More Linux Coverage in the News

Principal Skinner writes " The main feature on Userweb has a pretty good exposé of Linux, the open-source movement, and trends in OSes. Heavily slams NT on reliability, scalability and TCO, as well as raising questions about whether Windows2000 is The Answer. Also talks a bit about Novell and its products. "

Comments

64-bit clean leader?

[zatz]

Technically speaking, Linux also offers enterprises a migration path to support 64-bit applications as soon as they become available. ... Microsoft, Novell and other OS vendors are still at least a year away from providing 64-bit application support at the OS level....

Is Linux really so 64-bit clean? I know that the VFS layer is not on 32-bit architectures, and I haven't yet heard that glibc2 and kernel 2.2 are totally cleaned up even on e.g. Alpha and UltraSPARC. Someone who has had more recent experience please let me know... last time it mattered I found myself using cruft like llseek(), *shudder*.

I am sure of one thing: Linux is not ahead of Solaris on 64-bit cleanliness of interfaces. I have yet to come across any documented interface in Solaris 2.6 that is neither 64-bit nor has an explicit 64-bit equivalent.

Gartner Group Record

[Izaak]

I always love to see what the pundits at Gartner Group are blathering about. Why anyone would pay money for their *predictions* is beyond me. A while back they predicted Linux would go nowhere... now that it has swept the Internet/Intranet catagory, that has been revised to "linux will not penetrate the enterprise." So after we sweep the enterprise, what is their next prediction? "Linux will not ascend to the godhead", perhaps? Remember, these are the same people who once predicted the death of SMTP on the global email backbone.

Thad

Re:Novell misses the point, *sigh*

[David Greene]

This points out the fact that when criminals (or potential criminals) can get their hands on source code they'll sift through it looking for exploits.

Of course they will. All the more reason to accept peer reviewers, as they do the same thing. Why should criminals have an advantage?

Unless a piece of software is released under an OpenSource(tm) license, and mechanisms are in place for peer-review to result in rapid fixes (i.e. there is a body accepting open submissions, etc.) the public release of the source code DOES represent a security risk.

What you say here is not quite accurate. The software does not have to be released under and open source license to retain security, and there need be no body to accept (code) submission. At minimum, we would like:

• Availability of the source code for perusal. Redistribution can be restricted. We just need to see it.
• People willing to listen to suggestions. They do not have to accept code. Any sort of bug-tracking system would provide this.

It's sort of an all-or-nothing situation.

Not at all. What I've outlined above is clearly not Open Source, but it can improve security.

Regardless, the silliness of Novell's statement is that they imply security through obscurity is inherently better than open peer review, which has been proven time and again to be false.

The Support Question

[remande]

Yet it is the nature of Linux open-forum business model that GartnerGroup and others believe could harm Linux's chance of becoming a mainstream, general-purpose NOS. Author G. Weiss states in his book "Linux in the Mainstream: Key Make-or-Break Factors," "Linux sidesteps the issue of IS responsibility; many Linux converts unrealistically believe that IS departments can assume more responsibility and wean themselves from vendor dependence, since the worldwide resources of the community are available to leverage." The issue brings up a question: To whom will Linux IS managers turn in times of trouble to obtain fast relief in the absence of vendor support contracts?

We do not expect IS departments to take more platform responsibility. We expect them to get support contracts from a competent support firm. IS departments can expect to get better support out of Linux (and other open source software) because OSS demolishes the support monopoly.

You can only provide so much support for a piece of software without having the source code in your hands. If you find a bug, you can only fix it if you have the source code. With proprietary software, only the software vendor itself has that code, and thus it is the only truly competent support organization. If you really need a package to run, your chain of support must go to the vendor. If you don't get support from the vendor, you get support from someone who gets support from the vendor. If you don't like the support you get, you either live with it, or change support by changing vendors.

Every proprietary software firm is a monopoly in the support market for its own software.

With Linux, anybody with skills and a 486 can fix Linux bugs. You can support Linux to the hilt without selling Linux. There is no Linux support monopoly. The competition creates low-cost, competent support contractors.

Re:The Support Question

[AJWM]

Incidentally, it has to be a firm composed of your Open Source buddies.

Not at all. There's nothing in the world preventing, say, Microsoft from going into the Linux (etc) support business, so long as any mods they make to the code are released.

Mind, with Microsoft's reputation for support, they may not get many takers.

"Buying Protection" is nothing new. "Protection Rackets" have been defining the 'rules of the road' for centuries, then extracting their fees from the potential victims.

True, and that's exactly the angle that Microsoft seems to be adopting when they spread FUD about support for e.g. Linux. "Gee, nice OS ya got here, but it'd be a shame if those protocols were to break."

Knowing the algorithm

[betaray]

RSA's stuff is very secure because people know the alogorithm. People are able to examine it and find any flaws, and the usually they tell other people about those flaws and it gets fixed. DES had some features that allowed it to be easily cracked but they were fixed because everyone had the algorithm. Cryptology is where the Open Model began.

Security Through Obscurity?

[The Welcome Rain]

"Novell will use open-source publishing when it makes sense," says Brian Faustin, Novell's director of product marketing for NetWare. "It doesn't make sense for the network operating system because we need to maintain our value-add through security and reliability features. Our customers don't want us to give away source code."

What's the implication? That Novell's security would be reduced if they gave away source code?

That sounds like a certain discredited theory of security to me.

--

Factoring numbers.

[AJWM]

"The obvious mathematical breakthrough would be development of an easy way to factor large prime numbers." Bill Gates, The Road Ahead, Viking Penguin (1995)

Oh, come on! Did he really write that?

(What's his problem? I can factor large prime numbers in my head. (As long as you guarantee me it's prime.))

article didn't impress

[ChrisRijk]

As somebody points out above, Linux doesn't have dibs on 64bit kernal stuff - certainly just about every commercial unix bunch has this 64bit option. They don't seem to have researched the commercial Unixs much in general. Not that surprising in some ways - until recently most people were still predicting the death of Unix...

I dunno about IPv6 for the other unix guys, but there is a Sun provided IPv6 patch available for Solaris, and has been around since 1997 - for Solaris 2.5. Such a patch apparantly works on Solaris 7 too, though the web page doesn't say - it's bit outa date with regards to OS versions. Anybody know what the case is for Irix, and the other big boys? Besides, last I heard IPv6 hadn't even been completed yet, and I have no idea how long it'll be until it's being used significantly - ie I think bringing up IPv6 is a bit redundant when talking about current NOSs.

I wasn't particularly impressed by this article. Could have been better in a couple of ways (in some ways it seemed to have re-hashes from other articles going on about Netware VS Windows), and besides, we've seen so much similar articles it's getting boring... ^-^

PS Before someone asks, IPv6 is to replace IPv4 sometime and give us 128 bit IP addresses, instead of 32 bit. To put it simply.