Open-source software is a significant security risk for corporations that use it because in many cases, the open source community fails to adhere to minimal security best practices, according a study released Monday.

The study, carried out by Fortify Software with help from consultant Larry Suto, evaluated 11 open-source software packages and each community's response to security issues over the course of about three months. The goal was to find out if the community for each open-source software package was responsive to security questions or vulnerability findings, published security guidelines, and maintained a secure development process, for example.

[ Track the latest trends in open source with InfoWorld's Open Sources blog. ]

Open source application server Tomcat scored the best in the study, titled "Open Source Study -- How Are Open Source Development Communities Embracing Security Best Practices?"

The remaining 10 open-source application, tool and database packages -- Derby, Geronimo, Hibernate, Hipergate, JBoss, Jonas, OFBiz, OpenCMS, Resin, and Struts -- had a dismal showing. Among these 10 packages, application server JBoss scored higher by providing a prominent link to security information on its Web site and easy access to security experts, but came up short for not having a specific e-mail alias for submission of security vulnerabilities.

"You don't want to report bugs to a general mailing list because it would go to the general public," says Jacob West, manager of Fortify's security research group. There needs to be a measure of confidentiality in reporting bugs so that the fix for them can be provided when the public is notified, so attackers don't get early information they can exploit.

But too often the open-source communities that offer their software for free don't appear to be as mindful about security practices as their commercial counterparts, which charge for software and support, West says.

Fortify identified a total of 22,826 cross-site scripting and 15,612 SQL injection issues associated with multiple versions of the 11 open-source software packages examined.

But when Fortify tried to reach out to the open-source software communities, with the primary point of contact a Web site and a general e-mail address, the security firm found that "in two-thirds of these cases, you didn't get a response at all," West says. "There are no phone numbers. Who do you go to ask for information? It's kind of hard to tell who these people are."

The report itself notes, "Open-source packages often claim enterprise-class capabilities but are not adopting -- or even considering -- industry best practices. Only a few open source development teams are moving in the right direction."

West says Fortify did not conduct this study in order to condemn open source software, but rather to point out that the security practices need to improve because open source adoption by enterprises and governments is growing.

Howard Schmidt, former White House cybersecurity czar who's now a consultant, and also a board member at Fortify, says the study shows that when it comes to business adoption of open source software, "You've got to go into this with your eyes wide open."

The reality is that while open source software may appear more cost-effective and just as functional as commercial software in some instances, the question of maintenance must be examined very carefully.

"Who do you reach out to?" Schmidt asks. "What about the thousands of companies out there running Geronimo? And what about your supply-chain partners?"

The bottom line is that corporations may find they have to undertake remediation of open source packages on their own. "You are effectively on your own, absent your having an arrangement ahead of time," Schmidt says.

Government agencies and corporations need to decide if they're going to try to mitigate problems with open source software themselves, through risk assessment and code review, and whether they plan to give that information back to the open source community.

This is a fundamental question about the life-cycle development of the software, West says, adding that the study indicated to Fortify that the open source communities in these cases tended not to correct for identified flaws in software versions over a period of time.

SAP plans to close its TomorrowNow software maintenance subsidiary by Oct. 31, having failed to find a buyer for the company. It will help TomorrowNow's 225 customers to find new support providers before the company closes its doors, it announced Monday.

TomorrowNow built a business selling third-party support for PeopleSoft and JD Edwards applications at around half the price charged by the original software vendors, later adding support for Siebel and Baan software to its range.

[ Discover the top-rated IT products as rated by the InfoWorld Test Center. ]

SAP bought TomorrowNow in February 2005: the company offered a convenient way for SAP to get closer to customers of its arch-rival Oracle, which had acquired PeopleSoft and JD Edwards in 2004, and later snapped up Siebel too.

However, in March 2007 Oracle filed suit against TomorrowNow and SAP, alleging that they had gotten a little too close. Oracle charged that TomorrowNow employees had illegally downloaded support materials for PeopleSoft and JD Edwards products from an Oracle Web site. SAP has denied gaining access to Oracle's intellectual property in this way.

Last November, SAP announced the resignation of TomorrowNow's management team, and said it was considering selling the company. Both moves were seen as ways for SAP to distance itself from the activities of its subsidiary and clean up its reputation.

In the end, arranging a sale proved too much of a challenge.

"We carefully considered many options for selling TomorrowNow, but it would have been an extremely complex transaction for both the seller and the buyer. We chose to wind down operations instead," said SAP spokesman Saswato Das.

Oracle is asking for damages likely to total US$1 billion or more in its suit, according to documents filed with the court last month. A trial is scheduled for February 2010.

Das would not comment on what effect the closure of TomorrowNow might have on the case. SAP expects the cost of winding down operations at TomorrowNow to be "immaterial," he said.

SAP aims to make the switch in support provider as smooth as possible for TomorrowNow's 225 customers, around 70 of whom are also direct customers of SAP, Das said.

"We are working with each customer individually to help them choose their best option, including choosing Oracle support. Some can go to other third-party support," he said.

Despite abandoning the market, SAP still sees a role for third-party software support.

"We believe the third-party maintenance market has its strongest appeal to customers using software that is considered end-of-life or obsolete, which does not apply to the bulk of SAP software," he added.

Apple's iPhone 3G supply dropped dramatically over the weekend, as the company's own inventory tool showed fewer than 9 percent of its stores had any phones to sell on Sunday.

As of 11 a.m. Eastern time, only 16 of Apple's U.S. retail stores, or 8.5 percent of the 188 total stores, listed iPhone 3Gs available. That figure is significantly down from Thursday, when 50 stores, or 27 percent, indicated that they had iPhones in stock.

[ For the big picture on the iPhone 3G, see InfoWorld's special report, and for more on bringing the iPhone into the office, read "How to make the new iPhone work at work." And get the latest on mobile developments with InfoWorld's Mobile Report newsletter. ]

And unlike last week, when as many as 13 stores said that they had all three iPhone 3G models for sale -- the 8GB version in black, and the 16GB version in both white and black -- by Sunday, no Apple store had all in inventory.

Even one of Apple's most prominent stores (and the only one open around the clock), located on 5th Avenue in New York City, didn't have a full complement of iPhones to sell.

In fact, according to Apple's own stock-checking tool, none of the 38 stores in California, Apple's home state, had iPhones.

The hardest-to-find iPhone 3G remained the $299 black 16GB model, which was available today in only 3 stores, or 1.6 percent, of the outlets. Supplies of the $199 8GB iPhone 3G and the $299 16GB white model have also plummeted since last week, according to Apple. Only 10 stores reported the 8GB as available on Sunday (5.3 percent of the U.S. stores) compared to 24 stores on Thursday (12.8 percent), while just 6 stores claimed that the 16GB white iPhone 3G was in stock (3.2 percent), down from the 46 stores (24.5 percent) that had it Thursday.

It could be weeks before the deficit improves, one Wall Street analyst said last week. Gene Munster, an analyst with Piper Jaffray & Co., said in a Thursday interview that it would take Apple two to four weeks to place orders with its suppliers, receive more iPhones, and restock the depleted inventory.

AT&T's 1,200 retail stores, meanwhile, were almost completely out of iPhone inventory as early as last Tuesday.

However, some customers contributing to a massive thread on AT&T's support forum -- by Sunday, it had collected more than 3,900 messages -- said that they had been told iPhones they ordered on July 11 or 12 using the mobile operator's "direct fulfillment" program had been shipped as of Friday, July 18 or Saturday, July 19. A few consumers said they had actually received iPhones.

AT&T's direct fulfillment program lets customers place orders at one the company's retail stores; the store notifies the customer when the iPhone 3G has arrived, at which time the customers must return to the store to pick up and activate the phone.

Computerworld is an InfoWorld affiliate.

A California startup company is trying to improve on the Web browser with a free add-on tool that lets you access services from Web sites without having to actually visit them.

The add-on is available for Microsoft Internet Explorer and Mozilla Firefox. Once downloaded, it appears as a collapsible toolbar at the bottom right corner of the screen, with icons for services such as YouTube, Wikipedia, MapQuest, and Flickr.

[ Keep up on the latest tech news headlines at InfoWorld News, or subscribe to the Today's Headlines newsletter. ]

When you're browsing the Web and come across a term you want to know more about, you can highlight the term, click on the Wikipedia icon, and a box pops up with a snapshot of the Wikipedia page about that item. Clicking on a "Share" icon lets you send the text and the link for the Web page to friends via Gmail or Facebook.

The tool is called RoamAbout, to reflect the idea that you take your favorite services with you as you roam about the Web. It was introduced by startup Vysr (pronounced "visor") in late March and has been downloaded about 10,000 times, according to CEO Guda Venkatesh.

On Monday, Vysr opened its platform to let third parties develop further toolbar applications, which they can then try to make money from through advertising or other means. Vysr also added some new applications, including one for searching eBay, a music service from Grooveshark, and a comparative shopping service from one of its first developer partners, Viddu.

Viddu CEO Kiran Patchigolla said he was drawn to Vysr because it provides an unobtrusive way for people to use other services without having to open new browser tabs. He said it took him a weekend to create a new view for his existing shopping tool so that it can appear in RoamAbout.

The applications available in Vysr today are still fairly limited, however -- there are about a dozen -- and Gmail and Facebook are currently the only ways to connect with friends.

That's why opening the platform to developers is important, but getting them on board without having a large base of users could be tough, said Barry Parr, a media analyst with Jupiter Research.

"To make this a success you need to have several million active users. With less than that, it's difficult to have much going on in the market, as an advertising platform or one that developers will be interested in working for," he said.

Vysr also has plenty of competition from other platforms vying for developers' attention, such as Facebook, and from other browser add-ons, including the many available for Firefox. Most add-ons are free, open source tools, and not many have been successful as commercial businesses, Parr said.

In fact, history is littered with companies that have tried to build a business by extending or reinventing the ubiquitous Web browser. One factor in Vysr's favor is that more Web sites these days are exposing service interfaces for use by other sites, Parr said.

Venkatesh said other tools failed because they tried to change people's behavior too dramatically. "The only paradigm change here is the idea of selecting something on a page and then invoking it in another service. Even then, I'm a bit worried. It's still a paradigm shift, but it's small enough that we believe it will work," he said.

Vysr also says it has something unique to offer. Part of the platform available to developers is a VoIP service for adding calling capabilities to applications. Vysr claims it has the only platform that combines the context of a Web page with the social, sharing aspect and a communications platform.

The company has secured a bit less than $2 million in Series A funding, Venkatesh said. It hopes to make money by taking a cut of the ad revenue collected by third-party applications.

"The implementation is nice, but it's too early to say if it will be attractive to consumers," Jupiter Research's Parr said.

Yahoo has reached an agreement to end a proxy fight with investor Carl Icahn, who will take a seat on the company's board after the annual stockholders' meeting, Yahoo said Monday.

As part of the settlement agreement Icahn, who owns 4.98 percent of Yahoo common stock, has agreed to withdraw his nominees and support those of the board at the annual meeting on Aug. 1. Eight members from the current board of directors will be up for re-election, including CEO Jerry Yang.

[ For the complete saga of Microsoft's attempt to take over Yahoo, check out InfoWorld's special report. And keep up on all the latest tech news headlines at InfoWorld News, or subscribe to the Today's Headlines newsletter. ]

The Yahoo board will be expanded to 11 members, including Icahn and two others from his list. With Icahn now to have a seat on the board, his list includes eight remaining nominees along with Jonathan Miller, currently a partner in Velocity Interactive Group and former chairman and CEO of AOL, according to a statement from Yahoo.

Icahn had been trying to wrest control of the Yahoo board to force a sale of all or part of it to Microsoft. Yahoo has rebuffed Microsoft's offers and according to published reports Microsoft is now in talks with Time Warner to possibly buy its AOL business. After Yahoo investor Legg Mason said last week that it would support the current Yahoo board, it appeared likely that Icahn's efforts would not prevail. Legg Mason owns 4.4 percent of Yahoo shares.

The agreement between Yahoo and Icahn serves the best interest of stockholders, company chairman Roy Bostock said in a statement, and he now looks forward to working productively with Icahn and the other new members of the board.

For his part, Icahn said in the same statement issued by Yahoo that he is pleased with the settlement, but he still contends that selling all of the company or its search business "must be given full consideration."

As part of the agreement, that issue, as well as any strategy for a "transaction," will be discussed by the full board, which also pleases Icahn, according to the statement.

The power-saving properties of CherryPal's new Linux-based mini-desktop may attract cheers out of social conscience, but its performance may lead to some concerns.

The CherryPal "cloud computer," announced on Monday, which looks more like a thin client, uses only 2 watts of power at maximum usage, 97 percent less than typical desktops, the company claimed.

[ Get the analysis and insights that only Randall C. Kennedy can provide on PC tech in InfoWorld's Enterprise Desktop blog. And download our free Windows performance-monitoring tool. ]

But with low power consumption comes limited performance, said Michael Kanellos, senior analyst with GreenTech Media. It is best used as a secondary home desktop for basic Internet and productivity applications, but other than that, it serves limited purpose, Kanellos said.

Priced at $249, the system includes a Freescale processor running at 400MHz, 256MB of RAM, and 4GB of internal flash storage. It comes with the OpenOffice suite and the Firefox Web browser. By comparison, Asus Eee PC mini-notebooks have at least an 800GHz Intel Celeron processor, 512MB of RAM, and 2GB of flash storage for about $300.

Users have the option to store data online, a concept known as "cloud" storage, and access it from any device, including mobile phones. Online storage capacity of 50GB will be provided at no extra cost, according to the company.

The system weighs 0.66 pound (0.3 kilogram) and runs an embedded version of Debian Linux. It will not come with Windows, according to the company. It doesn't include a monitor or keyboard.

It is initially targeted at universities and students, but it will also be available for users to buy online, said Max Seybold, CEO of CherryPal. The mini-desktop not only conserves energy but takes up little desk space compared with desktops or laptops of the usual size, Seybold said.

Compared with normal desktops, CherryPal's can save $35 per year in energy costs in the U.S. if used eight hours per day, Kanellos said. It may have an even bigger benefit to users in some developing countries, where average incomes are lower and power is scarcer, Kanellos said.

Many companies, including Samsung, Sun, and OQO, have floated plans to sell similar mini-desktops but scrapped their ideas after audiences didn't buy into them. People are used to conventional computers, and CherryPal is trying to sell not just a limited-capability desktop, but a new concept, Kanellos said.

"In the last 15 years, these things have come and gone. It's going to be an uphill climb" for CherryPal, Kanellos said. Even if CherryPal succeeds, nothing will stop PC vendors, and retreads like Samsung could re-enter the market, Kanellos said.

Seybold said the company is trying to educate the market about the concept of low-cost computing, and the success of low-cost, Linux-based laptops such as the Eee PC is helping.

The company is also trying to educate the market on cloud computing, which people haven't warmed up to yet, Seybold said. Users originally didn't like the idea of data residing anywhere else other than on the local hard drive, but that is changing, he said. It took a while for people to latch on to cloud concepts such as Hotmail and Yahoo Mail with e-mail messages stored on external servers, Seybold said.

The system will begin shipping later this month, Seybold said.

Storage costs eat up at least 11 percent of IT hardware budgets, but there are plenty of ways to save money without sacrificing performance or security. In a new report called "Five Key Storage Strategies for a Down Economy," Forrester analyst Andrew Reichman provides a road map for smart purchasing and maximizing the resources you already have. Here's a summary.

1. Play hardball with vendors. The storage market is highly competitive, but vendors also know that the cost of switching can be prohibitive. (Compare storage products.) This means your current vendor might have become complacent, particularly if you have been loyal for many years, expanding capacity without competitive bids, Reichman writes.

[ Get the latest on storage developments with InfoWorld's Storage Adviser blog and Storage Report newsletter. ]

But as the economy gets worse, "storage vendors will be trying even harder to win new deals and protect their existing accounts from competitors trying to do the same thing," Reichman writes. "Use this situation to your advantage by introducing a fresh sense of competition among the vendors you work with." By undertaking a request for proposals bidding process, you can win discounts from your current vendor or discover a new, less-expensive vendor you weren't aware of.

2. Avoid new purchases by reclaiming what you have. Wasted storage, not surprisingly, is a waste of money. Storage is allocated but not used all the time for many reasons. "Some applications and operating systems don't lend themselves to gradual storage expansion over time; they require a large up-front allocation that may or may not be consumed eventually," Reichman writes. "This tendency for over-allocation combined with limited ability to effectively forecast data growth in most organizations leads to a significant gap in the amount of capacity that is allocated versus actually used."

Reclaiming wasted storage will often require application downtime, making careful planning necessary. Using storage virtualization is one way to migrate without disruption.

Other examples of wasted storage include: servers that have been taken off-line without its associated storage being returned to the free pool, and storage that's "'mapped but not masked,' meaning it has been allocated within the storage array but not recognized by a server."

3. Audit backup and replication configurations to cut waste. As important as disaster recovery is, the technologies that enable it sometimes lead to waste. "In a typical storage environment, there can often be as many as 10 copies of the same data -- several days of full backups, a couple of snapshots, and a fully replicated copy at the alternative site," Reichman notes. "Most backup systems have inadequate reporting capabilities, so it's difficult for storage administrators to associate applications to their backup jobs and their retention schedules."

An audit of backup policies and storage configurations can "eliminate unnecessary backup jobs, snapshots, clones and replication, and can return unused disk or tape media to the free pool to reduce future expenditure." Another strategy is to review replication levels to make sure the right amount of storage is being allocated to each application. This work can be tedious but can also be done internally and for little cost. (Compare data backup and replication products.)

4. Rethink storage network decisions. When you need high performance and availability, Fibre Channel isn't the only option. Alternatives that can sometimes provide both lower cost and meet performance needs include iSCSI, the Network File System (NFS) protocol, and direct-attached storage, Reichman writes.

Oracle and VMware are throwing "their hat into the NFS ring," he says, noting that more applications are supporting NFS as a way to connect servers to storage. Direct-attached storage is also a good alternative when the benefits of centralized networked storage are limited, such as when each storage device is dedicated to one application.

"While these options might not make sense for every application or every environment, cost-conscious firms should take a good, hard look at their storage network decisions and give some consideration to [these] approaches," Reichman writes.

5. Use a tiering methodology that delivers results simply. Every cost-control strategy requires an up-front investment of time or money, but for some the ROI happens quickly. Tiering, on the other hand, has to be viewed as a long-term strategy because you won't realize savings right away. For many users, the complexity of tiered storage has outweighed cost savings, but that doesn't mean it can't be effective.

"If tiering means buying a wholly separate platform in addition to the tier one infrastructure, it can take years to realize any benefit," Reichman notes. "By shifting investments you would already have made to lower tiers instead, you can realize cost avoidance."

Because of the down economy, more businesses are putting data on tier two storage right from the beginning, and only promoting it to tier one if the performance is unacceptable, he writes. "Buying cheaper, dense disks in the systems you already own makes sense for tiering without the added cost of a separate platform," Reichman writes. "Remember to keep it simple and consistent -- having too many tiers and options makes it hard to manage the environment, which can negatively impact cost savings."

Network World is an InfoWorld affiliate.

Because IT news can be fast-moving and readers don't always have the time to scan sites for the major news, reviews, and blog posts, InfoWorld now offers quick, mobile-friendly access to its key stories via the InfoWorld Twitter feed at twitter.com/infoworld. Periodic tweets alert readers to the most compelling stories on the site as hand-selected by our news editors. Editors, reviewers, and reporters also occasionally tweet their key observations on breaking events or on in-progress testing.

Anyone can access the InfoWorld Twitter feed from a Web browser, including those on popular mobile devices such as the Apple iPhone and Palm Treo. By using Twitter's "follow" feature, you can get notified whenever InfoWorld posts a tweet. You can also sign up at Twitter.com to get text messages sent to your cell phone. These last two capabilities require that readers have a free Twitter account.

Over time, InfoWorld expects to use the Twitter feed as a conduit between its editorial team and its readers, providing readers quick and easy access to talk about articles and suggest ideas for -- or even participate in -- future ones.

The use of Twitter is the latest of InfoWorld's mobile-friendly offerings. The IT experts' and practitioners' Web site also offers a mobile version of its Windows Sentinel performance monitoring tool, mobile versions of its InfoWorld Daily and other podcasts, and text-message alerts for several technology categories through the InfoWorld Mobile Alerts service.

Desktop and mobile Web users can also subscribe to a variety of InfoWorld RSS feeds to track specific topics. RSS badges appear throughout the InfoWorld site for easy sign-up to those specific channels.

WSO2 is releasing on Monday WSO Mashup Server Version 1.5, an open-source product for deploying mashup services featuring Google Gadgets support and interfaces to relational databases and other data sources.

The mashup server uses JavaScript to describe logic for acquiring information, combining data, and exposing it to a user. Information can be acquired from sources such as Web services and scraped pages and published as a new Web service, feeds, Web pages, or notifications.

Version 1.5 features stubs and templates for Google Gadgets, which can be hosted within Mashup Server or externally such as in an iGoogle page. A beta dashboard add-in is featured for hosting Google Gadgets within Mashup Server. Google Gadgets enable dynamic content to be placed on a Web page.

Data services enhancements provide Web services interfaces to relational databases and other data sources such as Excel spreadsheets and comma-separated values.

?The integrated WSO2 Data Services and expanded security functionality in our Mashup Server 1.5 make this a reality, enabling the deployment of trusted, enterprise-class composite services from multiple data sources in as little as a few hours," said Sanjiva Weerawarana, CEO of WSO2, in a statement released by the company.

Also featured is an integrated UI for managing secure mashup services based on the WS-Security specification. Users can choose from 20 enterprise scenarios providing different combinations of authentication, encryption, and signing.

API configuration extensions enable consumption of secured services. Feature and usability enhancements in Version 1.5 boost productivity, performance, and ease of use, WSO2 said.

Open-source electronic IDs are featured to complement existing login options based on username/password and Microsoft InfoCard, WSO2 said.

The product is available for download Monday under Apache License 2.0. WSO2 offers training, consulting, and related services for the mashup server. The company also features a hosted version of Mashup Server called Mooshup.com.

The popular Intel Atom microprocessors made for netbooks, or mini-laptops, costs 52 percent more per chip than the desktop version of the same processor.

The Atom N270, the mini-laptop version of the microprocessor, costs $44, compared to $29 for the Atom 230, the desktop, or nettop version of the chip, according to Intel's latest price list.

[ For more on products in the hot mini-notebook category, check out our hands-on looks at Asus' Eee PC 901 and 1000, Cloudbook Max netbook, Elitegroup's G10IL mini-laptop, MSI's Wind low-cost laptop, Giga-byte's M912X mini-laptop, and Acer's Aspire one. ]

Atom is Intel's smallest and lowest-power microprocessor, designed for a new category of computing devices that are low-cost and always connected to the Internet. The chips have found a home inside a number of devices, mainly the popular mini-laptop, or netbook segment of the market, which includes Asustek Computer's popular Eee PC, Micro-Star International's (MSI) Wind mini-notebook, Acer's Aspire one, and Giga-byte Technology's M912.

Netbooks have become popular because they're small and light, usually less than a kilogram (2.2 pounds), making them easy to carry around. They're also inexpensive, with most price tags under $500, and many of the newer ones can run for seven or eight hours if they have a six-cell battery.

The difference between the laptop Atom processor and the desktop version, Atom 230, is heat. There is commonly more space inside a desktop PC to allow heat to dissipate, or for more cooling systems such as fans and heat sinks, so the 230 can be made using less expensive material. For example, the 230 requires less expensive packaging than the N270.

A few companies have made desktop PCs using the Atom, including a desktop version of the Wind by MSI that runs full speed at only 35 watts of power, compared to 250 watts for a traditional PC. Asustek has also built the desktop Eee Box with an Atom microprocessor.

The chip has proven wildly popular.

During Intel's second-quarter investor's conference last week, Intel executives said it has been a strong seller that the company has had to revise up its production estimates every 40 days. Demand for the chips have not just been in netbooks, they said, but also in embedded devices and consumer electronics.

The closest rival to Atom on the market today is from Via Technologies. Hewlett-Packard's Mini-Note netbook uses a 1.2GHz Via C-7M microprocessor. The Taiwanese company revealed its latest Isaiah processors for low-cost laptops last month.