You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by David Johnson <jo...@cox.net> on 2005/12/02 03:41:36 UTC
Evaluating subversion for an enterprise installation
Greetings,
I am part of a technical assessment team at my company that is looking
at replacing our current version control software. After much arm
twisting, I was able to get subversion on the assessment list.
Good news: subversion is now one of the final contenders.
Bad news: it is still an up hill battle. I'm up against an entrenched
mentality of "if it's free it can't be any good" and a committee that is
75% management/25% users. So far, it appears that the top management is
pushing an expensive glitzy piece that is technically sound and has a
lot of potential.
The questions I will need to answer (so far) are:
1. Licensing - Subversion's license is clear, and I have identified and
located the licenses for apr/, expat-lite/, and neon/. Are there any
other licenses that I need to be aware of?
2. Customer service - it is a novel idea to some folks that there can be
superior customer service without a company to back the product.
Instead of getting a help desk operator with canned scripts that don't
ever quite work, you get knowledgable users and even the application
programmers.
2a. What is the average turnaround time between submitting a problem to
the mailing list and the first response?
2b. Is the mailing list monitored by the active developers?
2c. On average, how often are maintenance releases issued?
3. Security -
3a. There is a mindset issue I need to address. Specifically, I need to
demonstrate that having open source code does not make the product less
secure. Has anyone addressed this before? Are there some good
references and/or case studies?
3b. Are there specific security issues that are known (other than those
addressed in the book) that we need to be aware of?
4. Operating systems ... are the server side pieces Windows 2003 SP1
compliant, and are the client side pieces Windows XP SP2 compliant?
Thanks in advance,
David Johnson
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
RE: Evaluating subversion for an enterprise installation
Posted by Hernan Martinez - ECC <he...@ecc.es>.
> Some people have the confused belief that keeping the workings of the
> machinery secret is helpful to security. It is not. This has been an
> absolute rule in the encryption community for over a century:
> Kasiski's principle (if I remember right) -- every detail of the
> machinery is known, the only thing secret is the keys.
It's Kerckhoff's.
http://en.wikipedia.org/wiki/Kerckhoffs%27_law
-H.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Evaluating subversion for an enterprise installation
Posted by Paul Koning <pk...@equallogic.com>.
>>>>> "David" == David Johnson <jo...@cox.net> writes:
David> 3a. There is a mindset issue I need to address. Specifically,
David> I need to demonstrate that having open source code does not
David> make the product less secure. Has anyone addressed this
David> before? Are there some good references and/or case studies?
It's well established that open source is MORE secure. More eyes on
the code. No expectation that sloppy coding is allowed because no one
will ever see the code and spot the holes.
Some people have the confused belief that keeping the workings of the
machinery secret is helpful to security. It is not. This has been an
absolute rule in the encryption community for over a century:
Kasiski's principle (if I remember right) -- every detail of the
machinery is known, the only thing secret is the keys. That is the
basis on which three-letter agencies have evaluated cipher systems for
a century now -- clearly that is the right basis for looking at
software security.
paul
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Evaluating subversion for an enterprise installation
Posted by Andy Levy <an...@gmail.com>.
David, what other products are on your management's "short list"?
There's a lot of version control experience on this list and folks may
be able to help provide some compare/contrast between those and
subversion.
I'm in a somewhat similar position, or was a few weeks ago. I started
a new job and assignment #1 was "we want to use version control, make
a recommendation for us." The lower the price, the better. The only
concern really was support, but I told them that I had found resources
like this mailing list, svnforums.org, etc. and they seemed satisifed.
In a larger organization, there's a lot of pressure to have somewhere
to point fingers, which it sounds like your management is looking for.
So far everyone in my office is on-board with Subversion and I'll be
rolling it out before the end of the year.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Evaluating subversion for an enterprise installation
Posted by Andy Levy <an...@gmail.com>.
On 12/2/05, Stephen Clouse <st...@gmail.com> wrote:
> On 12/1/05, Noel Yap <no...@gmail.com> wrote:
> > Also, I'm surprised you hadn't mentioned one of the largest management
> > reasons not to use open source -- CYA. Management doesn't have anyone
> > to sue if something goes wrong.
>
> Not to bash you personally, but this is a fallacious argument I grow
> tired of hearing. Please show me a closed-source license that does
> not include a disclaimer of warranty and a limitation of liability
> clause analogous to the following:
They may not want to be able to sue, but management often wants some
single entity they can hold accountable for a failure.
At my last job we used MS Visual SourceSafe, but having a big company
"behind" the product didn't solve all the problems we had with it. We
also had a lot of CA tools, yet simply accepted all the shortcomings
of that software. In my opinion, you're better off not going in with
the assumption that "there's a corporate backer" means you're safe.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Evaluating subversion for an enterprise installation
Posted by Stephen Clouse <st...@gmail.com>.
On 12/1/05, Noel Yap <no...@gmail.com> wrote:
> Also, I'm surprised you hadn't mentioned one of the largest management
> reasons not to use open source -- CYA. Management doesn't have anyone
> to sue if something goes wrong.
Not to bash you personally, but this is a fallacious argument I grow
tired of hearing. Please show me a closed-source license that does
not include a disclaimer of warranty and a limitation of liability
clause analogous to the following:
----------
In no event shall Obscenely Large Software Company or its suppliers be
liable to you for any consequential, special, incidental, or indirect
damages of any kind arising out of the delivery, performance, or use
of the software; even if Obscenely Large Software Company has been
advised of the possibility of such damages. In no event will Obscenely
Large Software Company's liability for any claim, whether in contract,
tort, or any other theory of liability, exceed the license fee paid by
you, if any.
----------
In layman's terms, "If anything goes wrong, we'll give you your money
back. And that's all." Most aren't even that nice; they inform you
that your only remedy is to uninstall, and you get nothing. I'm sure
someone will mention that these clauses are not enforceable in some
jurisdictions, but considering the abject stupidity of the American
tort system at present, I'm not sure the law actually matters in this
situation.
If management is going to use that as ammo against you, you might tell
them to actually RTFL and learn just how many rights they don't have.
--
Stephen Clouse <st...@gmail.com>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Evaluating subversion for an enterprise installation
Posted by Noel Yap <no...@gmail.com>.
On 12/1/05, David Johnson <jo...@cox.net> wrote:
> Bad news: it is still an up hill battle. I'm up against an entrenched
> mentality of "if it's free it can't be any good" and a committee that is
> 75% management/25% users. So far, it appears that the top management is
> pushing an expensive glitzy piece that is technically sound and has a
> lot of potential.
I'm surprised there're still companies like this out there; I woulda
thought they would've been weeded out a while ago either due to their
good employees leaving or due to their bottom line being eaten up by
proprietary software costs (not that all proprietary software is bad
or that open source has no costs).
My last job was at a very large investment bank. They saw open source
has merits and dealt with its issues (eg legal team knew how to deal
with licenses) and mitigated its risks (eg developers know how to
code).
I'm sure there's lots of papers out there dealing with the hidden
costs of open source. Just be sure you don't buy all the FUD.
> 2a. What is the average turnaround time between submitting a problem to
> the mailing list and the first response?
If noone responds to this specific question, you might be able to
write a script parsing through the email archives. If you do this, I
think it'd be great if you publish your findings for future
generations still fighting the good fight.
> 2c. On average, how often are maintenance releases issued?
This information should be easily obtainable through the tarball
timestamps and the ChangeLog.
> 3. Security -
>
> 3a. There is a mindset issue I need to address. Specifically, I need to
> demonstrate that having open source code does not make the product less
> secure. Has anyone addressed this before? Are there some good
> references and/or case studies?
This is an on-going debate.
Re: Evaluating subversion for an enterprise installation
Posted by David Johnson <jo...@cox.net>.
There are so many replies that it would clutter the list to answer them
all directly.
Thanks everyone for the great direction.
I'll keep plugging, and will probably have a few more questions.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Evaluating subversion for an enterprise installation
Posted by William Nagel <bi...@stagelogic.com>.
On Dec 2, 2005, at 9:09 AM, Andy Levy wrote:
> On 12/1/05, William Nagel <bi...@stagelogic.com> wrote:
>> P.S. You may also want to take a look at my book "Subversion Version
>> Control: Using the Subversion Version Control System in Development
>> Projects". I've had several people tell me that it helped them with
>> formulating their arguments to management in favor of Subversion. It
>> was published under an open publishing license (much like the
>> O'Reilly book) and can be downloaded from http://www.phptr.com/
>> content/images/0131855182/downloads/Nagel_book.pdf or purchased in
>> hard copy from Amazon.
>
> I had already convinced management that we should implement Subversion
> before I purchased your book, but it (and "Practial Version Control
> Using Subversion" from the Pragmatic Programmer group) just cemented
> my belief that we made the right decision. Both these books have
> helped me get my head around the whole Subversion "philosophy" and,
> after only a couple weeks, have helped me write both user and
> administration documentation. I'll be putting your book in the hands
> of my users when we roll out into general usage. Thank you for your
> tremendous resource, Bill.
Thank you very much. This is my first book, and I have to say the
best part of the whole process is hearing from people who've found my
book helpful. It validates the whole effort.
Good luck with your Subversion rollout. I hope everything goes
smoothly.
-Bill
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Evaluating subversion for an enterprise installation
Posted by Andy Levy <an...@gmail.com>.
On 12/1/05, William Nagel <bi...@stagelogic.com> wrote:
> P.S. You may also want to take a look at my book "Subversion Version
> Control: Using the Subversion Version Control System in Development
> Projects". I've had several people tell me that it helped them with
> formulating their arguments to management in favor of Subversion. It
> was published under an open publishing license (much like the
> O'Reilly book) and can be downloaded from http://www.phptr.com/
> content/images/0131855182/downloads/Nagel_book.pdf or purchased in
> hard copy from Amazon.
I had already convinced management that we should implement Subversion
before I purchased your book, but it (and "Practial Version Control
Using Subversion" from the Pragmatic Programmer group) just cemented
my belief that we made the right decision. Both these books have
helped me get my head around the whole Subversion "philosophy" and,
after only a couple weeks, have helped me write both user and
administration documentation. I'll be putting your book in the hands
of my users when we roll out into general usage. Thank you for your
tremendous resource, Bill.
David, Bill's book is definitely worth purchasing. Not only does he
describe how to use Subversion, you'll also learn version control
basics (I'd been using version control in the form of MS VSS for 6
years before going to Subversion, and learned volumes from his book)
and he offers several for making the most of your Subversion system.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Evaluating subversion for an enterprise installation
Posted by William Nagel <bi...@stagelogic.com>.
David,
> Greetings,
>
> I am part of a technical assessment team at my company that is looking
> at replacing our current version control software. After much arm
> twisting, I was able to get subversion on the assessment list.
>
> Good news: subversion is now one of the final contenders.
Cool
>
> Bad news: it is still an up hill battle. I'm up against an entrenched
> mentality of "if it's free it can't be any good" and a committee
> that is
> 75% management/25% users. So far, it appears that the top
> management is
> pushing an expensive glitzy piece that is technically sound and has a
> lot of potential.
At least you're not facing a management team that wants to go with an
expensive glitzy piece that isn't technically sound and lacks any
potential.
>
> The questions I will need to answer (so far) are:
>
> 1. Licensing - Subversion's license is clear, and I have identified
> and
> located the licenses for apr/, expat-lite/, and neon/. Are there any
> other licenses that I need to be aware of?
You might want to look at the Apache license if you're considering
using it for your server.
>
> 2. Customer service - it is a novel idea to some folks that there
> can be
> superior customer service without a company to back the product.
> Instead of getting a help desk operator with canned scripts that don't
> ever quite work, you get knowledgable users and even the application
> programmers.
>
> 2a. What is the average turnaround time between submitting a
> problem to
> the mailing list and the first response?
As long as the ML question is detailed with a reasonably descriptive
subject line, the average is probably less than a couple of hours,
and often as quick as just a few minutes.
>
> 2b. Is the mailing list monitored by the active developers?
Yes.
>
> 2c. On average, how often are maintenance releases issued?
You will find a list of previous release dates here: http://
subversion.tigris.org/project_status.html
Of course with any open source project there are no guarantees about
future releases, but I think it's a pretty safe bet that frequent
steady releases will continue.
>
> 3. Security -
>
> 3a. There is a mindset issue I need to address. Specifically, I
> need to
> demonstrate that having open source code does not make the product
> less
> secure. Has anyone addressed this before? Are there some good
> references and/or case studies?
I don't know of any studies off the top of my head (although I'm sure
there are some good ones). You might use Apache to help your
argument, though. Not only does it run 80% of web sites, but it's
also the main server to user for serving Subversion repositories so
security studies on Apache should be doubly useful for your cause.
>
> 3b. Are there specific security issues that are known (other than
> those
> addressed in the book) that we need to be aware of?
>
None that I'm aware of. I believe there are some issues mentioned in
the book that have already been fixed, too.
>
> 4. Operating systems ... are the server side pieces Windows 2003 SP1
> compliant, and are the client side pieces Windows XP SP2 compliant?
I'm not really a Windows guy, but as far as I know the answer is yes.
Hope that helps.
-Bill
P.S. You may also want to take a look at my book "Subversion Version
Control: Using the Subversion Version Control System in Development
Projects". I've had several people tell me that it helped them with
formulating their arguments to management in favor of Subversion. It
was published under an open publishing license (much like the
O'Reilly book) and can be downloaded from http://www.phptr.com/
content/images/0131855182/downloads/Nagel_book.pdf or purchased in
hard copy from Amazon.
>
> Thanks in advance,
>
> David Johnson
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
> For additional commands, e-mail: users-help@subversion.tigris.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Evaluating subversion for an enterprise installation
Posted by Erik Huelsmann <eh...@gmail.com>.
On 12/2/05, Miha Vitorovic <mv...@nil.si> wrote:
> David Johnson <jo...@cox.net> wrote on 02.12.2005 04:41:36:
>
> > 2. Customer service - it is a novel idea to some folks that there can be
> > superior customer service without a company to back the product.
> > Instead of getting a help desk operator with canned scripts that don't
> > ever quite work, you get knowledgable users and even the application
> > programmers.
>
> Others have responded to your other questions, I just wanted to add, that
> AFAIK there are companies out there that offer Subversion support
> commercially, as long as it doesn't require to patch the code ,I guess...
There are also committers providing commercial support. They do know
how to change the code and maintain it. Either for your company, or
even by contributing it back to the base code.
bye,
Erik.
Re: Evaluating subversion for an enterprise installation
Posted by Miha Vitorovic <mv...@nil.si>.
David Johnson <jo...@cox.net> wrote on 02.12.2005 04:41:36:
> 2. Customer service - it is a novel idea to some folks that there can be
> superior customer service without a company to back the product.
> Instead of getting a help desk operator with canned scripts that don't
> ever quite work, you get knowledgable users and even the application
> programmers.
Others have responded to your other questions, I just wanted to add, that
AFAIK there are companies out there that offer Subversion support
commercially, as long as it doesn't require to patch the code ,I guess...
Cheers,
---
Miha Vitorovic
Inženir v tehničnem področju
Customer Support Engineer
NIL Data Communications, Tivolska cesta 48, 1000 Ljubljana, Slovenia
Phone +386 1 4746 500 Fax +386 1 4746 501 http://www.NIL.si
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org