Open-source thrives in sunshine

Michael Tiemann's career has grown along with the open-source software movement. In the late 1980s he wrote GCC, the first native-code C++ compiler and debugger, for the Free Software Foundation.In 1989, Tiemann co-founded Cygnus Solutions of Sunnyvale, Calif., one of the first companies offering commercial support for open-source software. During the following decade, his jobs ranged from company president to hacker and code tester.Today, as chief technical officer of Red Hat Inc., Tiemann helps formulate and communicate technical strategy for the Raleigh, N.C., distributor of the open-source Linux operating system and related software. Red Hat acquired Cygnus Solutions in 1999.Tiemann serves on the boards of the Open Source Initiative, Embedded Linux Consortium, Gnome Foundation, Jabber Technical Advisory Board and ActiveState Tool Corp. of Vancouver, British Columbia.Tiemann received a bachelor's degree from the University of Pennsylvania's Moore School of Electrical Engineering.GCN associate editor Patricia Daukantas interviewed Tiemann at GCN's Washington office. TIEMANN: Analysts have confirmed that Unix-to-Linux migration is under way. There's a drive to higher performance'five to 10 times as much'by moving from proprietary RISC to standard Intel Corp. processors with the same cost.In today's tough IT climate, people don't want to lose the sustainability, reliability and scalability they've built into their enterprise architectures with Unix.TIEMANN: We are taking the bold step of opening for debate the security infrastructure that we propose. Anyone who makes a positive claim about security becomes a target. In fact, from scanning our network weblogs and other forensic information to evaluate the level of security threats, we know we are a high-value target. Every day people try to crack our site.I live in a state with a billion-dollar shortfall. Everyone is trying to do more with less. If we have customers able to cut 80 percent of their enterprise IT spending while enhancing services and reducing trouble tickets, that's got to be interesting to federal and state agencies.TIEMANN: It's multidimensional. It starts with the question: Given an open-source model, what is possible in terms of a security implementation?In science, it's not the conventional wisdom or new idea that holds sway. It's scientists' ability to reproduce results, share and independently infer what's happening.Sometimes I wonder how we can consider computer software a science if software is not published for peer review or independent confirmation. Computer software is exposed to so little scientific skepticism that it's no wonder we see the resulting low quality. It's secret; it's magic.We're taking a different approach, and that is publication, disclosure and scrutiny. We expect that we and others who follow this model will reap rewards in a fundamentally superior commercial model.TIEMANN: Look at the business model of a law firm. The Constitution and all the laws that flow from it are freely available for anyone to use. It's not necessary to license Brown v. Board of Education.People who need to use a law typically find a law firm with expertise in a particular subject. They don't question the firm's business model. They might question the judge's decisions, but not the business model.Open-source software is free for anyone to adapt and use.TIEMANN: We're involved both generally and specifically. Two years ago, leaders of four or five open-source security projects approached Linus Torvalds, the grand poobah of Linux source code, and asked him to choose implementations to become standard for the Linux operating system. He said none of the options was adequate. It was impossible for him to implement one system using another one's results. They were forcing a kind of mutual exclusivity that is antithetical to the open-source model.In August 2002, those developers presented him with the Linux Security Module, which has a complete set of interfaces for any of the individual security systems. Linus approved that.Today, none of those systems uses the LSM. But it shows that the open-source model is not so much about picking winners as allowing the winner to evolve on the playing field. Whichever implementation ultimately proves to be the most commercially accepted or successful within federal departments, no implementation is going to be excluded by the Linux platform itself.In this model, one common kernel could support any security model. You don't have to change your underlying kernel to implement your new security layer. It puts a lot of control back into IT hands'a set of options today and a choice to change in the future.TIEMANN: We don't know how large the National Security Agency budget is, but it is finite. The funding of projects such as SE Linux is some fraction of that finite budget.The beauty of the open-source model is that people all over the world contribute to the advancement of SE Linux. The government provides some level of seed money, and the rest of the world can get on that train. That's what we saw with TCP/IP, the Web and the Apache Web server.When source code is sufficiently available, it opens up an almost unimaginable potential for innovation. Look at the multiple billions that people have estimated have gone into Linux to date'no single company could have marshaled such resources. Yet the fact that people can contribute to it'a dollar at a time or a billion dollars at a time'dramatically opens the innovation space.TIEMANN: The idea that the secretness of proprietary code somehow protects it from abuse is manifestly incorrect. If obscurity were so great, then we would see a lot more stability in proprietary platforms. Whatever the challenges to the open-source model, we cannot forget that right now it's not the one that's being hacked.A nefarious person who wanted to crack the code to get it into a mainstream Red Hat Linux distribution would have to bamboozle an unknowably large community. Nobody knows how many eyeballs are looking at Linux code. Cracking it would be a much greater challenge than just cracking one company's code.TIEMANN: There are still some world leaders who are profoundly upset at the viral nature of democracy and free enterprise.Should governments that endorse democracy endorse it all the way out to the level of technology? Should we require that file formats and public records and public information be implemented in such a fashion that citizens can get access by paying no greater royalty than what they would have paid in 1789 to read the Constitution?Given the failure of certain companies to deliver on their promises of reliability and security time after time, should governments continue to support their systems because of a large installed base? Or should they move to a procurement policy that dramatically opens the avenue of commercial support?Today, many vendors are quite literally sole-source suppliers of information technology. People in the public sector have begun to understand that the current sole-source model is working against them'not just in pricing, but also in quality. There's insufficient competition.The GPL guarantees that any distribution of GPL software will be made available with the original freedoms. Vendors must compete on service and quality.