SpikeSource's Polese cites open source complexities

Kim Polese, CEO of open source services provider SpikeSource since 2004, is perhaps one of the better known IT executives. Prior to joining SpikeSource, she became one of the industry's first female chief executives as co-founder, president, and CEO of push technology vendor Marimba, which was acquired by BMC Software in 2004. Earlier, while at Sun Microsystems, Polese was the first product manager for Java. InfoWorld editors Paul Krill and Neil McAllister spoke with Polese last week about a range of topics, including SpikeSource, open source, outsourcing, and Java.

Free IT resource Hear how top CIOs turn change into a competitive advantage. Sponsored by HP Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft

InfoWorld: Why do people need an open source infrastructure company like SpikeSource?

Polese: It fundamentally boils down to the challenges around interoperability. One of the biggest challenges that we find enterprises have and companies of all sizes [have when] they’re using open source is keeping all of the moving parts working together on a continual basis. [These are] the "what-works-with-what" problems, which [are] compounded when you have dozens of components in a stack. This is very typical for an enterprise that’s running open source applications. And those components are changing on an ongoing basis, whether it’s updates, patches, new features, security vulnerabilities.

To give you some numbers, in 2005 alone there were 490 combinations of PHP (Hypertext Preprocessor) Apache and MySQL that were released.  And then if you add 21 releases of OpenLDAP, you get over 10,000 combinations just for that one subset of the stack. And if you multiply that by Linux kernel versions and updates and distributions and then add patches on top of that, it becomes a very complex problem. There’s a lot of overhead involved in managing open source infrastructure. It’s the ongoing patch management, lifecycle management that becomes the cost, frankly, and it adds risk [and] overhead to enterprises that are using open source.

InfoWorld: Could you discuss briefly the type of services you provide for open source users?

Polese: We provide, first of all, the stacks themselves for free for download from our site, so you can choose a variety of different components. We certify over 100 components across six operating systems, six language runtimes, and have tested very large combinations of those components. So you can download the stacks for free.

The service that we provide is an update service, and it’s basically what we call SpikeNet. It’s a patch management update service that provides the ongoing lifecycle management for that stack, and the updates are targeted for a configuration that’s running at the endpoint. The service includes regular alerts and notifications. And then there’s a high-stakes vulnerability or security alerts. We deploy a patch that’s been tested and validated against that configuration in 24 hours or less.

So that’s basically what SpikeNet is, that’s the update service. And then the other part of the offering is technical support, which is one phone call for support for the entire stack. We have partnerships with companies like MySQL and JBoss. We sell third-level support from those companies and we also have many experts here internally at the company who are knowledgeable about different components in the stack.

InfoWorld: So you only sell services, you don’t sell any software at all?

Polese: Correct. And the services, in the form of SaaS [software as a service], it’s not the traditional professional services organization. This really is software in the form of updates. We don’t sell traditional enterprise licensed software products, but we do sell software in the form of ongoing updates and patch management. So it’s similar to a Norton-style model. The service is really the bits delivered that are tested, certified, validated to work with that configuration at the endpoint at the customer site.

InfoWorld: Is SpikeSource involved in intellectual property protection services?

Polese: We don’t do that ourselves, but we are partnered with the leading companies. We have, for example, a relationship with Black Duck. We created an integration between our asset management tool, called the Spike Asset Manager. Together with Black Duck, we integrated that with their licensed calculator that basically reports on what the open source licenses are that are related to those components. So it’s a very natural marriage of the two companies' products and services.

InfoWorld: What’s the installed base of SpikeSource?

Polese: We’re not yet talking about the numbers of customers at this point. You can expect to see some announcements over the next several months about additional customers. A bank based in London was one of our first customers. Another customer is Business Objects, an ISV in this case, that’s using SpikeSource to basically standardize on a common stack so their customer base has been moved to an open source environment. So I can’t give you numbers right now of customers, but I can tell you that the pipeline is big, the demand is strong, and we’re [closing] business every day.