Ha! Small world on HN. I haven't personally tried the Edgerouter solution. I've been trying to replicate on pfSense/BSD, but it isn't as simple as you might think. :/
There is varying levels of difficulty when you want to BYO router. The situation for AT&T U-Verse isn't too fun. If you want to use your own hardware, you only have a few options:
1. They offer "IP Passthrough" which is fake Bridge Mode. They still do routing and you'll still hit NAT table limits of 4096. Connection falls apart for anything over 3000.
2. You can dump and reverse the router-gateway firmware and 802.1X/EAP authentication. Oh goodie.
3. There's a history of exploits for the NVG510, NVG589 and NVG599. Try your luck. [1] [2]
4. Create some "magic" to split the 802.1X and untag VLAN0. Works in Linux at least. [3]
5. But good luck if you want to do this in pfSense or FreeBSD. There's an open BTC bounty if you've got any netgraph / networking chops. [4]
> What really worked for me is building a small product. The big picture I have for Logojoy will take years. I was able to get really excited about it because I decided on the simplest version of it. Spend time deciding on the most critical features to launch with, and only build those.
IBM has been recently promoting Docker on z. IBM argues the high I/O capabilities of their platform are a good fit for the container model. (I don't disagree with them. The many-application-on-big-hardware model is not a new concept to IBM. Hell, they invented it.)
Anyways... Since Docker is written in Go, the only way Docker has been available for s390x was by building with gccgo. My guess is that native Go support is in the interest of Docker on z and would be a worthwhile investment for IBM.
Actually, System z (mainframes) still accounts for a quarter of IBM's revenue and about half of its profits. [1] At least, that was the case in 2012. I suspect that hasn't changed much with IBM's recent announcement of the LinuxONE. In fact, IBM contributed significant effort get Node.js (and thereby V8) ported to s390x. [2]
You can blame IBM for that. The fact that they haven't made it easy for security researchers (or anyone really) to tinker hurts the platform.
Up until a few years ago, there was no legal way to run z/OS on hardware that wasn't a million dollar hunk of iron from IBM. IBM has since made a product called Rational Developer and Test Suite [0] available. With it, you get an emulator and a licensed copy of z/OS that you can run on x86. Except it's $9,500 / year.
The only saving grace is an open source project called Hercules [1] which emulates the z/Architecture. If you don't mind breaking some copyright laws, there is no technical reason why you can't download a copy of z/OS and run it under Hercules. But good luck finding the latest version. Want to test your research against the latest maintenance levels? Good luck.
For the security researchers out there, mainframes are really under-researched. There just aren't many people that have the expertise in the platform required for security research. And most of the people who do have expertise in the platform are often oblivious to technologies outside of the mainframe. (If you've ever dealt with mainframe people, you might know what I am talking about.) It's unfortunate, but too often true. Our best mainframe guy is brilliant. I've never met anyone more technically skilled in his platform. But ask him a basic Windows or a Linux question? Forget it.
With today's complex stack of multiple platforms in most enterprises, a good security researcher, IMHO, should be fluent with both worlds. Mainframes are where some of our most critical data is stored. When you pull up your account balance through your bank's website, there's a good chance that value was read off a mainframe.
Mainframers are old-school. They don't believe in public disclosure or open security models or public audits. If you go through the DEFCON and BlackHat archives, there's not much mainframe research out there. There's just a small community of mainframers on the Internet, but it's a significant part of the world's infrastructure. The mainframe world is a crazy alternate reality. (I know, because it's my day job.)
Phillip Young, the guy who owns this Tumblr project, has made some waves in this community. His talks are a great place to start. Here's a few resources to get you started:
> What kind of demand do you think there is for a Linux-only mainframe?
I think the answer really depends on IBM. Technically speaking, the hardware is rock-solid. There are no single points of failure in mainframe systems. But there are still some obscurities with the platform. There's a lot of packages you'd expect to be available in your s390x distribution of RedHat or SUSE that missing. And that's probably because the average open-source developer/maintainer doesn't have the means to develop/test on a mainframe.
IBM needs to realize they have an open operating system on a closed platform and the two don't mix. They are taking steps in the right direction, but time will tell if they get there. And they have to prove they can compete with the x86 guys on price.
> My limited understanding is that most mainframe customers are locked-in, e.g. they have legacy COBOL code running their ledger system and the expense to switch off of it is simply prohibitive. That plus the fact that the system is reliable, low-maintenance, etc. preserves the status quo, despite the fact that if you were to write the same applications today, you'd choose a newer platform because it would be more cost-effective.
You are mostly on track there. Mainframes haven't died because of many of the reasons you listed above. But I'd have to disagree with last statement about choosing a "newer" platform. Mainframe hardware is modern hardware, in the sense they are updated every one to two years. Mainframe operating systems are modern operating systems. They also get updated every one to two years. If you look at every industry that has been around for more than 30 years, almost all of their mission critical workloads are done on System z. Cheaper isn't cheaper when you have downtime.
But for some workloads, you are right: companies are only on mainframes because migrating to a different platform would be too costly. Even over 10, 15, 20 years.
You are preaching to the choir! I am not an IBMer, so I have the same gripes.
Mainframes gradually exited academia in the mid-80s. It was a terrible mistake by IBM, because they essentially eliminated the next generation of mainframers. They've since come to their senses with a program called the IBM Academic Initiative [0] which promotes the use of mainframes in Computer Science courses. It's only about 20 years too late.
But I think they could do a better job. Up until recently, the only way to try z/OS without accessing million dollar hardware was to break the law. You literally had to torrent a pirated copy of z/OS. And it's not easy to find. A few years ago, IBM changed this with their tool: Rational Developer and Test for System z [1]. It's essentially Hercules but you get a legal copy of z/OS. And it's $9500 per year per CPU. And there is some stupid hardware license usb key.
And regarding your questions, your points are valid. Vendor lock-in is a concern. IBM is the only player in the business, and they know it. But look at every major industry that's been around at least 30 years: all the mission critical stuff runs on a mainframe. Maybe it's because it's the only thing that runs their legacy COBOL code. But it works and it's rock solid.
The poster child of migrating to Linux on z is Nationwide. They successfully moved almost all of their x86 processing to Linux on z and saved a ton of money. There's the definitely-not-vendor-biased white paper out there. Do some googling on "Nationwide Linux on z".
It's hard to answer "z/OS vs Linux on z" generically, because there's use cases for both. But perhaps the most generic answer I can give you in favor of Linux is: familiarity.
z/OS has a long history. It's predecessor, OS/390, dates back to the 1990s. Before OS/390, there was OS/360 which dates back to the 60s. Back then, IBM was first to market on business computer processing. (That was the only computer processing.) Major industries, like financial, insurance, and airlines, poured their infrastructure into mainframes, because it was the only name in the game. IBM prides itself in assuring its customers that the COBOL code that ran your business back in the 80s will still run today on z/OS 2.1 (the current version of z/OS). Chances are, when you swipe your credit card, that transaction touches a mainframe and probably some code that was written in the 1980s. Or earlier. I know, because I've seen the timestamps.
This compatibility is really evident when you use z/OS. The green screen is perhaps the most obvious example. When you see a systems programmer (that's mainframe-talk for sysadmin) debugging a system, you'll see them page through a really archaic, unsexy TN3270 interface. Why? The same reason Unix (and thereby Linux) uses teletype. Because that's what the operating system was built on.
Sure. z/OS has Unix System Services. In fact, it's even POSIX compliant. But can you `apt-get install ruby`?. No. There's no Ruby for z/OS (unless you count JRuby). There's no package manager for USS. It's just plain, vanilla Unix. There's no new open source contributions. There's no Bash that comes with the operating system. You get a 10 year old version of Shell. There's all kinds of shenanigans with SCP/SFP and ASCII/EBCDIC. IBM has to maintain the tools. (Actually, it's been turned over to Rocket Software.) It feels very "round peg, square hole".
So z/OS has an image problem. IBM made a huge mistake back in the mid-80s. When commodity x86 PCs became available, universities realized they could teach their computer science programs on cheaper hardware instead of expensive mainframes. Compute Science is platform agnostic, right? What IBM didn't do is recognize this as a problem. They didn't give out free mainframes to universities, so schools quit teaching with them. How many people do you know under 30 that had a mainframe-based curriculum? And for the self-taught, how are you suppose to learn the basics of a platform if costs millions of dollars? Anybody can install Linux on their $100 laptop in a few hours. But mainframes?
Fast-forward a couple of decades and now you have a talent pool that's extremely saturated with x86 people. And the mainframe people? Well, they are all retiring and there aren't many replacements. Second-generation mainframers are far and few. (I'm one of them.)
So let's say you have a new workload. It's undeveloped. What platform should you choose? There's probably not many technical reasons why you could not accomplish what you want to do in z/OS. But how many people do you know that consider themselves proficient with debugging z/OS? Outside of "dead languages", your options are pretty much limited to Java. (There's a few exceptions to this, but Java is the biggest modern language player.) But that's not to say there isn't any new development happening in the z/OS space. There's plenty of new workloads coming to WebSphere on z because porting a WebSphere application could be pretty easy. There's also performance benefits when you are on the same system where all your financial records are stored. z/OS is definitely an option, but it varies by use case.
With Linux on z, you get real Linux. And the majority know Linux. The majority can debug Linux. And you get the same benefits of being on rock-solid mainframe hardware and you get memory-speed I/O against mainframe data and services through a special networking interface called Hipersockets. Mainframes are also pretty good a virtualization, because they invented it. (z/VM has it's roots dating back to the 70s.)
By trade, I am a mainframe systems programmer at a large financial institution. My group is responsible for mainframe operating systems: z/OS (it may also be referred to as MVS), z/VM (the mainframe hypervisor), and z/Linux (Linux on a mainframe) and many of the software components that go along with these.
I'm really excited about this announcement. I think IBM finally realized they need to be more open if they want to grow the Linux on z community. I just hope they are not too late to the game.
There's a lot of mystery and misconception behind mainframes, so I am happy to answer any questions about mainframes that I can.
People fall into the mistake of just comparing cores and memory specs between x86_64 and s390x. The hardware redundancy benefits are pretty huge. You really need a full proof-of-concept to get any picture of how your workload might run on System z.
Do you have a source on if the LinuxONE Emprorer is actually a z13 underneath? It wouldn't be surprised if the Emperor and Rockhopper are just re-branded z13s and z114s.
https://forum.pfsense.org/index.php?topic=111043.0