1. Open Source in Android Apps: Tips for Becoming a Good Open Source Citizen AnDevCon Kim Weins, SVP Marketing, OpenLogic

2. Copyright OpenLogic 2006 What Youll Learn How much open source is used in mobile apps? What level of compliance with open source licenses? Why should I be concerned? What should I do about it? 2

3. Copyright OpenLogic 2006 About OpenLogic OpenLogic helps enterprises to successfully and safely acquire, deploy, support and control all of the free and open source software they use. Scanning Tools Open Source Audits Open Source Support

4. Copyright OpenLogic 2006 Mobile Apps Depend on Open Source 4 Source: OpenLogic Mobile Research 9/2010 Open Source is Used in 88% of Android Apps & 41% of iOS Apps

5. Copyright OpenLogic 2006 Mobile Apps Depend on Open Source 5 jquery cocos2d JSON ichabber wz_graphics MWFeedParser Selenium YUI SQLite Boost OpenSSL Mobile Apps Open Source PhoneGap Rhodes

6. 6 But…

7. Copyright OpenLogic 2006 Compliance Concern 7 Mobile Apps Arent Consistently Complying with Open Source Licenses

8. Copyright OpenLogic 2006 Research Methodology Scanned 635 Top Apps with OSS Deep Discovery 123 Android Apps 512 iOS Apps Picked top paid and free apps across categories Identified 68 Apps with GPL, LGPL or Apache 52 with Apache 16 with GPL/LGPL Examined those apps for compliance with key obligations 8

9. Copyright OpenLogic 2006 Four Areas of Compliance Analyzed 9 Apache GPL/LGPL Provide copy of license Notices/Attributions Provide copy of license Provide source code

10. Copyright OpenLogic 2006 Failure to Comply 10 71% of Apps using Open Source under GPL, LGPL and Apache do not comply Comply 29% Do Not Comply 71% Source: OpenLogic Mobile Research 3/2011

11. Copyright OpenLogic 2006 Compliance by Platform 11 71% of Apps using Open Source under GPL, LGPL and Apache do not comply 27% Comply AndroidiOS 32% Comply Source: OpenLogic Mobile Research 3/2011

12. 12 REALLY? Do I need to care?

13. Copyright OpenLogic 2006 Three Reasons to Comply 1.Its the right thing to do 2.Protect your IP 3.Money in your pocket 13

14. Copyright OpenLogic 2006 Its The Right Thing to Do Free software… but please comply 14

15. Copyright OpenLogic 2006 Protect your IP Copyleft open source licenses can impact licensing of your IP 15 ©©©

16. Copyright OpenLogic 2006 Protect your IP 16 Open Source under Copyleft license Open Source under Copyleft license Your code Derivative work? Depends on the license and how you combine the code Linking

17. Copyright OpenLogic 2006 Money in Your Pocket Non-compliance can result in: Takedowns Injunctions Lawsuits Legal costs 17

18. Copyright OpenLogic 2006 Takedown Requests to Android Market 18 Source: Chilling Effects Clearinghouse, Takedown Complaints for Android Market Feb 2011 = 206 Takedown Requests

19. Copyright OpenLogic 2006 Takedowns: Open Source Copyright Violation 19 Example of complaint to Google re GPL violation. Source: Chilling Effects Clearinghouse

20. Copyright OpenLogic 2006 More Than A Theoretical Risk: Legal Action 20 Free Software Foundation has been active in GPL enforcement. Source: Ars Technica Source: cnet Source: The Inquirer

21. Copyright OpenLogic 2006 More Than A Theoretical Risk: Bad PR? 21 Source: Network World Source: Matthew Garrett http://www.codon.org.uk/~mjg59/android_tablets/

22. 22 OK, OK I get it.

23. Copyright OpenLogic 2006 How to Become A Good Open Source Citizen 1.Understand open source licensing 2.Create an open source policy 3.Track all open source usage 4.Conduct a scan or audit of your code 5.Develop a compliance checklist 23

24. Copyright OpenLogic 2006 24 1. Understand OSS Licensing Official definition of OSS license Approved by the Open Source Initiative (OSI) http://www.opensource.org/ Currently over 60 approved licenses Key Criteria Free distribution Source code is available Derived works are allowed Non-discrimination

25. Copyright OpenLogic 2006 25 Categorizing Open Source Licenses Strings Attached Liberal No Strings Copyleft Additional Clauses Traditional Open Source MIT/X W3C Original BSD Apache Software License Eclipse Public License GNU GPL GNU LGPL GNU GPL v3 Common Public License Mozilla Public License SISSL IBM Public License

26. Copyright OpenLogic 2006 26 Dependency Issues Impact Licensing OSS often depends on or bundles other OSS Need to look at all the dependencies and bundled projects and their licenses Important: The licenses may not be the same! Example: Geronimo (Apache license) uses MySQL (GPL) through the MySQL driver (formerly LGPL but now GPL)

27. Copyright OpenLogic 2006 2. Create an Open Source Policy Things to include Licenses allowed Approval processes Audit and compliance processes Considerations Keep it lightweight Dont let fear guide you 27

28. Copyright OpenLogic 2006 28 3. Track all Open Source Usage: Why? Know what you are using Best practices for software asset management Identify opportunities for sharing or savings Find out what open source is being used so you can leverage expertise, support, etc. across teams Legal & compliance Validate that you are complying with licenses Be able to determine impact of license changes Provide an audit trail for regulatory compliance Assess impact of lawsuit or IP infringement Maintenance Be prepared to handle security patches or critical issues Able to plan for maintenance updates Support Understand level of support necessary Share support resources (whether internal or external)

29. Copyright OpenLogic 2006 29 3. Track all Open Source Usage: What? What open source packages are used What versions are used The exact source/object code Where you got it from (source) What license its under What applications its used in What machines they are used on What operating system they are used with Whether the project is internal, external or for distribution When distributed and to whom Approval trail – who approved, when approved, for what purpose

30. Copyright OpenLogic 2006 4. Conduct a scan or audit of your code Outcome of an OSS audit: List of open source packages List of open source licenses List of license obligations List of licenses that may have conflicting terms Options Scanning tools Manual review Audit services

31. Copyright OpenLogic 2006 5. Develop a compliance checklist Create a compliance checklist: Notices in code and/or documentation Source code provided in proper way Is there an EULA for your product? If there are conflicts or compliance is not possible: Can you live without this code? Is there an alternative to the code? Can you contact the author and ask for an exception/different license? Risk management: What is likely to get litigated? What are your sticking points that prevent perfect compliance?

32. Copyright OpenLogic 2006 Thanks! Slides? www.openlogic.com/downloads www.slideshare.net Learn more www.openlogic.com To receive details of research kim.weins@openlogic.com Follow @openlogic @KimAtOpenLogic 32