Late as usual (but starting to catch up), I listened to Novell Open Audio‘s Ted Haeger interviews Nat Friedman, formerly co-founder of Ximian (The GNOME desktop company – bought by Novell and hence the link does a funny redirect) and currently Novell’s VP of engineering for Linux desktop (or something).
The interview was mostly interesting and except for a higher then average number of self back-patting and cheap shots at the competitors, I rather enjoyed it. Until it came to the Q&A part in which Mr. Friedman was asked to field some “touch questions” from the local crowd (the interview was done on the LinuxWorld Expo floor) – at which he fouled up big time:
“I think we also have a better security story then windows, because we have fewer users then windows, and so there’s no viruses or worms … for Linux yet. That would change in the future, [and] we’ve got to be ready for that, but I think in the mean time … the security story is undeniably many many orders of magnitude better on Linux today.”
Which is utter bullshit!. Except being FUD, misrepresentation of the facts its just plain wrong, and any technically inclined person with some amount of experience with Linux – let along the VP of engineering in one of the worlds largest Linux companies – should know that. The reason that there are no viruses or worms for Linux “yet” is not that there are fewer users then windows – its not even correct to say that there aren’t any viruses or worms for Linux because there are several – they are just never found “in the wild”. Under the same token you could say that as Mac OS-X has more users then Linux there should be more viruses for Mac (which there aren’t), or better yet: as there are many many more users of the Apache web server then Microsoft’s Internet Information Server (IIS), there should be many more worms that target the Apache web server – which there aren’t at all!
The reason there are no viruses or worms for Linux (in the wild), is that Linux has a much better “security story” due to a much better separation of user interactions and system applications – one cannot, under any circumstances, change, damage, remove or modify the other – so even if you had the misfortune to download an infected binary (like some Korean Mozilla installers), unless you are both stupid enough and technically savvy enough to run it as root, at most a virus can do is infect its own carrier – it can’t touch any system applications, and thus can’t infect other users.
But Mr. Friedman is not done yet with misrepresentation of facts: answering another question on why Novell chose to develop XGL, to support 3D desktop effects on Linux, instead of working with the AIGLX project (which was recently – later then this interview – was merged back to the main X.org server), he correctly noted that XGL was actually developed some time before AIGLX was thought of (and AIGLX was actually started because of XGL), but he then has these things to say about XGL vs. AIGLX (my comments after each quote):
“AIGLX will only work if you have open source drivers or if you get the various proprietary driver authors to do some fairly significant modifications to the drivers which ATI and Nvidia have not indicated a willingness to do.”
Nvidia have shown a willingness to support the required driver extensions, and indeed their latest beta drivers have the required features. The features that AIGLX requires are only some of the features that are made available by proprietary drivers in MS-Windows and currently aren’t in drivers from the same manufacturers for Linux – so it would generally be a good idea if video chipsets vendors would get a swift kick in the butt and start upgrading their Linux driver offers. And if that also fuels development of better open source drivers for these cards – even better. And ATI suck.
“Plus XGL is probably a much long term architecture for graphics, because we are able to really accelerate all the drawing primitives, because we basically run a GL backend for the X server, where as AIGLX are basically saying ‘lets take the existing driver model and extend its life time for as long as we can’, so you’re going to be hobbling along on crutches for another 10 years using the existing driver model basically”.
Describing XGL as a long term architecture is probably the saddest joke I’ve ever heard. XGL is a hack over a kludge – its nothing even closely resembling an OpenGL backend for the X server. XGL is an X server implemented as an X client running on top of another X server (which uses the same driver model, with the same problems and not even modifications to bring it up to date in terms of OpenGL calls available). The XGL client grabs an OpenGL context from the underlying server and uses that to render its own clients to the entire screen of the real backend server. XGL is more of a middle-frontend then a backend. As a result of that, XGL has a lot of problems – most notably is that OpenGL performance of applications is really poor as the nested XGL hogs the OpenGL resources. The long term architecture for XGL is the XEGL server which will require a major driver rewrite (much more then what AIGLX requires) and is currently not even in active development.
AIGLX on the other hand is a much saner architecture, allowing 3D applications with proper acceleration and even remote OpenGL applications to run on another computer and display to the local screen. It doesn’t use a kludgy double server method (which even XEGL would require) and is available now. It has been integrated into the X.org X server distribution (and even though it was done only recently – anyone who keeps track of these things could have guessed that this is where AIGLX is going) which makes it defacto the current standard and when the driver model changes (again – as it has done every few years) to kdrive or glucose, AIGLX will be there for the ride.
Nat Friedman then goes on to comment that he wants XGL to do dual screen and that he thinks it will be very hard to do with AIGLX – which again proves that he has no clue as to what he’s talking about: due to the hackish way XGL is layered, it can still not be made to run on dual screen (except under very specific circumstances and with a specific ATI model) while AIGLX can run wherever Xinerama does with no changes whatsoever.
Anyway – done ranting for now.