Slashdot Mirror
An Interview With Mark Gorham Of OpenVMS
Ken Farmer writes "There's already been one press interview with Mark Gorham, but that encounter with HP's VP of the OpenVMS Systems Division omitted some technical details that warrant further attention. Hence, SKHPC thought it appropriate to go on a deep dive with one experienced in OpenVMS and SCUBA diving as well."
If your camera was based on open standards you could port OpenVMS to it.
Is as secure as an attack-trained Rottweiler embedded in a block of black Lucite... ... and about as useful....
"...pretty popular in the low-end market (1-8 CPUs, up to 64GB of memory..."
/., if even in a linked-to article, where for the longest time a 4 way box was considered xtR3m3 (or whatever the l33t spelling would be these days).
Yup. Its refreshing to actually see opinions like this acknoledged on
And no, there's not really much of a need for a beowolf cluster of those things. Imagine a life instead. Mmm... isn't that nicer?
Yeah, yeah, flamebait...
You're special forces then? That's great! I just love your olympics!
Mark who? I don't know his name. I worked for DEC VMS Engineering in the VAX and Alpha days, who is this guy?
This article makes it seem like the idea of building unix apps on VMS is a new thing. It's not. VMS Posix was available in 1992, and many Unix/C apps would just compile and run. It was very cool.
The dinosaur is aging very well.
there are 3 kinds of people:
* those who can count
* those who can't
Reliability, scalability, uptime, high performance wide area clustering, no viruses, very few security problems of any kind (and those occur mostly in code migrated from unixland). A few of the reasons people choose VMS for an operating system. Individual VMS systems often have multi year uptimes (even in heavily used environments). VMS clusters have uptimes even longer still. And that's leaving out any of the religious flavored arguments about what OS is easier to administer and use.
There is no God, and Dirac is his prophet.
I don't think it's necessarily more painful than other systems, but it does seem to be pain that is easier to schedule (more work during your day, fewer middle of the night emergencies).
Of course, you can't play a lot of games on it...
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
I really enjoyed using OpenVMS and although I no longer use it on a daily basis I do still have an account on a friend's system that I log into from time to time. That interview reminded me of how wonderfully supportive the OpenVMS community is, even if you don't like OpenVMS you have to love the spirit, dedication and willingness to help of these guys. I especially remember the USENET posts by the recently departed John Wisniewski. Here is one of his posts in which he names the top "F" reasons OpenVMS is not going to die.
Information wants to be free -- but informants want to be paid.
I started working on VMS systems in 1997, so I was a relative latecomer to the OS. Still, I quickly learned to appreciate what it's capable of. The ancient hardware I've got in my garage (VAX 6000, VAXstation 3100s, MicroVAX IIs, AlphaStation 200) is capable of more useful and reliable clustering, out of the box, than Windows 2000 AS. Almost undoubtedly better than 2003 as well.
I've had to migrate a legacy VMS application to a Windows 2000 AS cluster, and after 10 years of operation with no more than a few hours' downtime at any given time, the old Alpha cluster is ready to be shut down next week. It's sad to see it go - the Windows version will probably never be as solid and reliable, but what counts to management is that for the price of annual hardware and software maintenance on the old cluster we can buy all new Dell servers with 3-year warranties every year or two.
I did once set up an OpenVMS machine with the intent of taking it to DefCon, but never got around to it. Others did, though, and there's nothing like watching a bunch of hotshot Unix crackers pounding their heads on their keyboards out of frustration.
(And that's just trying to get a volume listing, not breaking in!)
Cutler's original kernel was written in assembler. I assume that it was completely replaced with something in C. Was this done for VMS 5, or later (for the Alpha port)?
Was VMS designed with clustering in mind from the start? Did clusters really get going with v5?
Although, for a guy who implemented his kernel in assembler, Cutler's comment that UNIX "is a junk OS designed by a committee of Ph.D.s" is a little shaky, even if he was the project leader for Windows NT.
I miss the days when I worked on the old VAX mainframes running VMS.... Then again I also kinda miss my old Commodore VIC-20....
Do not meddle in the affairs of sysadmins, for the are subtle and quick to anger.
The people I have known who ran VMS were all physicists and electrical engineers who had large amounts of legacy Fortran code that they didn't want to port, and for which the VMS Fortran compiler was said to be superior to anything available for UNIX at the time. I wonder to what extent eople actually like VMS as an OS and to what extent its survival is due to heritage code?
Many, many posts come from people who have _never_ touched OpenVMS. For these people, I invite you to the Deathrow OpenVMS Cluster. This is a OpenVMS cluster (running OpenVMS 7.2) or VAXen and Alphas. It's free for use by the general public. Yes - you get access to the compilers (COBOL, Java, C, FORTRAN, BASIC, MACRO, and much more!). The entire point of the system is for people unfamiliar with OpenVMS to have the change to _play_ with OpenVMS.
Check out http://deathrow.vistech.net for how to open your own account.
I knew a company that rebooted their VMS boxes once a year when the building did their power test. It was more fear of a power spike then anything elss. Other then that, they never had a need to reboot the systems.
Its not scary, its what an Enterprise Class OS should be.
"I use a Mac because I'm just better than you are."
I looked and looked but could not find whether or not a 64 bit x86 version of open vms is available.
VMS presumes CPU functionality that does not exist in x86. Mainly, this has to do memoy management and "ring" protection.
A VMS engineer told us (at an Oracle Rdb conference in Nashua) that Intel purposfully made certain parts of the Itanium look like the VAX. That made it possible to port VMS to Itaniac.
"I don't know, therefore Aliens" Wafflebox1
If VMS also worked on Alpha, what were the barriers for VMS that allowed UNIX to gain more share? UNIX was expensive back then, so unless VMS was really expensive, that couldn't have been a barrier. Was it just DEC's infamous marketing dept.? It seems that other comments make VMS out to be a pretty nice OS.
-- Microsoft is the most expensive commodity operating system and office suite vendor in the marketplace.
As a general rule, for older systems, you need SCSI disk and CD, something that supports the full SCSI standard. You a PWS "u" is the same as a PWS with a SCSI controller/disk. Check google groups (comp.os.vms) for advice on these upgrades. Some of the newer Alphas understand IDE now.
The neat thing about OpenVMS and Alpha is that in the rare case when a system does crash you can log a call and HP will have someone do a byte by byte crawl through the crash dump and tell you what happened. If it's an o/s problem, VMS Engineering will fix it. If it's a hardware problem, you get an error log with useful diagnostic information.
My big cluster has 3 downtime incidents in the last 6 years, 2 operating system upgrades and frozen fuel line in the generator during an extended power outage. Individual systems have gone down, but never all at once.
The company I was working for in 1979 put an order in for a VAX/11-780 which we received in 1980. It was VAX serial number 21. The tech guy installing it said that the first 18 were for internal DEC use. It came with two RM80 (80Mb disks), 256K Mem, an expansion cabnet and a vacuum column 9 track tape drive... All for about $320K USD.
The back plane was all wire-wrap and the CPU was contained on four of the cards that plugged into the back-plane. The micro code wad uploaded from an 8" floppy loaded in a PDP-11/03 which resided in the lower portion of the main cabnet.
To make a long story short, this was one of the best systems I ever administered. The DEC people were professional and tech support was excelent.
It was a sad day to see DEC go...
Your post: "Plus, if you know the Windows NT kernel, you pretty much know the VMS kernel [wink wink]."
My puzzlement: Windows NT == VMS? Really? Are you serious?
More of a stab at M$FT - I think the gentleman's agreement they reached was that DEC wouldn't sue them over theft of proprietary trade secrets [i.e. theft of "Intellectual Property"] if M$FT agreed to port NT to Alpha hardware.
But as to the underlying question of the NT kernel: Folks, it ain't all that bad. In just about every test anyone ever throws at it, the NT kernel bitch slaps the competition.
Compare e.g.:
Now the decision in NT 4.0 to break the pure client/server model, and bring the windows/graphics stuff into "Ring 0", may have contributed to some system instability [particularly if you're using a bleeding-edge video card], and the NT Domain/Active Directory network infrastructure may be a pale imitation of a true directory like what Novell can offer you, but the underlying Windows NT kernel itself ain't nothing to laugh at.You've obviously never had Kevin Mitnick on your OpenVMS system... or attracted the attention
of the Chaos Computer Club (CCC), whose members at one point (in the old days) targeted
VAX/VMS systems. Nor have you had Neill Clift go through the OpenVMS source code and
discover "bugs".
Don't take it for granted -- just because the O/S is (for all intents and purposes) obscure
now doesn't mean its "secure" now.
I know plenty about SEVMS and its B2 security level rating as well as the circa-1992 VIP (VMS Integrated POSIX). I left this information out of the article because many of its intended readers don't know C2 from B2, and that VIP didn't cut it as a UNIX development environment. Better to keep things simple, the interview was long enough as it was. I didn't have the time to go down so many ratholes that an article became a book. (Been there, done that, didn't want to do it again yesterday.)
If VMS is a dinosaur, what's UNIX? It's an OS created 10 years prior to VMS, making it a Older Dinosaur. Neither of these dinosaurs are extinct, both have evolved. VMS can do things today that I had no clue it would be able to do today. Same goes for UNIX.
I don't know Mark Gorham's position or job title in the VAX and Alpha days, but he's currently the VP of HP's OpenVMS Division.
Cheers,
Terry Shannon
IT Consultant and Publisher, Shannon Knows HPC
The killer blow was when the architect of VMS, Dave Cutler, moved over to Microsoft.
Security suffered from the transition because Vax/VMS had KESU shells and the Intel platform didn't support the Exec mode. Each shell had specific instructions that could only run in that shell, and it's own discrete address space. A user program couldn't write to the kernel, or to a device driver, or to any structures managed by the Supervisor layer. Since user mode exe's were not able to reach protected address spaces where the other bits lived, exploits were few and far between.
Do not mock my vision of impractical footwear
|
| Mitnick never broke into a VMS system.
You're absolutely wrong, glenmark. Mitnick broke into many VAX/VMS systems. One of
them happened to be "the Arc" -- DEC's development machine. In addition, he broke into the
VAXes at Leed's University (just ask Neill Clift) and at USC. He also broke into the personal
workstation (a VAX) at Neill Clift's home, where he nabbed the bug reports before they got
to Digital. Not to mention his penetration of VPA (Volunteer Plan Administrators) in Calabasas,
where Lenny DiCicco lead the FBI in a sting operation, leading to Mitnick's apprehension
in VPA's parking lot.
Espousing hearsay as fact only tends to poison the world with ignorance. There's enough
ignorance in this world, as it stands.
So, I'm curious -- upon what factual basis do you conclude that "Mitnick never broke
into a VAX?" I base my statement that he did upon the fact that, as his co-defendant,
I saw the evidence as well as experienced some of it first-hand. You're not one of
those people who just repeats hearsay as if it were fact, are you?
There was a Jurassic Era in which T-Rex was the biggest and baddest. All that remains of T-Rex V1.0 is fossils and a few skeletons in the world's best museums of science.
There was a Jurassic Park, which was a work of fiction by Michael Chricton (and not one of his best, either). All sorts of dinosaurs roamed that fictional evolutionary leap forward into the past. The theatrical verion was worse than the book, and you're more likely to see black helicopters hovering over your house than you are to have a close emcounter of the worst kind with a rabid velicoraptor, or whatever those things were called.
In the IT industry, dinosaurs can evolve. The mainframe did, as did VMS amd UNIX. They aren't new, but they sure are improved and have adapted quite nicely. They are neither obsolete nor extinct. The Commodore VIC-20, which materialized in the 1980s--well after mainframes and VMS and UNIX showed up--is both obsolete and extinct. And nobody's booting any OS on a Convex or PRIME box any more.
So being a VMSasaurus Version 8.2 isn't a bad thing to be ;-}
IT Consultant and Publisher, Shannon Knows HPC
*** Quantum Mechanics: The Dreams of Which Stuff is Made ***
| First of all, I never said that Mitnick never broke into a VAX.
| I said he never broke into a VMS system (some VAXen run Unix).
Likewise, when I said "Mitnick broke into many VAX/VMS systems" (the
second sentence in my first paragraph), I qualified it. Unfortunately,
I was ambiguous later when I said "broke into a VAX".
Mitnick did indeed break into VAX/VMS systems, using flaws discovered
by the CCC (Chaos Computer Club) as well as by intercepting PGP email
communications between Neill Clift (of Leed's University) and Digital.
Neill Clift, who had access to the VMS source microfiche, would spend
a lot of his free time combing through it discovering vulnerabilities.
He would then report these vulnerabilities to his engineering contact
at Digital. Unbeknownst to him at the time, DEC's mail relay machine
was compromised (a VMS system) as well as Neill's home workstation.
As a result, his public/private key was compromised. Through a "man
in the middle" attack, Mitnick would decrypt and read Neill's bugs,
then re-PGP them (using a new key-set he had negotiated with Digital
as a result of pretending to be Neill Clift) and forward to Digital.
As for the CCC, Mitnick installed the "show user 0TTO/1TTO/2TTO" bug
in many VAX/VMS systems, so that he could remain invisible while on
as well as bypass the "pre-login" password required of dial-ups. He
also tricked dial-back systems (where the modem calls you back at a
pre-set phone number) by adding call-forwarding to the home phone of
authorized modem users, thus intercepting the call-backs.
Through the availability of source code, technical support (yes, we
had access to DEC technical services - all it took was an entry in
their database of support customers) and systems, we were able to
study several more weaknesses and eventually code a LAT exploit
which, to-date, remains unpublished.
Prior to all this, by the way, Mitnick was breaking into RSTS/E systems
with impunity. If you had dial-up access, there was basically no way
to stop him... no social engineering required! That really irritated
me, because I lived an hour away from work and emergency dial-up was
not an option.
I actually still have LA120 printouts of some of these exploits... and
answering machine tapes of mitnick leaving me messages about the latest
systems he was able to compromise. In the early days, he'd even steal
other peoples' RSTS/E cracking programs... Like Dave Kompel's tangled
syscalls to spin the kernel into giving you system privilege. I think
I still have a copy of that in storage somewhere.
By the way, all this is just the proverbial "tip of the iceberg."
There are a lot of other things from Mitnick on those answering
machine tapes that never made it beyond me... some of his other
"hobbies" involved the DEA, the MDC (Metropolitan Detention Center),
Magic Mountain's debit card terminals, and oh... the issuing of
"patches" to select VAX/VMS customers on upgrade support contracts.
The patches were delivered in the geniune DEC patches box, on the
correct media for those particular customers. Needless to say,
all those customers had dial-up (or network) access available.
None of that even covers the period of time when Lenny DiCicco worked
at (what was once) PacTel Cellular as their database administrator (in
Orange County, CA). Once Mitnick found out, hundreds of thousands of
ESN's, MIN's and the associated customer names, billing info and social
security numbers were compromised. Since we had the assembler code
(complete with comments) to the Novatel PTR-825 as well as the compiler,
Mitnick was able to remain "invisible" and "untraceable" for years until
he pissed off Tsutomu Shimomura. After all, he had an endless supply
of ESN/MIN combos, and could enter them into the PTR-825 directly
thanks to some custom firmware hacks.
Perhaps I should write a book on what really took place "on the inside"
complete with printouts and WAV files. Maybe in another five years,
after I retire, I might.