Brian Krebs Moves

One of the “Useful Links” in the right-hand column here since I started Random Walks has been for Brian Krebs’s “Security Fix” blog at the Washington Post.  I have always liked his work, and think he does a very good job of explaining security issues that affect normal users, in terms that those users  can actually understand.

In an announcement posted on Christmas Eve, Brian said that he is leaaving the Post and striking out on his own.  He has a new blog, “Krebs on Security”, which I am adding to the “Useful Links” list.  I’m sure he will continue to offer sound and practical advice, and I wish him all the best with his new gig.

IBM to Offer eyeOS

There has been a lot of conversation in the last few months, both here and elsewhere, about the future of cloud computing, a computing model in which data and applications reside on servers accessed via a Web browser over the Internet.  Google, of course, has introduced its Chrome OS project, which aims to produce a specialized Linux operating system for cloud clients.  Now, according to an article in Technology Review, IBM is going to be distributing another cloud-focused Linux derivative, called eyeOS, for use on its high-end mainframe servers.  The eyeOS system is similar in many ways to Google’s Chrome OS, but it has a few differences that suggest that it is aimed at a somewhat different set of potential customers.

Let’s start with the similarities. Both Chrome OS and eyeOS are based on Linux, and on open-source projects.  Google is packaging Chrome OS itself as a specific derivative of the Chromium project, while eyeOS is itself open-source, and distributed under a version of the Free Software Foundation’s Affero General Public License, version 3.  (A small company in Barcelona, Spain provides technical support, consulting, and customizations of eyeOS.)   More visibly, for both systems, the Web browser is the user interface.  Google’s Chrome OS includes, naturally enough, a version of Google’s Chrome browser; eyeOS users can, in principle, use any browser that runs on their client platform.

One major difference between the two systems is that, while Chrome OS seems to be focused primarily on efficient use of widely-available cloud services (like those provided by, say, Google), the eyeOS provides a “desktop” in the browser, complete with a selected set of applications.  The eyeOS applications include office productivity apps (spreadsheet, word processing, etc.), E-mail and messaging, personal information management (address books, calendars, etc.), file management, and some other network applications.  The applications can read and write Microsoft Office® and OpenOffice.org file formats.

In both cases, these systems allow the software installations on clients to be standardized and “locked down”, which is attractive from a security perspective; eyeOS also potentially allows other local applications to be installed.  That flexibility might be attractive in some large enterprise environments, where locally-developed applications are needed on user workstations (CAD for engineering might be one example).  The bigger potential difference is on the server end: Chrome OS potentially allows access to anything available on the Internet, while with eyeOS it is in principle possible to have a “private cloud”, in which the enterprise hosts the cloud on its own servers, and has complete control over what is or is not available.  (Something like this can be done with some current virtualization solutions and “thin clients”, but without the standard browser-based interface of eyeOS.)

IBM’s core business these days is providing services, primarily to large organizations.  So it is not really surprising that the eyeOS offering is aimed at those customers:

IBM’s goal with this product is to help customers build “private clouds,” since some companies hesitate to host data and applications on public clouds, often due to concerns about security and reliability. The idea of a private cloud is to set up–on a company’s own servers–the same sorts of efficiencies used by cloud providers, without having to entrust sensitive data to an outside organization.

An additional attraction for these customers is that, because eyeOS is completely open source, it can be easily customized to fit their specific requirements, on both the server and client platforms.  The eyeOS system comes with a toolkit that is intended to make developing new applications for the desktop simple.

It seems to me that there are a couple of underlying things that are motivating some of the interest in cloud computing:

• Economics.  There is the potential to acquire computing services as one does utilities, like electricity.  That in turn means that small users can potentially benefit from services like backup that they could not (or would not) provide for themselves.  It also means that larger users can acquire significant “lumps” of capacity from time to time for special or intermittent needs.
• Security.  Having valuable data scattered around on client machines throughout the organization creates one large set of security headaches.  Having ordinary users able to reconfigure machines and install software is even worse.

It will be interesting to see how this market develops.