Slashdot Mirror


Miguel de Icaza Debates Avalon with an Avalon Designer

Karma Sucks writes "In an interesting debate with a Microsoft employee, Miguel points out some crucial flaws in Microsoft's Avalon strategy. Perhaps the most shocking revelation is the absolutely horrendous inheritence hierarchy exposed by the Avalon API. Miguel himself is clearly not amused, saying 'We do not want to waste our time with dead-end APIs as we are vastly under-resourced, so we must choose carefully.'"

24 of 419 comments (clear)

  1. Hmmm... by NEOtaku17 · · Score: 5, Funny
    The Microsoft employee's take on security:

    " I totally agree, this is a huge issue. Phishing attacks, spyware, malware, viruses, and more are out there and probably the largest problem facing computer science today. This isn't a Microsoft, Linux, or Java issue - this is a "good guys" issue. Windows XP SP2 is probably the best response to Miguel's security concerns. The integrated firewall, security center, and dozens of other security related features are really the first line of defense. After the basics are resolved there, I would say that the new enhancements to the security system in Avalon are a great step. Not only is Avalon built from the ground up to be secure, but we are enhancing the security system for better application level security, and simpler more understandable presentation of security decisions to the user (hopefully in most cases this means no decision). As to the specific issue of Phishng that Miguel brings up, that is still mostly a research level issue, which I'd love to see creative solutions to. In Windows today there is the secure desktop, but you must press Ctrl+Alt+Delete to get to it first. "

    1. Re:Hmmm... by savagedome · · Score: 5, Funny

      Slashdotters could pull their heads out of Tux's feathery ass and look around for a minute and see that for themselves

      *Pulls head out of Tux's feathery ass*

      *looks around*

      Nah. Nothing to like here.

      *goes back into Tux's feathery ass*

    2. Re:Hmmm... by suckmysav · · Score: 5, Interesting

      "MSFT has been pretty honest about their past designs and it's security flaws as of late."

      If by "honest" you mean they have admitted there is a problem and have offered up some near useless hand-waving gestures (XP-SP2) as a solution then you would be correct.

      The real problem they have, a problem that they have been decidedly dishonest about (or pig-ignorant of, take your pick) is that their OS is insecure by design. This is all due to the monolithic design philosophy that their Windows OS is built around. The way they have enginneered it to have every goddamned bell and whistle tied directly into the base OS is just asking for trouble. All you need is a flaw in one of your applications, IE being the classic example, and the entire OS is compromised.

      Cosnider this paragraph taken from an article at The Register, which was written by an engineer involved in the creation and deployment of Combat Management Systems for use in Royal Navy Warships. I think we can assume he has some clue about what he is talking about. He said this;

      "In April 2002, Bill Gates, acting as Microsoft's Chief Software Architect, gave extensive testimony under oath to the US Courts. Gates's testimony included description of the current structure of Microsoft Windows. Snubbing fifty years of progress in computer science, the current structure of Windows abandoned the accepted principles of modular design and reverted instead to the, much deprecated, entangled monolithic approach. Paragraphs 207 to 223 are particularly revealing about Microsoft's chosen approach (paragraph 216 is difficult to believe!).* Anyone with elementary knowledge of computer science can see that Microsoft Windows, as described here by Gates, is inherently insecure by design. If this is a flagship Operating System, then Dijkstra's life was in vain."

      For Microsoft to get truly serious (and honest) about security, they will have to totally change their design philosophy, a philosophy that was chosen not based on it's technical mereits, but on its ability to stop the DoJ from breaking Windows up into it's seperate components.

      This is the Great Lie that Microsoft is telling the world.

      --
      "You can't fight in here, this is the war room!"
    3. Re:Hmmm... by Foolhardy · · Score: 5, Informative

      The Windows NT kernel (same one in 2000/xp) has nothing to do with "Internet Explorer/Media Player/Instant Messenger". Microsoft whined that they couldn't be removed not because it is technically infeasable but because it is part of an 'indispensible user expierence'.

      NT design 101: On the bottom, there is the kernel, then the executive, which includes the object, configuration, process, VM, I/O managers, the security ref monitor (a runtime to create tokens, check ACLs) and the local procedure call provider. After that, device drivers. After that, everything is in user mode with one exception. Then there are the intrinsic subsystems: the session manager (the init process, aka smss), the local security authority (lsass), the security accounts manager (SAM), winlogon, and the service control manager. Then the environment subsystems, namely win32. The entire syscall interface is exported to user mode by the Nt* functions in ntdll.dll. Environment subsystems translate calls from their API into native calls. Win32's environment server is hosted in csrss.exe. With NT4, the meat of win32 was moved into kernel mode (win32k.sys) to reduce context switching overhead; win32 was not then and still isn't integrated into the kernel itself. The kernel doesn't care what environment subsystems are running. After that, you have the shell components; these all run in the security context of the logged on user (subsystem components run as SYSTEM). The shell includes Internet Explorer and the start menu. On top of that (usually) are applications.

      Each layer only cares about the one immediately above and below it at most. To the kernel, Internet Explorer is just another user mode program. A hole in IE cannot escilate beyond the user's privledges in the process's security context. Your machine be hosed by a hole in IE if you are running it as Admin (just as a hole in Mozilla if it was running as root), but not if it is running as a normal user. You need to exploit a local vuln in the kernel first, just like any other OS.

      Look at the entire syscall interface (the Nt* functions). Tell me which functions are "directly tied into the lowest levels of the operating system".

    4. Re:Hmmm... by rsidd · · Score: 5, Funny
      If this is a flagship Operating System, then Dijkstra's life was in vain.

      It was, anyway.

      Dijkstra: "It is practically impossible to teach good programming style to students that have had prior exposure to BASIC: as potential programmers they are mentally mutilated beyond hope of regeneration."

      Microsoft: Visual BASIC.

    5. Re:Hmmm... by 808140 · · Score: 5, Interesting

      Wow, and out come the slashbots.

      If you actually took the time to reread what I wrote, you would realize (it seems none of my sibling posts have) that I am in fact not comparing Linux to Windows at all.

      Instead, what I am doing is making an analogy regarding modular design. It is common sense that a system designed to be stable should minimize the number of components that are so essential that, if they were to crash, would cause the whole system to come down.

      In MS Windows, this unfortunately includes the Windows GDI -- for some illuminating reading on some of the core design decisions Microsoft made with NT/XP, check out the ReactOS FAQ and mailing list. In trying to reimplement Windows they've really dug some interesting stuff up (none of it was secret, but now it's all in one place.)

      My point is that when someone says, "The reason Windows is fundamentally insecure is because it was designed in a kludgy, non-modular way, where non-essential things like the GDI can crash the whole system," all the Slashdrones immediately understand the insightful nature of the observation. Having the GDI in ring 0 is just braindead.

      However, due to their fanatical devotion to Linus -- let me say that I greatly admire the man and consider him one of the best, if not the best, OSS dev out there today -- they take his opinions on the macro/microkernel debate without so much as a critical thought. But as Bob Dylan said, "Even the President of the United States must sometimes have to stand naked."

      The truth is, the logic that makes "putting the Windows GDI in the kernel" stupid is the same logic that ought to damn macrokernel-based designs. Here's something interesting for you to contemplate: most Windows cashes happen in drivers, not in the GDI. Actually, the Win32 GDI is quite mature and while a) it probably has caused its share of crashes and b) putting it in the kernel was one of the stupidest design decisions ever, most crashes do not happen because of faults in the GDI these days. They've had a lot of time to iron these bugs out.

      The problem is, simply put, drivers. These are mostly written by third parties and due to NT's monolithic kernel design, they are running in kernel space. So a crash in a driver means the whole system comes down.

      A microkernel sandboxes things like drivers and has them run in something more like user space; as a result, just as process on Linux can't crash the kernel, a driver on L4 can't crash the kernel.

      Now, when Linus started developing Linux, he had a number of very good reasons to go with a monolithic design. One: it was easier, from a design perspective, both for developing and hacking. Two: the major microkernel, CMU Mach (and similarly, GNU Mach) were a) very slow, much too slow to be practical on the 386s that were state of the art in 1991 and b) actually not really all that micro-. Not to mention that GNU Mach, at least, didn't solve the driver problem because it actually ran most drivers in kernel space.

      Furthermore, at the time, Linus didn't expect Linux to become what it is today; reading his early posts, he fully expected Hurd to be released RSN and he was just providing something for hackers to mess around with until that happened. And it never happened.

      Don't think that by pointing out a problem with Linux that I am in any way against it. I run only Linux, and I'm a zealot by any stretch of the imagination. I just worry about its future -- in the old days, Linux was a Free Software only kind of beast, with all its drivers open source because they were reverse engineered by the community. But look at how fast Linux is gaining popularity: how long will it be before it really does begin to compete with MS on the desktop, and IP-happy hardware vendors start releasing binary drivers en masse?

      And then we're back to square one: normal users running non-free blackbox kernel modules written by corps that care nothing f

  2. Re:Avalon is SVG based so its rendered in 3d by cybrthng · · Score: 5, Informative

    with further explanation that means it can use the 3d acceleration of your video card and interface with directx as part of the graphics api to accelerate/render your desktop.

  3. Re:As far as I understand... by Anonymous Coward · · Score: 5, Informative

    Because you don't know what you're talking about.

    1) Microsoft isn't porting anything to Linux.
    2) Miguel doesn't work for Microsoft, and never has.
    3) Miguel works for Ximian, a company he founded, and which is now owned by Novell.

  4. Re:Joe Beda talks the talk.... by stratjakt · · Score: 5, Insightful

    That's not so weird. Everyone oohs and aahs when there's a slashdot article about OSS 3D desktops, myself included.

    I think desktop apps flipping around in 3D and all the new ways you could work with apps would be cool.

    But DirectX isn't right for the task, it's too low level. Too much DX code only works on ATi or nVidia, too many vendor specific extensions and shitty drivers. It's great for tweaking the crap out of Doom 3 so it goes as fast as it can, but it would suck if some pixel shader operation that only works on Geforces blowed up my coding session .

    Avalon is higher level, not trying to implement the latest hardware tweaks and gizmos, just base functionality you can count on across the board.

    There's no redundancy, the way I see it. Two different tools for two different tasks.

    --
    I don't need no instructions to know how to rock!!!!
  5. Re:Avalon is SVG based so its rendered in 3d by k98sven · · Score: 5, Informative

    unlike the current pixel based 2d rendering system of today.

    Um... say what?
    Ok, to begin with Avalon doesn't support SVG, which is one of the things Miguel was blasting them for.

    Secondly.. 2D rendering is not 'pixel based' today.
    It's never been 'pixel based'. Windows has had device-independent 2D rendering since.. well, forever. (Windows Metafiles ring a bell?) So has just about everything else (Mac, Atari) too, (X doesn't, but the Unix platform tended to use PostScript for that stuff).

    What is new here is the support of more advanced things like compositing (something you couldn't do device-independently before). OS X already has this of course in Quartz.

  6. Architecture Philosophy by FlutterVertigo(gmail · · Score: 5, Interesting

    I've said this before, here and elsewhere: WGHIII[1] has said several times in the past (and was at conferences in the mid '90s when & where he said them): "...people do not want bug fixes - they want new features...". This is frequently borne out by the underlying architecture Microsoft presents in their products. A semi-stable underpinning, capable of supporting certain elements is put into place such that products & features can be built upon that architecture. "Patching Architectural Holes" (Security, Stability, etc.) can be fixed via patches later[2]. Unfortunately, this means users suffer frustration for a semi "feature rich", unstable product, and developers discover situations where they write "three sides around the barn" when the pieces don't fit together as the philosophy would lead one to believe.

    There are other companies which spend a lot of time on the architecture - almost to a fault - knowing once it is solid, they can add the users' heavily desired features without worry about the stability beneath it.

    All developers know about both scenarios as they either crave and know the the outcome if they are permitted to put the architectural stability in place or they are forced to charge ahead with building on top of wet toilet paper.


    [1]William Henry Gates 3rd
    [2]Providing a vendor is even willing to do so. And the question begs to be answered: How unstable can an architecture be such that patches can be safely made to it (without risking screwing the pooch) to make an improvement? Remember the "three sides around the barn" development? What happens to developed code if the OS suddenly "works" correctly?


    Just remember....
    ______________________________________
    My Trunk Monkey can beat up your Trunk Monkey.
    http://www.suburbanautogroup.com/ford/trunkmonkey. html

  7. Two observations by jvmatthe · · Score: 5, Interesting
    • Microsoft talking design and technologies out in the open with other developers who aren't Microsoft employees? Even talking with Free software advocates? Man, that's good to hear, honestly. If this were system-wide, I bet it'd be good for both sides.
    • Reading Miguel mention that many APIs (Avalon, Tk, Swing, GNOME, Xview, Motif) at least gives one the impression that he might actually know what he's talking about. Let me give him the benefit of the doubt. It makes me wonder how many Microsoft employees have that much understanding of non-Microsoft APIs. Probably plenty, but the few I have encountered seem so immersed in Microsoft culture that they appear to have little understanding of what's going on outside of the Microsoft sphere.
    Now, I should say that I'm no real programmer, but I've done some. The "real" programming I've done is computational code that runs in the console, with a couple of GUI front ends. So, I'm not going to claim any kind of serious perspective on this.
  8. Re:Avalon is SVG based so its rendered in 3d by k98sven · · Score: 5, Informative

    SVG is part of the avalon concept done through the XAML interface.

    Except that Microsoft does not follow the SVG standard. So it's not SVG, it's just similar.

    As for 2d rendering, it has always been pixel/bitmap fill based and not vector based.

    Again, you are wrong. Although you seem to believe it, SVG isn't the first vector graphics format in existance. Not by a long shot. (PostScript is from 1984) Nor is Avalon the first device-independent 2D-graphics API.

    Providing a ref to the SVG spec doesn't make it true.

    Ok? Now, I've contributed fixes to Apache Batik, (an SVG library) and I've also written PostScript generators, and most recently I've contributed stuff to the Java2D library for libgcj. (another 2D library which is not 'pixel based')

    I do believe I know something of vector graphics.

  9. Ease of use and elegence with GUI toolkits by ShatteredDream · · Score: 5, Interesting

    A number of my peers like to bitch about how "Swing is hard to learn" and I get called an elitist for laughing at them. Of course, unlike most of them I have tried to learn other toolkits and have come to the conclusion that Swing's design really is the de facto gold standard for how a GUI toolkit should be arranged for practical development. It is fast, extremely logically structured and the documentation is really straight to the point for when you need to look stuff up.

    I could never get used to Windows Forms. It still amazes me that the layout manager concept isn't considered a standard part of the UI toolkit design process now. Developers shouldn't have to automatically manage most GUI layouts.

    1. Re:Ease of use and elegence with GUI toolkits by sporty · · Score: 5, Insightful
      Amen! The idea that a widget is an object, that can listen for events, such as being clicked, or scrolled or something, is what OOP is all about. Something can have attributes and do something.


      More-so, the "most difficult" layout manager is actually the simpler. GridBag. Even if I assign the constraints and add widgets in haphazard order, so long as i set the x and y right, they go in the right place. It is almost like html in how it works, except html requires ordering of the statements.


      So please, tell me.. why is swing difficult? It's overwhelming because people don't do graphical stuff from the getgo, just like tk and what not. The difference is, swing just makes sense. Now it's not to say others DON'T make sense. perl/tk makes a lot of sense too, but the oop in perl is weak, so it's easier to make tpyos and screw things up once in a blue moon... especially sans strict.

      --

      -
      ping -f 255.255.255.255 # if only

  10. Re:Joe Beda talks the talk.... by DAldredge · · Score: 5, Informative

    That isn't the right one.

    http://slashdot.org/~miguel

  11. Re:Ignoring standards by Isomer · · Score: 5, Insightful

    I remember reading something by some ex-microsoftie. One of the comments he said stuck in my mind. he said that it's not that microsoft doesn't like standards, it's more that if you follow a standard, then you're admitting that you can't do better than the standard. Why use opengl when you could change a whole heap of things to make it "better" and have directx instead?

    Which seems to me to miss the point of having standards. The value in standards isn't in whatever the standard specifies, it's the fact that everyone else is implementing the same standard.

  12. The fake Miguel de Icaza posts. by miguel · · Score: 5, Informative

    Hey guys,

    Just wanted to point out that the inflamatory
    comments that are being made in my name are someone
    else's idea of fun. Some guy decided to squatter
    the login `Miguel de Icaza'.

    Miguel.

    1. Re:The fake Miguel de Icaza posts. by don.g · · Score: 5, Funny

      Wow, I never realised I was Miguel.

      I must tell all my friends. They will be confused.

      --
      Pretend that something especially witty is here. Thanks.
  13. Re:As far as I understand... by miguel · · Score: 5, Interesting

    I do not hate Microsoft, but I think that they will
    eventually open source some interesting pieces of
    software. The pieces are already in movement.

    Microsoft is like any other corporation, they have
    to do what is best for their shareholders. They
    have had a pretty good ride but Linux and open
    source have changed the plane, so they will
    likely have to transform in the future in a different
    kind of company.

    In either case, working for Microsoft is not the
    end of the world. I just happen to be a lot
    happier working for Novell doing open source
    software and working with many talented developers
    from the Novell background, the SUSE background
    and Ximian. An opportunity in a lifetime to
    reshape this industry.

    Miguel.

  14. Re:look at those URLs... by chrisan · · Score: 5, Informative

    Oh, come on... when I wrote BlogX (the blog software I use) I wanted a unique ID for each post. I post more than once a day (Miguel's software doesn't have permalinks per post, only per day) and I didn't want to uniquify the titles... Radio uses monotonically increasing numbers, other software uses UTC datestamps to the millisecond, etc...

    --
    ChrisAn http://blog.simplegeek.com
  15. Re:About inheritance and the API by IrresponsibleUseOfFr · · Score: 5, Insightful

    The average programmer doesn't care the the hierarchy is 10 or 11 levels deep (well at least until the next avalon release comes out). But Microsoft should care, and Ximian also cares. Very deep inheritance hierarchies are tough to maintain. Inheritance is a pretty intimate binding of two classes and changes higher up in the hierarchy sometimes have disasterous changes down the line. From a talk that I heard Stroustrup give, he doesn't care for them much either. (I didn't attend this one, but I imagine it is the same based on the slides.)

    In this day and age, the commonly accepted wisdom is that you break functionality into interfaces and you write shallow helper classes to degalate to for common implementations of those interfaces. (C# is quite possibly the best language there is for supporting this architecture.) This way you don't force the user to use implementations they don't want when they want to program to a particular interface in your system.

    If you look at the code for eclipse, you'll see a good example of this design in action.

    --
    Facts are meaningless. You could use facts to prove anything that's even remotely true! -Homer Simpson
  16. Re:Ignoring standards by chrisan · · Score: 5, Interesting

    I tried to expand on my comments in my next post... "First, an old post from Joe Beda about SVG and XAML. Second, dismissing the CSS debate isn't really fair. A critical part of our design is unification. We didn't want one markup model for vector graphics, one for styling, one for 3D, one for data, etc. Another part of the unification was "Markup == OM", that is, we didn't want a separate markup programming model from code. HTML is this way, the markup and the code have a loose relationship. If we ignore the unification debate, I can understand how it seems simple to say "you should have used SVG". Avalon is a developer platform. We want to enable an entirely new breed of applications that span UI, graphics, and media. Integration of typography with imaging with video with controls with styling is a core part of our value proposition. We aren't trying to create a new 3D system or animation system, we are creating a new developer platform. "

    --
    ChrisAn http://blog.simplegeek.com