Open Source in the NT World

Open source could strengthen Windows 2000 and NT

All the publicity that Linux has enjoyed recently has brought the term open source into the technical public's eye. Open source really isn't a new idea—in fact, it's one of the oldest ideas in computing. But now that the industry is reexamining the notion, let's look at whether open source, or at least a modified version of it, could make sense in the Windows NT world.

The open-source folks argue that simply shipping a software program's binaries (the .exe files) and keeping the source code secret is a bad idea from the consumer's and even the vendor's point of view. If you purchase a program and find a bug in it, all that you can do is report the bug to the software vendor and hope that the vendor will fix the bug in a future release. But if you have the source, you can fix the bug yourself (or, more likely, hire a programmer to fix it) so that you don't need to wait for the vendor's fix. Really ambitious customers who need a new feature in the software could add that feature rather than simply hope that the vendor would recognize the need and implement the feature sometime in the future. Even software vendors win, because they get the benefit of all of those customer-developed fixes. When vendors find customer-provided fixes that are good, vendors can release the improved product to other customers.

Of course, open source has some obvious disadvantages. Microsoft spent millions and possibly billions of dollars developing Windows 2000 (Win2K). So, the company would naturally be leery about revealing the Win2K source code for fear that others might simply reuse—steal—pieces of it from the product without offering Microsoft compensation for its efforts. That's certainly a risk, and I don't want to minimize it. But keeping the source closed might limit Win2K and NT's eventual potential market.

Keeping the source closed does make some sense when the source protects some original high-tech ideas that the competition hasn't previously offered or even thought of. But, although Win2K certainly has a lot of increased functionality compared with its predecessor NT, very few ideas in Win2K are really new. Active Directory (AD) is Microsoft's response to Banyan's, Novell's, and UNIX's use of big user directories. Many of Win2K's support tools are nice but, again, not new: Offline Files looks a lot like Sun Microsystems' Cache FS cache file system, Remote Installation Services (RIS) is a tool similar to Norton Ghost, and disk space quotas have existed on just about every network OS except NT for years. I'm not criticizing what Microsoft is doing with Win2K; I'm simply saying that Microsoft's main task in building Win2K seems to have been to incorporate other firms' ideas and technology into NT—in other words, to provide better service to customers by giving them what they want.

Now imagine a time in the not-too-distant future—if we're not there already—when every major network OS vendor has implemented most of the good networking ideas. How will customers decide between products then? On the basis of quality of service, I'd guess. A version of NT accompanied by the source code would let customers either buy support from Microsoft or simply fix the code themselves.

In that possible future in which service options and service quality drive OS choice, OSs with openly available source code would naturally end up with more (and probably better) support options than a competing closed-source product would. And that better support would likely lead to a larger market share for the open-source OS.

Sound like a crazy idea? Here's another one. Revealing the Win2K source code at this point in the product's life cycle would clearly be a risky venture for Microsoft. But now that Win2K is replacing NT 4.0, why not continue to sell NT 4.0 as an open-source product? Microsoft could simply stop working on NT 4.0 but continue to distribute the OS with customer-created fixes and enhancements. This approach would be a low-risk way to experiment with open source in the NT world.

End of Article

Releasing source code clearly gives the bad guys another avenue for finding weaknesses. However, many security gurus dismiss that argument because, as we've seen, if code has holes, people will figure out those holes even in a closed-source world. Opening source exposes the code to everyone, so the white hats--as well as the black hats--can see the problems. 
Security experts tell me that the key to effective security on the silicon side is good security mechanisms and sufficiently long keys. (They also tell me that most security problems originate in the carbon units--people being sloppy with passwords, for example.) Relying on the hope that no one will discover a system's bugs is a bad idea. In an open-source world, the good guys can find weaknesses and release fixes as quickly as the bad guys can find weaknesses and exploit them. In an open-source world, I don't get black-box .exe files; I get source code that I can examine to be sure that it doesn't contain any Trojan horses. I believe open source is the way the world will go eventually (and the way it's already been for UNIX, MVS, and VMS). 
-Mark Minasi

Mark Minasi August 10, 2000

As I read Mark Minasi's En Garde: "Open Source in the NT World" (Summer 2000), the following thoughts came to mind. Windows NT is already vulnerable to and the subject of many security threats and hacks. Releasing the NT 4.0 source code would present an open invitation to intruders to find and exploit holes that are not already known. I believe that Microsoft is scared to release the code as much for security concerns as for the loss of revenue. What are your thoughts about potential security issues for the installed base of NT 4.0 if Microsoft were to release the source code for NT 4.0?

Eric Cutler August 10, 2000

I found the article interesting, and a further indicatio of the shrinking world in IT. Concepts from one established market being (proposed) for other markets. However if I were Bill Gates, would I not think that opening up the source code had the potential to 'kill' or at least severely injure my future potential market. Unix, VMs etc can all be taken to be 'professional' products in the sense that they are not normally found in other than controlled environments. Microsoft Windows products (3.1 - 98 & NT) are ostensibly to be found more in the less professional market. The implication surely is that with open source code the potential exists for the 'amateur' with plenty of spare time to develop and extend the original product to the point where he dosen't need to buy Win 2001/09/10 etc because he can keep upgradeing the features in Win 98 (or wahatever). It therefore requires a quantum leap in code to encourage this, probably large slice of the market, to ever buy a new product. I realise that this is an extremely simplistic view, and that the actual percentage of market that might take this road, evem if it were comletely viable, is a complete unknown. But again if I were Bill Gates, whose marketing expertise has led to a lucrative up grade market, why would I take the chance at lost revenue?

Paul Bird October 26, 2000

Sure. Take PHP vs. ASP, for example: security fixes in PHP are available within an hour after the moment a bug was found in PHP in most cases. You cannot say the same about ASP. If they're quick hacks, they're marked as that. (Last major problem found in PHP was plugged with such a hack in 4 [four] minutes.) In the closed source world, you get an upgrade some time, and then maybe another one because of 'bug found in the original fix'.

Roman Neuhauser@mail.cz October 27, 2000

You must log on before posting a comment.

If you don't have a username & password, please register now.