The Money Game
Roesch bristles when you bring up the fears CIOs have about "crippled" open source. He's got a right to be touchy. Eight years ago, he single-handedly developed the core of Snort. Since then, he estimates that he has written 3000 postings to the Snort discussion list and carefully built a large community of users (more than 2 million downloads and 100,000 active users, he says). In return, he got what every open source developer craves: respect, recognition and the occasional free beer from grateful users at technology conferences.
Roesch got everything except money. And that was OK. For a while.
"I was never motivated by financial gain," recalls Roesch. "It just ended up that way. People don't develop open source for monetary gain. You develop it for reputational gain."
Roesch could have used his reputation to land a high-paying job at a software company, but he liked working on Snort. So in 2001 he began courting venture capitalists to see if they would back his plans to start a company to support Snort. When he made the rounds, he says, there were no takers. "They wouldn't go near it unless we had some [proprietary] intellectual content wrapped around Snort," Roesch says.
Once he developed some proprietary management tools and a friendly GUI to run on top of Snort, Roesch got his money. And he's never looked back, partly, he argues, because he has no choice. Snort competes against software from well-known, well-funded companies such as Cisco, and "if you're going into a highly competitive area of software, as we did, you have to take venture capital", he says, adding that others have built proprietary tools around Snort. "You're going to have people who are going to try to ride on your coat-tails," Roesch says.
So far, according to Roesch, no one in the Snort community has held his financial success against him. "I like writing code," says Glenn Mansfield Keeni, a professional developer who contributes to Snort in his spare time. "I derive great satisfaction by contributing towards building a secure Internet. The code remains open source so there is no bitterness or feeling of being let down. If the commercial framework helps Snort take greater strides forward, that's welcome."
But others in the community wanted to guarantee that Snort would remain open. They formed a group in 2003 called Bleeding Snort to provide open source intrusion-detection rules and definitions for Snort (similar to the virus definition files you download for your antivirus program). It was a prescient move. Sourcefire now makes its updates available to its paying customers first; others have to wait five days. And unlike Bleeding Snort's updates, Sourcefire's are no longer released under an open source licence. Companies that have built proprietary software on top of Snort (Sourcefire is not the only one) have to pay a fee to Sourcefire to get those updates now. But Bleeding Snort often beats Sourcefire to the punch with new rules, says Alan Shimel, chief strategy officer for StillSecure, a security software company that uses the Snort engine as part of its proprietary software. Shimel obviously has a vested interest in keeping the Snort engine open source, but he says "there were a lot of people in the Snort community who weren't happy when [Roesch] formed Sourcefire. I've spoken to people inside Check Point who say they intend to keep Snort open, but as they say, the road to hell is littered with good intentions."
For its part, Check Point's Web site states that it is "committed to the Snort open source community, and we look forward to growing the Snort solution and the Snort community in the future".
But the fact is, not all open source security software has remained open. A software package called Nessus was initially released under an open source licence in 1998, but the latest version (3.0) has been released under a commercial licence (earlier versions remain available as open source) - though it is still free to users. Nessus's original developer, Renaud Deraison, who, like Roesch, has started a company (Tenable Network Security), says his commercial customers pressured him to close the source. "Many of them had prohibitions against [open source] software or had to jump through legal hoops to get permission for it," he says. "What they want is quality, free software. The licence is less important." Though Nessus's shift has brought criticism from some open source advocates on discussion Web sites like Slashdot.org, Nessus usage seems not to be affected - at least not yet.
Meanwhile, CIOs - who are constitutionally sceptical of vendor promises - are worried about Check Point's purchase of Snort. "It's definitely a concern," says Kirk Drake, vice president of technology for the National Institutes of Health Federal Credit Union, which uses Snort and Sourcefire's add-ons. "But it's no different from what we've seen before. We buy a good product, and it gets bought by another company and the product can change. And the pricing changes."
According to Roesch, those who see mixed source as a Trojan horse for an inevitable march back to proprietary software are underestimating the power of the open source community. "Check Point got one of the most tested and deployed code bases in the world, and if they manage it carefully they've got the community too," says Roesch. "I would argue that the goodwill generated by Snort among users and developers probably outweighs the value of [the proprietary software], and I think Check Point believes that as well." In other words, continuing to support an open Snort will cost Check Point less than alienating the community by closing the source.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.