|
|
Home | Switchboard | Unix Administration | Red Hat | TCP/IP Networks | Neoliberalism | Toxic Managers |
| (slightly skeptical) Educational society promoting "Back to basics" movement against IT overcomplexity and bastardization of classic Unix | |||||||
In cases of major discrepancy
it is always reality that's got it wrong.
|
|
A: I consider Open Source to be an important part of the international programming fraternity, an institution organized as a virtual scientific academy that discovered many talented developers from various countries, especially Europe and Spanish speaking countries. It's great how active this fraternity is!
|
|
This "pro bono" (Latin "for the common good") development is not unique to software. Most professional codes of ethics encourage participants to donate some of their time "pro bono". I think that the healthy part of Open Source movement is in reality a "pro bono" movement that already produced a long lasting impact on software and is especially important to education, developing countries, cash-strapped startups, etc.
I consider it to be an important part of the Unix Renaissance, the most important democratic movement in software development in the XX century started by Berkeley University Free/Net BSD project( TCP/IP, Bind, sendmail, vim to name a few things) and MIT's GNU project (gcc, gdb, emacs, etc.). One very important benefit that Linux provides is that along with Free/Open BSD it's a free and open alternative to any proprietary operating system and due to the GNU license it most probably will stay that way.
At the same time the movement is still in its early stages (and not last days, as some predict) and it suffers from some "childish diseases". One of them is bad advocacy. The term "bad Linux advocacy" or Raymondism was introduced in my First Monday paper to differentiate a credible OSS advocacy from the popular brand of naive on the border of blind fold Linux chauvinism ("Linux uber alles"). The main problem with Raymondism is that with the loss of credibility comes a betrayal of trust to the intelligent readership.
Like any other type of groupthink Raymondism incorrectly assumes:
What ESR and Co failed to realize is that people who are developing and using Solaris, Novell and Microsoft products are also professionals and many of them are of a caliber far superior to the author of low to middle-range open source products like EMACS editor macros, a mail utility, and like ;-). For any intelligent professional an open demonstration of arrogance naturally creates a strong negative reaction, a backlash that is damaging to the movement credibility and future.
Before I get flamed for this, please understand that a holy war, "Linux uber alles" of sorts, is a self-defeating strategy. I hope that there is a healthy "silent majority" of the open source community (that why I actually am writing this FAQ) who are just writing code as best they can, and/or submitting patches bug reports. But that does not mean that we can just ignore the ranting and raving of the zealots: the public tend to define the open source community in terms of its most outspoken members (ESR and Co) which in this particular case means zealots...
|
The main problem with Raymondism
is that with the loss of credibility |
As Jono Bacon put it in the UK Linux Group article The Good, the Bad and the Proprietary:
I mean, let's take a reality check at this early point in this discussion; Linux is software - a man made tool that serves a purpose, and we need to remember that Linux is only software, and not some godly means in life where we must cast down all those who oppose. The particular Linux users that I direct this comment to are what I would call "those users who like to express their opinion in forceful manner"; in other words, those people who get very hostile to anything that isn't Linux.
Microsoft is usually a direct target when it comes to shoving some negative energy in the right direction. While I think that Microsoft does have it's flaws, everything has two sides, and Microsoft has consistently developed well designed easy to use software that lets novices get some work done.
The same problems exist with primitive anti Microsoft rhetoric like ERS's (see Slashdot ESR responds to Ed Muth for more detailed discussion:
After months of silence out of Redmond, the themes of Microsoft's coming FUD campaign against Linux are beginning to emerge like a zombie army from the fetid mists of Redmond. And who should that black-armored, axe-wielding figure riding point be but our old friend Ed "Sheriff of Nottingham" Muth, apparently recovered from leading with his chin last time around and ready for another go at Linus and his Merry Men of Sherwood.
Even Linus Torvalds proved to be not immune to this disease. Some of his technical judgments are very suspect. It's enough to read attentively several of his interviews to understand that he started making predictions and evaluate things about which he actually has very little real knowledge due to the specifics of his career and the best he can do is to make an educated guess. As Charles Hannan, a developer of an alternative operating system was quoted in Ottawa Citizen artilce "All in all that IPO money did to some Linux developers was make them incredibly arrogant."
Overhyping open source doesn't actually help to create a larger user base and/or sustained development of the community. We should suspect any OSS advocacy that includes the following features:
After months of silence out of Redmond, the themes of Microsoft's coming FUD campaign against Linux are beginning to emerge like a zombie army from the fetid mists of Redmond. And who should that black-armored, axe-wielding figure riding point be but our old friend Ed "Sheriff of Nottingham" Muth, apparently recovered from leading with his chin last time around and ready for another go at Linus and his Merry Men of Sherwood.
Yes, of course, Microsoft is far from being a saint, but this is simply ridiculous. Even the usual marketing suspects rarely sink so low. Jeff Lewis in his interesting paper The Cathedral and the Bizarre discussed other trick that ERS often uses ("Windows 2000 63K bugs trick"):
Raymond points out that Windows 2000, which reportedly shipped with 63,000 bugs, shows that OpenSource works because under Brook's "Law", the number of bugs is roughly proportional to the square of the number of programmers. Since Linux has 40,000 developers working on it - there should be 2 billion bugs in Linux. The flaw is that he perceives Linux as a collection of small projects, but sees Win2K as a single monolithic application - much as he seems to see MacOS. In reality, Win2K and MacOS aren't monolithic. They are composed of many smaller parts which are handled by smaller teams. Much like Linux.
As for comparing bug counts - at least Microsoft has a bug count. If Raymond had bothered to check the number, he'd have found that a rather large proportion of the 63,000 bugs are cosmetic - and none were considered 'showstoppers'. We don't even have a way to determine the real bug count for Linux since there's no central repository for this sort of information.
Raymondism seems to be assuming that all OSes are targeted to the same market segment. This is a questionable assumption. Developer resources are not infinite and explicit or implicit priorities lead to particular strong and weak points of a particular OS. Unix in general was designed as a developer OS and naturally most developers and power users really like this OS and prefer it to others. It also a very good server OS. That does not exclude the possibility of using it by other market segments but the level of success achievable in each of them is questionable. For example Mac is popular among graphic artists, musicians and users without special computer training. One can say that it is a specialized OS for those market segments and that's why the question of consistency of user interface is so well addressed in the OS. It's a top priority for those segments. See Slashdot discussion of the The Cathedral and Bizarre for more information. Its just reinforcing the idea that there are different markets and different kinds of software and different kinds of users. No surprise that OSS fits some niches and doesn't fit others.
SR: Some of our readers may be confused by the "open source" movement you represent, which is significantly different from Richard Stallman's (a.k.a. RMS, founder of the Free Software Foundation and the GNU Project) "free software" statements. Open source is not the same thing as Stallman's "free software," right?
Raymond: The distinction between the open-source movement and what RMS is doing is that we push utility arguments while he publishes moralistic ones. RMS's basic stance is that intellectual property is evil and, therefore, sources must be open. Ours is that we want what gives the best engineering results, and that's open source.
Later ESR seems to get a pop star syndrome at some point and decided
that he can safely
make personal attack on RMS in order to promote his own Open Source
Initiative. This "pop star syndrome" can probably explain the fact that
he also have felt the need
to go public about his new wealth. This was very bad move from PR
perspective and just shows how arrogant ESR became; he not only managed
to discredit himself both as a person and as an evangelist by attacking
FSF, but also alienated those Linux developers who fail to get into
this short-lived get-money-fast-and-run
Linux Gold Rush (I suspect
the latter category encompass most developers outside USA). There's
nothing wrong with making money, even big money, but Linux doesn't benefit
from crazy IPOs based on hype and manipulations by investment brokers.
I suspect that "Open source rich" became rich at the expense of
naive believers in the OSS phenomena, not from the day traders.
The GNU Project was around long before Linux. But it's not a stretch to suggest that GNU was a relatively obscure phenomenon before Linux brought its benefits front and center to the computing mainstream. Stallman's belief that it is better to have poor-quality free software than high-quality proprietary stuff might have forever kept the GNU world view as a niche had Torvalds' pragmatism not brought it out.
See
cult of personality for additional quotes.
Eric Raymond wrote an article where he stated, "It's pretty clear. Anybody who trusts their security to closed-source software is begging to have a back door slipped on to their system -- with or without the knowledge of the people who shipped the code and theoretically stand behind it. ... Apache has never had an exploit like this, and never will. Nor will Linux...".
Of course the next day, after some background and fact checking, it was revealed that the Microsoft back-door wasn't as bad as was originally reported. Further, ten days later a security firm found a what could be considered a back door in Red Hat Linux. Ironically, the bug was in a piece of web software. The security advisory states, "The GUI portion of Piranha may allow any remote attacker to execute commands on the server. This may lead to remote compromise of the server, as well as exposure or defacement of the website."
Wait a minute. Doesn't Red Hat "theoretically" stand behind the code they ship? How could this back door have been inserted into Open Source code? Didn't Mr. Raymond say that this couldn't happen to Linux? What do all the pundits who were railing against Microsoft's security holes have to say about this? Is there a double standard when it comes to reporting Microsoft? In this situation, the Linux press, such as Slashdot, are looking more like a sick imitation of what ZDNet used to be. Why is it "evil" when Microsoft FUDs Linux, but "advocacy" when Linux sites FUD Microsoft?
Is it too much to expect unbiased reporting in the media?
But the problem is deeper. Here is an opinion of John Viega, a Senior Research Associate in the Software Security Group at Reliable Software Technologies, an Adjunct Professor of Computer Science at the Virginia Polytechnic Institute, the author of Mailman, the open source GNU Mailing List Manager, and ITS4, a tool for finding security vulnerabilities in C and C++ code. He has authored over 30 technical publications in the areas of software security and testing, and is responsible for finding several well-publicized security vulnerabilities in major network and e-commerce products, including a recent break in Netscape's security. In his recent paper open source resources at open source it The Myth of Open Source Security he wrote:
...Even if you get the right kind of people doing the right kinds of things, you may have problems that you never hear about. Security problems are often incredibly subtle, and may span large parts of a source tree. It is not uncommon to have two or three features spread throughout a program, none of which constitutes a security problem alone, but which can be used together to perform a security breach. For example, two buffer overflows recently found in Kerberos version 5 could only be exploited when used in conjunction with each other.
As a result, doing security reviews of source code tends to be complex and boring, since you generally have to look at a lot of code, and understand it pretty well. Even many experts don't like to do these kinds of reviews.
And even the experts can miss things. Consider the case of the popular open source FTP server wu-ftpd. In the past two years, several very subtle buffer overflow problems have been found in the code. Almost all of these problems had been in the code for years, despite the fact that the program had been examined many times by both hackers and security auditors. If any of them had discovered the problems, they didn't announce it publicly. In fact, the wu-ftpd has been used as a case study for vulnerability detection techniques that never identified these problems as definite flaws. One tool was able to identify one of the problems as potentially exploitable, but researchers examined the code thoroughly for a couple of days, and came to the conclusion that there was no way that the problem identified by their tool could actually be exploited. Over a year later, they learned that they were wrong, when an expert audit finally did turn up the problem.
In code with any reasonable complexity, it can be very difficult to find bugs. The wu-ftpd is less than 8000 lines of code long, but it was easy for several bugs to remain hidden in that small space over long periods of time.
To compound the problem, even when people know about security holes, they may not get fixed, at least not right away. Even when identified, the security problems in Mailman took many months to fix, because security was not the core development team's most immediate concern. In fact, the team believes one problem still persists in the code, but only in a configuration that we suspect doesn't get used.
An army in my belly
The single most pernicious problem in computer security today is the buffer overflow. While the availability of source code has clearly reduced the number of buffer overflow problems in open source programs, according to several sources, including CERT, buffer overflows still account for at least a quarter of all security advisories, year after year.
Open source proponents sometimes claim that the "many eyeballs" phenomenon prevents Trojan horses from being introduced in open source software. The speed with which the TCP wrappers Trojan was discovered in early 1999 is sometimes cited as supporting evidence. This too can lull the open source movement into a false sense of security, however, since the TCP wrappers Trojan is not a good example of a truly stealthy Trojan horse: the code was glaringly out of place and obviously put there for malicious purposes only. It was as if the original Trojan horse had been wheeled into Troy with a sign attached that said, "I've got an army in my belly!"
...Currently, however, the benefits open source provides in terms of security are vastly overrated, because there isn't as much high-quality auditing as people believe, and because many security problems are much more difficult to find than people realize. Open source programs which appeal to a limited audience are particularly at risk, because of the smaller number of eyeballs looking at the code. But all open source software is vulnerable, and the open source movement can only benefit by paying more attention to security.
That's why in my first paper I raised a heretical question: "Is the global free software/open source movement suffering from a special type of bad advocacy?". For those who read the paper it's clear that my answer is yes. Bad Linux advocacy for me is the name of an Linux-based open source fundamentalism -- the dominant type of bad advocacy that adopts the simplistic and badly thought out arguments in a spirit of an obscure cult (see also Lysenkoism). I’ve often wondered why it’s so difficult to avoid hyperbole when discussing Linux. After all it's just one of several free Unix kernels and technically even not the best one. Actually dramatic overstatement is not confined only to those who are most closely associated with Linux evangelism (sometimes called slashdot crowd), it also spread to those who are developing and implementing Linux. In his DaveNet The Sixth Sense Dave Winer aptly stated (bold italics are mine):
What does open source have in common with Java?
Both are former panaceas. Like object oriented programming in the late 80s, if adopted, they would supposedly lead to magic synergies known only to the promoters, and breathlessly replayed by reporters looking for an easy story to repeat over and over and over.
Java was (and is) Pascal reincarnated. A virtual machine that ran on real machines. Good idea. Been done before. Open source is a tradition that dates back at least thirty years, if not longer. If you learned how to program in the 70s your teacher was quite possibly the source code for Unix (that's how I learned).
Fodder for the hype machine, these "trends" make some people rich, and take the focus off what's really happening, which is still the Web. Then they fade out, to be replaced by the next vaccuous trend, and in the meantime, most developers work hard, outside the spotlight, to make their users happy. (That includes open source developers, btw.)
The thing that's truly offensive about these panaceas is that they are so exclusive and disrespectful of other developers. Until Sun embraced SOAP, the only Sun-endorsed way to communicate with Java apps was to convert your whole program to Java. The Java evangelists would cheerfully and seriously tell you to do this. Same with open source. Unless you shipped all your source on their terms the wall was insurmountable. These are outages of the first order.
When will we learn the lesson, that predates even the Internet, that all outages in software are eventually routed around. Try to control and you lose your place. The time-of-control is shortening all the time. IBM had a 20 year run. DEC was the leader for 10 years. Microsoft, for four, at most. Java had an even more brief run and it was over before Java could actually do anything that anyone wanted to do. If you're a student of technology history, the long-shot bet of being dominant looks worse and worse. Even if you manage to attain dominance, briefly, who wants to be the trend of last year?
Thankfully the open source rage is on its last legs. If you're honest and made a bet on open source, and want to get help from the press and investors, here's some open source (free) advice. Play it down.
Actually open source software can be better than closed source it can be worse, it's just different class of software with its own strengths and weaknesses and to claim that its superior by definition is kind of naive. I think that RMS is right that the main advantage here is freedom, not quality or other real or perceived attributes per se. Actual benefits depend on the personality of developer. Only talented people can produce top quality software be it open or proprietary. And quality documentation about algorithms used is often as important (or more important) as the availability of the source code. I often will prefer more simple and probably not that well written open source program to the closed source one, but I would prefer a closed source program with carefully documented algorithms and clean interface to a large undocumented open source program. For non-trivial programs algorithms are of crucial importance.
I would not go that far as to claim that extremist open source advocacy is a new type of religious fundamentalism although raymondism does share some features with a high demand cult.
Religious fundamentalism is extraordinarily dangerous. Open source fundamentalism, at best, is annoying. It's just an example of what's happening when a movement based on particular principles is repackaged and sold to companies as a new and effective means, i.e. a better way to turn a profit.
It's interesting that RMS is now typically criticized by ESR for being past his time, etc. There's a predictable pattern to many social movements of this sort: they begin with prophetic characters with a radical moral-ethical agenda (RMS), and then gradually become co-opted and assimilated to serve corporations and the market by opportunists like ESR. But in reality FSF approach "free as a principle" approach is close to the idea of "pro bono" and might be the most democratic approach. Yes, there are problems with GPL, and I would prefer BDS-style license in most (but not all) cases, but that's a completely different story.
Society
Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers : Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism : The Iron Law of Oligarchy : Libertarian Philosophy
Quotes
War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda : SE quotes : Language Design and Programming Quotes : Random IT-related quotes : Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce : Bernard Shaw : Mark Twain Quotes
Bulletin:
Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 : Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law
History:
Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds : Larry Wall : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS : Programming Languages History : PL/1 : Simula 67 : C : History of GCC development : Scripting Languages : Perl history : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history
Classic books:
The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month : How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite
Most popular humor pages:
Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor
The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D
Copyright © 1996-2021 by Softpanorama Society. www.softpanorama.org was initially created as a service to the (now defunct) UN Sustainable Development Networking Programme (SDNP) without any remuneration. This document is an industrial compilation designed and created exclusively for educational use and is distributed under the Softpanorama Content License. Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine.
FAIR USE NOTICE This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available to advance understanding of computer science, IT technology, economic, scientific, and social issues. We believe this constitutes a 'fair use' of any such copyrighted material as provided by section 107 of the US Copyright Law according to which such material can be distributed without profit exclusively for research and educational purposes.
This is a Spartan WHYFF (We Help You For Free) site written by people for whom English is not a native language. Grammar and spelling errors should be expected. The site contain some broken links as it develops like a living tree...
|
|
You can use PayPal to to buy a cup of coffee for authors of this site |
Disclaimer:
The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.
