Slashdot Mirror
An Interview With Mark Gorham Of OpenVMS
Ken Farmer writes "There's already been one press interview with Mark Gorham, but that encounter with HP's VP of the OpenVMS Systems Division omitted some technical details that warrant further attention. Hence, SKHPC thought it appropriate to go on a deep dive with one experienced in OpenVMS and SCUBA diving as well."
Mark who? I don't know his name. I worked for DEC VMS Engineering in the VAX and Alpha days, who is this guy?
This article makes it seem like the idea of building unix apps on VMS is a new thing. It's not. VMS Posix was available in 1992, and many Unix/C apps would just compile and run. It was very cool.
The dinosaur is aging very well.
there are 3 kinds of people:
* those who can count
* those who can't
Reliability, scalability, uptime, high performance wide area clustering, no viruses, very few security problems of any kind (and those occur mostly in code migrated from unixland). A few of the reasons people choose VMS for an operating system. Individual VMS systems often have multi year uptimes (even in heavily used environments). VMS clusters have uptimes even longer still. And that's leaving out any of the religious flavored arguments about what OS is easier to administer and use.
There is no God, and Dirac is his prophet.
Information wants to be free -- but informants want to be paid.
Clustering started in VMS 4.0, and was really going by or before V5.0
As a general rule, for older systems, you need SCSI disk and CD, something that supports the full SCSI standard. You a PWS "u" is the same as a PWS with a SCSI controller/disk. Check google groups (comp.os.vms) for advice on these upgrades. Some of the newer Alphas understand IDE now.
The neat thing about OpenVMS and Alpha is that in the rare case when a system does crash you can log a call and HP will have someone do a byte by byte crawl through the crash dump and tell you what happened. If it's an o/s problem, VMS Engineering will fix it. If it's a hardware problem, you get an error log with useful diagnostic information.
My big cluster has 3 downtime incidents in the last 6 years, 2 operating system upgrades and frozen fuel line in the generator during an extended power outage. Individual systems have gone down, but never all at once.
For a long time Digital had the .edu market mostly locked up despite BSD and other unix variants. Then they got greedy in the .edu space by charging large fees for the o/s when it had been either free or nearly so. That toasted the .edu market for them and the breeding ground for many VMS-conversant users.
Then Sun cam along and offered better price/performance, which Digital declined to match either through inertia, stupidity, or hubris.
Many organizations did NOT want to switch from VMS, but when it became apparent that they could save a bundle by doing so, well the bit the bullet, spent a lot of money to porting their apps to unix, but were left without a lot of things that the VMS environment supplied 'for free', which had to be bought and layered on to unix to provide equivalent functionality. If you did the math at the time - as I was reuqired to do where I worked - unix with all the extras we needed to buy was more expensive than staying with VMS - so we stayed put. Other companies found that their needs favored a unix solution.
Then through most of the 90's there was the DEC/Compaq non-marketing departments and deals with the devil (Microsoft).
I've worked on SunOS, Solaris, AIX, Tru64, and Linux and still find VMS to be my favorite for heavy-duty production use. I've spent a lot of time with Solaris and while it's ok, I prefered Tru64. AIX was just not my idea of fun.
You really owe it to yourself to give VMS a try. There's a free hobbyist licence available (see another post near this one for details), so pickup a used Alpha (you can always run Linux on it if you decide to) and give VMS a whirl.
It's easy to use and administer, and for the most part the command language (DCL) is english, not acronym. "Help" at the command prompt is the equivalent to 'man'.
SEVMS had a B1 rating - NOT a B2 rating. VMS could never have gotten a B2 rating, due to inherent covert channel problems in the lock manager.
I know plenty about SEVMS and its B2 security level rating as well as the circa-1992 VIP (VMS Integrated POSIX). I left this information out of the article because many of its intended readers don't know C2 from B2, and that VIP didn't cut it as a UNIX development environment. Better to keep things simple, the interview was long enough as it was. I didn't have the time to go down so many ratholes that an article became a book. (Been there, done that, didn't want to do it again yesterday.)
If VMS is a dinosaur, what's UNIX? It's an OS created 10 years prior to VMS, making it a Older Dinosaur. Neither of these dinosaurs are extinct, both have evolved. VMS can do things today that I had no clue it would be able to do today. Same goes for UNIX.
I don't know Mark Gorham's position or job title in the VAX and Alpha days, but he's currently the VP of HP's OpenVMS Division.
Cheers,
Terry Shannon
IT Consultant and Publisher, Shannon Knows HPC
Haven't a clue if VMS was designed with clustering in mind right from the get-go, but VMS started shipping in ~1988, VAXcluster software materialized around 1983-84. Clustering definitely preceded VMS V5.0, the 5.0 release was all about a modular kernel and SMP support and security enhancements.
Dave Cutler did not write or design VMS, he was responsible for VAXeln, a run-time version of VMS. He then went on to develop MICA, the OS intended to run on the PRISM hardware architecture. PRISM was killed because the hardware existed, MICA was nowhere near ready for prime time, or even initial boot time.
MICA was designed to be a superset of VMS that reduced VMS limitations and expanded its capabilities. Cutler went to Microsoft the day after the PRISM project was cancelled, and he took the MICA code along with him. Cutler went on to develop NT, and DEC discovered that portions of NT were identical to portions of MICA, right down to the comment lines.
I'm not a lawyer, but I know enough about intellectual property to realize that NT contained a lot of DEC IP which DEC did not legally convey to Microsoft. DEC's IP lawyers knew that DEC had been ripped off. DEC knew that filing a theft of intellectual property lawsuit against Microsoft would be an exercise in futility, as DEC had far fewer lawyers and far fewer financial resources than did Microsoft.
The end result: the so-called "Alliance for Enterprise Computing." Big win for Microsoft, massive blunder on DEC's part. DEC's CTO, whose initials were BS, jumped at the first offer Microsoft put on the table. Bill Strecker knew a lot about computer technology and packaging, but he didn't have much in the way of negotiating skills. He jumped at an offer that sealed the fate of Alpha back in ~1994 or so.
Under the terms of the "deal," Microsoft agreed to endow Alpha with Intel parity on the server side, but not on the desktop. VMS minus desktop productivity tools (trivial things like the MS-Office suite) couldn't compete in the high-volume Wintel space. DEC unilaterally ceded a vast addressable market for Alpha and VMS. FX!32 binary code translation and emulation couldn't undo the damage DEC did to itself.
Things may change now that VMS is available on an architecture (Itanium) which has a chance of achieving critical mass. Time will tell...
IT Consultant and Publisher, Shannon Knows HPC
|
| Mitnick never broke into a VMS system.
You're absolutely wrong, glenmark. Mitnick broke into many VAX/VMS systems. One of
them happened to be "the Arc" -- DEC's development machine. In addition, he broke into the
VAXes at Leed's University (just ask Neill Clift) and at USC. He also broke into the personal
workstation (a VAX) at Neill Clift's home, where he nabbed the bug reports before they got
to Digital. Not to mention his penetration of VPA (Volunteer Plan Administrators) in Calabasas,
where Lenny DiCicco lead the FBI in a sting operation, leading to Mitnick's apprehension
in VPA's parking lot.
Espousing hearsay as fact only tends to poison the world with ignorance. There's enough
ignorance in this world, as it stands.
So, I'm curious -- upon what factual basis do you conclude that "Mitnick never broke
into a VAX?" I base my statement that he did upon the fact that, as his co-defendant,
I saw the evidence as well as experienced some of it first-hand. You're not one of
those people who just repeats hearsay as if it were fact, are you?
| First of all, I never said that Mitnick never broke into a VAX.
| I said he never broke into a VMS system (some VAXen run Unix).
Likewise, when I said "Mitnick broke into many VAX/VMS systems" (the
second sentence in my first paragraph), I qualified it. Unfortunately,
I was ambiguous later when I said "broke into a VAX".
Mitnick did indeed break into VAX/VMS systems, using flaws discovered
by the CCC (Chaos Computer Club) as well as by intercepting PGP email
communications between Neill Clift (of Leed's University) and Digital.
Neill Clift, who had access to the VMS source microfiche, would spend
a lot of his free time combing through it discovering vulnerabilities.
He would then report these vulnerabilities to his engineering contact
at Digital. Unbeknownst to him at the time, DEC's mail relay machine
was compromised (a VMS system) as well as Neill's home workstation.
As a result, his public/private key was compromised. Through a "man
in the middle" attack, Mitnick would decrypt and read Neill's bugs,
then re-PGP them (using a new key-set he had negotiated with Digital
as a result of pretending to be Neill Clift) and forward to Digital.
As for the CCC, Mitnick installed the "show user 0TTO/1TTO/2TTO" bug
in many VAX/VMS systems, so that he could remain invisible while on
as well as bypass the "pre-login" password required of dial-ups. He
also tricked dial-back systems (where the modem calls you back at a
pre-set phone number) by adding call-forwarding to the home phone of
authorized modem users, thus intercepting the call-backs.
Through the availability of source code, technical support (yes, we
had access to DEC technical services - all it took was an entry in
their database of support customers) and systems, we were able to
study several more weaknesses and eventually code a LAT exploit
which, to-date, remains unpublished.
Prior to all this, by the way, Mitnick was breaking into RSTS/E systems
with impunity. If you had dial-up access, there was basically no way
to stop him... no social engineering required! That really irritated
me, because I lived an hour away from work and emergency dial-up was
not an option.
I actually still have LA120 printouts of some of these exploits... and
answering machine tapes of mitnick leaving me messages about the latest
systems he was able to compromise. In the early days, he'd even steal
other peoples' RSTS/E cracking programs... Like Dave Kompel's tangled
syscalls to spin the kernel into giving you system privilege. I think
I still have a copy of that in storage somewhere.
By the way, all this is just the proverbial "tip of the iceberg."
There are a lot of other things from Mitnick on those answering
machine tapes that never made it beyond me... some of his other
"hobbies" involved the DEA, the MDC (Metropolitan Detention Center),
Magic Mountain's debit card terminals, and oh... the issuing of
"patches" to select VAX/VMS customers on upgrade support contracts.
The patches were delivered in the geniune DEC patches box, on the
correct media for those particular customers. Needless to say,
all those customers had dial-up (or network) access available.
None of that even covers the period of time when Lenny DiCicco worked
at (what was once) PacTel Cellular as their database administrator (in
Orange County, CA). Once Mitnick found out, hundreds of thousands of
ESN's, MIN's and the associated customer names, billing info and social
security numbers were compromised. Since we had the assembler code
(complete with comments) to the Novatel PTR-825 as well as the compiler,
Mitnick was able to remain "invisible" and "untraceable" for years until
he pissed off Tsutomu Shimomura. After all, he had an endless supply
of ESN/MIN combos, and could enter them into the PTR-825 directly
thanks to some custom firmware hacks.
Perhaps I should write a book on what really took place "on the inside"
complete with printouts and WAV files. Maybe in another five years,
after I retire, I might.