Responses from around the Linux Community

Here are some responses from around the Linux community on the recent Novell deal with Microsoft.
Eben Moglen thinks the deal may actually violate the GPL:
It's possible that Thursday's deal between Microsoft and Novell could conflict with a provision in the General Public License (GPL), according to Eben Moglen, the attorney for the Free Software Foundation that created and oversees the Linux license.
“If you make an agreement which requires you to pay a royalty to anybody for the right to distribute GPL software, you may not distribute it under the GPL,” Moglen told CNET News.com Thursday. Section 7 of the GPL “requires that you have, and pass along to everybody, the right to distribute software freely and without additional permission.”
Whether the partnership precludes Novell from distributing Linux depends on precise terms of the agreement that Moglen hasn't seen, he cautioned. But he found other aspects of the deal troubling, too.
Microsoft's pledge not to sue unpaid programmers is “no comfort at all,” given the quantity of paid open-source programmers.

If the deal will have a material impact on Novell earnings (and I'd guess it does), there will have to be a filing on this in the coming weeks, so Eben and others may get the information they need to make an informed decision on this potential GPL violation. If the deal does indeed violate the GPL, I'm not sure how Novell will proceed.
Bruce Perens seems to have similar concerns:
One of the questions yet to be settled is whether Novell will violate the GPL, the license of the Linux kernel and other important software, by offering patent protection that is exclusive to Novell customers. The press release pretty much stated that. On that topic, the preamble of the GPL says it best:
We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all.
Novell has clearly accepted that license. But it appears that they are now out to make patent protection a business differentiator.

also from Perens:
“This is actually really bad news,” said Bruce Perens, a well-known Linux advocate. “It sets up Microsoft to assert its patents against all commercial open-source users. The deal is going to be, ‘You have to buy Microsoft-licensed Linux distribution from Novell or there is an implicit threat that Microsoft will assert their patents against you.”
It should be noted that Microsoft has opened this offer up to other Linux distributors, but to me that's of little solace. I'd not expect to see Red Hat sign a similar deal with Microsoft in the near future. Other community members seem less worried. From Linus:
I prefer to be an optimist, and will happily take the option that not everybody needs to be enemies,” said Linus Torvalds, the creator of the Linux kernel, in an e-mail message. “Let’s see how it all pans out.”
Greg KH, a Novell employee, thinks the media hype is much ado about nothing:
I don't really think this is a big deal at all for the Linux kernel community and code. We are no worse off than we were last week before this announcement, and we actually might be a bit better off now, depending on the actual wording of the agreement (which again, I have not read.)
I've still not formed a final opinion and am reading everything I can get my hands on. I couldn't, however, agree more with John Terpstra:
Instead of judging the book by its cover, we should sit back to weigh the facts, discuss this announcement in rational debate and then formulate a well-thought-out and united response.
That is spot on! The one bit of information that I did miss in my previous post is this bit:
Microsoft will make a one-time upfront payment to Novell for the cross licensing deal. Novell will pay a fee for each SuSE support contract that it sells.
Whoa! A fee for each SuSE support contract that it sells?!? That seems like a really bad precedent and certainly something that could lay the groundwork for future Microsoft litigation. Novell has now inextricably tied itself to Microsoft. I wonder if 5 years from now they'll look back on this deal fondly. Writing a monthly check to Microsoft isn't something I'd want to do if I were a Linux company.
–jeremy
, , , , , , ,

Novell and Microsoft Collaborate

As if the recent Oracle Red Hat talk wasn't interesting enough, Novell today announced that they will be collaborating with Microsoft. While some people seem to think this may have been a reaction to the Oracle announcement, I can't see any way this was thrown together that fast. I'd guess talks on this were ongoing even as the Oracle rumors were starting. The open letter is missing financial details as you may have guessed, but it does include some brief information on the 3 deals that were part of this arrangement. From the FAQ:
Q. What are you announcing?
Novell and Microsoft are announcing an historic bridging of the divide between open source and proprietary software. They have signed three related agreements which, taken together, will greatly enhance interoperability between Linux and Windows and give customers greater flexibility in their IT environments. Under a technical cooperation agreement, Novell and Microsoft will work together in three primary areas to deliver new solutions to customers: virtualization, web services management and document format compatibility. Under a patent cooperation agreement, Microsoft and Novell provide patent coverage for each others customers, giving customers peace of mind regarding patent issues. Finally, under a business cooperation agreement, Novell and Microsoft are committing to dedicate marketing and sales resources to promote joint solutions.

The agreement would seem to be a tacit acknowledgment by Microsoft that Linux is the real deal, has changed the rules of the game and is here to stay. As to what was actually gained by both sides. For Novell they are getting some increased exposure, which they desperately need right now. They are getting a resale deal for SLES (Microsoft will distribute as part of a resale arrangement approximately 70,000 coupons for SUSE Linux Enterprise Server maintenance and support per year) along with the recommendation of SLES by Microsoft if you are interested in running Linux in a Windows environment (For customers who have a significant Windows investment and want to add Linux to their IT infrastructure, Microsoft will recommend SUSE Linux Enterprise for Windows-Linux solutions). Additionally, their customers get patent protection for Samba, Mono and OpenOffice. Microsoft gets increased exposure for .NET through Mono, which should serve to help them compete better with Java in the enterprise space, and broader acceptance of the OpenXML document format, which could help them keep some of the Government contracts they may lose if OpenXML isn't broadly accepted. The companies will be working together on Virtualization, which looks to be a huge market going forward and have also built a “Collaboration Framework” which will allow them to work together more easily moving forward.
Shares of NOVL spiked almost 15% on the news, but are down about 1% in after hours trading. RHAT dropped about 2% on the news, with an additional 3% dip in after hours. The news had almost zero impact on MSFT. It should be interesting to see how both Red Hat and Sun react to this in the coming days. It will also be interesting to see how the Open Source community reacts to the news over the next 48 hours. It's a group that can be fickle at times and certainly one that isn't overly trusting of Microsoft. It's something I'll keep you updated on.
–jeremy
, , , , , , , , ,

Why Has Microsoft Abandoned the Power User?

That's the questions posed by Preston Gralla in this editorial. From the post:
The upcoming final releases of Windows Vista and Internet Explorer 7 make one thing exceedingly clear: Microsoft has abandoned the power user, allowing fewer and fewer customizations and tweaks. By doing this, they’re leaving behind a very loyal audience.
Internally, Microsoft has created a mythical typical user it calls “Abby” who knows very little about computers. It now targets the operating system and browser at this imaginary Abby, potentially leaving the rest of us out in the cold.

I've not seen Vista, but after recently using IE7, I can say it's clear that they are trying to dumb things down a bit. Microsoft is in a tough spot in this regard. On the one hand, power users are in the vast minority… but it's a vocal and influential minority. Losing the power user is something I don't think Microsoft can afford to do at this point. They may have lost sight of that. Tim brings up an interesting point too. Has Microsoft thrown in the towel, and admitted that the PC is now furniture, and that the frontier of innovation has moved on? If so, that does bode extremely well for the “web as a platform” meme. I think people will always want some measure of control though, especially the power users. There's an innate desire to tinker in some people, and that's not going away any time soon. Linux maintains the “make easy things easy, and hard things possible” way of thinking and hopefully always will. I wonder how long it will take for the Windows power users to take notice.
–jeremy
, , , , ,

IE7 Final Released

About 18 months after it was announced, IE7 is now available for download. It looks like it will be rolled out via automatic update “real soon now”. I wasn't going to blog about this, but changed my mind for a couple reasons. First, it impacts LQ. While for October 58% of all LQ visitors are using Firefox, there are still 28% using IE (on a somewhat surprising note, almost 10% of IE users are already at 7 as of yesterday). That means I have to test the site in IE7. Second, I think this is a shining example of why the Microsoft monopoly is bad. The last real release of IE was in 2001. If it weren't for the spectacular success of Firefox, I have no doubt that IE7 would still be years off. Think of how much the web has changed since 2001 and it's nothing short of astonishing that no real updates have been released in that time frame. If you do any kind of design for a high traffic site, you're well aware that the lack of a release isn't because everything works perfectly. To be honest, we gave up on IE-only fixes a while ago at LQ. We do make sure everything *works*, but some things look odd in IE (and only IE).
So far, the anecdotal reports I'm seeing don't instill a whole lot of confidence. I decided to fire up VMWare and install IE7, both to test LQ and to just check it out in general. The install is a bit odd. The first thing it did was download “updates” (how many updates can there be for a product released less than 24 hours ago). Then, it just sort of hung. No real progress bar or status indicator. Since I don't use Windows for actual work I just let it sit there. It did eventually indicate the install was successful about 15 minutes later, but if that was my main workstation I don't know if I would have waited that long. One reboot later, the install was done. I have to admit I only tested things for about 15 minutes, but the biggest two letdowns are that the oddities in the rendering of LQ are still there and the interface is absolutely horrific. It's possibly the hardest to use app I've seen out of Redmond. It may be that I just need to get used to the UI and then it will be great, but luckily for me I don't need to find out. On the up side, the rendering engine is definitely faster than IE 6 and the handling of RSS feeds is much improved. It should be interesting to watch as IE7 gets rolled out en masse over the next few weeks. Will it be a smooth transition or will the Internet be filled with complaints over broken and semi-functional web sites. As the web becomes more and more critical to peoples lives and businesses, this kind of things matters more and more. On that note, Firefox 2 is in late release candidate shape and should be ready for release very soon.
–jeremy
, , , , , ,

McAfee, Symantec Think Vista Unfair: Update

A follow up to this post. It looks like Microsoft has done an about-face, and will allow kernel level access in Vista. From the article:
Microsoft Now Decides to Accept Outside Security for Vista
Until now, Microsoft had planned to block those companies from installing their products in the deepest levels of the new operating system, which is scheduled for release early next year.
Microsoft's shift means that users would continue to have a choice in the programs they use to protect their computers and not be tied to something that Microsoft offers.

I'd guess that Microsoft was just testing the water here, seeing what they could get away with. While the advertisement of their security and anti-virus products at system boot seems way over the top, denying kernel level access is much more reasonable (once again, as long as all of their products also play by those same rules). What is Symantec and McAfee going to do if Microsoft is ever able to create an OS that is reasonably secure? Why is it that some anti-virus vendors had absolutely no problem with this? In the end, Microsoft probably lost two close allies and business partners here, but in the short term neither McAfee or Symantec can do much damage to Microsoft. In the long run though, the gradual erosion of application vendors will be a devastating loss for Microsoft. One of the real and legitimate knocks on Linux is the lack of application support. As Microsoft slowly assails on nearly every business parter (and even channel partner) it has, more and more vendors will be looking to move to an alternative stack. Linux is ready and waiting.
–jeremy
, , , , ,

The Microsoft Exec Exodus Continues

A continuation of the trend I've covered before, the Microsoft exec exodus just keeps rolling on. The latest two casualties are Rick Devenuti, chief of Microsoft's fledgling managed services operation and Jurgen Gallmann, CEO of Microsoft Deutschland. Once again the hits are fairly severe. Microsoft Deutschland is one of the companies largest subsidiaries. A couple quotes from the articles:
Devenuti, senior vieep of services and IT, leaves at the end of year after 19 years at the company. He will spend more time with his family and “consider his next challenge,” Microsoft said. A successor will be announced during the next month.
Devenuti joins a growing list of executives headed for the exit door at Redmond. Among them are 16-year Microsoft veteran and Windows chief Jim Allchin, due to leave in 2007 once Windows Vista finally ships; and Brian Valentine, vice president for Microsoft's core operating system division. He has already left for Amazon having been reshuffled out of his post after 19 years with Microsoft.

and
The head of Microsoft's German subsidiary has quit over differences with the US headquarters.
Jurgen Gallmann, CEO of Microsoft Deutschland – one of the software giant's largest subsidiaries – resigned on Friday. In an email he sent to employees, the executive complained of Redmond imposing increasing restrictions on the German operations and showing little interest in local requirements.
Microsoft has said only that Gallmann had asked to be released from his contract due to differences in views about the future strategy of Microsoft Germany.

The managed services move by Microsoft was one that was met with a lot of resistance for obvious reasons. It's one of the more disparate moves Microsoft has made recently IMHO (previously blogged about here. Competing with its channel, especially for the coveted huge projects, is a move that will inevitably drive consultants and VARs to offer non-Microsoft products. While that department is quite new, notice that Devenuti had been with Microsoft for almost 20 years. That's a trend you see with many of the recent departures. While Gallmann was only a five year Microsoftie, he held a fairly high position. For him to leave in such a public way and in the way he did surely points to trouble in the EU markets. The changing of the guard continues at Microsoft and I think it will go on for a good time longer. I'd say we'll know it's coming to an end when Ballmer steps down. What Microsoft will look like at that point is anyones guess.
–jeremy
, , ,

Microsoft Shown Involved with Baystar and SCO

Amazing how long we go between SCO stories these days, isn't it? From the Groklaw article:
On page 21 in IBM's Amended Redacted Memorandum in Support of its Motion for Summary Judgment on SCO's Interference Claims (SCO's Seventh, Eighth and Ninth Causes of Action [PDF], IBM reveals that SCO alleged that it was IBM that got BayStar to threaten litigation against SCO and to terminate its business relationship. BayStar denies it, as does IBM. If you noticed a Declaration by Larry Goldfarb on the list of exhibits [PDF], this is what it's about. He provided a declaration for IBM stating that SCO's allegations aren't true. A lot of folks have done so too, and so IBM is now asking the court to toss out these three SCO claims.
BayStar, Goldfarb testifies, dumped SCO because its stock price, financial performance and the viability of its UNIX products all appeared to be in decline, and he “was also very concerned about SCO's high cash burn rate.” Pure financial animals get nervous when that happens. But the kicker was he began to realize that Microsoft, whose senior VP of corporate development and strategy had promised that Microsoft would in some way guarantee the SCO investment, started showing signs it might not do that after all:
“Mr. Emerson and I discussed a variety of investment structures wherein Microsoft would 'backstop,' or guarantee in some way, BayStar's investment…. Microsoft assured me that it would in some way guarantee BayStar's investment in SCO.” After the investment was made, Goldfarb says, “Microsoft stopped returning my phone calls and emails, and to the best of my knowledge, Mr. Emerson was fired from Microsoft.”

While various previous leaks implicated Microsoft in the funding of the SCO charade, nothing as concrete as this had been released to my knowledge. The ironic part here, is that in the end, it appears this case may have helped both Linux and Open Source. It has given credence to the GPL, spread the word about Linux in places it may not have gotten exposure and it's made IBM and Linux a well-known, well-regarded combo. Even worse for Microsoft, I'd guess that IBM (and potentially Novell) will probably go after them now. As a monopoly who has already gone through litigation with the DOJ, this would be bad for them. Potentially very bad. In a year that is likely going to see Vista delayed one last time, this is certainly a headache they don't need. This may get more interesting than I'd have thought.
–jeremy
, , , , , ,

Microsoft on warding off the Linux threat

Wow. The hubris in this ZDNet interview is astounding. While some people at Microsoft are certainly adapting to a shifting business landscape, Nick McGrath, Microsoft's head of platform strategy in the UK, is a shining example of what is wrong with the Microsoft corporate culture. Reading the interviews it becomes clear that factual information and reality are of no concern. At times, you almost expect him to say something along the lines of “nah nah nah, I can't hear you”. Items like:
Q. Presumably you accept that there is more Linux in businesses than a few years ago?
A. No, I don't accept that at all.

show that either he is purposely being deceitful, or he's painful unaware of reality. Neither are good for a “head of platform strategy” IMHO. This interview is something I would have expected a couple years ago, but not today. Whether you like Linux or not, it should be obvious that there is more of it in businesses than a few years ago. Even if it's a small amount when compared to what Microsoft sells, it's still more on a comparative level with itself over time (especially where times is measured in a duration of a few years). It's clear that some people still think Microsoft is invincible, despite thousands of years of human history that categorically tell us that nothing of human origin is invincible. From the greatest of dynasties to the mightiest of companies, every one has a downfall eventually. Putting your head in the sand and denying that will only bring about your demise faster.
–jeremy
, , ,

The Truth About a Claimed Firefox Exploit

I'm sure most of you heard about the recent Firefox security issue. The one claiming Firefox is “critically flawed in the way it handles JavaScript” and that over 30 unreleased vulnerabilities exist. It turns out, the whole thing was a hoax. That's right, a ruse. From the Mozilla Developer Center:
We got a chance to talk to Mischa Spiegelmock, the Toorcon speaker that reported the potential javascript security issue referenced earlier. He gave us more code to work with and also made this statement and agreed to let me post it here:
The main purpose of our talk was to be humorous.
As part of our talk we mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution. However, the code we presented did not in fact do this, and I personally have not gotten it to result in code execution, nor do I know of anyone who has.
I have not succeeded in making this code do anything more than cause a crash and eat up system resources, and I certainly haven’t used it to take over anyone else’s computer and execute arbitrary code.
I do not have 30 undisclosed Firefox vulnerabilities, nor did I ever make this claim. I have no undisclosed Firefox vulnerabilities. The person who was speaking with me made this claim, and I honestly have no idea if he has them or not.
I apologize to everyone involved, and I hope I have made everything as clear as possible.

Somehow I don't think Window is laughing. While it's great to see that most of the info was fictitious (there is a legitimate flaw that can be used to crash the browser), in reality tangible damage has been done to the reputation of Firefox. Of course, now the rumors are swirling. Of the two people on stage at the time, one works at Six Apart (which owns LiveJournal) and the other recently claimed responsibility for a fairly high-profile Javascript attack against close to a million LiveJournal users. In addition, there's even a picture of him floating around eating with a bunch of Microsofties. As you can guess, the conspiracy theorists are having a field day. No word on what the fallout of this will be yet, but I'd guess there will be some. As for the real security track record of Firefox, well that's still being decided. My guess (as you may have presumed) is that while it will have problems, they won't be as consistently unpatched as IE ones have been.
–jeremy
, , , ,

McAfee, Symantec Think Vista Unfair

It seems that both McAfee and Symantec are unhappy with some of the new security features in Vista. McAfee has gone as far as taking out a full page ad in the Financial Times. The issue at hand is PatchGuard, which Microsoft describes as a facility that protects the operating system kernel against being patched or rewritten by an outside, unauthorized source. From the article:
McAfee, Symantec and other security software companies argue Microsoft's new Vista operating system will make it more difficult to protect customers because for the first time, they have been denied access to the core of the operating system.
Neither company has filed a formal complaint and so far the European Commission has taken no formal action on the matter.

It should be noted that Sophos has specifically said they don't have a problem with PatchGuard, and Trend Micro already has a Vista beta product available. Symantec seems to assert that these companies must have had some unfair access to information. A couple comments here. First, McAfee and Symantec (indeed all Windows based anti-virus companies) had to see this coming. They had a sort of symbiotic relationship with Microsoft, at best. As Microsoft attempts to both secure the OS and move in on the money made by the various enterprise security suites, the other vendors were bound to lose market share. While Microsoft and Windows enabled McAfee and Symantec to become the huge companies they are, Microsoft has a sordid history of pummeling business partners when the time is right. The following quote comes to mind: “It's a funny thing being taken under the wing of a dragon: it's warmer than you think.” The lesson here should be that when you only offer products for a closed platform that you don't have any control over, you are 100% beholden to the company who makes that platform. Second, one question I haven't seen answered is whether the Microsoft security suite, Defender, will have access to things that competitors products won't. You'd think Microsoft would be smarter than that, given past history, but who knows. If the answer to that question is yes, that to me is 100% monopoly abuse. Lastly, I'll admit to not having used McAfee or Symantec products too much in the recent past, but my experiences along with what I read in various places leads me to believe that most of the newer products are universally regarded as bloated garbage. While harsh, the companies may want to look back at their products and focus on what's important which is providing a service that your customers want. Is this move by Microsoft really preventing that? I remember Symantec fondly from the days of Norton utilities. Most times I see comments about the newer products today are either in regard to them blowing up badly or not uninstalling properly. That's the problem I'd want to focus on.
–jeremy
, , , , , , ,