OpenSSL, OpenSSH and NTP to receive support from Core Infrastructure Initiative - <AUTHOR> https://www.linuxfoundation.org/news-media/announcements/2014/05/core-infrastructure-initiative-announces-new-backers "Network Time Protocol, OpenSSH and OpenSSL first projects to receive support; Open Crypto Audit Project to conduct security audit of OpenSSL" <comment><USER2> Just give the money to the OpenBSD team. We saw with OpenSSH that they have a proven track record taking crappy security software and fixing it. Why does everyone have this aversion to giving the OpenBSD team the funding they deserve?

And "Theo's a dick" doesn't qualify as a valid reason to not fund real security development. For the work those guys have done improving the security infrastructure of every operating system (they lead, others followed), the entire team deserves to be well-off dicks. It's to me the ultimate highlight of OSS's funding problem. People make millions/billions of dollars off of this software, and nobody ever contributes any of that back to the shoulders they stood on to make that happen.

<comment><USER3> OpenBSD is not auditing OpenSSL. They're substantially rewriting it. The net effect is hopefully similar, but it's a very different path to get there. Further, the refactor might introduce new bugs, and it can easily miss subtle bugs (we're talking about cryptography, which is not as easy to spot or to fix "accidentally" [which is part of OpenBSD's M.O.] as memory corruption).

"Theo's a dick" has nothing to do with why funds are being applied to audit and not to "just have OpenBSD rewrite everything".

<comment><USER4> I would trust Theo's team over the OpenSSL team any day of the week.

<comment><USER3> That's great, but neither LibreSSL nor the Linux Foundation open audit project has anything whatsoever to do with the OpenSSL team.

</comment></comment></comment></comment><comment><USER5> When the missing funding of OpenSSL was discussed, it came up several times, that OpenSSH, while doing great, is quite underfunded, too. I am glad to see them getting some money.

What i can't really comment on myself, but am reading from the OpenBSD guys is, that the OpenSSL team does quite well with FIPS consulting and has no increased interest in improving the library.[0]

Even if those claims are not true, it would be nice to see several other TLS libraries (GnuTLS, LibreSSL etc.) getting sponsored to get some healthy competition. Maybe, they could even directly compete for shares of the funding by the Linux Foundation in some way.

[0]: [http://www.openbsd.org/papers/bsdcan14-libressl/mgp00008.htm...](http://www.openbsd.org/papers/bsdcan14-libressl/mgp00008.html)

<comment><USER6> Straight from the horse's mouth[1]

> Also, the income they earn though their paid consulting work supports their > unpaid work on OpenSSL, so by hiring OpenSSL team members you are not only > solving your own problems but also helping to ensure the long term viability > of the OpenSSL product.

They also on their website list hourly consulting starting at $250/hour. Neither of these describe _how much_ they get out of this, but it seems reasonable to say that the "OpenSSL runs of $2k/year" line is disingenuous at best.

[1] [http://www.openssl.org/support/consulting.html](http://www.openssl.org/support/consulting.html)

<comment><USER7> "but it seems reasonable to say that the "OpenSSL runs of $2k/year" line is disingenuous at best."

Is it? The last contract listed on that page is 4 years old. Maybe they don't regularly get contracts.

</comment></comment></comment><comment><USER8> I'm actually looking forward to seeing how the OpenSSL problem will deal with their own legacy code, compared to how the OpenBSD developers have handled it.

It seems that own of the only ways of dealing with the OpenSSL code is to strip out the code for a large number of, should we say "less used platforms". Is the OpenSSL developers willing to drop support for 16 bit Windows or OpenVMS?

<comment><USER9> _Is the OpenSSL developers willing to drop support for 16 bit Windows or OpenVMS?_

They either need to properly maintain it or drop it, and they don't have enough money to maintain it.

<comment><USER10> I just want to know who's still compiling against 16bit windows or OpenVMS. I know my world view isn't infinite, but those systems seem a bit out there.

<comment><USER11> Part of my job involves writing software on OpenVMS. We actually just recently ported something that needed OpenSSL and were happy to find an up-to-date version.

<comment><USER12> Out of curiosity (sorry if that's offtopic), but what kind of workload are you running?

Is there anything except resources that prevent you from moving to a more modern platform? Of course, "it works" is a valid argument there, too. But you seem to be writing new code, too.

<comment><USER11> No, nothing except resources is in the way of completion of a move to a more modern platform. It's coming gradually, but we can't drop everything for a year or two to devote all of our engineering resources to getting us there.

OpenVMS has some really good ideas baked into the OS that we've had to reimplement or find off-the-shelf solutions for our new platform (for example a distributed key-value store (called "logicals"), a job queue system, and a clustered filesystem) but nothing so earth-shattering that it would keep us on VMS.

The biggest downsides are expensive hardware (OpenVMS is designed around clusters of a few beefy boxes, rather than many commodity boxes), lack of community knowledge, and lack of new software available for the platform. (End of life is also looming: [http://h71000.www7.hp.com/openvms/openvms_supportchart.html](http://h71000.www7.hp.com/openvms/openvms_supportchart.html) .)

</comment></comment></comment></comment></comment></comment><comment><USER13> I skimmed, but cannot seem to see which project is being supported when they say NTP.

When you support the OpenBSD Foundation you support:

\- OpenBSD \- OpenSSH \- OpenBGPD \- OpenNTPD \- OpenSMTPD \- LibreSSL

The wording makes me think that the initiative will be supporting something other than OpenNTPD

<comment><USER14> They're supporting 4 projects so far: OpenSSL, OpenSSH, NTPd, and an Open Crypto Audit Project (OCAP) audit of OpenSSL. The Network Time Protocol project is here: [http://ntp.org/](http://ntp.org/)

</comment></comment><comment><USER15> If OpenSSL software foundation is a for profit operation, why are tech companies funding it(1) instead of LibreSSL?

1: [http://arstechnica.com/information- technology/2014/04/tech-g...](http://arstechnica.com/information- technology/2014/04/tech-g..).

<comment><USER16> The CII is not funding the OpenSSL Foundation; it is directly funding two OpenSSL developers, so they can work on whatever is best for OpenSSL, instead of whatever feature improvements contracted by the OpenSSL Foundation.

As a result, the people behind the OpenSSL Foundation are NOT taking a cut of the monies from the CII.

</comment></comment><comment><USER17> This is great news. NTP is one of the least appreciated OSS projects. Harlan and the rest of the ntp dev team are very helpful and deserve a lot of respect for keeping the clocks on time. I can only hope that increased ntp funding/awareness/development means that _BitKeeper_ (not a typo) is finally replaced by git/mercurial.

</comment><comment><USER18> How do code security audits actually work? Are various well-experienced people just combing through the code and trying to break it? Or is there a more formal process?

<comment><USER19> This depends on a couple of different things. The most important of which is "at what stage of development is the application? (i.e. how mature and well tested is this code)". Software Development Life Cycle (SDLC) processes are great when followed from the start. When they are applied long after the first 100k+ lines of code are written then its harder. A typical code audit for us (I do this professionally at [http://leafsr.com](http://leafsr.com)) involves some threat modeling, attack surface enumeration, manual data-flow and taint analysis ("where does untrusted data come into this application and how is it handled") and finally just reading the code. Timing and scope will heavily influence how deep you can go. 1 week on OpenSSH will probably get you nothing, 6 weeks on OpenSSL will definitely get you something.

(edit: expanded on what is most important)

</comment></comment><comment><USER20> It is possible the OpenSSH funding, since it is done through the OpenBSD Foundation, could, at the Foundation's discretion, go toward LibreSSL, since it's the same group.

<comment><USER21> No it's not. Libressl is a different team; one that feels a fork was more appropriate than just fixing the problems in openssl.

IMHO, libressl is a mistake. It's splitting resources over something that needs to be as air-tight as possible. I'd much rather have 1 really really good ssl library that everyone uses instead of 2 so-so ones.

<comment><USER22> > No it's not. Libressl is a different team

OpenSSH and LibreSSL are both a part of OpenBSD. So when you donate to the OpenBSD Foundation, you are very much donating to one project.

> one that feels a fork was more appropriate than just fixing the problems in > openssl

You can't start fixing things in other peoples' source tree just like that. I'm pretty sure nothing useful would've come out of it if the OpenBSD folk had sent half a million lines in diffs to OpenSSL; [http://www.openbsd.org/papers/bsdcan14-libressl/mgp00026.htm...](http://www.openbsd.org/papers/bsdcan14-libressl/mgp00026.html)

<comment><USER21> > You can't start fixing things in other peoples' source tree just like that.

Yes, you can. It's called contributing to a project. If the "half million lines of diffs" were actually things needing fixing, then the upstream team would accept them. If they are not necessary changes (such as ripping out all windows compatibility), then no, they would reject such changes.

It will take years, maybe a decade before a new ssl library becomes the "default". OpenSSL has a lot of ground covered and a lot of history. Yes, it's common knowledge that libressl started _before_ heartbleed, but the reasons for the project being started are mostly along the lines of:

1) We don't think upstream would take these changes

2) We don't like some aspects of the design philosophy

3) We can do it better.

All 3 reasons can be collapsed into a more focused effort to fix the already existing and very good ssl library; openssl.

<comment><USER23> > Yes, you can. It's called contributing to a project. If the "half million > lines of diffs" were actually things needing fixing, then the upstream team > would accept them. If they are not necessary changes (such as ripping out > all windows compatibility), then no, they would reject such changes.

I take it you've never dealt with an inactive/apathetic upstream before? Just because someone _is_ the steward of a project does not mean they _should_ be. This is perhaps one of the most valid reasons to fork!

The LibreSSL team says that there were big problems on the tracker that languished for years, such as OpenSSL not working correctly when you disable their custom memory allocator. If the OpenSSL team can't deal with bug reports in a timely fashion, what makes you think they will bother reviewing and merging hundreds of thousands of lines of code?

<comment><USER21> Then you become the steward of the project and continue forward. Forking will introduce an untold number of _new_ bugs, some of which may be _worse_ than imagined. Right now, native libressl only works on bsd's, when openssl codebase works on many os's. There are ports being made, which will introduce more bugs.

Bugs being in a tracker for years is not uncommon.

Here's OpenSSH's tracker:

[https://bugzilla.mindrot.org/buglist.cgi?bug_status=__open__...](https://bugzilla.mindrot.org/buglist.cgi?bug_status=__open__&content=&no_redirect=1&order=changeddate&product=Portable%20OpenSSH&query_based_on=&query_format=specific)

331 bugs, a large majority of which are pre 2012.

This is not a sign of inactive/apathetic developers. It's a sign of big and old projects.

I have no doubt the OpenBSD folk are excited about this now... but 5 years from now? More? What's the long term viability of this project? Will they eventually put all OS's on an equal footing instead of *BSD's first and port to other OS's?

Forking was not the answer. The answer was to fix the perceived problems in OpenSSL and make it as solid as it can be. It's splitting talent and resources unnecessarily. Especially when the two projects are under the same umbrella (OpenBSD Foundation).

<comment><USER23> > Then you become the steward of the project and continue forward. ... The > answer was to fix the perceived problems in OpenSSL and make it as solid as > it can be. It's splitting talent and resources unnecessarily.

But that is what the fork is, OpenSSL with new stewards. What is your objection? That they are using a different name? That they decided to remove certain platforms which were a maintenance burden? That FIPS is broken by design and therefore isn't a priority? I imagine the OpenSSL team disagrees with the LibreSSL team on all of these issues. The only option was a fork.

> Right now, native libressl only works on bsd's, when openssl codebase works > on many os's. There are ports being made, which will introduce more bugs.

One step backwards, two steps forward.

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> What about BIND for DNS?

<comment><USER25> The DNS ecosystem is much more diverse. djbdns is considered to be the most secure, and there are a few other quality implementations. The root servers, for example, run a mixture of BIND and NSD, so no single bug can affect all of them.

</comment></comment><comment><USER26> Just LibreSSL. Let OpenSSL die its deserved death. Portable LibreSSL will do wonders.

</comment><comment><USER27> Having "Huawei" as one of the backers does not create confidance. Recent news shows that they had there hardware backdoored.

[https://duckduckgo.com/?kh=1&q=Huawei&sites=www.schneier.com...](https://duckduckgo.com/?kh=1&q=Huawei&sites=www.schneier.com%2Fblog)

<comment><USER28> How is the NSA's ability to backdoor Huawei hardware relevant for Huawei's ability to provide money to help fund audits?

Presumably, the NSA hacking is a reason for Huawei to start caring a great deal more about investing in security.</comment></comment>


Simplest possible smooth contouring algorithm - <AUTHOR> https://wordsandbuttons.online/the_simplest_possible_smooth_contouring_algorithm.html <comment><USER2> Very interesting, and I like the interactive graphics. I've been looking at this problem recently with an eye towards what it looks like to translate scene descriptions from an SDF (signed distance function) representation of a CSG (constructive solid geometry) scene to a triangular-mesh representation. I've looked at marching cubes, which has another page on this site that is linked from this page, but it seems kind of inelegant.

The obvious problem with this method is that it relies in the underlying object being smooth, and many CSG designs have cusps and other non-smooth artifacts that are very hard to derive from an abstract representation because the SDF is not well-behaved around those regions.

<comment><AUTHOR> Try dual contouring. It preserves sharp features from the box. When combined with octrees, it's much more effective than the simple thing. [https://www.cse.wustl.edu/~taoju/research/dualContour.pdf](https://www.cse.wustl.edu/~taoju/research/dualContour.pdf)

</comment></comment><comment><USER3> It's pretty easy to create weird loops in the contour by placing two dots with about ~0.5r of distance between the edges.

</comment><comment><USER4> What makes this the simplest possible algorithm?

<comment><USER5> As opposed to, say, drawing a circle large enough to encompass all the points.

</comment></comment><comment><USER6> I really have a problem with this article, not because of the algorithm, but because of the presentation:

        for(x...)
        for(y...)
        for(z...) {
          ...
        }

I believe that code should at least attempt to be literate, and this just makes me shake my head in frustration.

<comment><USER7> I see no problem with this and do it myself if autoformat doesn't undo it.

This is being literate (evaluating over a space of three dimensions) rather than literal (of nested loops).</comment></comment>


How Moving to Work Remotely Could Affect Your Taxes - <AUTHOR> https://www.nytimes.com/2020/08/25/business/coronavirus-nonresident-state-taxes.html <comment><USER2> How would anyone know you have been working out of state / out of country? Has anyone been caught out by being tracked by their ip address when logging into the corporate VPN?

<comment><USER3> FWIW, the US federal government receives bulk cellphone location data from the tower owners.

Whether or not they let the IRS use it is another matter, but the data is there.</comment></comment>


Ask HN: Cool Arduino projects - <AUTHOR>

I'm looking to get into Arduino (or We-IO) and in need of inspiration.
What are some cool, small, DIY projects you saw, or wish to see utilizing the Arduino micro controller.
Thanks! <comment><USER2> Shameless plug: [http://sudharsh.me/blog/2013/12/07/jenkins-build-status- on-a...](http://sudharsh.me/blog/2013/12/07/jenkins-build-status-on-arduino/)

Everyone out there seem to start out with a CI traffic light using Arduino. This is no exception :).

</comment><comment><USER3> there is a topic for this on reddit: [http://www.reddit.com/r/ArduinoProjects](http://www.reddit.com/r/ArduinoProjects)</comment>


Maybe Hulu is right to block Boxee?  - <AUTHOR> http://www.crunchgear.com/2010/02/06/maybe-hulu-is-right-to-block-boxee/ <comment><USER2> The solution to this is so fucking obvious that it pains me. Boxee is an application platform.

Hulu needs to just make a goddamn Boxee app the way Netflix has for many platforms. They get to control the experience. If some of their content deals don't allow it, just make a subset available.

</comment><comment><USER3> This article accomplishes nothing more than saying "Hey guys, I understand both viewpoints." I wish I had my two minutes back.

<comment><USER4> I suspected that was where this was going, so I checked the comments.

Thanks for saving me the two minutes.</comment></comment>


Ask HN: What's going on at IBM? - <AUTHOR> Company seems to be doing poorly (14 straight quarters of declining revenue) and according to markets. Would be good if someone with a grasp of how the company works could explain what's going wrong <comment><USER3> I've been working at IBM for a couple of years now, started as a grad.

What you must be referring to is the stock price, which has dropped from 200 dollars a couple of years ago to like 120 these days.

I can't claim to understand this company, I think very few people can. There are 300,000 employees and more teams/products/departments than you can imagine. It's absolutely insane.

However, what I can say is the following: IBM is shifting it's strategy completely and that would've been very difficult to do without a drop in revenue and stock price. IBM is going from whatever it was before to a cloud- based company. All services and products will need to have some sort of cloud offering. I'm not sure if you can imagine what moving 300k employees worth of work to the cloud means. IBM has existed for like 100+ years now, this industry has not existed until a couple of years ago and, right now, all teams must re-evaluate their work and make the steps towards making this transition happen.

Many of the employees are stuck in their old ways, many people have been working at IBM their whole career (20-30-40 years) and it might be hard to adjust to so many new directives coming from the top. There's much bureaucracy and many old ways that need to be absolutely obliterated. Also, IBM doesn't have a great reputation for being cool or anything... almost everybody hates Lotus Notes, as an example.

This was sort of all over the place, I didn't spend a lot of time thinking about this. Please let me know if you have any specific questions...

<comment><AUTHOR> Watson is quite impressive from the outside atleast. It's sort of the opposite of the Palantir approach to unstructured data; which is to say Watson processes and outputs the conclusions as opposed to aiding humans. Is that getting any traction?

<comment><USER3> I wish I knew... As I said, there are very many people working here, it's very difficult to know much about all that. :) From what I know though, there is a lot of funding going into it and a lot of effort, I think it's currently no. 1 on the list for the executives. It did manage to get A LOT of attention with Jeopardy, but I haven't heard a lot of good stuff about it since. I mean, it's definitely laying lower than you would expect given how impressive it looked on TV.

</comment></comment></comment><comment><USER4> Regarding some of the Buffett posts, he has been reading the IBM annual report for 50 years. Other major investments he owns, like Wells Fargo and BNSF, are major IBM customers. He once said Wells Fargo's largest expense is paid out to IBM each year.

Buffett's position is that IBM has succeeded in turnarounds throughout its 100+ year history. Also, their advantage is in the Public/Private hybrid cloud. Buffett also believes the cloud business is not a "Winner Take All" game.

Buffett also applauds what industry pundits have dubbed, IBM's "Financial engineering". IBM has financed share buybacks with debt. With interest rates and share prices at low-levels, he believes the buybacks are sound.

In my time, I remember when IBM jumped on the Linux and Java bandwagons with great success. I think most people respect the contributions they made with the Eclipse IDE for example.

It will be interesting to see what they do with Bluemix and AI. I still respect them as a technology company.

<comment><USER5> Blumix is late to the game and has to put it mildly road to do [https://status.ng.bluemix.net/](https://status.ng.bluemix.net/)

<comment><USER4> When bluemix started out on day one, I didn't know what the heck was going on. When I look at that list now, I'm impressed with the cohesion of the services presented. I see bluemix, Twitter insights, weather insights, and a lot of other services that fit into the narrative IBM has pushed through the media. The services appear relevant, and I'd trust ibm to support and grow them instead of using the public as its sandbox.

<comment><USER5> yeah but look at the outages, provisioning of something is broken every other day. this has impacted my startup already multiple times, sadly.

</comment></comment></comment></comment><comment><USER6> I'm surprised no comments here mention containers. These are a great example of where IBM absolutely screwed itself. Most of the kernel features for containers and the initial release of LXC were done on IBM's dime. The two major developers (one focused on kernelspace, one on userspace) then left, at least one of them for Ubuntu, I believe. I know this because I was in touch with them and using LXC personally about 2009-2010 before the docker hype era.

As I comprehend it, the features were originally intended to allow fat mainframes to dole out tiny resource portions for distinct jobs. As it seems to have turned out, every CPU these days is the equivalent of a fat mainframe, and the greater challenge is around integrating this form of rapid SOA micro- provisioning in to developer workflow through tooling and education. I just upgraded this few year old Macbook Pro to run Docker 1.1.0: 200MB Linux ISO + Virtualbox + kludgey go wrapper = better solution than IBM ever provided. With a different management culture, they could have released this in 2010, pre- empting stable docker by 5+ years with a kernel commit history and adequate marketing funding.

</comment><comment><USER7> IBM has transitioned into an enterprise services/consulting firm over the past 15 years or so. Their game plan is to get huge $$ contracts from Fortune 50 companies and government agencies, which is a long and costly process.

This kind of business is extremely hard to scale, compared to a true software or hardware company innovating and licensing/selling products. IBM does have a ton of resources behind Watson, but that's still basically an enterprise services contract sale, and not much of a cloud product.

<comment><AUTHOR> Does it mean its core revenues are more stable? Are enterprise customers moving away from it?

<comment><USER8> A lot of enterprise software work that I know about that IBM does are things like SAP integration (which was a great disaster in my home land - queensland, australia, have a google). You can see a lot of this sort of stuff moving to the cloud and off the shelf products replacing it, there is certainly consulting work to be had integrating products from this, but it would be easy to argue the amount of money for these things is a lot less.

Also in the past IBM had an integrated value stack of hardware and software they provided (AS/400 and so on), these are being replaced by commodity cloud based servers running linux or windows. So their consulting model is being disrupted. There's still money in it, but probably not the amount of money they're used to, same sort of thing is happening in Oracle I'd guess.

</comment></comment></comment><comment><USER9> Accountants have taken over leadership roles, resulting in a corporate-wide prioritization of earnings-per-share promises over engineering and logistics.

<comment><USER10> Blech!!

It's too bad that companies like both IBM and Yahoo! didnt do a better job in capturing the startup market given the hoards of cash they both have.

Talk about 900 pound gorillas, they got their asses handed to them even though they could have funded every single startup in the valley over the last ten years and not put a dent in their reserves...

I'm curious to know why these companies with massive cash stockpiles seem to literally just sit on them.

<comment><USER11> It's always been controversial whether a company should be allowed to invest in new fields. Over the last 100 years a few people have even made the argument that it is illegal for a company to invest in a new fields. There were some lawsuits about this in the 20th Century, though the courts always sided with the corporations.

Still, the argument is interesting to consider. Suppose it is 1995 and Microsoft it at the peak of its power, so you invest in Microsoft stock. Then 14 years go by. Now it is 2009. Google is rising in power. You want to get your money out of Microsoft, so you can invest it in Google. Does Microsoft have a legal obligation to give you all that it can? Or can Microsoft create Bing? Microsoft then creates Bing and loses more than $1 billion on it. You feel frustrated. Microsoft could have given that money to its shareholders, so you would have more money to invest in Google. But instead the money was wasted on Bing.

On the more general level, the question is, when one industry is in decline, and another industry is rising, who is responsible for shifting capital from the dying industry to the growing industry? Should individual investors do it, or should corporations do it?

You could argue that IBM is following the philosophy that all money should be given to the shareholders, so that the shareholders can reinvest the money wherever they feel best.

<comment><USER10> This isnt what I asked at all.

If MSFT has BILLIONS in the bank - why do they literally sit on the money instead of investing heavily in GOOG when GOOG is born?

I am not saying a company should give the money they have in the bank back to their shareholders to invest - I am saying why dont they actively invest in startups VERY AGGRESSIVELY as opposed to sitting on the money entirely.

Also, I am literally only talking about one industry - tech - so I am expecting that those that are in tech beget tech startups....

<comment><USER12> Because your question depends on MSFT being able to see into the future.

Second, if they did know that the Google business model would be successful they could just have copied it to out-google Google.

<comment><USER13> Surely this is what Bing was attempted to be

</comment></comment></comment></comment></comment></comment><comment><USER14> From my lowly developer point of view.

Power may be a bit quicker than Intel, but it's unfamiliar to many. Nvidia is breaking new ground, it's sexy, accessible, and cheaper.

On the software side it's a similar story. Why use their unknown proprietary cloud stuff when I can just make use of the plethora python/julia/clojure/R stuff? AWS is fancy and ever expanding, Softlayer is a PITA.

IBM biz news [http://finance.yahoo.com/q/h?s=ibm](http://finance.yahoo.com/q/h?s=ibm)

<comment><AUTHOR> AWS does cater to enterprise customers, but do they have the same one point of contact style service that IBM has historically provided?

<comment><USER10> In my experience, yes.

The support I have received fromAWS has been literally stellar over anyone I've ever worked with.

Even now, my previous rep got promoted and moved on from account mgmt but if I send him a one-off question he gets it answered and taken care of immediately.

I have literally out of hundreds of calls and meetings with aws been disappointed with one call. That was when I accidentally changed my root account email address and I couldn't recall which email I had set it to, so I clicked the "contact customer service" link from the forgot password page and it connected me with the "Amazon.com" (shopping) customer service agent who apparently had no fucking clue what aws was.

</comment></comment></comment><comment><USER15> IBM has long seen itself not as a computer or electronics company but as a marketing company. Their approach to marketing is to have salesmen in branch offices selling to businesses. Long they sold _business machines_ for routine business record keeping.

They are still trying to sell, sell something, via those branch offices to those businesses but they have run out of things to sell. And the sales culture is not good at thinking of good, new products/services to sell.

</comment><comment><USER16> Robert Cringley has a recent book about the decline of IBM - [http://www.cringely.com/2014/06/04/decline-fall- ibm/](http://www.cringely.com/2014/06/04/decline-fall-ibm/) \- I found it pretty interesting. His thesis is that IBM's management has consistently goosed short-term profits by making cuts that hurt it long term. It off-shored technical work, under-invested in quality, tooling and automation, laid off older more experienced workers, etc. I don't have any first hand of experience of IBM, so I cannot vouch for how true Cringley's story is.

<comment><USER17> The problem with anything Cringeley writes is it is tainted by his baseless past claims that IBM will be laying off most of its workforce. He has been wrong every time. He'd be more interesting to read if he wasn't trying to act as some Nostradamus to IBM who keeps repainting the IBM death portrait each time his predictions don't turn into reality.

</comment></comment><comment><USER18> Define "doing poorly".

IBM is down 17% percent in the last 6 months. ([https://www.google.com/finance?q=ibm](https://www.google.com/finance?q=ibm)) As far as tech stocks go, that's not crisis-mode.

As far as newsworthyness, Watson and Bluemix have been making the press rounds.

<comment><AUTHOR> Since its March 2013 high. Their revenues have been decreasing for 14 straight quarters

</comment></comment><comment><USER19> IBM has to change their business plan and focus on new technology.

When the IBM PC was made it started the PC Era that became the Post-Mainframe era. When mobile devices took off it became the Post-PC era and IBM had to sell its PC and Server lines and focus on services.

Now even if it is the Post-PC era PCs are still being used. IBM had to get rid of OS/2 and migrate to GNU/Linux.

Right now it is also the Cloud-Era and IBM has to work on Cloud technology.

When a company shifts technology like that it takes a while to find a way to turn a profit.

Apple went to the mobile technology market and it took off like a rocket. IBM had the Simon Smart Phone in the 1990s but couldn't market it.

IBM has a lot of technical debt in maintaining Mainframes and Minicomputers that are still in use. The Lotus products also are outdated and they tried to use OpenOffice.Org to make Lotus Symphony and it didn't take off.

IBM Opened up its Power technology: [http://openpowerfoundation.org/](http://openpowerfoundation.org/)

A lot of things have happened to technology that IBM suffered from losing money because the technology became outdated. IBM has to invent new technology to replace it.

IBM is focusing on services and the cloud right now. Sort of moving away from hardware because it is hard to earn money from hardware and moving to software and services instead.

Everything I used to know about IBM has changed, IBM has to reinvent themselves. The technology and markets have changed and IBM has to adapt.

</comment><comment><USER20> One interesting thing is that Alliance@IBM- the organization that has been trying to unionize the company is giving up. I assume that the interested workers are now at Lenovo.

[http://www.computerworld.com/article/3019552/it- industry/ibm...](http://www.computerworld.com/article/3019552/it-industry/ibm- union-calls-it-quits.html)

Maybe they should focus on unionizing Amazon.

</comment><comment><USER21> IBM is suffering the fate of OPEC countries, except with technology. IBM wasn't diversified. (Sure, IBM has lots of products, but it usually sold licenses to all these products in large bundles, rarely did anyone buy just DB2, rather, agreements purchased entire ecosystem of IBM software/hardware). IBM was built on a single golden goose "massive multi-million dollar agreements with Fortune 500 CTO's for thousands of licenses of IBM hardware/software". IBM solved big problems with big, expensive solutions. Nowadays, developers regularly make the purchasing decisions, not upper- management, so FOSS or Freemium products win out over expensive IBM software licenses. IBM hardware is largely dying out because the Cloud and x86 won the architecture wars and no one wants to develop for PowerPC or AIX. So the legacy IBM is dying on the table.

IBM is losing its old accounts and old business agreements faster than it can generate new revenue with Softlayer/Bluemix/Watson. IBM makes 4.5B from Cloud revenue. In contrast, total revenue in 2015 was 81.7B. So IBM revenue is going to be a bloodbath until Cloud revenue can catch up. Unfortunately, Cloud is a razor thin margin business, where Amazon, Microsoft, and Google are willing to sell at, or below cost to gain marketshare, which will likely continue to hurt IBM's cloud revenue at a time it needs it most. IBM is the underdog here, so it can not bring any of the other cloud giants to the table and make them end the price wars, so IBM cloud revenue is likely to remain anemic.

IBM also suffers from a number of management mistakes. IBM is way behind on automation and lacks the talent, so they've had to make acquisitions and "strategic partnerships" to buy it. IBM previously tried to outsource as much software and operations to China or India, and the unskilled labor available in those countries simply don't have the skill sets to do devops or any sort of basic automation. So you've got datacenters where people still ssh into each box and run commands by hand thousands of times because the skill level isn't there. But hey, a few quarters of lower labor expenses in exchange for long term growth is a great deal when you can just parachute out.

Other mistakes IBM has made includes massive buildup of debt and stock buybacks to inflate the stock price. As bad as the stock looks now, just consider how bad it would be if IBM hadn't spent 8B+ buying back stock. These buybacks have largely been financed by new corporate debt. IBM's market cap is nearly 40% less than only a few years ago. These buybacks hide a lot of the stock price damage (the stock would be worth about $75 instead of ~$130). In addition, buybacks are essentially returning money from the corporation to the shareholders, unwinding the assets. This means IBM management has no plans which could return a higher yield to investors than simply handing back their money -- not great for investor confidence or long term future for IBM.

Source: Employee.

<comment><USER22>
        > faster than it can generate new revenue with Watson

I evaluated the Watson public APIs a little while (a year?) ago, and found them close to useless, yet the amount of hype behind the brand is intense. I wonder what the disconnect is.

<comment><USER23> The speech transcription API is pretty great, but that's the only one I've dealt with in any capacity.

</comment></comment></comment><comment><USER24> IBM makes a lot of money selling ELAs (Enterprise License Agreements) to their customers. An ELA is like buying a bundle of IBM hardware, software and services. It's like buffet dining.

Big companies are no longer buying the buffet and are increasingly opting to go ala carte. Or alternatively, they are negotiating IBM down on prices for the buffet.

It's true that IBM is switching its focus to Cloud services and Watson. However, these are just new, unproven items on the buffet menu.

</comment><comment><USER25> I remember Mr Buffet talking about how awesome IBM's pipeline for the next few years is. Also, this:

[http://www.forbes.com/sites/panosmourdoukoutas/2015/11/17/wh...](http://www.forbes.com/sites/panosmourdoukoutas/2015/11/17/what- warren-buffett-sees-in-ibm-others-are-missing/)

<comment><USER21> Warren Buffet has often said he avoids investing in the tech sector because he does not like to own companies he does not understand. For the life of me, I can not fathom why he broke this cardinal rule with IBM.

<comment><USER26> IBM has run a very aggressive stock buyback scheme for the past few years. Even while their revenues have decreased for 14 straight quarters, they returned $50 billion to shareholders through stock buybacks. They paid for most of this by issuing new debt and manipulating their accounting.

Imagine what they could have accomplished if they invested this into R&D instead.

They've given a huge amount of wealth to their shareholders at the expense of future growth. They can't sustain this much longer.

Some charts illustrating this from 2014 - [http://www.zerohedge.com/news/2014-04-17/great-stock- buyback...](http://www.zerohedge.com/news/2014-04-17/great-stock-buyback- craze-finally-ending)

And them manipulating their finances [http://www.zerohedge.com/news/2015-04-20/ibm-reports- worst-s...](http://www.zerohedge.com/news/2015-04-20/ibm-reports-worst- sales-2002-eps-beats-aggressive-buybacks-cut-tax-rate)

</comment></comment></comment><comment><USER27> According to the CEO the declining revenues are not a bug, they are a feature. From [http://www.cnbc.com/2015/11/03/ibm-ceo-said-sometimes- size-m...](http://www.cnbc.com/2015/11/03/ibm-ceo-said-sometimes-size- matters.html) :

>"In my tenure, I've divested $8 billion of businesses," Rometty said. "The point was, they weren't about the future of where we were going."

>Rometty cited an example of a recent divestiture in hardware — making semiconductors. Now, only 10 percent of IBM is comprised of hardware.

see also their pdf on the same [http://www.ibm.com/annualreport/2013/bin/assets/ibm_ghv_marc...](http://www.ibm.com/annualreport/2013/bin/assets/ibm_ghv_march_2014.pdf)

</comment><comment><USER28> IBM is still a strong company, but they are no longer in the position where they are market leaders in their product lines. Watson is the only new product to catch fire, otherwise they are competing and losing to Oracle and Microsoft. Softlayer is an alsoran. They bought cloudant instead of mongodb. The only thing they do well is consulting and even then they are expensive. They appear to be several years behind their competitors with little chance of catching up.

</comment><comment><USER29> Something not mentioned here is their 'big push' into Design Thinking. IBM have snapped up ~14+ of the graduates from my college course (Visual Communications, IADT, Dublin) flown them out to Austin for a 3 month starter course and now have quiet a substantial design department here in Ireland.

More info: [https://www.ibm.com/design/studio.shtml](https://www.ibm.com/design/studio.shtml)

</comment><comment><USER30> I'm surprised only one comment here mentions patents. IBM are filing patents as fast ever, and while they're trying to get into "the cloud" like everyone else, I get the impression that they're also still working on hardware R&D, as well as the AI research that goes into projects such as Watson.

Also they calculate the Wimbledon serve speeds, so they've got that going for them which is nice.

</comment><comment><USER31> They're doing a bit of quantum computing research and patenting stuff left and right and it's making everyone in the field uncomfortable.

</comment><comment><USER32> Over what time period? Like the last 2 years or longer or shorter? What specifically is the poor being asked about?

</comment><comment><USER33> IBM is failing at devops. It needs to license developer versions of DB2, MQ, and Websphere at free so devs can containerize and spin up instances for unit tests on a whim. It needs to advocate a liquibase type solution too.

Fortune 500 IBM software is also dying because IBM has let DBAs running scripts by hand not version control be the source of truth.

</comment><comment><USER25> Wasn't there something about Warren Buffet investing in IBM?

<comment><USER27> He'd invested $13bn in IBM stock as of his last shareholders letter - <USER2> largest stock position by cost.

</comment></comment><comment><USER34> I joined IBM Global Business Services (IBM's consulting division) in London a couple of years ago.

As others have said, IBM is so big that it can only really be understood as many different companies, all with slightly different cultures. There are plenty of people who are better qualified than me to discuss the overall strategy and financial picture, so I won't even try.

I can, however, give a few opinions about my 2+ years in GBS.

* There is a general lack of respect for technical skills. I was hired as a "Technical Consultant" but put through the same training as the business consultant grads, which is largely about project management / presentation skills. A lot of money is spent on this training, if you ask for funding to (e.g.) attend a developer conference, you are told to forget about it. Maintaining dev skills or learning new ones is to be done in your own time or as part of "giveback", which is the IBM name for extra work done on top of your day job.

* The leadership team is utterly obsessed with maximising billable hours. While this is understandable for a services business, it is taken to ridiculous extremes. People are under such pressure to be billable that they are forced into roles that are completely unsuitable for them, rather than spend a few days waiting for the right role. Training etc gets cancelled at short notice if billable targets are not met, especially in Q4. Last year the entire GBS UK workforce were banned from taking any vacation for several weeks in November and December. A spoof email from senior management was circulated, saying "Christmas is cancelled" which gives an idea of current morale.

* The annual appraisal (PBC) system is a popularity contest. The best way to game the system is to do "giveback" (see above) work for senior people and persuade them to write nice things about you. This is all well and good, but it means that performance in your main job role is actually secondary to how much eminence you can gain by doing odd jobs for senior management. Thankfully IBM has seen the light and retired the PBC process, so I'm looking forward to seeing how well the replacement works.

* I get the feeling that nobody really understands Watson. It seems like the senior execs are under a lot of pressure to buy into the hype and sell Watson to their clients. There is a lot of hand waving about using Watson in "virtual assistant" type of use cases, but I've seen very little of any substance.

* The bureaucracy can be incredibly painful. I once had to go through multiple layers of sign-off involving people in 2 different countries over several weeks, to buy a $25 software licence (which I needed urgently for my job).

* Things are changing, slowly. The iX service line is adopting a startup-like approach on some projects. Agile is being promoted in a big way, and we now have access to modern tools like Slack and Enterprise GitHub.

I hope I don't come across as a bitter, entitled millennial. These are just my opinions.

</comment><comment><USER35> > 14 straight quarters of declining revenue

Yeah, but dat Earnings Per Share though... /s</comment>