Pitfalls In An Open-Source WorldPitfalls In An Open-Source World

That's huge," Burton Group analyst Richard Monson-Haefel said. "Developers will take tools and pieces off the Internet, and you really have to have a strict policy that everything has to pass through a policy check to make sure it doesn't have licenses you're not familiar with."

Companies need to be prepared to demonstrate diligence, to show that they worked to keep other people's intellectual property out of their software, Rankin said.

Companies can avoid intellectual-property hassles by using software from vendors such as IBM that indemnify customers, Monson-Haefel said. The catch is that those companies' indemnification is voided if the user modifies the code, which eliminates one of the main benefits of open source.

Another reason companies need to think carefully about whether they want to modify, or "fork," open-source code for internal use is that it risks losing the support of the open-source community, Rankin said. "If you fork it, and the community doesn't like what you did, you're going to own those changes the rest of your natural life."

For cases where the open-source community can't, or won't, provide technical support, companies should find vendors willing to support open-source products. ADP uses IBM to support Linux, Zend Technologies to support PHP, and Command Prompt for PostgreSQL.

The open-source community can be counted on for support in some areas. But that community isn't interested in other projects, and companies will either have to do those projects themselves or hire vendors.

For example, the original Postgres database lets users see all the tables in the database, without filtering the view. Some at ADP saw that as a security risk, and it was definitely an inconvenience, resulting in information overload. The open-source community wasn't willing to fix the problem, so ADP hired Command Prompt to fix it, which the vendor was willing to do for a modest sum of about $3,500, Rankin said.

A small price to pay for the peace of mind the company needed, but also one of the extra steps it had to take to ensure that its open-source migration worked.