Interview with Sun's Tim Bray and Radia Perlman

ReadWriteWeb writes "To celebrate the 15th anniversary of the World Wide Web, Richard MacManus interviewed two senior engineers from Sun Microsystems - Tim Bray (Director of Web Technologies) and Radia Perlman (Distinguished Engineer). The interview discusses the past and future of the Web, including the impact that Sun's servers have had over the years. Also discussed is the reason why Tim and Radia believe that P2P won't be a driving force on the Web going forward. Radia thinks that having central sites where people can register is key to making the Web scalable and more secure."

Comments

P2P

[Rob T Firefly]

Tim and Radia believe that P2P won't be a driving force on the Web going forward. Radia thinks that having central sites where people can register is key to making the Web scalable and more secure.

I'll say. Nothing feels more scalable and secure than when I register and login to all my favorite P2P trackers.

Re:P2P

[Anonymous Coward]

P2P is a dead technology, plain and simple. It can't work in a secure network, for several reasons.

1. P2P requires holes in firewalls. You cannot use P2P applications safely through a firewall, you must also allow incoming connections.

2. P2P and a distributed attack look identical. There's no way to tell the difference between a P2P application and a worm attacking a network. As such, allowing P2P applications to exist necessarily lessens the security of the network by allowing worms to hide in the P2P traffic.

3. There's no way to secure a P2P network to require certain permission levels to access data. Once data is flowing in the network, every peer has to be trusted not to distribute the data to another peer without proper validation.

And perhaps the biggest reason:

4. P2P isn't. You have to have a central source at some point that tells the peers where to find each other. If you have a central source anyway, you might as well just have all peers connect only to it so you have clearly defined routes and security roles.

P2P is already effectively dead. It's only going to continue to die as more and more ISPs strengthen the security on their network and, as a side effect, kill off all P2P traffic.

Re:P2P

[Aladrin]

You've forgotten 1 very very important thing:

People like it.

All the technical reasons in the world don't matter if people prefer it to everything else. Until you have actually created and properly hyped a better 'technology', then P2P is here to stay.

Re:P2P

[morgan_greywolf]

P2P is a dead technology, plain and simple. It can't work in a secure network, for several reasons.

Who said anything about the Internet being a secure network?

Look, the Internet, by its very nature, is inherently insecure. It cannot be secure. Only networks where resources can be controlled and managed can be considered secure. You can only secure your own private network, and if that network is connected to the Internet, even via a firewall, its security must be considered at least compromiseable, if not already compromised (this depends on how important security is to your network -- U.S. military and civillian intellegence consider air gap security to be the only security that is acceptable in relation to the Internet and their classified systems). P2P or no P2P.

As for holes in the firewall -- any service your network provides to the public internet requires holes in your firewall. If you don't like that, then don't run services on your public facing connections. *shrug*

Re:And I thought...

[mrogers]

There's a difference between decentralising the infrastructure and decentralising the control. Radia Perlman's thesis is a good example: a robust, decentralised routing protocol made possible by a centralised PKI.

Re:Oh I get it

[OakDragon]

To make the internet more reliable and secure, maybe we could have a whole bunch of centralized servers, all spread out.

Re:Oh I get it

[dc.wander]

I wouldn't be so condescending about the suggestion... Radia Perlman has accomplished more for modern networking and the internet that you probably will in your lifetime. She is more than just a "sun employee." She is inteventer of the Spanning Tree Protocol amoung other things http://en.wikipedia.org/wiki/Spanning_tree_protoco l.

Maybe check out her book, Interconnections, on Amazon to get a feel for the type of work she does.

Need a new interviewer

[buffoverflow]

This was a disappointment. I was really hoping for a lot more out of this interview. Two brilliant interviewees, (one of which is arguably the most influential and groundbreaking female engineer to ever work in this industry, the other is the creator of one of the most prevalent markup languages used); an interesting topic, (I'd like to know what these two think of the past 15 years, and more importantly, what they see to come); finally a simpering imp of an interviewer.
Let the two with the IQ's & overly impressive resumes do the talking. MacManus, I'm really hoping you're leaving all the good stuff for part 2. I didn't see much in the way of a single worthwhile question or topic. The writing was dry and elementary.
Mr. MacManus.. When you get people of this caliber to speak to you, don't treat it like a freshman project for the campus paper. Please do something before you release part 2... Or just toss that page into the fire before you embarrass yourself any more.

(P.S. It never hurts to plug your interviewees work either... "Interconnections" kicks ass...)

Re:Need a new interviewer

[bsartist]

Two brilliant interviewees, (one of which is arguably the most influential and groundbreaking female engineer to ever work in this industry

I have to disagree. No disrespect to Ms. Perlman intended, but I think the term "groundbreaking" more accurately describes the work of Admiral Grace Hopper. I will give you however, that Ms. Perlman is arguably the most influential and groundbreaking female engineer currently working in this industry.

Re:Need a new interviewer

[fm6]

COBOL was not the first high-level programming language, not by a long shot. There were already languages that knew how to interpret formulas (FORTRAN), process complex data structures (LISP) and even primitives forms of block structuring (Algol). The one big idea that COBOL added to the mix was that source code should resemble natural language (IF X EQUALS 3 OR 4 ADD 1 TO X). Hopper had to have been pretty ignorant about the sheer ambiguity of natural language to make this mistake.

Central Server vs. P2P

[nascarguy27]

IMHO, The central server stucture is the way to go. The entity that owns the central server(s) can concentrate security on those server(s) and thus provide verification that you download what you wanted. You can also track payments and such easier with a central server structure. With P2P, you never know what you are going to get until you run the file, and it's harder to track for liscensing purposes and the like. P2P has been shown to be faster in some applications, but with people getting faster and faster connections to the internet, the speed advantage is going to be less in the future.

You have no privacy, get over it.

[Zigurd]

"You have no privacy, get over it." - Scott McNealy

Although McNealy spent a lot of time and ink explaining his point of view, and claiming he was taken out of context, he never backed off that statement. In fact, he clarifies this way "If there were no audit trails and no fingerprints, there would be a lot more crime in this world. Audit trails deter lots of criminal activity. So all I'm suggesting, given that we all have ID cards anyhow, is to use the biometric and other forms of authentication that are way more powerful and way more accurate than the garbage we use today."

The part that is wrong about this is that audit trails are for government and corporate operations, to make sure they are honest and within the law, and within the bounds of their investors' and constituents contracts. Applying the same controls to individuals is oppressive, and McNealy should not have been surprised to find out many people objected to his view.

Layers is the key

[presidenteloco]

Google is based on a network of x-number (say 500,000) of low-grade server pcs.
They layer on a highly redundant, fault tolerant, hot-computer-swappable,
massively distributed file system.

This is a much smarter solution for reliability than centralization. Further
decentralization (even across corporate boundaries) would lead to even less risk of
information loss.

Consider that one single corporation, even with massive decentralization, is still
vulnerable to a single legal attack by a single misguided corporation or government.

A distributed, encrypted, cache-migrating filesystem layer on top of millions of
anonymous peer computers would be even more secure and reliable.

The fact that 1 expensive Sun computer can be replaced by 2 or 3 (or 10 or 20)
commodity pcs networked together is what is causing the death of Sun.
And make no mistake; unless Sun reinvents its business model to FULLY recognize the
power of commodity-computing and decentralization, it WILL complete its long death
spiral, or live out a weak, pathetic old age selling replacement Sun "mainframes" to
technically locked-in fortune 500 customers.

Note: You can re-introduce a layer that creates virtual "centralization" and "registration"
on top of a fully decentralized, encrypted, and migrating filesystem layer, if you need
to. Google already does this. So the argument made in the article is specious.

Full Interview available now as a podcast

[ReadWriteWeb]

Given some of the comments about wanting more context, I've now done a podcast of the entire interview.