Do I Still Have a Job?

This is Bill Macgowan.

Bill is Sun's Chief Human Resources Officer.

Which means he works with me to build and cultivate talent at Sun.

He's bright, well spoken, and usually exercises good judgement.

Usually.

But today, he perpetrated a prank. On me. An April Fool's Day prank.

Executed early enough to turn into a video for the enjoyment of Sun's employees on Tuesday (April Fool's Day). And if I have the courage to publicly display my gullibility, it'll be here, on this blog, in front of a global audience.

The prank, like any good Silicon Valley practical joke, involved a venture capitalist, a drooling visitor, a bib and lamb chops.

Owing to the graciousness with which my parents raised me, I suffered through the prank. Without staring. Focused on the business at hand.

Having no idea it was a prank.

Until all the camera men appeared. At which point I picked up on the notion something wasn't quite right. I had been spoofed.

Upon my humbling return from lunch, Bill caught me in the hallway. He asked, with his ill-gotten video in hand, "so do I still have a job?"

And I have until Tuesday to think up a creative response.

Remember, my office mate is the CFO, and the General Counsel writes a blog. Surely there's an opportunity for clever repartee.

Surely :)

Posted on 07:00PM Mar 28, 2008 | Comments[31]

Share this post  | | | | | |

OpenSolaris, Security and the NSA (National Security Agency)

We made a very significant announcement last week, of a collaboration with one of the most (if not the most) security sensitive institutions on earth, the United States government's National Security Agency. They've joined the burgeoning OpenSolaris community, to collaborate with Sun and other community members on the future of ultra-secure operating systems.

To put this in context, community engagement has always been one of the most important ways Sun innovates in the marketplace - we partner with those that have extreme demands (whether it's the world's largest supercomputing facility, or the world's most paranoid security professionals (no offense intended), or the world's largest archival storage facilities), and then we leverage that expertise to create products for the mass market. We let extreme customers teach us what the rest of the world will ultimately experience.

Nine times out of ten, what extreme customers experience is a great leading indicator for the industry as a whole.

Historically, this type of collaboration used to involve reams and reams of legal documents describing all kinds of confidentiality restrictions, intellectual property exchanges, or cumbersome institutional processes. But it got really simple when we embraced the open source community - now our most fruitful collaborations boil down to this: "come join the community." And that's exactly what we're announcing with the National Security Agency, they've joined the OpenSolaris community.

And rather than walk through the details of our collaboration, I figured I'd have Bill Vass, the president of Sun's Federal Systems Group do all the heavy lifting - so I sent him a bunch of questions, and thought I'd post the resulting Q&A. His responses are below.

So Bill, what did we announce?
That we've formalized a relationship with the United States National Security Agency (NSA) to incorporate their security research into an OpenSolaris community project called Flexible Mandatory Access Control (FMAC). The press release for the project is available here.

What's Flexible Mandatory Access Control (FMAC)?
First, Mandatory Access Control (MAC) is a mechanism generally implemented in the operating system that provides unbypassable restrictions over system privileges. MAC's exists so that not just anyone, for example, can look at your passport file without permission, or turn off a machine in mission critical deployment. MAC is all about managing privileges.

But when it comes to MAC, there isn't one size that fits all, so that's where the flexible part comes in. An installation's security goals can vary based upon the value of its information assets or systems, and the methods used to protect them. By allowing flexibility, the security policy can be described to meet the actual needs for access control based upon an extensible enforcement model.

Thus, Flexible Mandatory Access Controls - you can read more about FMAC here. FMAC isn't just a government issue, of course, it's just as much an issue for a social networking site, or a bank - everyone wants simplified, easy to use access controls, consumers and corporations, too.

Who's involved in the project?
Sun and the NSA are jointly working in the OpenSolaris community, and we're inviting broad participation - one of the great benefits of being an open source company is that Sun can innovate out in the open, within a very large community. For security technologies in particular, transparency of development is absolutely vital, even for the NSA - you can't sneak trojan horses into open source platforms. So open source allows high security customers to trust vendors *and* verify.

This collaboration is a great endorsement for the integrity of the OpenSolaris community among government users focused on technical and commercial progress.

So why did the NSA select Sun?
Security and performance are really the core of our relationship with governments around the world. We've been focused on security since our inception, and we've got more than 20 years experience in the trusted operating system business (remember, Trusted Solaris spawned from collaboration with the US government about a decade ago).

Our security technologies touch everything from the SIM card in your cell phone, to the identity management platforms at the heart of some of the world's largest web services - and Solaris has long been recognized as the most secure open source OS in deployment, from battlefields to command and control systems. So this seemed like a natural partnership to us.

You mentioned something about integrating NSA security research?
Yes, we are investigating how the NSA research on Flux Advanced Security Kernel (FLASK) architecture and type enforcement (TE) policy can be combined with our Solaris Trusted Extensions technology. They're potentially complementary, and we think we can leverage that in the delivery of a fully open source application stack - from MySQL through Glassfish/Java, and up to the user.

The Flask architecture separates policy enforcement from the policy itself. Policies can be modified without needing to change the enforcement "hooks" in the operating environment, which makes life a lot easier for security administrators, and makes the systems more flexible and useful.

Type Enforcement policy allows for very fine-grained access control that can be used to to protect against malicious software.

Why are we embarking on this work with the NSA?
We've received requests for a Flask/TE based implementation in Solaris from a number of government customers. And now that we have Solaris Trusted Extensions out the door, it's a great time to start looking toward the future. We already have a great Multilevel Security (MLS) infrastructure with Solaris Trusted Extensions but the value of the combined technologies may provide a single extensible platform that can be used to protect sensitive government information, along with mainstream enterprises, and ultimately, even consumer electronics like your phone or digital video recorder.

What audience does FMAC address?
Like I said above, MAC based systems are used primarily by governments. Our goal moving forward is to make technologies such as FMAC more accessible to commercial markets, from startups to big enterprises. Governments tend to be good leading indicators for broader commercial security concerns.

High security used to be esoteric, now it's essential - for the US government, for international governments, and most importantly, for users.

Is this limited to the US?
Nope. It's an OpenSolaris project and we want the global community to help drive it forward. If others want to collaborate, just create an account on opensolaris.org and join in.

If someone wants to get a hold of your team to talk about FMAC in the open source community, what should they do?
Just send me an email, bill.vass@sun.com. We've got lots of folks in Washington, DC, as well as contacts around the world, who can help organizations understand security and open source, and understand how to join the community to collaborate around security innovation. Now's the time, join in!

Thanks, Bill. Much appreciated.
You're very welcome. ADDITION: if any of your readers are local to Silicon Valley, and would like to hear Sun's lead John Weeks discuss Flask/TE and the OpenSolaris collaboration project, you might stop in on us in at Sun's Santa Clara campus at 7:30p. If not, I'll post a video of the session so interested parties can share their insights.

Posted on 09:35AM Mar 25, 2008 | Comments[21]

Share this post  | | | | | |

The World's Largest Supercomputing Cloud

I had no idea the Hubble telescope could see only 12 billion years into the past.

Frankly, I'd never really thought about telescopes looking into the past until Dr. Michael Norman, a researcher from UCSD gave me a basic education in astronomy - and explained the Hubble looks at celestial bodies whose light is just now reaching us. But it can "only" see 12 billion years into the past - and that was a veil he'd like to pierce. (I asked him what he did for a living, he said, "I simulate the universe." Trump that job description.)

The question he was interested in answering was, "what about the prior 1.7 billion years?" The universe is roughly 13.7 billion years old, and given the Hubble's limits, he was using the world's largest supercomputer, the Ranger platform at the University of Texas at Austin's TACC (Texas Advanced Computer Center) to simulate the prior 1.7 billion years. (He later confided he was most interested in the prior 1.5 billion years, the first 200-300 million were characterized by lots of hydrogen fog, yet to clump into the wells that enable stars to be born.)

I was asked to give a keynote to celebrate Ranger's opening, and this was only one example of the flood of basic research and science that will now be performed on the world's largest open computing platform. Open? The facility was funded by the National Science Foundation, and is committed to providing large scale supercomputing as a service to any researcher or scientist within the US (submit proposals here). Ranger is built entirely on Sun - to dip into geekspeak for a moment, here are the stats:

• In around 6,000 square feet datacenter space, consuming less than 3 Megawatts...
• More than 4000 quad core Sun/Opteron blades, 120+ Tb of DRAM, running CentOS
• Delivering more than 500 teraflops computing capacity
• Jobs scheduled by Sun's Grid Engine
• Interconnected by two, 100 terabit non-blocking Magnum switches (horns optional)
• Data managed by the Lustre file system, on Thumpers
• More than 2 petabytes of storage
• Managed by our hierarchical data management SAM-FS product, archived to Sun tape platforms
• With overall systems managed and monitored by xVM OpsCenter (the world's largest installation).

An enormous amount of engineering went into the construction of the facility and the technology behind it, which Sun can now replicate across the world in smaller (and larger, of course) installations (public and commercial). Beyond governments and research facilities, Industries across the planet are turning to high performance computing for business advantage, not simply scientific endeavor. This system consumes a fraction of the power budget required just a few years ago - making it among the greenest supercomputing facilities on earth, too.

To give you a sense of how significant Ranger actually is, check out this chart (click for live version):

Ranger's capacity exceeds that of all other National Science Foundation granted supercomputing facilities combined. When they say big in Texas, they mean big.

As the director of Cyberinfrastructure at the NSF pointed out during his congratulatory speech, computational simulation is now considered a legitimate field of scientific exploration. From drug discovery to climate modeling, fluid dynamics to simulating the universe, epidemiology to materials science - a facility of this size will revolutionize science, in the US and across the world. To date, there are already more than 500 research projects using Ranger - it's already changing the world. And because it's part of the NSF Teragrid, output from the studies will be shared throughout the world. Open means open. Jay Boisseau, TACC's director, let me know they're dangerously close to receiving more applications for time on Ranger (they have about 500 million cpu hours to allocate each year, or 125m/quarter) than they have available. For folks like Jay and Dr.Norman, increasing capacity increases appetite - unlike much of enterprise computing, where surpluses are often consolidated away (the heart of Greg's redshift theory).

How did Ranger come together? It resulted from a commitment to basic science from the National Science Foundation, a passionate set of people at the University of Texas, inspired by a driven technical leader in Jay, commitments from an exceptional (truly exceptional) team of TACC, Sun and AMD employees, with all three groups in a mad scramble to stand up the facility in record time - as the world's largest open supercomputing facility. The world's largest, by a factor of 4.

Ranger will transform academia, industry and ultimately society. Why do I believe that?

As I pointed out during my speech, there was a point at which the Niagara Falls power plant in the United States supplied fully 30% of America's electrical requirements. The engineering and basic science that went into that work parallels the work required to build Ranger. It was truly fundamental research.

Did electricity transform society? Unquestionably. Will knowing what happened in the first 1.7 billion years of the universe transform our lives? We don't know yet. That's what Dr. Norman is figuring out. A question Sun, AMD and the University of Texas researcher will now be able to help him answer. With a platform Sun will now be making generally available to the commercial market. (I was going to write something like "parting the clouds of cloud computing," but even I winced when I read that.)

__________________

(For those interested, this is a great summary of Dr. Norman's approach to computational astrophysics - notably, like pretty much all the work I'm seeing in high performance computing across the world...

...predicated upon free and open source software.)

Posted on 04:00AM Mar 03, 2008 | Comments[41]

Share this post  | | | | | |