Open Source Telecom Survey 2021 Results & Discussion: General Survey Alan Quayle, Independent Consultant in Programmable Communications This is our 3rd year of the survey, thank you for your continued support. We received 114 responses to the general survey, +163 project survey responses giving a total of 277 received. The general survey covered: Security, Serverless, STIR/SHAKEN, barriers and benefits of OSS, telcos and OSS, Training, IoT, and general geographic / category info. Training: An interesting dichotomy is where people do not expect to pay for training when investigating a project but will pay when the project is part of their business. MOOC.org pricing is interesting. It’s free if you just want to learn, if you want the training recognized, then there’s a fee. This enables people to investigate for free, and then if they require support, the training needs to be verified. This avoids training through support. Open Source telecom software is part of a suite of open source projects used. Perhaps we should investigate dominant architectures? Companies that use open source make a long-term commitment to building an organization that understands open source, and is committed to owning the product, its roadmap, and the customer experience. Companies successful with open source do not happen overnight, they are built over years. Documentation, documentation, documentation Check out Twilio – but we need to find a way to help solve this industry-wide issue. Recommendations on what we need to do as an industry.

1. 2021 Results: General Survey

2. 2021 Survey Introduction
● This survey follows on from the surveys run in 2020 and 2019. Thank you for
your continued support.
● Please complete the general survey, and then choose the specific project
surveys (separate forms) you want to provide feedback. If any question is not
relevant or you have no opinion, just skip it.
● Covered in the general survey this year are: Security, Serverless,
STIR/SHAKEN, barriers and benefits of OSS, telcos and OSS, Training, IoT,
and general geographic / category info.
● The project specific surveys follow the format of previous years with some
customizations to make them more relevant to the specific projects.
● 114 responses to general survey, +163 project survey responses (277 total)
© Alan Quayle, 2021

3. 2021 Results: What Region are you based?
© Alan Quayle, 2021
2020
Similar
distribution to
previous years
with Europe
dominating
thanks to
University
support, e.g.
FOKUS
2021

4. 2021 Results: What region(s) are most of your
customers based?
© Alan Quayle, 2021
Given North America is the epicenter of
programmable communications,
Europe still dominates with customers.
Outside Europe / North America is
slightly greater number than last year.

5. 2021 Results: Business Category
© Alan Quayle, 2021
New question for 2021. Most
Universities are from Europe.
Telcos remain under-represented.
The importance of resellers /
channel was good to see, given
my experience from attending
events like Astricon.

6. 2021 Results: Business Category
© Alan Quayle, 2021
New question for 2021. Will
track how this changes. I was
surprised by the number of
medium sized businesses
(100-<1000).

7. 2021 Results: What open source software do you use?
© Alan Quayle, 2021
Linux
Linux 15
debian
linux 15
OpenSuS
E Linux 9
centos 9
linux mint 8
Manjaro 7
Percona 4
Ubuntu 3
DB
Postgres 19
MariaDB 9
REDIS 5
MongoDB 4
MySQL 4
CouchDB 4
Web/
Enterprise
Part 1
Ansible 19
Confluent
Kafka 19
Apache 18
Node.js 16
Docker 14
nginx 12
Grafana 12
HAProxy 11
RabbitMQ 9
PHP 8
Prometheus 7
suitecrm 7
Puppet 7
Web/
Enterprise Part
2
Jenkins 6
Zabbix 5
GnuCash 5
Perl 4
vscode 4
Kibana 4
SpagoBI 4
Elasticsearch 3
EspoCRM 3
QGIS 3
FRRouting 3
D3 2
Thunderbird 2
ActiveMQ 2
odoo 2
Karaf 1
Passbolt 1
Univention 1
Voice
OpenSIPS 24
Kamailio 23
FreeSWITCH 22
Asterisk 21
Homer 18
rtpengine 18
drachtio / jambonz 18
wazo 15
RTPproxy 15
freepbx 12
SIPp 11
Matrix 11
VICIDial 9
Jitsi 8
ASTPP 8
XiVO 7
Janus 5
Sippy/b2bua 5
WSO2 3
Restcomm 2
Open Source telecom
software is part of a suite
of open source projects.
Perhaps we should
investigate dominant
architectures?

8. 2021 Results: How has the pandemic…..
© Alan Quayle, 2021
Interestingly ‘not impacted’ dominates. Followed by acceleration in cloud/hosted. Video was relatively
small compared to the media coverage. In part this reflects the segment of the open source community
that contributes to this survey.

9. 2021 Results: Open Source Barriers
© Alan Quayle, 2021
This was the richest selection of
barriers raised so far, including
some interesting insights on
perceptions and mindsets.
Documentation remains the top.
Some projects consider their
documentation adequate for
their community. But for the
community to grow it needs to
be accessible by NEW people.

10. 2021 Results: How Overcome Barriers?
© Alan Quayle, 2021
There’s a long-term commitment to
building an organization that
understands open source, and is
committed to owning the product, its
roadmap, and the customer experience.
Companies successful with open source
do not happen overnight, they are built
over years. See Gamma buying Mission
Labs.

11. 2021 Results: Benefits?
© Alan Quayle, 2021
Control over your business, and
all the benefits that come from it
was top. The benefits of the
community back into the
business, e.g. rapid debugging,
deployment advice. An
underlying theme was being
human centered, rather than a
bureaucratic (corporate).
Main benefits of using open source
Control over your business - roadmap, customer experience,
understanding 47
Community 43
Customer focus 41
Speed - respond to customer needs in days not years 38
Interoperability 35
Innovation 33
Support 31
More Secure, plus understand how secure 27
No bureaucracy of closed source negotiations 26
Flexibility 24
Cloud native 22
Value 21
Almost always 20% TCO compared to licensed 19
No risk product will disappear 18
Stability 15

12. Importance in
overcoming
barriers
© Alan Quayle, 2021
High Medium Low
Documentation and
training 68 13 8
Community 65 29 7
Roadmap, releases,
fixes, contributions 23 66 15
Security audits 21 61 18
Consultants 33 35 41
Support contracts 17 41 40
Documentation and community
remain top. Security has risen in
importance. Surprisingly support
contracts were not considered
important in overcoming the
barriers. While it was rated the
#2 barrier. Reflects mix of those
running / consuming projects.

13. IoT Section
● Are you using any of the open source telecom software projects for IoT
○ Yes 48, No 19 (59% of respondents answered this section)
○ I was surprised by the number of IoT projects, at over 40% of all respondents
● What tools / resources would help for your IoT projects?
○ Over-riding comment was keeping documentation up to date, particularly with
new devices. There is recognition its an impossible task. However, a subset
should be recommended and maintained in a relatively timely way.
● In your opinion what IoT projects require open source telecom software?
○ Enterprise IoT not consumer IoT dominated responses including routers,
cameras, door locks, and other access control and security devices.
© Alan Quayle, 2021

14. STIR/SHAKEN
● Have you implemented STIR/SHAKEN for your project / deployment?
○ Yes 11, No 39 (44% of respondents answered this section)
● Do you have a need for STIR/SHAKEN in any open source telecom software?
○ Yes 21, No 26
○ Only if the project if focused on North American service providers is there a
need.
● When do you plan to implement STIR/SHAKEN?
● Have you taken part in
STIR/SHAKEN interoperability
testing?
○ Yes 12, No 31, planning 5
© Alan Quayle, 2021

15. Training: How is it offered?
© Alan Quayle, 2021
Given the pandemic, online
/ remote is top. Given my
experience working with
web-centric developers,
YouTube videos are quite
popular.
Investing in training is a
critical pillar for any project.
Commercial products make
large investments, and
while open source budgets
are not the same,
certifications and online
training courses will help
convert more businesses to
be confident with open
source.

16. Training: What type of training do you prefer?
© Alan Quayle, 2021
Good documentation / manuals / tiers for different skill
levels 31
Online training 31
Tier training by knowledge / skill 28
Online with email / chat support 24
Hands-on guided builds based on real-world examples 22
On-line instructor-led training 20
YouTube videos 19
Online Udemy style 19
Lots and lots and lots of examples 19
Short how-to videos 17
Easy on ramp for web-centric developers 17
Webinars 15
On-site / in-person training 12
MOOC (A massive open online course, mooc.org) 11
Interestingly there are many more online
training options people prefer, including
with email / chat support, tiered by
ability level. With guidance to use
Udemy and MOOC.org.
Tiering of knowledge was mentioned in
several responses. Several web-
developers who completed the survey
mentioned the need for an on-ramp into
the project. Projects need new blood to
survive, being accessible to new
developers is critical.
A variety of video formats where also
seen as important. Plus lots and lots of
worked examples.

17. Training: What do you expect to pay for training?
© Alan Quayle, 2021
In-person $1000 per day 20
Online $200 for the course 18
If investgating project - free 17
If core project to business - $1000 per day 17
MOOC pricing (free with $100-$200 for
verification) 16
Market rate for technology training 15
Online with chat/email support $100 pm 15
Webinar $100 per hour 15
Online free 12
<$500 9
No idea 8
MOOC pricing is interesting, free if
you just want to learn, if you want
the training recognized, then there’s
a fee. This enables people to
investigate for free, and then if they
require support, the training needs
to be verified. This avoids training
through support ;)
The pricing points vary greatly by
market. Within North America and
Europe, $1k per day for in-person
was often mentioned.

18. Serverless Plans
© Alan Quayle, 2021
2021
2020 2021
No plans 41% 63%
Evaluating 34%
Implemented 12% 15%
This year 5% 7%
Next year 4% 15%
Don't care 3%
While implementation progresses slowly, more people
have made a decision against serverless adoption. See
discussion about RTC and serverless here:
https://blog.tadsummit.com/2020/11/02/serverless-
and-rtc-panel-discussion/. Industry has concluded
serverless’s role.

19. Serverless Pros:
● Good when starting a business, but as it scales, costs can explode
● Lower costs for bursty workloads that don't need dedicated VMs/containers
● Good for database, not for VoIP signaling or media processing
● Pay as you go
● No need to manage the security, upgrades, etc.
● If your application architecture is suitable, there are lots of positive benefits. Even just
architecting for serverless and then deploying containers on K8s or even own
infrastructure gives massive deployment flexibility.
● Scalability, no need for middle-ware e.g. JainSLEE, lightweight. resilience.
● Easy to deploy
● Great redundancy and survivability, therefore availability
● Already using
● Good concept can be useful in the right places for the right things such as automated
testing. © Alan Quayle, 2021

20. Serverless: Cons
● Very hard to architect efficiently with SIP and other stateful protocols/clients.
● Hype
● Harder traceability and debugging, latency issues
● Complexity explosion in management and devops
● No proven tech yet, legal issues (?)
● Not ready
● Cost is unpredictable with scale
● More complicated deployment. Cost related to automation and containerization. O&M
● Not for telco yet
● Loss of application control
● Sometimes difficult to debug and troubleshoot
● Less features
● Documentation and examples
© Alan Quayle, 2021

21. Security: Internal Security Teams
© Alan Quayle, 2021
Thank you for the honest
answers!
Though not a surprise this
does show RTC security is
falling through the cracks.

22. Security
● If you are using security testing tools for RTC, please list them
○ None 75%, SIPVicious / SIPVicious Pro 13%, Sipp 4%. Sipcrack suite 4%, Test RTC 4%
● Are you supporting RSA and/or Elliptic Curve TLS server certificates in SIP?
© Alan Quayle, 2021

23. Security: Are you supporting/using encryption of
media?
© Alan Quayle, 2021

24. Security:
● Are you supporting/using MD5
based digest authentication in SIP?
● Are you supporting/using SHA256/512
based digest authentication in SIP?
© Alan Quayle, 2021

25. Security: Are you supporting/using token based
authentication (OAuth2/OpenID connect) for SIP?
© Alan Quayle, 2021

26. Security: What type of defensive mechanisms for
RTC Security do you use?
© Alan Quayle, 2021

27. Security:
● How is security hardening done?
○ Internally 63 (74%), Both 22 (26%)
● At which layer are defensive mechanisms applied?
○ Application, 20 (24%), Network 23 (27%), Both 42 (49%)
● What type of offensive
mechanisms, if any,
for RTC are used?
© Alan Quayle, 2021

28. Security:
● How much of the security efforts
are reactive / proactive?
● Secure code review?
© Alan Quayle, 2021

29. Security: What sort of security training is provided to
employees?
© Alan Quayle, 2021