By Jonathan Corbet
May 6, 2008
Every now and then one should have a look at some unabashed fear,
uncertainty, and doubt (FUD) material. It's good to know what the other
side is saying, the level of unintended humor is often high, and, on occasion, one even
learns something. Your editor's suggestion for FUD of the week is
this Embedded.com
article by Dan O'Dowd. Therein, one will learn about the impending
death of embedded Linux as told by the companies which sell embedded Linux.
In particular, Mr. O'Dowd looks at some marketing material from MontaVista
and Wind River, and concludes:
This embedded Linux bashing from embedded Linux's strongest
proponents should give pause to those who are thinking through
their embedded operating system strategy. If embedded Linux
champions are saying that embedded Linux is terrible, why would
anyone want to risk their products or their company on it?
One can easily pick holes in this article, starting with the assertion that
MontaVista and Wind River are "Linux's strongest proponents." One could
also recall that we have heard this kind of thing before; in 2004,
Mr. O'Dowd (who happens to be the founder and CEO of a proprietary embedded
systems software vendor)
helpfully warned us
that "intelligence agencies and terrorists" would contribute "subversive
software" to Linux and lectured on the need for secret
source code to achieve true security. One could point out that many of the
points put forward by Mr. O'Dowd appear to be pure fantasy.
All of these rebuttals would be valid, but they
risk missing an important point to be gained from this article - though
it's not quite the point Mr. O'Dowd is trying to make.
Mr. O'Dowd obtains his "facts" from two sources: an advertisement by Wind
River Systems (which your editor was unable to find online) and, primarily,
from a column by MontaVista founder Jim Ready in Military
Embedded Systems magazine. Mr. Ready's evident purpose is to frighten
embedded systems vendors into buying his company's services; to that end,
he lays it on pretty thick:
To keep abreast of the changes occurring on a daily basis, a
developer needs to monitor the email traffic of 11 different and
unsynchronized open source projects: kernel.org, the core home of
the Linux kernel; the gcc and glibc projects (the core tool chain
and libraries from FSF at fsf.org); and at least nine other
components that would typically comprise a useable Linux
development environment.
Kernel.org itself may have up to 5,000 messages a day with 1,000 of
these being patches that need to be evaluated and possibly applied
to the source base. Simply ignoring the traffic, figuring that the
system in use seems to be working well enough, can lead to
disastrous consequences later. For example, a recent security patch
that took all of 13 lines of code to implement against an embedded
Linux system would have taken more than 800k lines of source
patches to implement if the previous trail of patches had been
ignored. It's a classic case of pay now or really pay later.
Somebody must have had a great deal of fun putting all of those numbers
together. The generation of ordinary random numbers can be managed through
traditional methods like a toss of the dice, picking numbers out of a hat,
or reading corporate earnings estimates. Randomness on this scale, though,
can only be achieved through the use of special-purpose software.
Even by kernel.org standards, 5,000 messages per day is fairly intense,
though your editor, a subscriber to the linux-kernel, git-commits-head, and
mm-commits lists, can attest that the order of magnitude is right at least.
But your editor cannot even begin to grasp the thought process which turns
a 13-line security patch into 800,000 lines of code. Imagine posting
that to linux-kernel. "Pay now or really pay later" indeed.
But the provenance of the numbers is not really the point here. Mr. Ready
is perpetrating the fallacy that, to build an embedded system with Linux,
one starts with the various components and integrates them all by hand.
If a company were to take that path, it might well incur the high costs
that Mr. Ready warns about. Creating your own distribution - and
maintaining it over a product's life - is, indeed, a difficult and
expensive job.
But it is a rare vendor which does that; even Gentoo users outsource
much of the integration work to their distributor. Why would any vendor
create its own distribution when there are so many out there to base a
product on? Customizing a distribution for an embedded application is not
a trivial job, but it's not rocket science either. The distributor will
keep up with most of those mailing lists, and, somehow, a reasonable
distribution also manages to ship security updates which do not involve
800,000 lines of code. There is no reason for embedded systems vendors to
wander into the expensive mess that Mr. Ready describes; the creation of a
suitable distribution is much easier than that.
Even so, many vendors may decide that, in fact, they would rather not be in
the business of customizing distributions. They might, instead, look to a
vendor to do that work for them. It makes perfect sense for companies like
MontaVista and Wind River (among others) to offer to provide a stable,
integrated, and supported platform to embedded systems vendors for a
fee. There is honest value in this line of business.
But one does have to wonder why these companies feel the need to scare
companies into buying their services. Those services, properly rendered,
have a real value which can be sold without resort to outright FUD.
Failure to focus on that value gives encouragement to people like
Mr. O'Dowd, who would be most pleased if embedded Linux were to go away
altogether. This does not seem like a sensible business strategy.
Companies which seek to make money from Linux might just want to think
twice before poisoning the well they are trying to drink from. That
is the real lesson to be learned from this particular piece of writing.
(
Log in to post comments)