Roy Fielding, chief scientist at Day Software and co-founder of the original Apache Web server project, is the kind of guy who oozes cred in the open source community. He was lead architect on the HTTP specification and described Representational State Transfer—we know it simply as REST today—as a development method in his doctoral dissertation eight years ago.

When Fielding joined the OpenSolaris community advisory board in 2005, Sun Microsystems hailed his presence as a sign of its commitment to open source. The honeymoon ended in February, when Fielding resigned. Sun’s pledge to give the community authority over OpenSolaris was “a sham,” Fielding wrote in his letter of resignation.
“They were telling me they wanted a community, like the one around Apache,” Fielding says in an interview. At the same time, “they were undermining the OpenSolaris brand,” by distributing open source code combined with Sun proprietary code. “There’s no point sitting around giving advice when Sun’s marketing department will decide what it wants to distribute anyway,” he says.

The discord underscores what can go wrong when big IT vendors get integrally involved in open source projects or, as has been increasingly the case, buy open source companies. Business technology organizations have years of experience watching their key software startups get snapped up and, in some cases, mutilated, but the large-scale commercialization of open source brings a whole new set of challenges.
The timing of Fielding’s departure couldn’t have been worse for Sun, which was completing a $1 billion acquisition of MySQL AB, developer of the MySQL open source database. What should businesses using MySQL expect will change under Sun ownership?

Nothing changes, asserts Sun CEO Jonathan Schwartz, who by leading the acquisition of MySQL and making the Solaris operating system and Sun’s Java middleware suite open source has bet his job on the idea of a profitable coexistence between open source and proprietary software in the same company. Schwartz says he doesn’t expect former MySQL CEO Marten Mickos and others from MySQL to become obedient Sun employees. What he really wants is for them to continue cultivating their communities of open source developers and users.

If they do, Sun will tap into the thousands of new open source users who download MySQL each week; it’ll supply technical support to those who have built a major business around it; and it will have the chance to sell servers and offer its library of open source Java middleware and tools to the same prospects. Rivals such as IBM, Microsoft, and Oracle already have a broad front of software products in these markets, and embracing open source could give Sun an opening to be a disruptive force, capitalizing on its technical expertise while outflanking established players for new customers. So far, so good at least on one critical front—Sun hasn’t lost any of MySQL’s top leaders since it completed the acquisition in February.

How We Got Here
Sun isn’t the only big vendor breaking new ground with the integration of major open source software projects and companies. Same goes for Citrix Systems, which acquired XenSource and the expertise behind the Xen hypervisor for $500 million in October; Yahoo, which acquired Zimbra and its desktop application suite for $350 million in October; Oracle, which bought Sleepycat and its BerkeleyDB embedded database for an undisclosed amount in February 2006; and even Linux distributor Red Hat, which acquired JBoss and its Java application server for $350 million in June 2006.

Over the past 24 months, a premium has been placed on open source code, as it moved from the backwater of the enterprise to the mainstream. In the process, open source has become big business. The idea: Develop open source code quickly; make it available for free download in hopes of winning early market momentum; rake in some technical support revenues as the code develops an enterprise following; and cash in via an acquisition by a deep-pocketed vendor.

The movement highlights how much has changed from the days when the Apache project was started by a bunch of volunteer developers who built—and then gave away—the world’s best Web server. Such contributions still occur, but open source projects increasingly started as a commercial enterprise, or morph quickly into one. Hyperic, Terracotta, SugarCRM, MuleSource, SpringSource, and dozens of other open source outfits aimed at business IT hope to follow in MySQL’s and JBoss’ footsteps.

Nokia acknowledged the open source momentum in June when it said it would acquire Symbian for $410 million, then make Symbian’s popular mobile operating system available as open source code. In doing so, Nokia hopes to neutralize a fledgling Linux mobile platform and steal a march on Windows Mobile. It also hopes openness will spur creative application development, giving people new reasons to buy high-powered phones. Nokia could have spent more on marketing and sales; instead, it invested in open source code.

The Risks: Community Lost
For businesses using open source, the biggest risk in the acquisition of those projects is a weakened community, where the core developer relationships fall apart. One of the biggest business advantages of using open source code is the ability to tap into software that iterates quickly and transparently, incorporating a range of new ideas.

At its best, open source software provides businesses with a fast, low-cost way to deliver something the market is ready to try. Charismatic project leaders attract skilled developers, who self-organize into a fast-moving team motivated by the ability to contribute to solving a problem. Ross Mason, CTO of MuleSource, producer of a lightweight enterprise service bus used at financial services firms, and Rod Johnson, CEO of SpringSource, the lightweight Java development framework, are two such personalities. The team attracts outside contributors, users, and reviewers, who give early feedback that helps the open source code become a business-ready product. JBoss started as such a project under Marc Fleury.

At small companies like JBoss, MySQL, Sleepycat, XenSource, and Zimbra, leaders are in direct contact with users and work personally at building a community’s trust. Almost everything happens transparently on mailing lists and online discussion forums. When those leaders step inside a much larger company, at least some transparency—and trust—is lost.

Six weeks after the MySQL acquisition, Sun had what one observer called the dreaded “Slashdot moment.” On April 16, Sun announced it would launch a backup system for MySQL invoking advanced features including compression and encryption as a commercial product for which people would have to pay. The announcement was met with a flame war of protest on the open source discussion board.

Until this point, all MySQL offerings had been freely downloadable, rather than one free “community” version and a more advanced, feature-rich version for a price. Having a free and a for-fee version is hardly unheard of in open source projects, but it’s a tricky transition when people are hooked on getting the best version for free. “For those of you who put your time into helping MySQL become a great DB, and who must feel like a child kicked in the tummy by mother, my condolences,” said commenter Margrave, the day after the news broke. “Maybe we’ll see a fork.”

If a second open source version of MySQL veered off from Sun’s subscription version, such a fork could divert developer focus, something business users don’t want. Likewise, the community worried that MySQL’s focus would shift to proprietary additions, rather than free, open source offerings. Open source companies are judged by the developer community in part on how much of their code they make freely available. Keep the finest bells and whistles for commercial products, and the risk is that enthusiasm to contribute wanes.
Sun backed off charging for encryption and compression. “We listened to the reaction, we’ve had time to reconsider, and that was done,” said Rich Green, Sun’s executive VP for software, in an interview in May during JavaOne. The enterprise-friendly enhancements were added to the core system instead.

However, it was revealed later that MySQL’s open source founders had planned the same move in hopes of boosting revenue ahead of an IPO filing. The incident shows that an add-on product that might have been sold by an intact, small open source company faces greater suspicion once that company is part of a major vendor.

A related risk to losing or fragmenting the developer community is losing the open source company’s leadership. Sun so far has retained CEO Mickos, VP for products Zack Urlocker, and other MySQL execs, who are among the most experienced at walking the tightrope between community interest and profitability. Mickos walks that line deftly, and Sun executives who want to lead the company in MySQL’s direction can learn a lot from him, says Fielding, if Sun “thinks of itself as part of the community, not the leader of the community.” Johnson, originator of the Spring Framework and someone who has worked with Sun through the Java Community Process, says he has been encouraged lately by Sun’s efforts to open up Solaris and Java. Johnson says he feels “more positive” about Sun’s ability to produce good open source code and relate to open source communities, and about the the potential for the MySQL organization to thrive inside of Sun.

Asked in April if he’s concerned about Sun’s acquisition of MySQL, Bruce Lowe, owner of Center Stage Software, a maker of show business events software, said he tends to believe CEO Schwartz will protect MySQL’s open source integrity. “Better to be acquired by Mr. Schwartz than Mr. Ellison,” Lowe said.

Who Will Lead Them?
When Oracle acquired Sleepycat, a supplier of technical support for the BerkeleyDB embedded database, there was no pretense that Sleepycat would remain intact. Its salespeople became part of the Oracle sales organization, and its developers joined the larger engineering staff. Sleepycat CEO Mike Olson, a realistic, tough-minded team leader and salesman who in many ways fits the Oracle culture, became Oracle’s VP of embedded databases. Olson said in an interview at the time that he enjoyed working at Oracle. But he left right at the two-year mark. Even when all goes well, open source team leaders, like many an acquired entrepreneur, don’t stick around big companies for long.

When Red Hat acquired JBoss, JBoss customers heaved a sigh of relief that the acquirer wasn’t Oracle, reported to have been pursuing JBoss a few weeks earlier. After all, both JBoss and Red Hat were open source companies. But within months, Fleury, JBoss’ outspoken leader, took a “leave of absence.” Soon after, nearly all former JBoss business executives were gone.

Despite their open source pedigrees, Red Hat and JBoss had plenty of differences. JBoss was organized as a business first and an open source project second. Its development ranks weren’t open to all newcomers; key contributors were invited to join the company and asked to sign over ownership of contributed code.
Craig Muzilla, Red Hat’s VP of middleware and former senior VP of marketing at Metamatrix, acquired by Red Hat 15 months after it bought JBoss, says the JBoss community has benefited from the acquisition by becoming more open to contributors. “In some respects, it’s more vibrant,” Muzilla says. “The majority of contributions come from outside the company now.”

So in Red Hat’s version, an acquisition of an open source firm by a large company can open up participation and improve community ties. If so, Red Hat is the exception that doesn’t necessarily disprove that acquisitions of small open source companies test the company-project-community relationships.

The Advantages: Scale And Access
There’s another potential advantage to business IT when open source companies and projects get acquired: The project suddenly gets access to a large enterprise customer base. Sun brings MySQL to its high-powered client base and can pitch it as part of a larger strategic picture—MySQL, combined with its Java middleware and NetBeans open source development tools, makes open source code adoption more of a coordinated transition and enterprise cost-saving move. While there’s a risk of losing volunteer developers after an acquisition, big vendors may be able to bring more paid developers to a project, letting them work long term on it, and draw new perspective from top-tier user companies.

All these factors are playing out in Citrix’s acquisition of XenSource, centered on the open source Xen virtualization project. When Xen, with its roots at Cambridge University, showed it had the smarts to virtualize the x86 instruction set, Hewlett-Packard, IBM, Oracle, Sun, and others flocked to the project as a ready-built alternative to VMware. IBM, for example, contributed a designed-in approach to virtual machine security that some consider superior to measures that VMware has been adding through third parties.

As VMware threatened to dominate the virtualization market, XenSource’s leaders agreed to sell to Citrix, a close Microsoft ally. XenSource on its own had been building ties to Microsoft, and after the acquisition, the joint work accelerated. Once XenSource was inside Citrix, one of the first announcements concerning the renamed XenServer hypervisor was that it would support the Microsoft virtual machine file format, VHD. (VMware has its own incompatible format.)

Xen continues as an open source project, and Sun and Oracle are producing their own hypervisor software based on Xen, something they couldn’t have done as quickly without an open source option. But the combination of a Citrix proprietary XenServer and Microsoft’s Hyper-V, both sharing a common file format and managed by Microsoft’s System Center Virtual Machine Manager later this year, suddenly looks like a formidable competitor in its own right—perhaps not the outcome other vendors had in mind when they flocked to the Xen project. Says Sun VP Green, “We always knew somebody would buy XenSource.”

The emergence of an alliance of Hyper-V and XenServer changes the competitive landscape for VMware. Under CEO Diane Greene, VMware outflanked Xen, making the low end of VMware’s product line free just as the enhanced Xen 3.0 became available. VMware was miles ahead of Microsoft, commanding the high ground in virtualization en route to $1.3 billion in revenue last year as businesses raced to virtualize servers to cut energy, equipment, and space expenses.

Citrix, as a Microsoft ally, has always benefited from having its code in Windows Server, speeding operation of its flagship Presentation Manager, while Microsoft benefits from having an ally that concentrates on a high-end presentation option on top of Windows Terminal Services. In April, this partnership was extended from application presentation to server and desktop virtualization.

“The next year is going to be the most interesting year in virtualization,” predicts Simon Crosby, former XenSource CTO and now CTO of Citrix’s virtualization unit. Gartner put XenSource’s 2007 market share at 4%, he says, based on less than $10 million in revenue. In 2008, XenSource will generate $50 million in revenue and be on a growth path that rivals VMware’s, Crosby says. XenSource has close to 3,000 customers, compared with 1,800 at the time of the acquisition.

The product line fueling that growth won’t be open source Xen but a proprietary Citrix version, XenServer, working with Microsoft System Center Virtual Machine Manager in the near future.
To pull it off, XenSource still must prove it can push a proprietary product line without invoking the wrath of the open source community. But it has advantages. The Xen hypervisor, produced by XenSource and other Xen contributors, remains freely available. Xen doesn’t have a mass following of open source developers or a big following of large-scale users. There are open source alternatives—such as KVM, now in the Linux kernel—which likely are more interesting to many open source developers. The Citrix product line was never free, so there’s not a switch.

Crosby is unapologetic about proprietary advantages. “Strange to say, it’s been easier to work with Microsoft than with some of the members of the open source community,” he says. “They tend to be more surly—not surly, a little more difficult to partner with.” Xen, for example, got roughed up in the Linux kernel development process when XenSource asked for support in the kernel. Crosby says the people he’s working with at Microsoft “aren’t the old Microsoft guys. There’s a new generation more interested in reaching out to the community.”

A Race To Watch
Can a big vendor like Citrix that takes open source code in a proprietary direction stay ahead of the open source development community? With Linux, no commercial distributor has been able to move the operating system forward faster than the kernel developers, who make their work available to all. XenServer, with the resources of the Citrix-Microsoft alliance, might be a different story, as might other big-vendor-backed projects.

Crosby promises Citrix will contribute back to the open source project, but for Xen users, the XenSource acquisition takes them a step further away from the open source guarantee that they will always be masters of the code. That’s because key supporting products will be proprietary. Will they wake up one morning two years from now and find so much has changed that they again face vendor lock-in?
So there you have it. Open source code has gained in value over the last two years, and that value is recognized in the high acquisition prices. The open source code, of course, remains freely available, but the code’s value withers if there’s no community of independent, critical users and developers driving it forward, with leadership to guide it.

Some acquirers will seek a return on their huge investments by turning the open source into an enhanced “enterprise” product line that, in a matter of months, creates lock-in no different from proprietary code. Some will sustain and encourage a community, balancing the community’s interests with the need to drive profits. Some software companies have grown by being good at acquiring and integrating startups. They have a new skill to learn in doing that with open source.

For business IT teams, the industry dynamics make picking the right open source projects all the more difficult. The next two years will answer some of the questions hanging over this brave new world of acquisition and merger. You’re surely an optimist if you think all the answers will reward users in the same manner as the original Apache project.