings will focus attention on the need to regularly review application code to ensure it’s free of known open source vulnerabilities.”

The process of scanning and generating the report takes about 15 minutes, according to Black Duck, which also noted the maximum file size Security Checker can scan is 100MB.

June 6, 2016
Open Source Is the Secret Sauce of DevOps

DevOps is a relatively recent phenomenon—especially compared to the world of open source. While DevOps and open source are two entirely separate things, though, the reality is that it’s difficult to separate the two at this point. Many open source projects rely on DevOps tools and principles, and DevOps depends heavily on open source applications as both the glue that binds it all together and the engine that keeps everything moving. A new report from devopsy.kinsta.cloud, “DevOps and Open Source,” digs in to understand the symbiotic relationship driving the next generation of IT.

“DevOps and Open Source” examines the role of open source in DevOps, whether DevOps can succeed without open source, the unique challenges of leveraging open source tools, and the benefits of open source partnerships with large corporations such as Microsoft and IBM. The report also includes a list of some of the most widely used open source tools for DevOps, including Chef, Puppet and Docker.

Leveraging open source tools gives organizations and developers much more flexibility and control. Because the underlying code is available, it provides an opportunity to customize it to fit unique scenarios or to create the necessary APIs to integrate the open source software with other tools. The fact that there is no single vendor that “owns” the software also means that organizations and developers can build on open source tools with the confidence that the apps will not arbitrarily disappear one day.

You can definitely develop or use open source applications without embracing DevOps, but is it possible to do DevOps effectively without using open source? “Maybe,” says Randy Kilmon, vice president of Engineering at Black Duck. “But who would want to do it that way? With so many great open source tools and components out there, deliberately shunning them would be a mistake. Besides, there is a piece of open source somewhere in your stack, whether you know it or not.”

That statement seems to be more true with each passing day. The growing momentum of DevOps and the mainstream acceptance of open source software form a powerful partnership that is transforming how applications are developed, deployed, monitored and maintained.

“Organizations want to advance their technology practices and stay ahead in very competitive industries, and do so in a mindful way,” explains Jose Miguel Parrella, senior product marketing manager of Cloud Platform Marketing for Microsoft, in the report. “DevOps can help reconcile the organizational needs, add value to the business, streamline the IT value delivery process and leverage open source innovation.”

The report sums up with this: “The simple fact is that the fundamental concept of DevOps—the culture shift organizations embrace to change how teams cooperate and collaborate so that projects can be delivered more effectively and efficiently—more or less requires a dependence on open source tools. A DevOps environment is too fluid and evolving to sit idly, waiting for a commercial vendor to develop a product with just the right set of features and capabilities.”

The report is available for download here.

June 1, 2016
DevOps Stack on a Shoestring Budget
There are competing products, both open source and licensed, in any DevOps area that you can think of. The Operations groups in companies tend to accumulate such applications over time as determined by ongoing projects. Team members’ familiarity with a certain application could be a factor in adding it to the tools stack.

Companies, therefore, end up with a mixed bag of freeware, open source or community versions of applications and software licensed from the get-go. In a startup environment where the Operations group might be on a shoestring budget, it might make sense to build the DevOps infrastructure on the cheap; using open source software (OSS) products would be one way to achieve that goal.

The Shoestring Budget

Below is a list of some of the applications and software for an effective DevOps environment. The list here includes only core applications that are needed to build the DevOps infrastructure. The basic communication and productivity tools that would be used by everyone in the company—and usually managed by IT—are not in the scope. Neither are the compilers and debugging and testing tools used by product development teams. However, in a small company setting, managing all kinds of tools might drop into the laps of the same people driving the DevOps initiatives.

The objective here is to make a list of software that could be used license-free. That means some of the obvious applications in certain areas might not make it to the list. That doesn’t mean that the open source alternative is an inferior choice; availability of reliable product support is a major factor in most of the software purchase decision-making processes, and licensed software scores over OSS on that front.

Git for Source Code Management (SCM)

A code repository might be the first DevOps infrastructure component that would be set up even before a product idea is formalized into a company. Also, both developers and DevOps engineers need it for collaboration, within their own teams and across various engineering teams. Typically in a startup, developers get started with the DevOps work such as build and deployment automation before a dedicated DevOps team would even be part of the engineering staff.

In this category, It is hard toimagine choosing anything other than Git. Even though GitHub is not free for maintaining private code repositories, Git server can be setup on-premise for free. AWS has CodeCommit, another SaaS version of Git, as one of the services, and there is no extra cost for using it if you are already on AWS.

Bugzilla for Bug Tracking

The popular Atlassian suite of products, JIRA in this category and Confluence for collaborative documentation, seems to be default choices in respective categories. But, both on-premise and SaaS offerings of JIRA and Confluence are licensed. Bugzilla is a powerful OSS alternative to JIRA that can support a large user base and it has been around for a while.

If you are open to customizing Bugzilla for specific requirements, it could work better than some of its licensed competitions. Though its primary use is bug tracking, Bugzilla is feature-rich enough to be used for managing all phases of software development and even as an IT ticketing system.

MediaWiki for Collaborative Documentation

Though there are multiple, open source wiki applications available, MediaWiki might be the best supported when it comes to the availability of third-party extensions. Out-of-the-box features of MediaWiki are limited, but it can be extended using the free extensions available. Such customizations are very straightforward.

Jenkins as Build & Continuous Integration Platform

Though there is an enterprise offering of Jenkins from CloudBees, its open source version combined with freely downloadable plugins would make up a powerful integration platform for build, release and deployment automation—and any other areas in between. Describing Jenkins any more here would be simply preaching to the choir.

Artifactory for Artifacts Management

This is one of the applications a lot of companies might not have in their DevOps stack in the initial stage. However, the need to store built artifacts and to cache third-party tools is real, and the packages and binaries would normally end up in S3 buckets or shared filer volumes. There is no reason for not using the OSS version of Artifactory right from the beginning, as it covers the storage requirements already mentioned and much more:
- Automated uploading of artifacts as part of the build process, typically done from Jenkins
- Caching third-party tools locally for builds and deployments
- Storing software artifacts for meeting build dependencies
- Distributing packages and third-party tools for deployments
Ansible for Configuration Management and Orchestration

There are two great products in this space that could be used for free: the OSS versions of Puppet and Ansible. If you are on AWS, Chef is also available, at no extra cost, in the form of OpsWorks. But I would recommend Ansible for those getting started for these reasons:
- It is an agentless tool and beginners would feel safer to roll out automation using it. A configuration management agent can play havoc with production systems if something gets misconfigured inadvertently.
- Using the playbooks, deployments can be orchestrated very well using Ansible. In many companies, Puppet or Chef primarily covers system management aspects and there would be additional tools for deployments. Ansible simplifies that scenario.
- Ansible’s support of Python turned out to be more useful, in my experience, than the support of Ruby in Puppet and Chef. The chances of a DevOps engineer knowing Python is much more than Ruby.
- Ansible’s handling of host inventory is advanced, especially the dynamic generation of inventory lists. The latter feature is compatible with the provisioning of cloud infrastructure where its elasticity demands the use of dynamic inventory lists in configuration management systems.
Nagios for Monitoring

A lot of us in the DevOps community despise Nagios for its blandness and lack of features out of the box. But if you are willing to customize it by developing application-specific plugins, it could be converted into a very effective monitoring platform that can be used to consolidate outputs from the rest of the monitoring and various admin applications. I recommend it for these reasons:
- Writing plugins for Nagios is very simple. Also, there are tons of free plugins available that would meet most of the system-level and third-party component level monitoring.
- Developing plugins to add application-level monitoring and to integrate with third-party admin applications is easy.
- When you want to move on to a next generation cloud-based monitoring application such as Datadog, existing Nagios plugins are normally migrated natively or as an integration.
In a sysadmin environment where coding skills would be in short supply, Nagios could be of limited use as a systems monitoring application. But DevOps teams should treat it as an easily extendable tool that can be used to implement specific and fine-grained monitoring goals of the company.

ELK for Log Management

Splunk was instrumental in changing the way we dealt with log files, and, now there are several good products including Loggly, Logentries and Sumo Logic in that space. Though some of these SaaS products have a free tier and that might be enough for a small operation, it is better to start with ELK (Elasticsearch, Logstash and Kibana stack), mainly because the size of the logs can grow very fast and so would the usage of the log management application in the company. ELK requires substantial DevOps resources to set it up and maintain, as there are three applications involved.

Closing Remarks

It is important to have these essential applications, or similar ones with comparable features, implemented or made available to empower the engineering staff. They facilitate the application development, lay the foundation for automation initiatives, and provide the toolkit to maintain production environments 24×7.

Though it is normal, the organic growth of the DevOps organization and infrastructure can bring in OSS products with overlapping features, mainly because they could be used license-free. Carefully selecting the tools would help avoid the otherwise-inevitable clutter and the confusion later.

One aspect not discussed is the total cost of use of a software. If SaaS offerings such as GitHub, Datadog and Loggly, and hosted versions of JIRA, Confluence and Artifactory are used, the cost would only be the subscription charges. OSS applications will need computing resources and some amount of customization and administrative overheads, which could add up to the overall cost.

If the objective is to minimize total cost, the upfront decision-making can become much more complicated than it looks. However, for a startup or a small company, getting started with the OSS stack for setting up the DevOps infrastructure can be advantageous if the applications are selected carefully.
February 5, 2016
Open Source software license and security management with WhiteSource
With the growing speed and availability of open source components, it becomes easy to add features and integration of software with other components which makes software development easier. But there are a few points to be remembered while using any open source component.
- Security vulnerabilities
- Licensing risks of open source component.
- Outdated open source components.
The above are a very important part of the the software development life cycle to eliminate any discrepancies related to security or legal issues.

WhiteSource provides one fine platform to solve such issues without putting in much effort by developers, They can concentrate on core development instead of spending time on finding these issues which can be easily handled by WhiteSource.

WhiteSource is an open source management solution which does
- Open source licensing and compliance management
- Open Source security vulnerabilities alerts and management
- Executive dashboards, policy enforcement, and reporting
WhiteSource checks your software and generates open source inventory report, including detail from open source. The WhiteSource gathers information on open source components and they keep the inventory updated.

WhiteSource covers almost all commonly used languages and provide detail report, This tool can track all your open source components used knowing or unknowingly within your software.

It sends alerts for any potential issue observed in open source component used by software. It does check for outdated/expired component, It provides detail on security issues found in any opensource component.

WhiteSource does not store (keep track of) any software component which is not open source, this means it’s safe and your code will not be touched.

CI tool Integration (Jenkins)

The best part of the tool is that it has plugin available for the widely used CI tool – Jenkins.

WhiteSource Jenkins plugin is the best and easy way to integrate with WhiteSource to run the checks during build and integration phase in an automatic way.

Its very easy to use, not even just for Maven project also for free style projects.

Easy to configure and use within project. Only token needs to be added and plugin automatically takes care of everything.

Multiple options are available at job level to define the project and modules to be included.

Logs are pretty descriptive when plugin start processing in Jenkins job.

WhiteSource basic principle talks about

Managing the component vs governing the component.

Developers can leave the managing part up to WhiteSource and only concentrate on the issue of governance at the component level in software.
September 18, 2015