Progress on EROS

[shapj@us.ibm.com]

My apologies for the off-topic posting to e-lang, but I think this is of
interest to that audience.  Also, my apologies for the duplicate copies for
those of you on multiple lists.  To avoid a fload, PLEASE reply only to the
eros-port list or to me.

As most of you know, I've spent much of the last 15 months trying to get
IBM to do something with EROS. Considerable progress has been made, which
I'll say a little bit about below, but no final decision has been made yet.
Decision-making is a very simple thing: either you have made one or you
haven't. IBM hasn't.

I remain hopeful, but I'm now looking at other options. First, I'm looking
at academic positions [in fact, I'm writing this from Tucson]. I got my
Ph.D. to be able to teach, and it has long been my plan to go into
academia. Ironically it may be easier to make EROS succeed from there,
simply because my hands won't be tied in working with the community.  The
other option I'm considering is forming a new company to deliver
capability-based security technology, including EROS. I may, of course, end
up doing both.

One consequence of all this is that I owe an apology to the many people who
have wanted to make forward progress with EROS. Because I am an IBM
employee, any modifications I make to the EROS repository become IBM
property. Further, because they are open source (and therefore released),
they need to go through a release permissions process that is complex and
painful. Since applying the patches creates legal issues, I've been forced
to basically set the patches aside for later. I promise you that they
*will* get applied (or in some cases a simpler fix will get applied). I ask
you to have patience just a little bit longer.

Within IBM I am in the final phases of getting a new open source project
cleared to proceed. It has been pushed back once (due to agenda overflow),
but in theory the project goes before the internal open source steering
committee in early march. We shall see what happens.

I have also made it clear to my management chain that if we do not arrive
at closure on this in the next few weeks I plan to leave the company.

If I do leave, and I go the academic route, it will realistically be July
or September (depending on the school) before I can actively participate
again. In the startup scenario, there is a fund-raising process to go
through that takes 4 to 7 months.

The best answer, of course, is for IBM to decide to become involved. I'm
still hopeful that this will occur.

Once again, I apologize for the delays. It would all be much simpler
without a roof and a family to support. :-)


Jonathan S. Shapiro, Ph. D.
Research Staff Member
IBM T.J. Watson Research Center
Email: shapj@us.ibm.com
Phone: +1 914 784 7085  (Tieline: 863)
Fax: +1 914 784 6576