Open Source and Free Software 2015:

Transcription

1 INTELLECTUAL PROPERTY Course Handbook Series Number G-1250 Open Source and Free Software 2015: Benefits, Risks and Challenges Co-Chairs Lori E. Lesser Stuart D. Levi Heather Meeker Lawrence Rosen To order this book, call (800) 260-4PLI or fax us at (800) Ask our Customer Service Department for PLI order number 59187, Dept. BAV5. Practising Law Institute 1177 Avenue of the Americas New York, New York 10036

2 3 Effective Business Practices in the Open Source Cloud Nissa M. Strottman Hewlett-Packard Company If you find this article helpful, you can learn more about the subject by going to to view the on demand program or segment for which it was written. 125

3 126 Practising Law Institute

4 Over the past few years, cloud computing has become an increasingly important and prevalent technology. The cloud is used by large companies and small businesses for both internal operations and to provide critical, customer-facing aspects of their businesses. Individuals are also cloud consumers, e.g. using the cloud to store music, photographs and other data. Developing and provisioning cloud technologies and services are major areas of focus for many technology companies and developers. Open source code is commonly used in the development and provision of cloud technologies and services and is often a significant component of such technologies and services. This paper will explore open source issues that arise from the open source cloud, with respect to providers (including developers) and consumers of cloud technologies and services. For a more general discussion on open source business practices, please refer to the paper entitled Effective Open Source Development Business Practices by Adam G. Cohn and Gary Spiegel, also in this publication. The first section of this paper will provide a brief overview of cloud computing and different service and deployment models. The second section of this paper will address open source issues for cloud service providers, and the third section will discuss open source issues faced by consumers of cloud technologies and services. I. A BRIEF OVERVIEW OF CLOUD COMPUTING There are three common cloud computing service models: Infrastructure as a Service ( IaaS ), Platform as a Service ( PaaS ), and Software as a Service ( SaaS ). IaaS provides a user with computing resources, such as processing and storage, that enable the user to perform various operations including provisioning virtual machines, running operating systems and applications and storing and accessing data. IaaS users do not manage the underlying physical infrastructure. PaaS provides a user with programming languages and other tools (such as databases and web servers) that allow the user to develop and deploy applications from the cloud-provided platform; the user does not control the underlying infrastructure. In the SaaS model, software is provided and accessed (though not downloaded to or installed on user devices) through the cloud, but the user does not control either the underlying infrastructure or platform. Each of these service models can be made available in different cloud deployment models. Cloud deployment models include public and private clouds

5 With respect to a public cloud, the infrastructure is controlled by the service provider and the service is made available to multiple customers. Public cloud services are typically made available on a pay-as-you go basis and are often used by developers or small businesses who want a wide variety of scalable computing resources without having to expend the resources to either acquire their own infrastructure or a private cloud. Public clouds are also used by larger organizations who want to reduce expenditures by storing certain types of data or running certain operations outside of their own infrastructure. In contrast, a private cloud is operated for a single organization, and the infrastructure is owned and/or operated by or on behalf of that organization. A private cloud model may be preferred by organizations for various reasons, including the ability to control the infrastructure. Now, let s turn to a discussion of open source issues which may be encountered by cloud service providers. II. SERVICE PROVIDERS AND THE OPEN SOURCE CLOUD If you are a provider of any type of cloud solution, whether it is IaaS, PaaS, or SaaS, whether you offer a public or private cloud deployment, you are almost certainly using open source in some capacity, and it is likely that your customers will be using open source code as well. In addition, your customers may have questions about your use of open source code and will expect you to comply with your obligations under open source licenses. Given this, you should understand what open source code you are using and identify the licenses associated with such open source code. If you have built your own cloud solution, you should identify the open source components that you used. If you are using third party proprietary technology to provide any part of your service, there are several things you should know: What open source code is included with that technology? What are the third party s obligations under those licenses, and have they complied with those obligations (and put you in a position where you can comply with any obligations you may have under those licenses, e.g. source code distribution)? Have you architected your solution in such a way as to avoid any license incompatibility issues? If you modified any open source code, are you obligated under the terms of the license to make those modifications available in source code form? You should also understand how open source code in your service is being used. Is it being used on the backend to provide the service, where it will never be accessed by customers, or is it accessible to customers 4 128

6 even if there is no physical transfer of bits to the customer? Is the code actually being distributed to or made available for download by customers? Once you understand how the code is being used in the service, you can determine what your obligations are under the corresponding open source licenses. Note that some open source licenses provide that certain obligations are triggered by distribution of the code covered by that license; other open source licenses (such as AGPLv3) provide that obligations (e.g. making source code available) may be triggered in certain instances even if you are not distributing the code, but you are simply using the licensed code to provide a service. The licenses governing the open source code should be reviewed carefully to understand your obligations and also to determine whether the use of code governed by those licenses is consistent with the open source policy and strategic goals of your business. Another question for your consideration is whether you want to contribute code to open source projects or the open source community. There are many reasons you may want to participate, including improving the code base, promoting interoperability of your solution with other services, influencing the direction a particular project takes, driving adoption, attracting other developers to work on projects of interest to you or enabling other developers to develop applications that are compatible with your solution. If you are offering IaaS to customers, those customers may be storing and running open source code in your service (and using that code to provide a service to their own customers). Therefore, you should consider how you want to address your customers potential use of open source code in your Terms of Service. For instance, you may want to add a provision to your Terms of Service that requires customers to comply with all third party license terms. Having discussed open source issues that may be faced by service providers, let s now review open source issues for consumers of cloud solutions. III. CONSUMERS AND THE OPEN SOURCE CLOUD As a consumer of cloud technologies or services, the types of open source issues you need to consider vary based upon whether you are using a public or private cloud

7 A. The Public Cloud Practising Law Institute When utilizing a public cloud, one of the first questions you should ask is, what code, if any, is distributed or otherwise provided or available to you under an open source license by or from your service provider? Once that code and the associated license(s) are identified, you should consider how you are planning to use that code, what rights you have under the license, and whether you have any obligations under the license. For instance, if you are planning to use the code in a product you will distribute or a service you will make available, does your proposed distribution or use in providing that service trigger any obligations under the open source license, such as attribution or making source code available? You should also consider whether the content you are uploading to the public cloud includes any open source code and, if so, what rights and obligations you have under the controlling open source licenses given your intended use of that code. For instance, if you are going to use the public cloud to provide a service of your own in which you will be (1) using open source code to provide the service (though you won t actually make any of the bits of the code used to provide the service accessible to customers) and (2) making open source code available for download to customers of the service, understand your obligations under the relevant open source licenses for each of these proposed uses and whether these uses are consistent with the public cloud provider s Terms of Service. Finally, for businesses using a public cloud service, you should determine whether the proposed use of the public cloud service and any open source code distributed by or otherwise available to you from the service provider is consistent with the open source policy and strategic goals of your business. B. The Private Cloud There are various issues raised by the private open source cloud. If you are using a third party solution to provide all or part of your private cloud, what open source code has been provided or is available to you from that third party? What licenses govern that code? How are you planning to use the code? Given your planned use of the code, what rights and obligations do you have under the licenses governing the code (including any proprietary licenses that may be part of the private cloud solution)? Assuming you have the right to modify the open source code in the private cloud solution and you are 6 130

8 planning to do so, do you have an obligation to make those changes available in source code form or, if you have no obligation to make those changes available, do you want to contribute those changes to the community? Will any such modification impact your rights under any agreement you have with the third party provider of your solution e.g., does modification impact your right to receive support? If you are going to add additional open source or proprietary code to your private cloud solution, are the licenses of the code you are considering compatible with the licenses governing the code in the private cloud solution? You should also consider the third party s obligations under the licenses controlling the open source code in the third party solution and whether those obligations have been met. As with the public cloud, you should consider whether the content you are uploading to the private cloud includes any open source code and, if so, what rights and obligations you have under the controlling open source licenses, given your intended use of that code. If you are going to use the private cloud to provide a service which is publicly available, and you have uploaded open source code to your private cloud in order to provide that service, you will need to consider what obligations you may have under the open source licenses with regard to that open source code. In addition, you should determine whether the proposed use of the private cloud service and any open source code associated with that private cloud is consistent with the open source policy and strategic goals of your business. IV. CONCLUSION The use of open source in the cloud requires a review and an analysis of the corresponding open source licenses by service providers and consumers of cloud solutions. The review and analysis should include identifying the open source code being used, the licenses that govern that code, the proposed use of that code, and any obligations arising under the open source licenses based upon the proposed use, and aligning these with the open source policy and strategic goals of your business

9 NOTES 132