"I was never motivated by financial gain," recalls Roesch. "It just ended up that way. People don’t develop open source for monetary gain. You develop it for reputational gain."

Roesch could have used his reputation to land a high-paying job at a software company, but he liked working on Snort. So in 2001 he began courting venture capitalists to see if they would back his plans to start a company to support Snort. When he made the rounds, he says, there were no takers. "They wouldn’t go near it unless we had some [proprietary] intellectual content wrapped around Snort," Roesch says.

Once he developed some proprietary management tools and a friendly GUI to run on top of Snort, Roesch got his money. And he’s never looked back, partly, he argues, because he has no choice. Snort competes against software from well-known, well-funded companies such as Cisco, and "if you’re going into a highly competitive area of software, as we did, you have to take venture capital," he says, adding that others have built proprietary tools around Snort. "You’re going to have people who are going to try to ride on your coattails," Roesch says.

So far, according to Roesch, no one in the Snort community has held his financial success against him. "I like writing code," says Glenn Mansfield Keeni, a professional developer who contributes to Snort in his spare time. "I derive great satisfaction by contributing towards building a secure Internet. The code remains open source so there is no bitterness or feeling of being let down. If the commercial framework helps Snort take greater strides forward, that’s welcome."

But others in the community wanted to guarantee that Snort would remain open. They formed a group in 2003 called Bleeding Snort to provide open-source intrusion-detection rules and definitions for Snort (similar to the virus definition files you download for your antivirus program). It was a prescient move. Sourcefire now makes its updates available to its paying customers first; others have to wait five days. And unlike Bleeding Snort’s updates, Sourcefire’s are no longer released under an open-source license. Companies that have built proprietary software on top of Snort (Sourcefire is not the only one) have to pay a fee to Sourcefire to get those updates now. But Bleeding Snort often beats Sourcefire to the punch with new rules, says Alan Shimel, chief strategy officer for StillSecure, a security software company that uses the Snort engine as part of its proprietary software. Shimel obviously has a vested interest in keeping the Snort engine open source, but he says "there were a lot of people in the Snort community who weren’t happy when [Roesch] formed Sourcefire. I’ve spoken to people inside Check Point who say they intend to keep Snort open, but as they say, the road to hell is littered with good intentions."