Sure. The vendor may have a proprietary interest, but in this case, I say that we should give them the benefit of the doubt. In many cases, vendors have important perspectives to contribute when examining a given issue.

Where the problems come in is when it goes something like this -- "I've identified that you have 'x' as a problem and my new software/service/hardware 'BigWidget' will solve this problem and potentially many more". That's the real problem. Products are not substitutes for thinking and appropriate action.

When it comes to security and open source, I think due caution is appropriate. Too many developers have no concept of what secure development is all about.

Additionally, while on the topic of open source, I've had many clients tell me the equivalent of "if it's for free, it's for me!". The thinking being that something that's "free" (or doesn't result in an expense for license) is easy to justify.

While it may be easy to justify, I think that's a pretty narrow view of things. Just becuase it doesn't cost you anything up front (like license fees or royalties) doesn't mean that there are no costs. That's absolutely insane. Anything you install into your environment ultimately has a cost (and consequences).

Don't get me wrong, I work for a commercial software vendor and I love open source! I just think we need to get real about what things really cost and the impacts of the decisions we make when depoying new stuff.

kengon