Open-source software is a significant security risk for corporations that use it because in many cases, the open source community fails to adhere to minimal security best practices, according a study released Monday.

The study, carried out by Fortify Software with help from consultant Larry Suto, evaluated 11 open-source software packages and each community's response to security issues over the course of about three months. The goal was to find out if the community for each open-source software package was responsive to security questions or vulnerability findings, published security guidelines, and maintained a secure development process, for example.

[ Track the latest trends in open source with InfoWorld's Open Sources blog. ]

Open source application server Tomcat scored the best in the study, titled "Open Source Study -- How Are Open Source Development Communities Embracing Security Best Practices?"

The remaining 10 open-source application, tool and database packages -- Derby, Geronimo, Hibernate, Hipergate, JBoss, Jonas, OFBiz, OpenCMS, Resin, and Struts -- had a dismal showing. Among these 10 packages, application server JBoss scored higher by providing a prominent link to security information on its Web site and easy access to security experts, but came up short for not having a specific e-mail alias for submission of security vulnerabilities.

"You don't want to report bugs to a general mailing list because it would go to the general public," says Jacob West, manager of Fortify's security research group. There needs to be a measure of confidentiality in reporting bugs so that the fix for them can be provided when the public is notified, so attackers don't get early information they can exploit.

But too often the open-source communities that offer their software for free don't appear to be as mindful about security practices as their commercial counterparts, which charge for software and support, West says.

Fortify identified a total of 22,826 cross-site scripting and 15,612 SQL injection issues associated with multiple versions of the 11 open-source software packages examined.

But when Fortify tried to reach out to the open-source software communities, with the primary point of contact a Web site and a general e-mail address, the security firm found that "in two-thirds of these cases, you didn't get a response at all," West says. "There are no phone numbers. Who do you go to ask for information? It's kind of hard to tell who these people are."

The report itself notes, "Open-source packages often claim enterprise-class capabilities but are not adopting -- or even considering -- industry best practices. Only a few open source development teams are moving in the right direction."

West says Fortify did not conduct this study in order to condemn open source software, but rather to point out that the security practices need to improve because open source adoption by enterprises and governments is growing.

Howard Schmidt, former White House cybersecurity czar who's now a consultant, and also a board member at Fortify, says the study shows that when it comes to business adoption of open source software, "You've got to go into this with your eyes wide open."

The reality is that while open source software may appear more cost-effective and just as functional as commercial software in some instances, the question of maintenance must be examined very carefully.

"Who do you reach out to?" Schmidt asks. "What about the thousands of companies out there running Geronimo? And what about your supply-chain partners?"

The bottom line is that corporations may find they have to undertake remediation of open source packages on their own. "You are effectively on your own, absent your having an arrangement ahead of time," Schmidt says.

Government agencies and corporations need to decide if they're going to try to mitigate problems with open source software themselves, through risk assessment and code review, and whether they plan to give that information back to the open source community.

This is a fundamental question about the life-cycle development of the software, West says, adding that the study indicated to Fortify that the open source communities in these cases tended not to correct for identified flaws in software versions over a period of time.

Microsoft's Silverlight 2 browser plug-in technology for rich Internet applications will be generally available on Tuesday along with supportive development tools, the company said during a teleconference on Monday morning.

The company also revealed plans to have Silverlight capabilities integrated into the open-source Eclipse IDE.

Silverlight 2 has "been kind of a unique release," in terms of widespread beta testing and deployment prior to its actual general availability, said Scott Guthrie, corporate vice president of the Microsoft .Net Developer Edition. The technology already has been in use by Web properties such as NBCOlympics.com, which streamed more than 70 million videos via Silverlight for this past August's summer Olympic games, Guthrie said. Another prominent user was the recent Democratic National Convention, he said.

"We've have a number of huge customers that went live starting as early as last March," Guthrie said. Additional customers, such as the CBS College Sports Network and Blockbuster, are signing on this month, he added.

Silverlight 2 is cross-browser and cross-platform. It features a 4.5MB download size and installs in fewer than 10 seconds, Guthrie said. While version 1 of Silverlight was a fairly basic media plug-in for high-definition video, version 2 adds adaptive streaming, Guthrie said.

Also critical to version 2 is inclusion of a cross-platform subset of Microsoft's .Net Framework programming model supporting development in languages ranging from Visual Basic to C#, JavaScript, and Ruby. The framework can be 1,000 times faster than running JavaScript in a browser, Guthrie said.

Silverlight 2 supports a rich programming model, offering capabilities for data grids, calendar controls, sliders, and buttons. Control skinning and templating also are featured. The version 2 networking stack backs Web services, Atom endpoints, and sockets. Application capabilities like deep zoom are enabled as well, and AJAX APIs are featured.

Concurrent with the release of Silverlight 2, Microsoft is supporting development of Silverlight applications in Visual Studio 2008, Expression Studio, and the free Visual Web Developer Express Edition. Development capabilities ship with Visual Studio 2. Visual Studio 2005 users will not, however, be able to build applications for Silverlight but can access the Visual Web Developer tool.

To enable Silverlight development in Eclipse, Microsoft is funding a project by Eclipse member Soyatec, which will lead a project to integrate advanced Silverlight development capabilities into the Eclipse IDE. The project is to be offered under the Eclipse Public License Version 1.0 on SourceForge and be submitted as an open Eclipse project.

"I think it's great news that Microsoft is starting to constructively engage with Eclipse and propose projects at Eclipse," said Eclipse Executive Director Mike Milinkovich. But Microsoft still is not an Eclipse member, he acknowledged.

"I would certainly hope they decide to join at some point," Milinkovich said. Microsoft's linking Eclipse to Silverlight provides a strong endorsement of Eclipse, he said.

Microsoft also will offer Silverlight Control Pack and publish on MSDN the technical specification for the Silverlight XAML vocabulary. The Control Pack will be released under the Microsoft Permissive License, an OSI-approved license, Microsoft said.

The XAML vocabulary will be offered under Microsoft's "open specifications promise" so developers can read and write Silverlight XAML vocabulary tooling, said Brian Goldfarb, director of the Microsoft development platform group.

Asked what future versions of Silverlight might feature, Guthrie said the company feels good about the architecture and programming model of Silverlight and believes it can add new features shortly.

Rival Adobe Systems, whose Flash technology stands to be the biggest competitor to Silverlight, remained undaunted by the release of Silverlight 2. "We didn't really hear much that hasn't already been announced," said Tom Barclay, senior product marketing manager for the Adobe Flash Player. "They seem to be following Adobe's leadership in the RIA space."

Flash is on 98 percent of Internet-connected PCs and has 80 percent of the Internet video market, Barclay said.

Guthrie also reiterated Microsoft plans to bring Silverlight to mobile devices via a port to Symbian devices, done with Nokia, and Nokia's plans to distribute Silverlight with its phones. Also, a Linux version of Silverlight, dubbed "Moonlight," is being developed by a team of developers led by Miguel de Icaza at Novell, Microsoft officials noted.

Microsoft currently is prohibited from putting Silverlight on the iPhone because Apple does not want browser plug-ins like Silverlight or Flash on the phone, Guthrie said. "Right now, that isn't an option for any vendor. If [Apple lets] us, we'll definitely go," he said.

Silverlight now is working within the Google Chrome browser after resolution of paning issues, he said.

Users can download Silverlight 2 at the Silverlight Web site. Early users of Silverlight will be automatically upgraded.

Interest in modular datacenters is growing, fueled by high-profile endorsements from Microsoft and Google. But the model raises new management concerns, and efficiency claims may be exaggerated.

Modular, containerized datacenters being sold by vendors such as IBM, Sun, and Rackable Systems fit storage and hundreds, sometimes thousands of servers into one large shipping container with its own cooling system. Microsoft, using Rackable containers, is building a datacenter outside Chicago with more than 150 containerized datacenters, each holding 1,000 to 2,000 servers. Google, not to be outdone, secured a patent last year for a modular datacenter that includes "an intermodal shipping container and computing systems mounted within the container."

[ Get sage advice on IT careers and management from Bob Lewis in InfoWorld's Advice Line blog and newsletter. ]

(See related slideshow: IT takes a close look at shipping container-based datacenters.)

To hear some people tell it, containerized datacenters are far easier to set up than a traditional datacenter, easy to manage and more power-efficient. It should also be easier to secure permits, depending on local building regulations. Who wouldn't want one?

If a business has a choice between buying a shipping container full of servers, and building a datacenter from the ground up, it's a no-brainer, says Geoffrey Noer, a vice president at Rackable, which sells the ICE Cube Modular Data Center. 

"We don't believe there's a good reason to go the traditional route the vast majority of the time," he says.

But that is not the consensus view by any stretch of the imagination. Claims about efficiency are overrated, according to some observers.

Even IBM, which offers a Portable Modular Data Center and calls the container part of its green strategy, says the same efficiency can be achieved within the four walls of a normal building.

IBM touts a "modular" approach to datacenter construction, taking advantage of standardized designs and predefined components, but that doesn't have to be in a container. "We're a huge supporter of modular. We're a limited supporter of container-based datacenters," says Steve Sams, vice president of IBM Global Technology Services.

Containers are efficient because they pack lots of servers into a small space, and use standardized designs with modular components, he says. But you can deploy storage and servers with the same level of density inside a building, he notes.

Container vendors often tout 40 to 80 percent savings on cooling costs. But according to Sams, "in almost all cases they're comparing a highly dense [container] to a low-density [traditional data center]."

Containers also eliminate one scalability advantage related to cooling found in traditional datacenters, according to Sams. Just as it's more efficient to cool an apartment complex with 100 living units than it is to cool 100 separate houses, it's more cost-effective to cool a huge datacenter than many small ones, he says. Air conditioning systems for containerized datacenters are locked inside, just like the servers and storage, making true scalability impossible to achieve, he notes.

Gartner analyst Rakesh Kumar says it will take a bit of creative marketing for vendors to convince customers that containers are inherently more efficient than regular datacenters. Gartner is still analyzing the data, but as of now Kumar says, "I don't think energy consumption will necessarily be an advantage."

Finding buyersThat doesn't mean there aren't any advantages, however. A container can be up and running within two or three months, eliminating lengthy building and permitting times. But if you need an instant boost in capacity, why not just go to a hosting provider, Kumar asks.

"We don't think it's going to become a mainstream solution," he says. "We're struggling to find real benefits."

Kumar sees the containers being more suited to Internet-based, "hyper-scale" companies such as Google, Amazon, and Microsoft. Containerized datacenters offer scalability in big chunks, if you're willing to buy more containers. But they don't offer scalability inside each container once it has been filled, he says.

Container vendors tout various benefits, of course. Each container is almost fully self-contained, Rackable's Noer says. Chilled water, power, and networking are the only things from the outside world that must be connected to each one, he says. Rackable containers, which can be fitted with as many as 22,400 processing cores in 2,800 servers, are water-tight and are fitted with locks, alarms, and LoJack-like tracking units. Sun's Modular Data Center can survive an earthquake -- the company made sure of that by testing it on one of the world's largest shake tables at the University of California in San Diego.

A fully equipped Rackable ICE Cube costs several million dollars, mostly for the servers themselves, Noer says. The container pays for itself with lower electricity costs due to an innovative Rackable design that maximizes server density, Noer says.

But it's still too early to tell whether containerized datacenters are the way of the future. "We're just at the cusp of broad adoption," Noer says.

Potential use cases for containers include disaster recovery, remote locations like military bases, or big IT hosting companies that would prefer not to build brick-and-mortar datacenters, Kumar says.

A TV crew that follows sporting events may want a mobile datacenter, says Robert Bunger, director of business development for American Power Conversion. APC doesn't sell its portable datacenter, but in 2004, it built one into a tractor-trailer as a proof-of-concept. It was resilient. "We pulled that trailer all over the country" for demos, Bunger notes.

But APC isn't seeing much demand, except in limited cases. For example, a business that needs an immediate capacity upgrade but is also planning to move its datacenter in a year might want a container because it would be easier to move than individual servers and storage boxes.

UC San Diego bought two of Sun's Modular Data Centers. One goal is to contain the cost of storing and processing rapidly increasing amounts of data, says Tom DeFanti, principal investigator of the school's GreenLight energy efficiency research project. But it will take time to see whether the container approach is more efficient. "The whole idea is to create an experiment to see if we can get more work per watts," DeFanti says.

The Modular Data Center is not as convenient to maintain as a regular computer room, because there is so little space to maneuver inside, he says. But "It seems to me to be an extremely well-designed and thought-out system," DeFanti says. "It gives us a way of dealing with the exploding amount of scientific computing that we need to do."

Beware vendor lock-inBefore purchasing a containerized datacenter, enterprises should consider several issues related to their manageability and usefulness. Vendors often want you to fill the containers with only their servers, Kumar notes. Besides limiting flexibility at the time of purchase, this raises the question of what happens when those servers reach end-of-life. Will you need the vendor to rip out the servers and put new ones in, once again limiting your choice of technology?

"At the moment, most vendors will fill their containers only with their servers," Kumar says.

IBM, however, says it uses industry-standard racks in its portable datacenter, allowing customers to buy whatever technology they like. (Compare server products.) DeFanti said Sun's Modular Data Center allows him the flexibility to buy a heterogeneous mix of servers and storage. Rackable, though, steers customers toward either its own servers or IBM BladeCenter machines through a partnership with IBM.

"I think vendors are learning that people want more flexibility," DeFanti says.

Another consideration is failover capabilities, says Lee Kirby, who provides site assessments, data center designs and other services as the general manager of Lee Technologies. If one container goes down, its work must be transferred to another. Server virtualization will help provide this failover capability, and also make it easier to manage distributed containerized datacenters -- an important consideration for customers who want to distribute computing power and have it reside as close to users as possible, Kirby says.

"I think it is key that the combination of virtualization and distributed infrastructure produce a container that can be out of service without impacting the application as a whole," Kirby says.

The release of a new version of the OpenOffice.org productivity suite hit a snag Monday when the community experienced Web site problems that made downloading the suite extremely slow and at times impossible for users.

The OpenOffice.org Community released OpenOffice.org 3.0, a new version of the open source productivity suite that competes with Microsoft Office. However, a note on the community's Web site Monday apologized for problems with the site, attributing them to demand for the new suite that was higher than expected.

[ For more on potential challengers to Microsoft Office, see InfoWorld Test Center's review of Google Docs, Zoho, IBM Lotus Symphony, and OpenOffice.org. ]

"Apologies -- our website is struggling to cope with the unprecedented demand for the new release 3.0 of OpenOffice.org," according to a note. "The technical teams are trying to come up with a solution."

A spokeswoman for OpenOffice.org's public relations firm confirmed the problems Monday, saying that while people have been "successfully downloading" the suite all day, "there are times when the servers get overrun due to volume."

OpenOffice.org set up a temporary landing page for users until site issues have been fully resolved, she added. Though the URL is different, it looks the same as the regular OpenOffice.org page.

As of about 2 p.m. ET, the OpenOffice.org site was working very slowly, although several different language versions of OpenOffice.org 3.0 -- including English, French, German, and Italian -- were available for downloading from the site. Older versions of the suite also were available for download.

OpenOffice.org is a freely available and open source competitor to Microsoft Office. The 3.0 version of the suite makes it more extensible for users, allowing them to add third-party features from an OpenOffice.org repository to the suite, which offers basic productivity, spreadsheet, and presentation software, according to the OpenOffice.org community.

New add-on features available for OpenOffice.org 3.0 are support for business analytics and the ability to import PDF documents. There is also a feature for creating hybrid PDF documents, which have the ODF (Open Document Format) attached to the PDF document. ODF is the file format for documents that OpenOffice.org uses; it is recognized as an international standard by the ISO.

Sun boosted the processing capabilities of its most popular Unix server line today with the aim of attracting bigger IT workloads, including databases, ERP applications, and large server-consolidation projects.

The new system, called the Sparc Enterprise T5440, is based on Sun's eight-core UltraSparc T2 Plus processor, a version of the company's T2 chip that was designed to enable two of the devices to share cache and other system resources. The four-socket T5440 expands on the two-socket T5240, which was introduced last spring along with the T2 Plus.

[ Keep up with Windows Server and related developments in InfoWorld's Enterprise Windows blog. ]

Servers based on the T2 processor family, which debuted last October and is also known by the code-name Niagara 2, have become a $1 billion business that currently is growing at an annual rate of about 60 percent, according to Jonathan Schwartz, Sun's CEO and president. That makes it "arguably the fastest-growing business that we have ever built at Sun," Schwartz said.

The T5440, which is being manufactured by Sun business partner Fujitsu Ltd., runs Solaris 10 and can support up to 256 threads and 512GB of memory when fully loaded. Pricing for the new server starts at $44,995.

Systems with the earlier generation of T2 chips were focused on so-called network-facing uses, such as application servers. But with this upgrade, Sun will also pitch the T5440 as a midrange system for ERP and other corporate applications.

The multithreading capability "means if you were running historically 256 separate machines, you can collapse them on to one," thus saving on hardware and systems management costs, Schwartz said.

But what Sun hopes will really drive interest in the T5440 is its environmental characteristics. It's a compact system that fits in a 4U rack (1U equals 1.75 inches) and includes a variety of power management features, such as the ability to park idle threads and disable processor cores when they aren't needed. The server also offers self-regulating fan controls, another feature aimed at minimizing power use.

Sun's server revenue declined in the last quarter by about 7 percent year over year, according to market research firm IDC. Schwartz said, though, that what has been slow from a sales standpoint is the company's high-end enterprise systems. "That's not the growth part of the marketplace," he said.

The biggest problem for Sun in the Unix server market has been expanding outside of its established customer base. That's one of the reasons why Sun expanded its development of x86 systems through a joint development deal with Intel early last year.

Jean Bozman, an analyst at IDC, said that although Sun's overall server revenue has dropped off, sales of systems based on the multithreading UltraSparc chips "have seen dramatic growth." Bozman also said that she is seeing evidence of Sun gaining new customers via the multithreading technology.

Two very different tales are circulating about Palm Inc. and its new Treo Pro smart phone these days.

One story, from Palm and some analysts, is that the new Treo Pro's unlocked feature offers a cost-effective way for international business travelers to dramatically lower roaming costs. Travelers can insert a SIM card into the Pro from the carrier in the country they're in, potentially cutting those costs by 90%, Palm officials said.

[ To learn about increasing competition in the mobile 2.0 realm, read Get ready for next-gen mobile. Or, read about the latest on mobile developments with InfoWorld's Mobile Report newsletter. ]

The other story, from a different group of analysts in recent weeks, is that Palm had to unlock the phone because it could not find a carrier willing to sell it. One analyst on Friday went further, saying that the inability to find a carrier to sell the Treo Pro is a sign that the troubled Palm is facing its ultimate demise.

"Palm loses a major distribution channel and any subsidy by not going through the carrier," Gartner Inc. analyst Phillip Redman said via e-mail today. Having to sell the smart phone unlocked "looks like the final death sigh" for Palm and follows years of struggles finding effective products to sell fending off financial difficulties, he said.

The new smart phone, available in the U.S. since Sept. 26, sells for $549, a premium price compared to the Apple Inc. iPhone 3G and some other competitors. The higher price is largely because the upfront hardware cost isn't offset by the guarantee of monthly service charges.

Mike Adamine, senior product manager for the Treo Pro at Palm, said Palm decided to unlock the device because business customers wanted to avoid draconian roaming costs when traveling. Palm's decision to include a SIM card slot for various carriers means IT managers can help users cut roaming costs that easily reach $500 a month for a single user who travels through two or three countries.

"There's already been a lot of demand for unlocked," Adamine said.

Wasik Malik, director of mobile solutions at the Ohio State University Medical Center in Columbus, Ohio, said the prospect of an unlocked device interests him. He has been testing a Treo Pro for three months before deciding whether to purchase more than 600 for use by medical students and residents in the fall of 2009.

Purchasing rules at the university require Malik to check out a variety of carriers for service, even though he realizes the GSM-based Treo Pro will only work with AT&T Inc. and T-Mobile USA Inc. networks. "Unlocked is important to us because we cannot bind ourselves with a single vendor for data and phone service," he said.

In general, Malik said he looks for a single device that has voice and data capabilities for young doctors who might otherwise need to carry a phone separate from an online medical reference database. "Smart phones are becoming cheaper and our goal is to give the students one device instead of having six things in their pockets," he said.

More than 80 medical students at the school this year are using the iPhone , although the medical department constantly reviews devices for future deployment, Malik said.

Another feature in the Pro is a simple switch to turn on Wi-Fi usage. By comparison, the iPhone will search for Wi-Fi service continually, burning up battery power, unless a user turns off that feature, Adamine said.

Reviewers have generally liked the new Pro , which runs the Windows Mobile 6.1 operating system.

Phillippe Winthrop, an analyst at Strategy Analytics Inc., said the new Treo Pro is "on par" with other smart phones that run Windows Mobile, such as the HTC Touch Diamond. "I say it is 'on par' as a glass-half-full statement," Winthrop said. "Candidly, Palm has been struggling with innovating mobile handsets, but the Treo Pro shows they are back in the game."

He added it might not matter much to some IT managers that the device is unlocked. "Unlocked devices are an arrow in a quiver of wireless expense management," he said. "It's not the end-all and be-all."

Winthrop called Redman's comment that Palm is nearing its demise too severe. He said that Malik and other IT managers worried about Palm's record of lackluster innovation and financial difficulties should not ignore the Pro device. "There is no reason not to strongly consider the Pro device," he said. "Any fears about Palm's short-term financial situation are not warranted."

However, Winthrop said analysts and Palm customers are rightly concerned about what sort of new proprietary Palm OS, based on Linux, that Palm will develop. The new operating system is designed for products targeted at consumers. "Palm knows that if they don't get that Linux OS right, they're done," he said. "This is make or break for Palm."