Why the vast majority of enterprises still do not contribute to open source...

Everyone knows that the vast majority of Fortune enterprises heavily use but otherwise don't contribute to open source. I wanted to explore some insight as to what would need to happen in order for this to change...



First, let me get some of my own beliefs on the table. The trend of outsourcing is causing many enterprises to treat IT as a commodity whereby they pursue lower cost, lower quality resources to develop applications. In this model, the ability to have developers who simply intuitively grok the requirements disappears and is replaced with comprehensive documentation and arduous specification. In order for open source contribution to work in this model, it would require the enterprise to specify even more than they have in the past which becomes a non-starter.

We have all heard the phrase that you get what you pay for and outsourcing most certainly is the poster child. You can find many CIOs who talk about getting lower cost resources in India but few if any that believe that the quality of their portfolio has increased since outsourcing. In order for outsourcing to work, you have to lower your standards when it comes to code quality. So, if you have developers writing low quality code, would you then want to have it published transparently for the world to see or would you want to keep it secret?

For enterprises that aren't outsourcing, they have picked up on the latest buzzword known as innovation. The enterprise architecture community has rallied around the notion of assets and is busy inventorying things they think make their business unique. Of course, the most transparent way of measuring intellectual property is via the patent model and therefore the enterprise architecture team is wired to think about not only not being open but making even more things closed.

Find someone you respect and view their resume. Do you see numerous listings for patents on them? Unless making things open is on par with the prestige of making something patentable then open source will also struggle.

Most importantly, one needs to observe the human dynamics within large enterprises where the construct of influence plays heavily into the decision making process. The best way to influence commercial software is by paying lots of money for it while the model for open source may be to either contribute to it or to at least talk about. Ask yourself the question of when was the last time you saw an enterprise architect at a conference talking about open source (other than me)? Is it because the majority of enterprise architects are blissfully ignorant when it comes to understanding open source or is it because they have a media relations policy that forbids them from talking about certain things. You decide.

I of course contribute my time and thinking to open projects such as OWASP and have worked hard to influence the direction of projects I am passionate about including but not limited to the OWASP Top Ten, SAMM and others. Could my boss, just because he is my boss escalate our organizational concerns to OWASP because he has a higher title and expect that it will be considered deeper? You get the point.

Open source is not driven by abstract authority but by credibility and contribution. Sadly, many executives in large enterprises have nothing of value to contribute. Open source is a threat that will be defended against through subversion by all but the few who truly care more about the strategic direction of the business than their own inadequacies.

Speaking of being inadequate, I can say that my very first contribution to open source was enlightening. While I delivered working software that was secure, it failed the higher standard and was mercilessly refactored to the point that only one single line of original code survived.

Code reviews and feedback within most enterprises are cordial, where the focus is more on aesthetics than structure. I remember receiving comments via email saying don't quit your day job and you code like you are an enterprise architect. Of course, I am capable of making fun of myself, but the masses of developers in corporations have yet to receive meaningful feedback on their code and the day this happens, their egos will be shattered.

Ask yourself, why developers write software for large corporations and aren't working at Microsoft, Oracle and so on. In the back of their minds, there is solace in knowing that the only measure is speed of delivery and their bosses aren't smart enough to recognize quality or lack of if it were staring them in the face. Sadly, open source is smarter than them all...

Does Microsoft truly want Information Cards to be successful...

I am a big fan of Information Cards and believe there are a few challenges that Microsoft needs to address in order for it to be truly ready for primetime...



The general industry trend towards mobile devices means that identity selectors need to be made available for Apple iPhone, Google Droid and the Blackberry platform if identity ever seeks to become mobile. Microsoft has no committed roadmap to develop identity selectors for other than traditional Windows platforms.

Another trend I have observed is that Microsoft field sales teams do a great job of selling other products, but they generally aren't visiting large enterprises and briefing them on their strategy around identity. I wonder if they expect the enterprise architecture community who trends towards blissful ignorance when it comes to security to stumble upon the identity conversation and just get it without any hand holding.

Let's be clear, enterprises and their employees need to be spoonfed. Without Microsoft field staff showing up with chock-a-block eye candy PowerPoint spelling out the value proposition of identity to all those non-technical IT employees, adoption will continue to struggle.

More importantly, as enterprises shift towards buying more software, the guys in procurement could benefit from having a few contract clauses they could insert into agreements with their strategic vendors. Right now, no one knows to even ask the question.

Has Microsoft acknowledged that many enterprise applications are built on Java and that many of the J2EE containers dont support it out of the box. Wouldn't it be great if Microsoft encouraged Oracle to include Information Card support in BEA Weblogic Portal as a starting point? Surely, Microsoft doesn't expect enterprises who use Java to go hunting for open source libraries and will at least acknowledge the importance of vendor support...

SAML vs XACML

Gerry Gebel former analyst with the Burton Group and now of Axiomatics provided an interesting perspective on SAML vs XACML that I wanted to expand upon by providing a real-world business scenario...



Many people know that I am employed by a Fortune Insurance carrier and will use an example from this domain. An independent insurance agent does business with a variety of insurance carriers ranging from AIG to Travelers, CNA and so on, so the value of SAML becomes apparent in that this agent doesn't have to remember all those passwords each which could have its own policy around history, expiry and complexity.

An independent insurance agent could be licensed to sell insurance in multiple states, so in a claims-based model, you would need a way to assert multivalued attributes. As I understand, support for this will be forthcoming from Microsoft. I will of course defer to Kim Cameron to discuss in his own blog deeper.

Where the claims model starts to crack and XACML starts to shine is the scenario of the independent insurance agent not just being licensed in a particular state but also for particular lines of business (e.g. Personal, Commercial, Life, Health, etc) within each state. This is more complicated than just a simple listing of name/value pairs.

Within our business model, the independent agent may desire to track their commissions according to a structure they define. One independent agent may desire to see commissions based on line of business (personal, commercial, etc) where another may decide to view based on geographic region (e.g. Northeast, Southwest, etc) while another still may need to see based on size of company (e.g. Mom and Pop vs institution). In this model, it is not just about dynamically asserting parameters to a reporting engine in order to produce the right report but also needs to take into consideration whether one independent agent in a given agency can view say the Northeast commissions while another may only view the Southwest commissions.

In the above scenario, it would be very difficult to fit the declaration into a claims-based model. However, if this were based on XACML, the independent agent at signon time could include XACML in their SAML assertion and the XACML could be applied as a further restriction.

Anyway, if the blogosphere is going to debate the merits of one approach over another, I think it is vital that we do so within a business context going forward. Otherwise, the conversation won't be as productive...