How Software is Built

Interviewers: Scott Swigart and Sean Campbell

Interviewee: Brad Wilson

In this interview we talk with Brad Wilson - Software Developer in Microsoft’s OfficeLabs team. In specific, we talk about:

• CodePlex, the Microsoft open source repository
• Community participation other than coding
• Open-source governance at Microsoft
• Open-source inroads and future at Microsoft

Continue reading…

Interviewers: Scott Swigart and Sean Campbell

Interviewee: Marc Frons

In this second interview with Marc Frons, CTO for the New York Times digital operations, we discuss the Times use of open source in their infrastructure. In specific, we talk about:

• WordPress and blogging at the New York Times
• New York Times investment in open source
• Licensing issues and corporate citizenship
• How they address open-source application support and evolution
• The role of content management systems
• The future of corporate investment in open source

Continue reading…

Interviewers: Scott Swigart and Sean Campbell

Interviewee: Mark Osborne

• Challenges unique to building developer tools
• Changes to how Microsoft is now building its developer tools
• Using "Feature Crews" to build product
• Predictability, efficiency, and agility in software development
• Preventing "corner cutting" in development
• Defining and enforcing quality gates
• 600 features, and no single development methodology
• Managing dependencies

Continue reading…

In this interview, we talk to Scott Densmore about Microsoft’s CodePlex and the Patterns & Practice’s work on the Enterprise Library Version 4:

• Forking the Enterprise Library
• How Microsoft product teams are using the CodePlex repository for open-source code.
• How CodePlex is different from SourceForge
• Favorite CodePlex projects
• How CodePlex itself is community driven

Continue reading…

Interviewers: Scott Swigart and Sean Campbell

Interviewee: David Campbell

In this interview with David Campbell we talked to him about:

• How the development methodology of SQL Server has changed.
• How the changes affect the ability of customers to give feedback.
• How virtualization makes it easier for users to test-drive SQL Server.
• As products and open-source projects grow, the developers have to realize that they are not the target user.
• David’s belief that the best product doesn’t necessarily have the most knobs.
• Building a community around a closed-source product like SQL Server.

Continue reading…

Interviewers: Scott Swigart and Sean Campbell

Interviewee: Britten Martin

In this interview with Britten Martin we talked to him about:

• The role of support inside Microsoft.
• A walkthrough of how a support request is handled.
• The ways in which the outside community can interact with the internal support processes.
• How a product is supported differently in beta than when it’s finally released.
• How a bug eventually become a fix in the product.

Continue reading…

Interviewers: Scott Swigart and Sean Campbell.

Interviewees:Shawn Burke.

In this interview with Shawn Burke of Microsoft we asked him about:

• Shawn’s motivation for helping to make the framework source code available.
• Whether there are any limits on who gets access to the source code.
• Whether there was any internal resistance initially to providing the framework source.
• Why Microsoft doesn’t just provide a zip for the source.
• Whether Microsoft’s individual developers write code differently knowing that their actual source might be available for the world to see someday.
• Whether or not Microsoft is planning on making available other development artifacts such as test scripts, threat models, etc.
• Whether a closed source company or an open source company is better positioned to support external developers who need access to the source for a given project.

Continue reading…

The OSI has approved the two Microsoft software licenses, the Microsoft Reciprocal License, and the Microsoft Public License.  This makes all the code on Microsoft’s CodePlex site (Microsoft’s equivalent of SourceForge) official open-source software, as much of it is licensed under the Microsoft Public License (formerly the Microsoft Permissive License).  It also means that things like Microsoft’s Ajax Control Toolkit is open-source (with the inherent ability to fork, etc.)

There’s a good article on LinuxWorld about the security debate between open-source and Windows. My first question is, does it need to be a debate? In this day and age, isn’t it easy enough to quantify vulnerabilities?

If you are looking for subjective opinion, I recommend looking through the interviews we’ve done here. At the risk of sounding like a Microsoft fan-boy, the Microsoft interviews (in my opinion) demonstrate a company where secure coding is “in the water”. Code goes through threat modeling, risky function calls have simply been banned, code goes through automated and human inspection, and vulnerabilities that do slip through feedback into the process to determine how to prevent them in the future.

I simply don’t get the same feeling from the open-source people we’ve talked to. When we’ve brought the subject up, the response is almost universally “many eyeballs,” and faith (without data) that “many eyeballs” is effective.

Am I completely off base? Do things like the Linux kernel and Apache go through rigorous security reviews? Is there proof that “many eyeballs” in open source is at least as good as something like the Security Development Lifecycle in Microsoft? If you’re in a position to know, let’s chat!

According to Scott Guthrie, Microsoft will make the source for the upcoming .NET Framework 3.5 available under the Microsoft Reference License. This isn’t an open-source license (i.e. you couldn’t fork the code), but it is still a “good thing” in that developers can learn from the source and have an improved debugging experience with the ability to step-into the framework code.

Update: It seems that this isn’t seen as happy news by all. There’s an article on eWeek that’s just too irrational and frothing to pass up, claiming that this is all a ploy by Microsoft to kill Mono. As Microsoft is officially supporting Novell’s efforts in porting Silverlight to Linux (on top of Mono), the evidence would indicate that Microsoft is doing this to support .NET developers, and not as some clever conspiracy to kill off Mono.

A while back, we did an in-depth interview with Michael Howard about Microsoft’s Security Development Lifecycle, which has been one of our most popular interviews to date.  It seems there’s a lot of interest in pulling back the covers and looking at how Microsoft is approaching building secure code. 

ComputerWorld just did an interview with Microsoft’s Scott Charney, which provides more insight into their efforts to produce secure products.

Interviewers: Scott Swigart, and Sean Campbell

Interviewee: Ryan Waite

Ryan Waite

In this interview, we talk with Ryan Waite, Group Program Manager for High-Performance Computing at Microsoft.  We talk about:

• Microsoft’s entry into the High Performance Computing area.
• Microsoft’s support of the open source Message Passing Interface (MPI).
• MPI has become bloated, and there’s no usability data (like there is with Microsoft Office) to indicate what should be deprecated.
• At Microsoft, select customers help shape the features for the next product release.
• Microsoft has always focused on ease of use, simplified administration, and uncomplicated setup. HPC is no different.
• Instrumentation helps find reliability issues. If partners are affecting reliability (with unstable drivers, for example) certification helps raise the bar.
• Parallel programming is now the only way to do more computation in the same amount of time. Processors just are getting faster like they used to.
• It’s easier for open source to be incremental. Proprietary software has to make radical changes.
• Hard drives + overnight shipping = really high bandwidth.

Continue reading…