decoration decoration
Stories

GROKLAW
When you want to know more...
decoration
For layout only
Home
Archives
Site Map
Search
About Groklaw
Awards
Legal Research
Timelines
ApplevSamsung
ApplevSamsung p.2
ArchiveExplorer
Autozone
Bilski
Cases
Cast: Lawyers
Comes v. MS
Contracts/Documents
Courts
DRM
Gordon v MS
GPL
Grokdoc
HTML How To
IPI v RH
IV v. Google
Legal Docs
Lodsys
MS Litigations
MSvB&N
News Picks
Novell v. MS
Novell-MS Deal
ODF/OOXML
OOXML Appeals
OraclevGoogle
Patents
ProjectMonterey
Psystar
Quote Database
Red Hat v SCO
Salus Book
SCEA v Hotz
SCO Appeals
SCO Bankruptcy
SCO Financials
SCO Overview
SCO v IBM
SCO v Novell
SCO:Soup2Nuts
SCOsource
Sean Daly
Software Patents
Switch to Linux
Transcripts
Unix Books

Gear

Groklaw Gear

Click here to send an email to the editor of this weblog.


You won't find me on Facebook


Donate

Donate Paypal


No Legal Advice

The information on Groklaw is not intended to constitute legal advice. While Mark is a lawyer and he has asked other lawyers and law students to contribute articles, all of these articles are offered to help educate, not to provide specific legal advice. They are not your lawyers.

Here's Groklaw's comments policy.


What's New

STORIES
No new stories

COMMENTS last 48 hrs
No new comments


Sponsors

Hosting:
hosted by ibiblio

On servers donated to ibiblio by AMD.

Webmaster
Dr. Ivie Declares his Suppositions - Updated: Jan. 18th motion hearing transcript
Monday, March 26 2007 @ 07:30 AM EDT

Here is SCO expert Evan Ivie's Declaration in Support of SCO's Motion for Reconsideration by the Magistrate Court of the Order Denying SCO's Motion for Relief for IBM's Spoliation [PDF]. As you'll recall, the Magistrate Judge, Brooke Wells, already ruled against SCO on this motion, so SCO is trying to suggest that she made a mistake, or as they delicately phrase it, she suffered from a "misapprehension of fact and law". Here's SCO's Memorandum in Support [PDF], so you can match it all up with this declaration.

The whole point of Magistrate Judge Brooke Wells' order was that there was no proof before her that there was any evidence lost or destroyed by IBM, as she expressed it [PDF] at the hearing on SCO's motion on January 18th:

I am going to find that based upon the evidence before me, as it's put into context, reflects that SCO's motion will be denied. It cannot show that any evidence was lost or destroyed. In fact, I find that it is available and has been available through CMVC. The evidence before me, when seen in context, does not show that IBM acted in bad faith, nor does the evidence show that it has been prejudiced because the evidence, as I indicated, has been and is reasonably available. So the motion regarding spoliation and the adverse inference instruction will be denied.

SCO would like to change her mind, and Ivie's job is to support the idea that the materials IBM deleted were vital to his task of parsing out IBM's evil-doing.

IBM told the court that their Linux programmers don't use sandboxes for Linux development. Ivie says he thinks they do. He presents no evidence of that, but he presents his supposition that they must, because in his mind developing without a sandbox would be "like taking a tractor away from a farmer and giving him a shovel." He also states that "any sizable software development effort requires the use of a change/version management and control system", and from his extravagant description of what a sandbox can do, they are certainly more useful than any CMVC-type of system. According to Ivie, every programmer's squiggle, doodle or false start is carefully preserved to time indefinite in those sandboxes where programmers play with their code. If you look at the sandbox, you could trace every move they've ever made. Isn't that exactly how it is with your sandboxes?

Snort.

Look. We have all played in sandboxes as kids. We built castles one day, then knocked them down the next to build a fort, with the same sand. Or if the castle wasn't quite what we imagined it would be, and we didn't like it, what did we do? We immediately knocked it down and started over. That is what a sandbox is, a transitory play area where resources are used and then reused. Programmers use a sandbox to try things out and test things and then if it works, it gets added to the code base. If it doesn't work, you erase and try again. But either way, *it doesn't stay there*. To trace all the versions, just look at the CMVC or whatever system the working code goes into. That is where all the versions of the code will be found.

Here's what else he doesn't factor in, beyond the simple truth that sandboxes get cleaned out regularly to make room for further development and the obvious fact that no one needs to preserve code that didn't work out or that has been put into a CMVC type of system for preservation. Linux is different. It isn't developed like AIX or Dynix or Vista. Thank heaven. It's developed by many individual volunteers from all over the world and it just happens that IBM doesn't own or control Linux or host the main development process. Linux is not Unix, SCO fantasies to the contrary. It isn't controlled by any vendors. Not that they wouldn't love it. AIX code goes into CMVC, with check in and out notations, but Linux code doesn't and what was erased wasn't Linux code in any case, so whatever Mr. Ivie is looking for can be found there in CMVC. That is because IBM controls that code, SCO contract theories notwithstanding. But Linus controls Linux, not IBM. Might that give us a clue?

Linux is revolutionary in its development method, which is maybe why SCO claimed, falsely, back in 2003 that it wasn't possible to control what went into it. Now, their expert would like us to believe that IBM *must* be able to control every passing byte its Linux programmers so much as think about. It *must be* possible to control it, IBM *must* actually control it, and so IBM must be lying, implies this expert. And since he can't find evidence sufficient to support that statement the way he wanted to, therefore, they must have deleted the evidence that would have proven their guilt. Ivie imagines scenarios that in his mind *could* happen that *could* result in copying and opines how valuable it would be if he could have had access to the sandboxes that IBM has already said it didn't use that Ivie assures the judge they must have used.

That is what Judge Wells "misapprehended". She goofed by not hopping on to SCO's Magical Mystery Tour Bus so they could take her for a ride. So there you are. The shifting sands of SCO. Ah. Now there's an appropriate saying.

Did you know you could be sued over thin air? Over some paid expert's mere suppositions of what could have or might have happened based on his ideas of what most folks probably do? And may I ask the obvious? If this was SCO's theory, when it first heard years ago that some computers had been cleaned out, why didn't it ask to forensically examine those computers? Or at least depose the folks that used the computers in question? Maybe because this is all silly?

After all these years of what felt like interminable discovery, and SCO telling the court that if it could gain access to CMVC it could find the allegedly infringing code, and getting access to all that code, this is what SCO's expert puts on the judge's table. Litigation by supposition, by imagined wrongdoing. Who needs evidence? It must be so, and therefore it is. If there is no evidence, it must have been erased. Off with their heads. This wouldn't even work in a kangaroo court. Well. I guess it could there, but in the US legal system, you are supposed to provide actual evidence. The idea is that you can only get in trouble for what you actually did. What a concept.

SCO, in my opinion, misrepresents Ivie's Declaration when it writes this in its Memorandum in Support of its Motion for Reconsideration:

SCO's computer science expert Evan Ivie has also confirmed that "IBM programmers for Dynix/ptx and Linux, as well as AIX, used sandboxes, or other similar workspaces or programming environments, to draft, revise and implement computer software for those systems.

Is that true? Compare that characterization with what he actually said:

4. Thus, contrary to IBM counsel’s representation, I believe that IBM programmers for Dynix/ptx and Linux, as well as AIX, used sandboxes, or other similar workspaces or programming environments, to draft, revise and implement computer software for those systems.

The first, SCO's version, makes it sound like a fact in evidence. The actual quotation is a speculation. And that, in a nutshell, is precisely what is wrong with this Declaration.

Some of us are not programmers, including me, so I thought it would be worthwhile to ask one what he thinks of Ivie's suppositions, so I contacted a guy with some 35 years' experience as a programmer and I asked if what Dr. Ivie states as being the one and only way to program is in fact an accurate portrayal. He disagrees with Dr. Ivie, telling me that "there are many methods for accomplishing development tasks that are not as Dr. Ivie portrays them but are not a reversion to 1950-1960 development styles." He says he always feels free to delete false starts or earlier versions, to free up resources for further development, so if you took a look at his workspaces, you wouldn't find anything other than what you'd find in the source code control systems he used. For that reason, he tells me, looking at the finished product would be at least as useful, and actually more so, than looking at the workspace.

I've put his remarks* after SCO's filing, in a second annotated version. His comments are indented and in blue text. Feel free to add your thoughts and experiences, those of you who are also programmers. But the bottom line is, he fully contradicts Dr. Ivie's suppositions.

I want to apologize for all the down time over the weekend. Yes, more hardware troubles. I think we have a solution coming soon, but for the moment, things are rather delicate, so bear with us, please.

UPDATE:

I have the text of the January 18th hearing** on SCO's original motion regarding spoliation done. The hearing is the first exhibit attached by SCO to this motion [PDF] asking for reconsideration. I think it really helps to understand the entire matter more clearly. Until now, we had our eyewitness reports, but this is the exact transcript. There were two motions heard that day, and I'll post the entire transcript at some point, but I didn't want you to have to wait for this part of it, so I'll put this at the very end, after a double row of stars. As usual, we present it as is, and in this case the transcript repeatedly spells Linux as Lunux and spoliation as spoilation, so don't let it bug you.

*****************************

Brent O. Hatch (5715)
HATCH, JAMES & DODGE, PC
[address, phone, fax]

Robert Silver (admitted pro hac vice)
Edward Normand (admitted pro hac vice)
BOIES, SCHILLER & FLEXNER LLP
[address, phone, fax]

Devan V. Padmanabhan (admitted pro hac vice)
DORSEY & WHITNEY LLP
[address, phone, fax]

Stephen N. Zack (admitted pro hac vice)
BOIES, SCHILLER & FLEXNER LLP
[address, phone, fax]

Stuart Singer (admitted pro hac vice)
BOIES, SCHILLER & FLEXNER LLP
[address, phone, fax]

Attorneys for Plaintiff, The SCO Group, Inc.

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF UTAH

_________________________

THE SCO GROUP, INC.

Plaintiff/Counterclaim-Defendant,

v.

INTERNATIONAL BUSINESS
MACHINES CORPORATION,

Defendant/Counterclaim-Plaintiff.

___________________________

DECLARATION OF EVAN IVIE IN
SUPPORT OF SCO’S MOTION FOR
RECONSIDERATION BY THE
MAGISTRATE COURT OF THE
ORDER DENYING SCO’S MOTION
FOR RELIEF FOR IBM’S SPOLIATION OF EVIDENCE

Case No. 2:03CV-0294DAK

Honorable Dale A. Kimball
Magistrate Judge Brooke C. Wells

1. I was retained by counsel to SCO to analyze the technical evidence in this case and to serve as a consultant and expert witness. I have been asked to comment on the use of sandboxes or similar programming environments in the development of Linux code at IBM, the importance to the case of information in such sandboxes, and whether other sources of information such as CMVC or RCS might suffice in evaluating what went on in that development process in sandboxes. My qualifications are set forth in my May 19, 2006 report submitted in this case.

Programming Environments (e.g. Sandboxes) Were Used by IBM Linux and Dynix/ptx Programmers

2. I understand that counsel for IBM represented that sandboxes were not used for Linux development. Any creative process requires an environment and facility where that creative process can take place. An artist creates paintings in a studio. A woodcarver creates carvings in a woodshop. Artisans, craftsmen, and skilled workers develop facilities where they can perform their work: workbenches, body shops, bakeries, etc. Programmers are no different.

3. At Bell Labs I decided to use Ken Thompson’s newly developed Unix operating system as the basis for a Programmer’s Workbench (PWB), a facility where programmers could create software. Unix was an ideal environment for such work when enhanced with the set of tools that we developed. Within Bell Labs, and at a number of other companies, the PWB became the standard environment for software development at that time. Whether you call this workspace a programmer’s workbench, a sandbox, or some other name, it is essential to the software development process. IBM has used the term “sandbox” in a number of depositions and other documents.

2

4. Thus, contrary to IBM counsel’s representation, I believe that IBM programmers for Dynix/ptx and Linux, as well as AIX, used sandboxes, or other similar workspaces or programming environments, to draft, revise and implement computer software for those systems.

5. If IBM had not adopted and/or developed some type of suitable environment for their programmers, it would have taken them back to the late 1950’s and early 1960’s and would have made programming an incredibly inefficient and slow process. This would be like taking a tractor away from a farmer and giving him a shovel. Even if IBM had tried it, programmers would have resisted the move.

Information in Programming Environments (e.g. Sandboxes)

6. An adequate programming environment provides a place where all of the basic functions involved in software development can be performed. This includes the storage space to keep code, data, documents, and other information. It also includes suitable tools to perform the functions needed to create a software system. Below is a list of some of the activities performed in a programming environment or sandbox:

• the creation of design documentation specifying the functionality of each module, routine, subsystem, etc.;

• the definition of interfaces between software entities including arguments, parameters, flags, sequencing, etc.;

• the specification of structures, file formats, databases, constants, variables, etc.;

• the approach to be used in the testing each function, subroutine and module; • the plan for subsystem and system level testing;

• the specific tests to be undertaken, the test scenarios, the test data, etc.;

• the capability to perform such tests in the context of the total system;

3

• the creation of code modules, the compiling of that code, and the linking of it together;

• the reasoning, behind algorithms and the motivation behind the various designs;

• all of this documentation for each software entity at each level of abstraction; and

• suitable backup to protect the system and so that when programmers hit a roadblock the system can be rolled back to an earlier state and development can begin again there.

7. In addition to the sandbox or programming environment functionalities enumerated above, any sizable software development effort requires the use of a change/version management and control system. The SCCS system developed by Marc Rochkind is the granddaddy of such systems. Other such systems involved in this case include CMVC, RCS, CVS, and bitkeeper. 12 A source code control system is one good source of information when trying to track a software development effort, and I did a number of searches of revision control information in these systems. One example of my use of this information is found paragraph 98 of my expert report where I note that a CMVC entry admits that JFS is based on System V Unix.

CMVC and Other Such Systems Are Not a Substitute for Programming Environment Information

8. There are several fundamental flaws in the use a change control system, such as CMVC or RCS, to track a software development effort. A typical change control system allows a programmer to “check out” a module, to modify and test it for some unspecified

4

amount of time, and then when satisfied to “check it back in” to the system. Perhaps this might be compared to trying to see what is going on in a darkened room with a strobe light. However, the strobe only illuminates a small part of the room (the code checked in and out) and the strobe is controlled by a programmer who may or may not want you to see all that is going on (visibility only at check-in time).

9. For example, let us assume that the programmer is developing a module for Linux, but is basing it on a module that comes from a contractually-protected operating system owned by another company. If the only visibility that we have is the module after it has been appropriately disguised, then tracing the source becomes much more difficult. Perhaps one could compare this to a body shop for processing stolen cars. It is much easier to prove auto theft if one can find the body shop being used. After a paint job, changes to upholstery, options, accessories, and careful modification of the engine and body numbers, it is much more difficult to identify the theft.

10. It should be noted that a developer’s computer can hold more than one sandbox. They could be different versions of the same project, or they could be different projects. Take for example a computer with both an AIX and Linux sandbox. This creates the capability for a programmer to copy code from one sandbox (that had been checked out from the change control system) and use it in developing code for another sandbox.

11. Another specific example of valuable information that would have been in a programming environment or sandbox, but not in a change control system such as CMVC or RCS, is the timing of access to code files. Most computers, including Unix and Windows,

5

maintain the last access time of each file they store. 3 In other words, the computer keeps a record of the last time a file was viewed. If a file containing AIX or Dynix/ptx code was viewed in proximity to access to a Linux file, or even after the Linux files were created, that would cause concern that the AIX files were used to develop the Linux files.

12. The claim that SCO did not need access to the programming environment/sandbox information because the code was available in CMVC (or RCS) ignores the following basic problems:

• CMVC and RCS would not show whether code from AIX and Dynix/ptx was copied, retained, and used by IBM Linux programmers in the development of IBM contributions to Linux, or what particular code was copied, retained, and used.

• A programming environment or sandbox is the only place where the progression of code drafts can be viewed, from the initial version to subsequent versions. For AIX code, CMVC shows the initial code that was checked out, and the final code that was checked back in, but not all the steps in between. RCS, the system on which Dynix/ptx code is saved, shows even less. These intermediate drafts, – saved only on programmers’ sandboxes or similar workspaces –would have been important to develop further proof of IBM’s copying.

Importance of Programming Environment Information to SCO/ IBM Case

13. Despite the loss of programming environment and sandbox information through the destruction initiated by IBM management, we were able to find numerous cases where code from Dynix/ptx and AIX found its way into IBM’s disclosures to Linux. This effort would have been significantly easier if the evidence in programming environments and sandboxes had not been destroyed.

6

14. If I had known which Dynix/ptx and AIX code IBM’s Linux programmers had retained on their programming environments or sandboxes, I would have compared the programmers’ Linux disclosures to that code – which would have been easier than trying to compare the final Linux disclosures to the entire body of AIX and Dynix/ptx code available. This would have enabled more specific identification of the AIX or Dynix/ptx code on which the programmers’ Linux disclosures was based

15. If I had access to drafts of programmers’ Linux code from programming environments and sandboxes that also contained AIX or Dynix/ptx code, I could have identified even more specifically the copying that occurred.

7

I hereby certify under penalty of perjury and the laws of the State of Utah and the United States of America that the foregoing is true and correct.

Signed this 16th day of March 2007 at Nauvoo, Illinois.

[ signature ]

Dr. Evan Ivie


1 “What is your preferred revision control system, http://www.perlmonks.org/?displaytype=print;node_id=394350;replies=1

2 “ List of Revision Control Software, http://en.wikipedia.org/wiki/List_of_revision_control_software

3 "Unix records three file times in the inode, these are referred to as ctime, mtime, and atime. The ctime field refers to the time the inode was last changed, mtime refers to the last modification time of the file, and atime refers to the time the file was last accessed." http://userpages.umbc.edu/~jack/ifsm498/filesystem.html

8

CERTIFICATE OF SERVICE

Plaintiff/Counterclaim-Defendant, The SCO Group, Inc., hereby certifies that a true and correct copy of the foregoing was served on Defendant/Counterclaim-Plaintiff, International Business Machines Corporation, on this 20th day of March 2007, via CM/ECF to the following:

David Marriott, Esq. [email]
Cravath, Swaine & Moore LLP
[address]

Todd Shaughnessy, Esq. [email]
Snell & Wilmer LLP

/s/ Edward Normand

9

*****************************************************

This is the version* with comments by Groklaw's MumbleGrumble in blue text, with the headers and footnotes left out for simplicity:

Brent O. Hatch (5715)
HATCH, JAMES & DODGE, PC
[address, phone, fax]

Robert Silver (admitted pro hac vice)
Edward Normand (admitted pro hac vice)
BOIES, SCHILLER & FLEXNER LLP
[address, phone, fax]

Devan V. Padmanabhan (admitted pro hac vice)
DORSEY & WHITNEY LLP
[address, phone, fax]

Stephen N. Zack (admitted pro hac vice)
BOIES, SCHILLER & FLEXNER LLP
[address, phone, fax]

Stuart Singer (admitted pro hac vice)
BOIES, SCHILLER & FLEXNER LLP
[address, phone, fax]

Attorneys for Plaintiff, The SCO Group, Inc.

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF UTAH

_________________________

THE SCO GROUP, INC.

Plaintiff/Counterclaim-Defendant,

v.

INTERNATIONAL BUSINESS
MACHINES CORPORATION,

Defendant/Counterclaim-Plaintiff.

___________________________

DECLARATION OF EVAN IVIE IN
SUPPORT OF SCO’S MOTION FOR
RECONSIDERATION BY THE
MAGISTRATE COURT OF THE
ORDER DENYING SCO’S MOTION
FOR RELIEF FOR IBM’S SPOLIATION OF EVIDENCE

Case No. 2:03CV-0294DAK

Honorable Dale A. Kimball
Magistrate Judge Brooke C. Wells

1. I was retained by counsel to SCO to analyze the technical evidence in this case and to serve as a consultant and expert witness. I have been asked to comment on the use of sandboxes or similar programming environments in the development of Linux code at IBM, the importance to the case of information in such sandboxes, and whether other sources of information such as CMVC or RCS might suffice in evaluating what went on in that development process in sandboxes. My qualifications are set forth in my May 19, 2006 report submitted in this case.

Programming Environments (e.g. Sandboxes) Were Used by IBM Linux and Dynix/ptx Programmers

2. I understand that counsel for IBM represented that sandboxes were not used for Linux development. Any creative process requires an environment and facility where that creative process can take place. An artist creates paintings in a studio. A woodcarver creates carvings in a woodshop. Artisans, craftsmen, and skilled workers develop facilities where they can perform their work: workbenches, body shops, bakeries, etc. Programmers are no different.

3. At Bell Labs I decided to use Ken Thompson’s newly developed Unix operating system as the basis for a Programmer’s Workbench (PWB), a facility where programmers could create software. Unix was an ideal environment for such work when enhanced with the set of tools that we developed. Within Bell Labs, and at a number of other companies, the PWB became the standard environment for software development at that time. Whether you call this workspace a programmer’s workbench, a sandbox, or some other name, it is essential to the software development process. IBM has used the term “sandbox” in a number of depositions and other documents.

2

4. Thus, contrary to IBM counsel’s representation, I believe that IBM programmers for Dynix/ptx and Linux, as well as AIX, used sandboxes, or other similar workspaces or programming environments, to draft, revise and implement computer software for those systems.

5. If IBM had not adopted and/or developed some type of suitable environment for their programmers, it would have taken them back to the late 1950’s and early 1960’s and would have made programming an incredibly inefficient and slow process. This would be like taking a tractor away from a farmer and giving him a shovel. Even if IBM had tried it, programmers would have resisted the move.

Item 5 draws conclusions without supporting evidence. First, as I point out below there are many methods for accomplishing development tasks that are not as Dr. Ivie portrays them but are not a reversion to 1950-1960 development styles. Second, I would not venture a guess as to what IBM developers would resist or not resist as I was not there at the time. Was Dr. Ivie?

Information in Programming Environments (e.g. Sandboxes)

6. An adequate programming environment provides a place where all of the basic functions involved in software development can be performed. This includes the storage space to keep code, data, documents, and other information. It also includes suitable tools to perform the functions needed to create a software system. Below is a list of some of the activities performed in a programming environment or sandbox:

• the creation of design documentation specifying the functionality of each module, routine, subsystem, etc.;

• the definition of interfaces between software entities including arguments, parameters, flags, sequencing, etc.;

• the specification of structures, file formats, databases, constants, variables, etc.;

• the approach to be used in the testing each function, subroutine and module; • the plan for subsystem and system level testing;

• the specific tests to be undertaken, the test scenarios, the test data, etc.;

• the capability to perform such tests in the context of the total system;

3

• the creation of code modules, the compiling of that code, and the linking of it together;

• the reasoning, behind algorithms and the motivation behind the various designs;

• all of this documentation for each software entity at each level of abstraction; and

• suitable backup to protect the system and so that when programmers hit a roadblock the system can be rolled back to an earlier state and development can begin again there.

There are many assumptions made in paragraph 6 that are not necessarily true. The developer’s workspace does not always contain:
1) Design documents.
2) The approach used for unit testing.
3) The subsystem and system level test plans.
4) The testing results.
5) The documentation for the use of the code.

Indeed, in many organizations I have worked for over the last 35 years:

1) Design documents (including requirements, functional specifications and detailed designs) have been written by people different that the actual code developer and stored in document control and database systems that were wholly separate from the source code control and product build systems.

2) In my experience it is a very good idea for a different person than the code developer to write the test plan and the unit test code (if unit test code is required at all; some development does not require it.) This tends to insure more complete test coverage and often points out missing elements in the developer’s thinking.

3) Usually subsystem and system level test plans are written by people who are NOT the developers of the code. The reasons given immediately above apply here also but so does the fact that subsystem and system level testing must incorporate thinking and information about the entire subsystem and/or system which is often not available to the individual developers during their development cycle. Indeed, the entire subsystem and/or system code may not be available to the individual developers as it may not all be complete at the same time. Code may also come from several physically diverse locations and require an integration team to put the various pieces together (including third party software) prior to its being ready for subsystem and/or system level testing.

4) Documentation may be developed by an information development team which, of course, might have its own development tools, workspaces, documentation control and delivery systems.

7. In addition to the sandbox or programming environment functionalities enumerated above, any sizable software development effort requires the use of a change/version management and control system. The SCCS system developed by Marc Rochkind is the granddaddy of such systems. Other such systems involved in this case include CMVC, RCS, CVS, and bitkeeper. 12 A source code control system is one good source of information when trying to track a software development effort, and I did a number of searches of revision control information in these systems. One example of my use of this information is found paragraph 98 of my expert report where I note that a CMVC entry admits that JFS is based on System V Unix.

CMVC and Other Such Systems Are Not a Substitute for Programming Environment Information

In my experience the source control system is likely to be the most complete repository of the code development history. The workspaces I have used rarely, if ever, had a history of the various code changes I made with each edit. However, I often checked the code back into the source code control system prior to completion to insure that, should some thing happen to me or the computer on which my workspace was resident, the code would not be lost.

In addition, I have always felt free to delete from my workspaces files containing “false starts” and/or files that I may have modeled my new code after. Examining my workspaces long after my projects were complete would rarely, if ever, provide more information that examining the code I delivered in the source code control systems I used. Indeed, examining the delivered product would be far more useful than examining my workspaces.

Finally, I have always felt free to delete the entire workspace once I delivered the code and it was integrated into the product. Since workspaces consume vital computer system resources it has often been necessary to delete old workspaces to free up those resources for further development.

8. There are several fundamental flaws in the use a change control system, such as CMVC or RCS, to track a software development effort. A typical change control system allows a programmer to “check out” a module, to modify and test it for some unspecified

4

amount of time, and then when satisfied to “check it back in” to the system. Perhaps this might be compared to trying to see what is going on in a darkened room with a strobe light. However, the strobe only illuminates a small part of the room (the code checked in and out) and the strobe is controlled by a programmer who may or may not want you to see all that is going on (visibility only at check-in time).

9. For example, let us assume that the programmer is developing a module for Linux, but is basing it on a module that comes from a contractually-protected operating system owned by another company. If the only visibility that we have is the module after it has been appropriately disguised, then tracing the source becomes much more difficult. Perhaps one could compare this to a body shop for processing stolen cars. It is much easier to prove auto theft if one can find the body shop being used. After a paint job, changes to upholstery, options, accessories, and careful modification of the engine and body numbers, it is much more difficult to identify the theft.

10. It should be noted that a developer’s computer can hold more than one sandbox. They could be different versions of the same project, or they could be different projects. Take for example a computer with both an AIX and Linux sandbox. This creates the capability for a programmer to copy code from one sandbox (that had been checked out from the change control system) and use it in developing code for another sandbox.

11. Another specific example of valuable information that would have been in a programming environment or sandbox, but not in a change control system such as CMVC or RCS, is the timing of access to code files. Most computers, including Unix and Windows,

5

maintain the last access time of each file they store. 3 In other words, the computer keeps a record of the last time a file was viewed. If a file containing AIX or Dynix/ptx code was viewed in proximity to access to a Linux file, or even after the Linux files were created, that would cause concern that the AIX files were used to develop the Linux files.

Assuming that the developer did not delete the files from their work space and did not touch them in some way that would alter the times, this might be true. However, I fail to see how this information would be of more use than the code checked into the source code control system. This item appears to me to be a “red herring”. Does anyone else see something I have missed?

Also, as mentioned above, by the time the code makes it to a field release of the product, I have almost always deleted my workspace to recover the resources so all the information listed above would be lost.

12. The claim that SCO did not need access to the programming environment/sandbox information because the code was available in CMVC (or RCS) ignores the following basic problems:

• CMVC and RCS would not show whether code from AIX and Dynix/ptx was copied, retained, and used by IBM Linux programmers in the development of IBM contributions to Linux, or what particular code was copied, retained, and used.

• A programming environment or sandbox is the only place where the progression of code drafts can be viewed, from the initial version to subsequent versions. For AIX code, CMVC shows the initial code that was checked out, and the final code that was checked back in, but not all the steps in between. RCS, the system on which Dynix/ptx code is saved, shows even less. These intermediate drafts, – saved only on programmers’ sandboxes or similar workspaces –would have been important to develop further proof of IBM’s copying.

As I believe I have made clear there are conclusions drawn in item 12 that are based on supposition of what might have been in the workspaces and not based on known facts. Certainly, in workspaces I have used for development, the information would have never been available.

Importance of Programming Environment Information to SCO/ IBM Case

13. Despite the loss of programming environment and sandbox information through the destruction initiated by IBM management, we were able to find numerous cases where code from Dynix/ptx and AIX found its way into IBM’s disclosures to Linux. This effort would have been significantly easier if the evidence in programming environments and sandboxes had not been destroyed.

6

14. If I had known which Dynix/ptx and AIX code IBM’s Linux programmers had retained on their programming environments or sandboxes, I would have compared the programmers’ Linux disclosures to that code – which would have been easier than trying to compare the final Linux disclosures to the entire body of AIX and Dynix/ptx code available. This would have enabled more specific identification of the AIX or Dynix/ptx code on which the programmers’ Linux disclosures was based

15. If I had access to drafts of programmers’ Linux code from programming environments and sandboxes that also contained AIX or Dynix/ptx code, I could have identified even more specifically the copying that occurred.

I am no legal expert but 13, 14 and 15 appear to be conclusion based of what might have been in the workspaces and not based on known fact.

7

I hereby certify under penalty of perjury and the laws of the State of Utah and the United States of America that the foregoing is true and correct.

Signed this 16th day of March 2007 at Nauvoo, Illinois.

[ signature ]

Dr. Evan Ivie


1 “What is your preferred revision control system, http://www.perlmonks.org/?displaytype=print;node_id=394350;replies=1

2 “ List of Revision Control Software, http://en.wikipedia.org/wiki/List_of_revision_control_software

3 "Unix records three file times in the inode, these are referred to as ctime, mtime, and atime. The ctime field refers to the time the inode was last changed, mtime refers to the last modification time of the file, and atime refers to the time the file was last accessed." http://userpages.umbc.edu/~jack/ifsm498/filesystem.html

8

CERTIFICATE OF SERVICE

Plaintiff/Counterclaim-Defendant, The SCO Group, Inc., hereby certifies that a true and correct copy of the foregoing was served on Defendant/Counterclaim-Plaintiff, International Business Machines Corporation, on this 20th day of March 2007, via CM/ECF to the following:

David Marriott, Esq. [email]
Cravath, Swaine & Moore LLP
[address]

Todd Shaughnessy, Esq. [email]
Snell & Wilmer LLP

/s/ Edward Normand

9

*********************************************
*********************************************

Before the Honorable Brooke Wells

January 19, 2007

Motion Hearing**

[beginning with page 16]

Court: Let's go on to the second motion now, which is SCO's motion related to spoliation.

MR. JAMES: Good morning again, Your Honor. I will try and be as brief as possible and then maybe take a few minutes on reply, if that's okay with Your Honor.

THE COURT: I've always let everybody reply.

MR. JAMES: I am aware of that and I appreciate that. Thank you.

As Your Honor indicated, this is SCO's motion for relief for what SCO believes spoliation of evidence has occurred in this case. SCO initially initiated this action, Your Honor, in March of 2003. Prior to that time, SCO has had a number of discussions with IBM regarding the subject matter of its complaints and ultimately SCO initiated the litigation.

About a month later, April 8th, 2003, Randy Swanberg, an IBM representative, sent an e-mail that was addressed to eight different individuals. The e-mail has been marked confidential in the litigation. It's been provided to Your Honor. I won't quote from it in open court. However, as Your Honor will note, the e-mail was explicit. It instructed the

16

destruction of certain evidence, requested that certain types of evidence be purged from the computers.

THE COURT: What is the exhibit number again?

MR. JAMES: It's G to the opening memorandum of SCO. And I think, Your Honor, it's indisputable that the instruction that was issued was for the destruction of evidence that is relevant to this case. IBM does not contend that the evidence that is addressed by the e-mail is not otherwise relevant.

Central to several of SCO's claims, in fact, in this case is SCO's allegation that IBM made contributions to Lunux development of source code, methods and concepts in violation of IBM's contractual obligations and other obligations to SCO.

The Tenth Circuit has made very clear that a litigant has a duty to preserve evidence that he knows or should know is relevant to imminent or ongoing litigation, and it made that statement in the Jordan F. Miller Corporation v. American Eagle Insurance case in 1998.

The United States Supreme Court even has recognized the spoilation sanctions may be imposed as part of the inherent power of a district court, and that is a legal principle that federal courts, including the Tenth Circuit, uniformly recognize.

In the Jordan Miller case, the Tenth Circuit stated, as a general rule, the bad faith destruction of a document relevant to proof of an issue at trial can give rise to an inference that production of the document would have been unfavorable to the party responsible for its destruction. Judge Stewart indicated in the Adams v. Gateway case in this district that bad faith can be inferred from

17

circumstantial evidence. Here, Your Honor, I submit we have much more than circumstantial evidence. We have direct evidence in the form of an explicit e-mail, instruction to destroy evidence that was given soon after litigation was initiated.

The Tenth Circuit, and this district as well, has indicated the bad faith is not required when spoilation has occurred in order to impose a sanctions -- an imposition of sanctions other than for the negative inference. And so while bad faith is required for a negative inference, a spoilation sanction is not required for any other type of spoilation sanction.

THE COURT: Okay. We're presuming something here, and we're presuming destruction.

MR. JAMES: We are, and I'm going to talk about that, Your Honor, here in a minute as part of the presentation.

THE COURT: All right. Then I will let you go ahead.

MR. JAMES: Thank you.

In determining what the appropriate sanction is where there has been spoilation of evidence, courts have considered a variety of factors. There are two that courts have primarily looked at, the degree of culpability of the party who has destroyed evidence and the degree of prejudice to the other party. And, again, when we talk about the degree of culpability, from SCO's perspective we are not talking about circumstances where evidence was negligently destroyed or where there was a failure to give an instruction to preserve evidence, we're talking about, in our view, intentional destruction of evidence. There is no question, Your Honor, that the prejudice that occurred to SCO as a result exists in this case, and I will talk about that in a few minutes.

18

Addressing prejudice, the Southern District of New York in the MasterCard case stated as follows, relating to that case: While the record does not strongly suggest that MasterCard is likely to have been seriously hampered in the presentation of its case by the failure of the defendants to preserve the missing e-mails, we, nonetheless, recognize the very fact that the e-mails are missing leaves us in the realm of speculation as to what they contained or in what manner they might have assisted plaintiff in litigating its claims. And the court went on to impose spoilation sanction.

Now, let me talk for a few minutes about IBM's arguments, Your Honor, and the declarations submitted and hopefully in that context we can talk about whether, in fact, evidence was or was not destroyed. And that is the first argument, in fact, that IBM makes, it says that SCO cannot show that IBM destroyed anything. In fact, it contends that Mr. Swanberg's e-mail was intended really for only eight developers, none of whom were part of IBM's Lunux TechnologyCenter.

IBM has submitted the declarations of those eight developers to whom it says the e-mail at issue was intended, four of whom said they did not destroy anything despite the instruction that they do so. As to the other four developers to whom Mr. Swanberg indicated the e-mail was intended, those developers can't recall whether they deleted anything. But they claim that if they did, it otherwise would have been available on the IBM CMVC database which has been produced in this case.

Well, Your Honor, there is no foundation, when you look at those statements in the declarations or on any other

19

bases, for IBM's contention that if the sandboxes at issue were deleted, that those sandboxes otherwise would have been contained on IBM's CMVC database. That's just a pure conclusory assertion that is made in these affidavits without any foundation whatsoever.

And IBM wants the Court to focus on eight developers who worked for one of the eight managers to whom this e-mail was addressed. If you look back, Your Honor, at that e-mail, what you will see is the e-mail was directed again to eight IBM managers or team leaders, not to any of the eight developers for whom IBM has submitted the declarations. IBM just wants the Court to assume, without any evidence, that e-mail meant nothing to the other managers and the developers who worked under those managers to whom that e-mail also was directed.

While IBM has submitted the declaration of Mr. Swanberg in which he asserts in paragraph 6 of his declaration that what he really intended was that only three of the individuals listed on the e-mail communicate the information that was communicated or that was directed in that e-mail, nowhere in Mr. Swanberg's declaration or in the e-mail is that intent communicated or even suggested, and it simply defies common sense that someone would send an e-mail to eight people and later claim that it really wasn't intended for those eight people, but only for developers of two or three of those eight people.

Recall, Your Honor, also that the e-mail that Mr. Swanberg sent was an e-mail that originated from IBM's open source steering committee. That's where the instruction originally came from. That committee was charged with the oversight of all of IBM's contributions to open source

20

software.

Let me talk for a minute about Daniel Frye. He is an IBM executive that testified as both the 30(b)(6) representative and in his personal capacity in this case. He testified that developers in the Lunux Technology Center were given a similar direction to that contained in Mr. Swanberg's e-mail.

And if you look at pages 4 and 5, and, again, that is testimony that has been marked as confidential, so if you look at pages 4 and 5 of SCO's reply memorandum, we quote quite extensively, Your Honor, from Mr. Frye's deposition testimony, and then we go on in the next three or four pages to talk quite extensively in detail about the questions that were asked and the fact that those questions reflect absolutely no confusion and the answers were absolutely clear, that contrary to the claim made in Mr. Frye's subsequent declaration that IBM now has submitted, he clearly testified about that instruction that was consistent with the instruction contained in the e-mail being sent to all of the developers in the Lunux Technology Center.

There was every opportunity on the part of IBM's counsel to address through cross-examination any ambiguity or confusion that may have existed at the time Mr. Frye was deposed. That did not occur.

IBM also claims that Paul McKenney, whose deposition testimony SCO also cites, was confused, and that his confusion arose from SCO's counsel asking Mr. McKenney the same question twice during the deposition, as if that doesn't occur over and over again in depositions, Your Honor. And, again, that's filed under seal. We've addressed that in detail on pages 9,

21

10 and 11 of our reply. And there was no indication at the time of Mr. McKenney's deposition that he was confused with respect to the relevant answers on which SCO relies in connection with this spoilation motion.

And, again, during Mr. McKenney's deposition, IBM's counsel made no effort to correct or clarify any alleged confusion. He had the opportunity to correct his deposition after it was over, make any changes that he felt were appropriate. None of the changes were made. Now IBM comes back with the declaration of Mr. McKenney who says, I was confused at the time, I didn't understand, you can't rely on the deposition testimony I gave, here is really what I meant.

And, Your Honor, in September of this past year, Judge Cassell of this court issued an opinion in a case entitled Juarez v. Utah Department of Health-Family Dental Plan, and in that case Judge Cassell talked about the case law that addresses the submission of what the case law refers to as sham affidavits or sham declarations. And he noted in that regard that while the Federal Rules of Civil Procedure allow nonmaterial changes to deposition testimony, material changes are allowed only in certain circumstances.

And he referred to the test that the Tenth Circuit has adopted and articulated in Burns v. Board of County Commissioners, and the Franks v. Nimmo case, and he said that there are three factors that a court looks at in determining whether to accept an affidavit or a declaration that is contrary to or inconsistent with testimony given in a deposition: First, whether the party was cross-examined when giving the prior sworn testimony; second, whether the contested evidence was newly discovered or whether the party had access to the evidence at the time of the previous testimony; and,

22

three, whether the contested evidence attempts to explain confusion of earlier testimony reflected.

Judge Cassell went on to state, again, quoting from Tenth Circuit law this time, the Garcia v. Pueblo Country Club case, if Rule 30(e) -- which allows changes to depositions after the deposition has been taken -- if Rule 30(e) were interpreted to allow individuals to alter the statements they made under oath, one could merely answer the questions with no thought at all and then return home and plan artful responses. Depositions differ from interrogatories in that regard. A deposition is not a take home examination.

And I submit, Your Honor, if you look back at the briefing and the deposition testimony that we have attached to our memoranda, the deposition testimony at the time was clear. There were no ambiguities in the answers that these gentlemen gave. And IBM's counsel had the opportunity to cross-examine. Whether they took that opportunity or not, as Judge Cassell says, is irrelevant. They had it. And the affidavits or declarations that IBM now has submitted in which they try to alter the deposition testimony, that we think clearly demonstrates instructions to destroy evidence, that doesn't rely on any newly discovered evidence or anything that doesn't exist at the time of the deposition.

Your Honor, it is our contention that the clear deposition testimony is much more reliable and should be accepted over affidavits or declarations that have been submitted after the fact in opposition to SCO's motion.

THE COURT: Okay. Counsel, let's presume that I do accept the original testimony. The question still is based upon what arguably did happen, how does that get us to the

23

evidence having been destroyed?

MR. JAMES: Okay. I was slowly getting to that.

THE COURT: That's where -

MR. JAMES: Far more slowly than Your Honor wanted me to.

THE COURT: That's where my interest is. Let me just tell you, so you can address that. Yesterday, as I was preparing for this hearing, I ran across a portion of the transcript of the hearing on February 4th of 2004. And Mr. Heise, representing SCO at that hearing, stated, and I don't know exactly what page it is, but he's talking about -- he's handing to me a document from IBM that has been marked confidential. It is regarding an item called the CMVC, which stands for configuration management version control. It says in the beginning that AIX development organization and through the highlighted portions identified that configuration management as a process of identifying managing software modules as they change over time. In other words, we would be able to get every version, every iteration. Control is the storage of multiple visions in a single file along with information versions. Then it gives a simplified descriptionat the bottom saying what it boils down to is that all levels of all files are stored on a central server and are available for updating by those with proper authority.

What that gets me to is whether or not the information you are talking about has, in fact, been destroyed for purposes of giving you the relief you are asking for or whether it has been transferred and is otherwise reasonably available.

MR. JAMES: I think, Your Honor, that is an excellent

24

question and I think that probably most amply falls under, I guess, the issue of whether there was any prejudice to SCO because obviously if SCO has access to the same information it claims was lost, there wouldn't be any prejudice to SCO. But I think the point, Your Honor, and I think it's an important point, is this: The issue is not whether the information that was contained in particular developers' sandboxes somehow ended up in the CMVC and thus was maintained, the issue is this, that is the value of that information to SCO in the context of this lawsuit is what information, what source code did particular developers have available to them at a given time as they worked on developing Lunux.

It has been IBM's position in this case that its developers did not rely on AIX or Dynix/ptx code in developing Lunux software. Our position is that they did. The problem that we have is whether software or source code exists out there in a databank in the form of the CMVC doesn't answer that question. We need to know what developers at a given time have what on their computer, on a particular developer's computer, and we can't know that.

THE COURT: But what I need to determine is whether you can show that any evidence was lost or destroyed.

MR. JAMES: The evidence that was lost or destroyed is what particular developers at a given time had what access on their sandboxes in their own computer when they were working on Lunux code. When you take all that code and take it away and dump it into a database, it doesn't do us any good because the issue isn't whether the code exists or doesn't exist now, the issue is access by developers at a given time, particular developers at a given time to the code at issue. We can't tell

25

what access those particular developers had at a given time because they were instructed to purge their sandboxes of that information. So to say all of that code still exists doesn't do us any good.

THE COURT: But it has not been destroyed.

MR. JAMES: What has been destroyed is our ability from the evidence to determine what developer had access to what particular source code at a given time. We do not have that information, we cannot have that information. If IBM had maintained the sandboxes of their developers, we would have that information.

So while the code itself has not been lost, apparently, the evidence of what code existed with respect to particular developments in a particular location has been. We can never get that back. That is absolutely probative to SCO's claims in this case.

We have alleged in this case that IBM developers have relied on and used AIX, Dynix, or derivatives thereof in the formulation of Lunux source code. Just because we now have a database that has a bunch of information in it regarding source code, doesn't tell us in any respect, Your Honor, what developers had what access when they were working on their computers on the Lunux code, and we can't get that back because it's been destroyed.

And I think relying even on probably what is the principal case that IBM cites on this issue, the Gates Rubber case, what that case says is that given the fact -- let me back up. Given the fact that programmers were instructed to destroy information that was in their sandboxes, again, from the Gates Rubber case stating, there is at least a reasonable possibility based on concrete evidence here, the deposition testimony and

26

the e-mail, that the lost material would have produced evidence favorable to SCO's cause. And in this case, Your Honor, we don't have that. We have lost the ability to determine access issues, and the case law says that is a real loss.

And, Your Honor, let me just very briefly address just the waiver issue. They have raised that. It is our position this is not a discovery dispute or a discovery issue. We do not contend that the discovery was inadequate. By IBM's own admission, there is no evidence or documents leading to discoverable evidence responsive to SCO's request that IBM could turn over if ordered by the Court. We can't seek the production of evidence that no longer exists in the form we needed it.

IBM claims, based on the stipulation, it relies on the following language, the parties have reviewed one another's document production, then it conferred and agreed that there are no discovery disputes between them. As indicated, this isn't a discovery dispute. IBM cannot produce what it does not have because it destroyed it. Waiver is the intentional relinquishment of a known right. Nothing in the language of the stipulation suggests that SCO relinquished the right to bring an evidentiary motion.

Your Honor, we've asked for two different sanctions, Your Honor is aware of that, one of which is an inference based on what we think is bad faith and the other one doesn't require bad faith. We think both are appropriate. And if you don'thave any further questions at this time, I will be back on reply. Thanks.

MR. SHAUGHNESSY: Thank you, Your Honor.

SCO claims that IBM intentionally and in bad faith

27

destroyed evidence. That is, Your Honor, one of the most serious and severe allegations that a party in litigation can make against another. It is not an allegation that, in my view, should be made lightly, and it's an allegation that both I and IBM take very seriously.

In addition, Your Honor, the particular sanction that SCO is requesting here, an adverse inference instruction along with an evidentiary presumption, are the most severe sanctions, short of dismissal, that a court can impose. For that reason, as SCO concedes, the Court has to make an explicit finding of bad faith before those sanctions can be imposed.

Now I disagree with Mr. James about whether bad faith is required for both an adverse inference and an evidentiary presumption. If bad faith is required for an adverse inference, then the argument for requiring it for an evidentiary presumption, which is something even greater than an adverse inference, is even stronger.

Your Honor, this motion is being made in the face of a discovery record from IBM that can only be characterized as vast. We have produced to SCO documents from more than 260 separate custodians. We've produced more than 3.3 million pages of documents. We have produced to SCO billions and billions of lines of source code, including every version or iteration of AIX since 1991, every version or iteration of Dynix/ptx, hundreds and hundreds of thousands of program notes, thousands of design documents.

Your Honor, the production, as you know, to SCO of just the CMVC and the RCS systems took work by more than 400 IBM employees spending more than 4,700 hours. Now it bears noting, Your Honor, that despite the time the Court spent with that particular issue and despite the enormous amount of time

28

and money that IBM spent with that particular issue, it appears that SCO has done absolutely nothing with CMVC.

Your Honor will recall that the whole basis, as Mr. Heise was talking about in the particular hearing you mentioned, for SCO needing CMVC is they had to have CMVC in order to be able to figure out what improper contribution to technology IBM had made to AIX. As we stand here today, coming on the second year anniversary of having produced CMVC, SCO has identified one and only one improper contribution from AIX, Your Honor, and it's a contribution that is identified in their complaint.

Like SCO's claims with respect to the need for CMVC, Your Honor, this motion in the end is truly much ado about nothing. The motion is based upon assertion and speculation. The only party who has come forward to offer the Court evidence is IBM. And the evidence, I respectfully submit, Your Honor, shows, number one, IBM never, I repeat, never directed developers in the LTC to destroy anything. As counsel for SCO has now conceded, no original source code has been destroyed and SCO has no evidence that it has.

That what we are left with, Your Honor, at the end of the day, at the very most, is four developers who might have had old copies of source code on their machines. They are not sure. And who, if they did, might have deleted them. That, Your Honor, to put it in a more familiar context, is a bit like Your Honor having discarded a courtesy copy of a motion you ruled on a year ago knowing that Matt has a copy, knowing that Judge Kimball's chambers has a copy, and knowing that the clerk's office has a copy. That, Your Honor, is not bad faith.

29

As counsel has explained, there are basically three subject areas, Mr. Swanberg's e-mail and the eight developers to whom it applied, Mr. Frye's testimony concerning the Lunux technology, and Paul McKenney's testimony. What I would like to do, if I may, Your Honor, is explain the circumstances surrounding each of those three and in the context of that discussion demonstrate to you why it is that SCO has not come close to meeting its burden to prove the three things that it has to prove in order for this motion to be granted: Number one, that evidence was lost or destroyed; number two, critically, that IBM acted in bad faith, and, number three, equally critical, that SCO has been prejudiced in any way.

Now with respect to Mr. Swanberg's e-mail, context is incredibly important here, Your Honor. In April of 2003, IBM's open source steering committee had a meeting to discuss a particular project, a particular issue concerning the Lunux for PowerPC project. At the time of that meeting, Your Honor, eight AIX developers had been assigned to do the work on that project. The work that those eight AIX developers were doing was writing entirely new code specific to IBM's PowerPC hardware.

These eight developers, since they were writing new code, had no need for access to AIX. During the course of this meeting, the question came up about whether these eight developers' access to CMVC had been removed. It had. Mr. Swanberg knew that it had and advised the people at the meeting that was the case.

The question then came up about whether any of these developers might have local copies of AIX in their -- what are referred to as sandboxes. Sandboxes, Your Honor, are a development tool that is used in AIX. They are not used in

30

Lunux. They are not used in the Lunux Technology Center. A sandbox is basically a tool and what it does is it allows a developer to check out of CMVC a small portion of the source code base on which the developer is doing work rather than downloading the entire millions and millions of lines of the code base.

So they check out of CMVC, they do the work, they fix the bug, whatever it is they are doing. And if they are successful in what they are doing, they check it back in to CMVC. As Your Honor correctly noted, every time they do, it's tracked, when they did it, what they did, when they checked it out, and when they checked it back in. Mr. Swanberg, as I said, knew that these eight developers didn't have access to CMVC, but he didn't know one way or the other, and to this day doesn't know one way or the other, whether any of those eight developers may have had sandboxes. So out of an abundance of caution, they said, well, like CMVC, let's make sure they don't have access, so have them get rid of those sandboxes as well.

Now, Your Honor, that was an eminently reasonable, rational decision. The developers didn't need access to AIX for the work they were doing. The developers, if they had, again, if they had code on their machine, would have been the exact same code that existed in CMVC.

Mr. Swanberg had no intent, absolutely no intent to destroy evidence. SCO has not come forward with a shred of evidence that any member of the LTC, or Mr. Swanberg, ever entertained the thought that what they were doing by making this very simple request was destroying evidence. Now, as I said, Mr. Swanberg had no idea whether any

31

of these eight developers may have had sandboxes on their machines, but what he did know, based on years of experience, was that if they did, the information would simply be a copy. It would be the courtesy copy of the motion on Your Honor's desk.

It turns out that Mr. Swanberg was exactly right, four of the developers didn't delete anything at all. Your Honor, that presumably means they didn't have a sandbox to delete. The other four can't remember today, more than three years ago, whether they had a sandbox or whether they deleted it. But what they do know and what they are perfectly clear about in their declarations is if they did, whatever they deleted was a copy of what is in CMVC.

In short, Your Honor, what the open source steering committee was talking about, what Mr. Swanberg's e-mail was addressed to is a question of access to code. It is not addressed to an issue of deleting or destroying evidence.

Now, Your Honor, to put this particular issue in context, these eight developers and the PowerPC project on which they were working had absolutely nothing to do with any of SCO's claims in this case.

SCO has not identified a single line of this code as having been misused. As I told Your Honor, the only thing they have identified has having been misused from AIX is JFS, something they identified in their complaint, apparently without the benefit of looking at CMVC. SCO has not identified any one of these eight developers as having made an improper contribution to Lunux. Each of the developers, Your Honor, has testified that he or she never looked at or referenced any such code or any code they may have had on their machines in making any contributions to Lunux.

32

The developers were writing new, original code from scratch. They were not taking technology from AIX and incorporating it into the work that they were doing for Lunux. So by no stretch of the imagination, Your Honor, could what these developers were doing possibly relate to any of SCO's claims. But most important, Your Honor, as I've said, nothing, nothing was destroyed.

Now SCO's motion as it relates to Mr. Swanberg's e-mail and these eight developers is a dead end. They can't meet their burden or come close to meeting their burden with respect to any of the three elements. They can't show that anything was destroyed. We've demonstrated, Your Honor, exactly the opposite. They can't show that IBM acted in bad faith. Indeed, Your Honor, they haven't even tried. They can't show, Your Honor, that there has been any prejudice. The work these eight developers were doing and the project they were working on has absolutely nothing to do with any claim in this case.

And, Your Honor, SCO agrees. If you look at their papers, you listen to the arguments of counsel, they do not even attempt to tell Your Honor that this particular project or these eight developers are at issue in the case. Instead, Your Honor, this motion works for SCO only if SCO is able to leverage the Swanberg e-mail into the LTC. So what we're talking about here is a claim by SCO that instruction was given to the LTC to delete copies of source code.

To make out this claim, Your Honor, SCO relies exclusively on what I submit is ambiguous testimony from Dan Frye, which I will discuss in a moment. But what is really remarkable, Your Honor, to me is what SCO doesn't offer you.

33

SCO didn't offer you a single document akin to the Swanberg e-mail that suggests even remotely this occurred. Your Honor, we have produced hundreds of thousands, if not millions, of pages of e-mails, yet SCO cannot come forward with one document to indicate that this happened.

Equally remarkable, Your Honor, they haven't offered you the testimony of a single person who says I was told to delete documents and I did. SCO has taken depositions of dozens of people who work in the LTC, and I can tell you the issue of spoilation has never been far from SCO's mind throughout this case. They could have asked, they should have asked and certainly if they got any testimony they thought was helpful, they would have shared it with you.

Now, they rely instead, Your Honor, on Mr. Frye's testimony.

May I approach, Your Honor?

What SCO ignores, Your Honor, is testimony that Mr. Frye gave during his deposition. If you turn to tab one, I have excerpted here, Your Honor, the instances in which Mr. Frye was asked directly the question about whether anything was destroyed. And I won't read them, Your Honor, but you can see that he said during his deposition no less than six times, six separate occasions that it didn't happen.

Your Honor, his testimony on this subject was so clear and so precise and so well understood that if you turn to tab two, you can see that SCO's lawyer, who took that deposition, acknowledged that that was precisely what Dr. Frye had said. SCO's counsel acknowledges, in the excerpt you see there, that the witness has testified nothing has been destroyed.

34

Your Honor, beyond that, Dr. Frye testified at length that members of the LTC weren't instructed to destroy anything, on the contrary, they were instructed to do the opposite, they were instructed to preserve information. Dr. Frye testified at length about that.

Now, what does SCO say about the testimony that I have just outlined for you? If you read their opening brief, they say not a word. Counsel's arguments today haven't even mentioned it. If you read their reply brief, they make a statement that, Your Honor, I can only say is truly remarkable. Although we laid this evidence out in detail, all the numerous instances in which, during his deposition, Dr. Frye said it didn't happen, we laid it out in detail, SCO says at page 12 of its reply memorandum, quote, other than Mr. Frye's declaration, which directly contradicts his sworn testimony, IBM submits no evidence to refute the direct evidence showing that IBM did direct LTC members to delete such material.

Your Honor, that is sticking your head in the sand. SCO chose in its reply memorandum and in its arguments today not even to address the numerous repeated instances in which Dr. Frye testified that no destruction occurred.

Now, Your Honor, this is not a case of a witness testifying in deposition that the light was red and submitting a declaration saying that the light was green. This, Your Honor, isn't close. This is a case of a witness testifying in deposition that the light was green not once, not twice, but six times, then testifying that a different light was red and submitting a declaration that says, when I testified in my deposition six times that the light was green, I meant the light was green.

35

Your Honor, Dr. Frye hasn't changed his testimony. He has reaffirmed what he said multiple times throughout his deposition that absolutely nothing was destroyed. There is no basis for disregarding that declaration.

Your Honor, SCO's motion with respect to Dr. Frye's testimony and the Lunux technology doesn't even get out of the chute. SCO has utterly failed in its burden to show that anything was destroyed. It relies on one line of testimony from Dr. Frye, which he explains in his declaration had three ideas enmeshed in it and, if you read it carefully, that is exactly what it does, and that he didn't give as precise a testimony as he should. And, Your Honor, that is certainly true. But what he did do in the very same deposition is give as precise a testimony as he could have possibly given, six times on this particular subject, evidence that SCO has chosen entirely to ignore.

Now, Your Honor, Mr. James said in his opening comments that the Court should accept clear deposition testimony, if I have written it down correctly. You know what, he's absolutely right. What you have right here is as clear a deposition testimony as you can possibly get, and Your Honor should accept it.

Now with respect to SCO's burden with respect to Lunux Technology Center and Dr. Frye's testimony, SCO has shown, as I said, nothing, has provided you no evidence that anything was destroyed. Beyond this, Your Honor, SCO has to prove that IBM acted in bad faith and the Court has to make explicit findings of bad faith. So what has SCO said on this subject, what guidance have they given Your Honor about how to go about making a finding of bad faith? Well, if you look at their reply brief,

36

you see bad faith -- the words bad faith appear in one paragraph on page 16, and the net of that paragraph is see our opening brief. So you go back to SCO's opening brief and the words bad faith appear once on page 5, and they appear in the context of quoting the case that says that SCO has to prove bad faith.

Your Honor, in short, other than acknowledging that it has to prove bad faith, SCO's briefs are entirely silent. They offer Your Honor nothing by which you could possibly make a finding that IBM acted in bad faith.

That is true, Your Honor, both with respect to Dr. Frye's testimony and the Lunux Technology Center, but it is true across all of the claims that are being made.

Finally, Your Honor, SCO has to prove that it was prejudiced, and it comes nowhere close. The original premise of this motion as it was filed was that original source code has been lost, we no longer have ability to look at it. In our opposition, we demonstrated and SCO now concedes that nothing was lost. And, in fact, the very source code that SCO claims was lost has been sitting in its counsel's office on the CMVC.

So now, Your Honor, there is a revised premise, there is a new premise of this motion. It's no longer about, well, we now lost source code and don't have the ability. Now the premise is, well, we may not have lost source code, but what we lost is the ability no figure out which particular programmers had looked at or had access to which particular AIX or Dynix source code. That, Your Honor, is wrong. SCO has that information in spades.

Precisely as you pointed out, that was the purpose of producing CMVC. If SCO really cared, if SCO really wanted to

37

know what code a particular developer had on their machine, it would be a very simple exercise to find out. SCO could have easily taken the list of individuals we provided of people who made contributions to AIX and Dynix and compared it to any one of the other lists we provided them that identified people who made Lunux contributions or who worked in the LTC and could have determined if any names were the same.

Having determined that names were the same, SCO could have but chose not to turn the machine on and look at it. Because had they done so, they would have been able to figure out exactly what developer X looked at and when, what was checked out, when it was checked out, and what developer X did to it.

Your Honor, you are precisely right, they didn't make any effort to look at the information that we provided them to show that they were prejudiced. But, Your Honor, I submit that SCO isn't really interested in the evidence. What SCO is really interested in is having you make a ruling that will get them to a point that the evidence can't.

Your Honor, with respect to Paul McKenney, I will be brief because this one is truly silly. Tab six reproduces the disputed Paul McKenney testimony. As I say, I won't read through it. You see that the discussion here is all about overriding drafts and source code. Just so Your Honor can appreciate the true gravity of what it is we're talking about here, Dr. McKenney, when he writes source code, will write it and then he runs it through a little program to check to make sure it doesn't have obvious mistakes, letters or numbers transposed, things like that. If it does, then he fixes it. He doesn't create a whole new version of it, he fixes the

38

change. It is, Your Honor, the equivalent of correcting a spelling error. It is no different than before I file a brief or before I send a brief to the printer, I run the spell-check and I correct any spelling mistakes. So we're talking here, when we are talking about overriding, talking about correcting spelling mistakes.

And since no molehill isn't worth trying to dress up as a mountain, we've now got lengthy testimony and all kinds of argument about what was going on here. I won't read through the testimony, Your Honor, you can do that should you deem it necessary to do so, but what I will say, it is crystal clear, both from the testimony itself and from what Dr. McKenney has submitted in the form of his declaration, that he misheard the question.

And, Your Honor, if you turn to the second page of that, I direct your attention to a portion of that that appears emboldened. And, Your Honor, this doesn't appear in the written transcript of the deposition. This, however, is recorded in the audio version of the transcript, which I have included in the event the Court wishes to look at it. What you can see is that after Dr. McKenney answers these series of questions, SCO's lawyer, during the deposition, realizes that there is an inconsistency, realizes that there is some inconsistency in what the witness has just said.

What does SCO's lawyer taking the deposition do? He asks Dr. McKenney two follow-up questions. Those two follow-up questions are absolutely fatal to the arguments that SCO is making about the destruction of evidence. SCO's lawyers asked the follow-up that was necessary to clarify Dr. McKenney's deposition, and they did that, Your Honor, with full knowledge

39

that there was some confusion in the testimony that had just occurred.

Your Honor, finally, a very brief word on the timing of this motion. During the weeks preceding the close of fact discovery, I had numerous conversations, countless conversations with SCO's counsel, the purpose of which was to try and work through the long, long list of discovery issues that were pending between the parties and to resolve as many of them as possible. And to the extent they could not be resolved, to preserve both parties' abilities to go forward with those issues.

Your Honor, we attempted to put to bed all of the outstanding discovery issues other than those that really mattered to the parties. We signed a stipulation that did exactly that on March 17th of 2006. And, Your Honor, I participated in every one of those conversations. And SCO never once during any of those conversations ever raised any issue about needing to bring a claim about spoilation of evidence.

SCO's response is spoilation isn't a discovery motion. And, Your Honor, if a motion that seeks to sanction a party for failing to produce evidence in discovery because it's been destroyed isn't a discovery motion, then I don't know what is.

But, Your Honor, there is a problem with timing of this motion that goes beyond the fact that they stipulated it away, and the problem is this: SCO didn't file this motion after fact discovery closed. SCO waited to file this motion until after expert discovery closed. Now having waited until expert discovery closed, SCO argues in its papers that they have been prejudiced because

40

their experts didn't have certain information or didn't have access to certain information. Your Honor, if there was a concern by SCO, a legitimate concern by SCO about information that their experts may not have had access to, the time to bring that motion and get it resolved was before expert discovery concluded. So they stipulated the motion away, Your Honor, and they chose, deliberately or otherwise, to wait until expert discovery closed to bring it and then argue that the expert discovery itself has now prejudiced them.

Your Honor, respectfully, there is no basis for granting the motion that SCO has filed and I would request that it be denied.

THE COURT: Thank you, Mr. Shaughnessy. Mr. James.

MR. JAMES: Your Honor, I am going to ask the Court to do what I think is fair, and that is set aside the rhetoric, set aside the discussion about SCO having stuck its head in the sand, set aside all of the talk about remarkable, credible and knowing the mind of Dr. Frye, and look at the evidentiary record in this case.

I am going to start, Your Honor, with the issue that Mr. Shaughnessy started with on bad faith. He has told you that spoilation sanction of any type requires a finding of bad faith. I am going to read to you from Judge Stewart's opinion in the Adams v. Gateway case. He says, referring to Magistrate Nuffer and a finding, he said that bad faith is not generally required when considering other sanctions for spoilation of evidence. The court finds that case was accurately cited, is helpful in discussion of factors to be considered, and he says in that case that bad faith is not required in order to find

41

spoilation other than with respect to the negative inference finding. If you look at the Jordan Miller case from the Tenth Circuit, that is exactly what that case states, other than in the context of a negative inference, bad faith is not required.

Your Honor, when you look at the case law, and there has been a lot of case law cited, none of the case law talks about specifically what constitutes bad faith. That's obviously a determination that the Court has to find. But in this case what we have is an e-mail that specifically is talking about resulting from the initiation of litigation instructing the destruction of evidence. What happens is IBM now comes and says that doesn't even matter, none of these guys, these eight developers, none of whom were even listed on the e-mail at issue, those guys weren't in the Lunux Technology Center and therefore it doesn't even matter. If it didn't matter, why did IBM instruct the destruction, the purge of that evidence.

And, Your Honor, if you go back and you look at Dr. Frye's testimony on the instruction that was given to the LTC, the Lunux Technology Center, we cite that I think very succinctly and carefully at the bottom of page 5 of our reply memorandum, you will see that his testimony was absolutely clear that that instruction was, in fact, given. And, Your Honor, I think if you step back, you say, wait a minute, wait a minute, if the developers didn't need this access from their sandboxes, why do we have an instruction to purge their sandboxes. The appropriate instruction would be to save that information and remove access, not destroy that information. And the problem that we have is we have counsel getting up here saying you can go to CMVC and find anything and everything that has been lost. And, Your Honor, I submit that

42

is just not true.

We have been denied the ability to know what access a particular developer had and was using at a given time and you cannot find that on the CMVC. And Mr. Shaughnessy wants to tell you that you can. There is no declaration, there is no evidence whatsoever in the record of that representation to the Court.

The e-mail, Your Honor, at issue originated with IBM's open source steering committee. It was addressed to eight different team managers or team leaders. The deposition testimony of Mr. Frye is unambiguous that a similar instruction was given to developers in the Lunux Technology Center. Both Dr. Frye and Mr. McKenney had the opportunity and did make corrections to their deposition testimony before this motion ever arose. They made no corrections making the type of clarifications and marked changes that they have made in the declarations that have now been submitted by IBM in opposition to this motion.

The value of the sandbox, once again, Your Honor, to SCO is to show developers had access to AIX and Dynix/ptx as they were developing Lunux source code. Our ability to show that access has been destroyed because IBM plainly and clearly instructed developers to purge their computers of that information and you cannot get that information from the CMVC.

THE COURT: Why?

MR. JAMES: Because the CMVC doesn't show the information of who had access and what was in a sandbox at a given time with respect to a given developer. All the CMVC shows is all of the source code that was available. It doesn't

43

show who at a particular time had access, who was actually accessing Dynix code and AIX code while they were developing the source code of Lunux. That was the information in the sandbox that is critical information.

Your Honor, this is not something much ado about nothing. This is much ado about something. The something is a very clear instruction to purge, to destroy evidence after this lawsuit was filed, an instruction that came down from the IBM committee -- open source steering committee that oversaw IBM's contribution to all open source software.

Your Honor, IBM wants to stand up here and tell you how many hours they have spent producing information, how many millions of pages of documents they have given to SCO. That's not the issue and that is not what spoilation talks about. The issue before Your Honor is the fact that evidence that is probative, that is important has been destroyed. And whatever that evidence ultimately may mean, whatever it ultimately - what impact it has on the case, the fact that IBM destroyed that evidence, that is what spoilation is all about. The theory says that the party who destroys that evidence is the party who has to bear the risk that that evidence would be negative to their case, otherwise what is the point of the spoilation doctrine at all.

Your Honor, Mr. Shaughnessy has made a number of representations to the Court about SCO having done nothing with CMVC, and what SCO has and hasn't done. And, Your Honor, I respectfully simply just disagree with that. And I think those are representations by counsel. I can stand up and tell you everything that I think SCO has done with the information from CMVC, all of the things that -- details of the JFS disclosure from AIX that are in December submissions that are beyond those

44

in the complaint that Mr. Shaughnessy talked about.

You know what, we can get up here and argue all day, and that is not the point. The point is this: There is a clear record we've submitted to the Court in the form of our opening memorandum, along with the e-mails and declarations and deposition testimony in opposition and the information that IBM provided to you in that context and the reply. In our reply we go through in a very detailed way and address the very same arguments that Mr. Shaughnessy has made to you today. It's a little difficult to get into that in open court because of the confidentiality concerns and the protective order, but we've laid that testimony out in the reply memorandum and we have talked about how that testimony came down.

When Your Honor -- if you have had a chance -

THE COURT: I have.

MR. JAMES: -- to look at that, I submit that deposition testimony, particularly the deposition testimony of Dr. Frye, was clear. There was ample opportunity on the part of IBM's counsel if they thought it wasn't clear at the time to clear it up, and they didn't do that. What the courts say is you look at the deposition testimony and does it reflect confusion or doesn't it. If it doesn't reflect confusion, then it's not appropriate to be trying to make significant marked changes in that deposition after the fact.

Your Honor, clearly I think when you look at the e-mail and when you look at the testimony in this case, there was evidence that was destroyed. The fact that it was done intentionally pursuant to an instruction one month after the litigation was filed, the fact that it was done as a result of an open steering meeting, I submit satisfies the bad faith -

45

the bad faith requirement and SCO's entitlement to an adverse inference as it's requested.

Short of that, there clearly has been spoilation I believe. We have been deprived of knowing who had access to what. And as a result of that, even if a bad faith spoilation inference is not given in this case, that kind of an instruction, the Court should still give the spoilation sanction that SCO has requested that does not require the bad faith finding. Thank you, Your Honor.

THE COURT: Thank you, Mr. James. Mr. Shaughnessy anything further?

MR. SHAUGHNESSY: Despite being very tempted, Your Honor, I would not say anything further.

THE COURT: All right.

I am going to find that based upon the evidence before me, as it's put into context, reflects that SCO's motion will be denied. It cannot show that any evidence was lost or destroyed. In fact, I find that it is available and has been available through CMVC. The evidence before me, when seen in context, does not show that IBM acted in bad faith nor does the evidence show that it has been prejudiced because the evidence, as I indicated, has been and is reasonably available. So the motion regarding spoilation and the adverse inference instruction will be denied.

MR. JAMES: Your Honor, based on Mr. Shaughnessy's representations, would Your Honor have any objection to asking or ordering IBM to tell us how we find that in CMVC because this is something that is absolutely new to us. If it's in CMVC, we sure haven't been able to figure out how to get it.

THE COURT: That's why I pointed out to you the testimony that I found yesterday which indicated that as early

46

as February of 2004 you were aware of the purpose of that CMVC, whatever, and that it was in your possession.

MR. JAMES: Okay. Maybe I had a little different understanding when you read what Mr. Heise said about the understanding of what CMVC potentially could do. I may have misunderstood that. If I did, I apologize, Your Honor.

THE COURT: Anything further?

MR. SHAUGHNESSY: Nothing further, Your Honor.

THE COURT: Now I'm going to ask you, Mr. Shaughnessy, to answer that question: What if anything is IBM willing to do or do you have an obligation -

MR. SHAUGHNESSY: Your Honor, the day for asking for that passed a long time ago. That discovery in this case is closed. SCO has had that now for almost two years. And they were the ones who came in and told you, Your Honor, that they had to have this and that it would have the very information you just described. We have given them detailed instructions on how to use it.

And what you haven't heard, Your Honor, very curiously, is SCO comes in and says, well, we haven't offered evidence that, in fact, you can find this in SCO. What they haven't done, Your Honor, is they haven't attempted to come in and say to Your Honor in some evidentiary admissible form, we tried it and we couldn't do it. But at the end of the day, Your Honor, that day has passed. Fact and expert discovery in this case are closed. To the extent that information was important for those purposes, it should have been investigated and looked into long, long, long before now.

MR. JAMES: Just, finally, Your Honor, and I don't want to drag this out longer than it has to be, but it seems to

47

me that Your Honor has denied the motion in large part on Your Honor's finding and belief that the evidence is available, that it's not lost. And we've heard Mr. Shaughnessy say today that it is available and it's not lost, although we have spent literally hundreds of thousands of dollars trying to find that kind of thing and we can't. They say it's easily findable. Then Your Honor says, Mr. Shaughnessy, how about IBM, what is their willingness to find that easibly findable information, and we get the, well, we've represented to the Court it's easily findable and we contend it's easily findable, and that's the basis for the Court's rulings, but a year or two late. Sorry, you're out of luck.

THE COURT: The standard I think is reasonably available. I am going to ask IBM, in the spirit of cooperation, Mr. Shaughnessy, to do what you can or have others do it to see if you can assist in identifying it. That doesn't mean that anything is going to change in terms of the deadlines and the scheduling order cutoffs. But if there is somebody who readily has that information, I would ask you to assist in doing that.

MR. SHAUGHNESSY: Your Honor, if the Court would like us to do that, I'm happy to undertake that. What I want to make sure we're very, very clear about, Your Honor, is that we are not reopening discovery.

THE COURT: I think I just said that.

MR. JAMES: I think Your Honor made that very clear.

THE COURT: I don't think that's open to question. So with that having been said and, Mr. Shaughnessy, if you will prepare a proposed order.

MR. SHAUGHNESSY: We would do that, Your Honor.

48

Would you like us to prepare orders on both motions or did you address an order on the prior motion?

THE COURT: I did not ask. I will ask SCO to prepare the order on the first motion.

MS. BORUCHOW: We would be happy to, Your Honor.

MR. SHAUGHNESSY: Thank you, Your Honor.

THE COURT: Thank you. And we'll be in informal recess. Thank you.

(Whereupon, the proceeding was concluded.)

49


  


Dr. Ivie Declares his Suppositions - Updated: Jan. 18th motion hearing transcript | 563 comments | Create New Account
Comments belong to whoever posts them. Please notify us of inappropriate comments.
Corrections go here
Authored by: WhiteFang on Monday, March 26 2007 @ 07:39 AM EDT
:-D

---
"SCO's response to IBM's statement of undisputed facts is largely a frolic and
detour into the irrelevant, ... "IBM's (Redacted) RM in Support of its SJ on
CC10

[ Reply to This | # ]

SCOX has religion?
Authored by: WhiteFang on Monday, March 26 2007 @ 07:41 AM EDT
Belief --> Faith --> Religion --> PROFIT!

Please pardon my sarcastic mien here. "Belief" does not a disputed
fact make.

---
"SCO's response to IBM's statement of undisputed facts is largely a frolic and
detour into the irrelevant, ... "IBM's (Redacted) RM in Support of its SJ on
CC10

[ Reply to This | # ]

OT Here Please
Authored by: WhiteFang on Monday, March 26 2007 @ 07:44 AM EDT
Clickies if you've got 'em!

---
"SCO's response to IBM's statement of undisputed facts is largely a frolic and
detour into the irrelevant, ... "IBM's (Redacted) RM in Support of its SJ on
CC10

[ Reply to This | # ]

Sandbox developers are lazy hobbyists
Authored by: Anonymous on Monday, March 26 2007 @ 07:44 AM EDT
If you want real results, you use real environments.

[ Reply to This | # ]

I wonder if Dr. Ivie reads Groklaw.
Authored by: Anonymous on Monday, March 26 2007 @ 07:46 AM EDT
He could learn a lot if he did.

[ Reply to This | # ]

More SCO - Microsoft legal terrorism
Authored by: Anonymous on Monday, March 26 2007 @ 07:50 AM EDT

"Red herring" pretty much says it all, not just for this declaration
but for the whole case. Add Microsoft's growing covenants not to sue.

It adds up to SCO and Microsoft legal terrorism.

[ Reply to This | # ]

Defening Dr Ivie's Character
Authored by: Anonymous on Monday, March 26 2007 @ 08:02 AM EDT
While my personal association with Dr Ivie was limited to a brief period several
years ago, my experience leads me to believe that he is a man of character and
integrity. Please note, I am not saying that his technical facts are accurate in
any way. And I appreciate that PJ does not suggest that he is malicious. I just
want to remind groklaw readers that good people can be mistaken, misinformed,
misguided, and so forth without any underlying motive of power, fame, or
fortune.

I guess this is just a personal request that we shred his technical arguments
with zeal while simultaneously choosing not to estimate the moral or ethical
character of Dr. Ivie without direct evidence of the same.

[ Reply to This | # ]

Libellous???
Authored by: Anonymous on Monday, March 26 2007 @ 08:05 AM EDT
<blockquote>9. For example, let us assume that the programmer is
developing a module for Linux, but is basing it on a module that comes from a
contractually-protected operating system owned by another company. If the only
visibility that we have is the module after it has been appropriately disguised,
then tracing the source becomes much more difficult. Perhaps one could compare
this to a body shop for processing stolen cars. It is much easier to prove auto
theft if one can find the body shop being used. After a paint job, changes to
upholstery, options, accessories, and careful modification of the engine and
body numbers, it is much more difficult to identify the
theft.</blockquote><p>he's basically accusing IBM coders of grinding
the serial numbers off the modules and then giving them a respray to hide the
evidence.

[ Reply to This | # ]

Dr. Ivie Declares his Suppositions
Authored by: StormReaver on Monday, March 26 2007 @ 08:08 AM EDT
I've been programming for 22 years, and the notion that a workspace sandbox (a
term that grates on my nerves, by the way) has more detailed revision history
than the version control system is laughable at best and highly deceitful on its
face.

A programmer's workspace is separate from the VCS for the very reason PJ
implied: the workspace can be blown away if the programmer gets so far off
course as to make recovery more painful than starting over from the last known
working VCS commit. Duh!

My development trees occasionally meet this very fate. When I don't use VC
systems, manually named tar.bz2 backup files on my file servers provide the
versioning. Have any SCO witnesses ever done any actual development? It's like
they're pulling their descriptions of software development from the movie
Hackers -- entertaining, but woefully wrong.

[ Reply to This | # ]

Dr. Ivie Declares his Suppositions
Authored by: Anonymous on Monday, March 26 2007 @ 08:11 AM EDT
As a professional software developer I have read Dr Ivie's comments aith some
amazement.
History bit - ( an attempt to prove my credibility...)
I wrote my first program in Sept 1972. It was Fortran on Puch Cards submitted to
ICL George 3 running on an ICL 1901A. I am also a Chartered Engineer in the UK.
I now write DB2 & WebSphare Applications for my sins. I am Linux &
WebSphere certified.
-end history bit.

Whenever I have come upon the concelt of sandboxes in relation to IT it means
the following:-
A prototype design to demonstrate a proof of concept or theoretical solution to
a problem.
I have built many things under this concept. The whole idea is that you can just
throw the whole thing away if it does not work. My garage is littered with
failed attempts to make various things that just didn;t work.
Often the 2nd or even 3rd attempt got somewhere which in a few cases eventually
became a product or complete solution to the problem.
Apart from my Day Book (daily log) there remains nothing at all to many many
sandbox projects I worked on over the years.
Many engineers/software developers don't keep a day book so unless your company
or legal dept requires it, it is likely that you don't have any physical records
of the sandbox.
Dr Ivie just does not get the concept of Sandboxes in the real world.
Often, when you change jobs, you have to archive or (more often) destroy all
your day books. Then there is no physical evidence of the various sandboxes you
worked on during that term of employment.

So, back to Judge Wells.
Her ruling quite rightly (IMHO) shows that she understands the General Sandbox
concept.
The use of Dr Ivie by SCO seems to be yet another attempt to Fillibuster the
due legal process. Her ruling is pretty clear. If they continue to protest at
every ruling that goes againt them like this they could very quickly get to the
point where Judge Wells says,
Thou doth protest too much!

How I wish they would just accept that they can't win here.

[ Reply to This | # ]

Dr. Ivie Declares his Suppositions
Authored by: shiptar on Monday, March 26 2007 @ 08:16 AM EDT
What are these sandboxes and workspaces he refers to?

All you need is a computer and a text editor.

Last access times?

Does he have any idea the difficulty in creating a forensically sound image
which you could draw those conclusions from?

The US legal system has no mechanism for doing such a thing anyway. It can't
recognize when that kind of evidence should be admissable or whether it is sound
or not. We send pregnant women to jail because of incompetent administrators,
prosecutors, judges and lawyers while he thinks you can create an image with
which to compare file access times from more than 5 years ago???

I really don't see how he can be anything other than incompetent, at least in
this field.

[ Reply to This | # ]

File access time......
Authored by: tiger99 on Monday, March 26 2007 @ 08:22 AM EDT
"Most computers, including Unix and Windows, maintain the last access time of each file they store."

Well, actually not necessarily so, most Unix/Linux systems can turn off atime because it adds to the run-time overhead, both in the CPU, and more importantly, the disc drive, and many of these systems do not have an over-abundance of processing power available, because of what they are used for. But in many cases it is turned off to avoid wearout of flash memory, where this is used instead of disk, as flash has a very finite number of write cycles, often 10,000 or thereabouts, at a given adress, before it becomes unreliable.

On desktop systems I run with it off on my AMD 64X2, where minor overheads are negligible, but on my oldest machine, it is off, and likely so on some embedded things which I have.

If you need to know the last access time, you leave it on, but the access might have been by something irrelevant to the argument like a virus scanner. Some people read through files just to admire their work of several years ago, or for any number of other legitimate reasons, or even to alleviate boredom, and the atime would be updated as a result. It proves nothing at all. The last modified time is of far more relevance, and is one reason why you do not want your clock to be wrong if you are using a typical version control system, or even make.

I am an occasional programmer, who prefers *nix type systems to anything else, and has done for a long time. I am somewhat disappointed that an "expert" with this guy's background seems to be lacking in how people actually configure and use Unix/Linux/xBSD......

But there again, Programme's Work Bench (PWB) had a very short life outside of AT&T. I wonder why? (Peter Salus has of course documented the history, which you can check for yourselves, I am only speaking from my personal experience. I used Unix V7, and SysIII, and PWB was allegedly between the two, but never even seen by me.)

[ Reply to This | # ]

  • Ah PWB - Authored by: Anonymous on Monday, March 26 2007 @ 11:12 AM EDT
    • Ah PWB - Authored by: tiger99 on Monday, March 26 2007 @ 01:02 PM EDT
Perfect hit!
Authored by: Anonymous on Monday, March 26 2007 @ 08:24 AM EDT
Linux is revolutionary in its development method, which is maybe why SCO claimed, falsely, back in 2003 that it wasn't possible to control what went into it. Now, their expert would like us to believe that IBM must be able to control every passing byte its Linux programmers so much as think about.

+100! Bravo!! PJ you really nailed them!!!

Probably not in legal sense, yet in my technician eyes' it is perfect hit.

[ Reply to This | # ]

  • Perfect hit! - Authored by: Anonymous on Monday, March 26 2007 @ 11:01 AM EDT
Both Rochkind and Ivie Misrepresent Sandboxes
Authored by: Anonymous on Monday, March 26 2007 @ 08:35 AM EDT
It has been my experience that a "sandbox" is simply your workstation
where things are fiddled with until you are done for the day, after which you
may, if it is worth bothering, submit your work into the source/revision control
system. The notion that one would save all their mistakes, experiments, etc
*plus* all the other magical things Ivie and Rochkind say should be there just
flies in the face of reality.

Rochkind tries to frame an out of context quote from an IBM developer as some
kind of "proof" that sanboxes were used, as dissected in this post
from timransom over on Y!:
"*whistle*

Where to start?

<<In short, in this interview, an IBM programmer recommended use of a
sandbox to other Linux programmers as a "more effective approach" to
programming for Linux. This supports my view that sandboxes or similar systems
wopuld have to have been used by IBM and Sequent progrmmers in their work on
Dynix/ptx and Linux.>>

What the guy said was "A more effective approach appears to be creating a
sandbox where the data is disposable and the system nonessential and running the
code and figuring out what went wrong when the system crashes." He was
talking about kernel hacking, to put things into context.

Rochkind says he spent 300 or so hours looking at the CMVC and I don't know how
long with the RCS, yet he contends that that isn't where the elusive evidence
would be. Rather, he now feels that it would have been in the alleged
"sandboxes" where the evil comingling of SCOX's alleged IP with Linux
peanut butter occured, and the scene of the crime whitewashed by delete keys. He
says "CMVC and RCS do not show" after which there is a bulleted list
with a,b,c organization, including the following:

<<d. what the progression of drafts of the programmers' code for the other
operating system, such as Linux, looked like - whether the first drafts were
similar to the AIX and Dynix/ptx files he had copied, and then became
progressively dissimilar,perhaps as the author tried to hide his copying, until
the final version actually bore little resemblence to the AIX and Dynix/ptx
files on which it had been based; ...>>

Doesn't that sound like an *idiotic* way to steal something? Start with it, then
try and obfuscate it beyond recognition so that it would not pass muster as
evidence of copyright infringement? One thing's for sure: it sounds like a lot
more work than simply creating your own from scratch.

Perhaps Rochkind should have read the rest of the quote he used from the IBM
programmer, which also says:

<<And another thing is that reading code is harder than writing it (and
debugging is harder than both but moving on) so a from-scratch rewrite of
something will be easier than finding the small changes needed to fix real
problems.>>

Using Rochkind's own logical parameters, I'd say that this supports the notion
that his assertions are meritless."

I think this response from the infamous vanburgerstein neatly sums up SCOX's
"case":
"I would not be too quick to snicker at this theory because it happens all
the time in the publishing industry. Authors read books, historical documents
and other copyright protected material then mysteriously create their own work
which looks nothing like any of the material they were exposed to, but in fact
does incorporate similar plot lines. Here's where I have to agree with you: they
don't shuffle around and edit the original work, it's much easier to write from
scratch, as it were.

In fact, Rochkind is being too generous. IBM programmers kept some of the ideas
they were exposed to in bio-memory (e.g., key sites within the hippocampus) and
did all of the rethinking, rearranging and improvements there. They then wrote
code to implement those ideas from "scratch". IMO all programmers
should undergo memory erasure so that anything they were exposed to from other
companies or previous jobs doesn't "infect" their current work."

[ Reply to This | # ]

As a note aside:
Authored by: Anonymous on Monday, March 26 2007 @ 08:45 AM EDT
when working on some project, programmers do make copies where they try out
things possibly going nowhere, and that often end up as bit rot: partially
completed stuff based on old versions and not worth merging, either because the
functionality has been implemented differently, or because implementation from
scratch would be easier.

They might still be a storage for ideas and stuff. It is feasible to throw away
the stuff once it is no longer of possible use, just so that one does not end up
checking its usefulness time and again.

Instead of making copies of the files and working on them, it is also possible
to switch version control systems in between.

Indeed, Emacs version control integration offers a command C-x v b RET,
vc-switch-backend.

With that it is possible to switch the version control used on the currently
edited file between RCS (local to the directory in question) and VCS or other
repository-based systems.

That way, one can keep track of attempts and changes and in-between approaches
abandoned momentarily because of a shift of priorities locally.

Such a local RCS file would indeed record a personal "sandbox" history
of a programmer.

Whether this would constitute poachable material for court cases is a different
question.

Also the creation and management of such personal material is not under company
control and one can't depend on its presence. It is a matter of project history
and personal style whether anything of significance would end up there.

I can't imagine that the non-preservation of such material could be considered
spoliation any more than the non-preservation of used toilet paper could be
considered spoliation in a court case about food poisoning.

[ Reply to This | # ]

Dr. Ivie Declares his Suppositions
Authored by: Anonymous on Monday, March 26 2007 @ 08:52 AM EDT

Groklaw comment:

In my experience the source control system is likely to be the most complete repository of the code development history.

Even more so. Since document work flow systems though promised for many decades had largely failed, now even documentation is normally found in source control systems. (*)

My three last employers all used revision control systems to coordinate work on documentation. You can't diff the binary blobs, but still it is easier when you see what documents others are working on.

SCO sandboxes are really futile attempt. I as developer used to have tens sandboxes deployed in all times containing some snapshots and little tests. Large sandboxes are in fact counterproductive: software is developed in teams and sandboxes easily allow developer to forget about his teammates and stray his development far away from common denominator - software state/version in revision control system. (In fact, my actual employer forbids such sandboxes at all.) Revision control is central to all modern development. Sandboxes?.. I never counted them. Nor considered them anything important. I number them at home starting from 001 and after two years I'm now at 047.

(*) In fact, IBM is one of few companies which has internal documentation system deployed. And IBM is one of those vendors who actually sells such solutions. But again, in many aspects it works like specialized revision control system.

[ Reply to This | # ]

What a Sandbox is.
Authored by: Anonymous on Monday, March 26 2007 @ 08:54 AM EDT
I just pulled my copy of O'Reilly's "Essential CVS" (Jennifer
Vesperman 2003). "CVS stores projects and files in a central repository,
but you work from a working copy, called a -sandbox-, in your local
directories." (page 20). Elsewhere (pages 251-253) it describes the CVS
administrative files that are added to that working copy for CVS purposes.

What Ivie does is misrepresent a sandbox as an integrated development
environment (IDE). A sandbox is, and is only, a COPY of the code being worked
on. It is not an IDE. An IDE by comparison is typically a set of programming
tools, e.g. text editor, debugger, compiler control panel, etc., which have been
um... integrated, so as to appear as an specialized desktop screen. Think
Delphi, Lazarus, Eclipse, Visual anything.

If IBM has a different meaning for the term "sandbox", then Ivie has
to cite that definition, as the basis for his. He didn't. So the conclusion
is: he has no basis for his representation of the term.

I do not find it creditable that a purported expert could make that sort of
misrepresentation inadvertently.

PS: O'Reilly's "Version Control with Subversion" (2004) doesn't even
index the term "sandbox".

PPS: I don't have any data handy on Bitkeeper, or Git, let alone the heavy iron
stuff from IBM.

JG

[ Reply to This | # ]

Oh for heaven's sake
Authored by: billyskank on Monday, March 26 2007 @ 09:12 AM EDT
There are several fundamental flaws in the use a change control system, such as CMVC or RCS, to track a software development effort.

This is just utter nonsense. There is no other way to track a software development than its change control system. If the changes tracked aren't fine grained enough, tough luck - they aren't stored anywhere else. And the only reason SCO are bringing this up is because they have got nothing. If their code was copied it would be in the SCM. Furthermore, if their allegations were true it would be in linux and they'd be able to point to it.

Is there actually no defence against a nuisance litigant? SCO have showed that ruling against them - actually making a decision - doesn't change anything. They just file a motion asking the judge to change their mind. If the judge still doesn't see things their way, they just file another motion asking the judge to change their mind. What is there to make them stop? The only light I can see at the end of the tunnel is that they will soon run out of money and management will lose control of the cases. But that is so unsatisfying - knowing that the law apparently has no mechanism for checking this sort of thing. I know that the law is designed so that every plaintiff gets a fair chance to hear their complaint. But doesn't the defendant get any consideration in this system? This has gone way beyond giving SCO a fair hearing for their arguments. This is just violence by law suit.



---
It's not the software that's free; it's you.

[ Reply to This | # ]

Dr. Ivie Declares his Suppositions
Authored by: Anonymous on Monday, March 26 2007 @ 09:13 AM EDT
The Ivie report makes a slight amount of sense if you consider him to be talking
about the very ephemeral but still real mechanism of shell history available in
Unix/Linux systems. However the look back time is days not years.

[ Reply to This | # ]

Dr. Ivie Declares his Suppositions
Authored by: Anonymous on Monday, March 26 2007 @ 09:26 AM EDT
I think all the previous posts explain why Dr Ivies's reasoning is flawed. As an
ex-developer I might have had a couple of copies of files I was working on on a
workstation but having transferred them into a controlled environment I'd almost
certainly delete those local copies as they wouldn't be useful any further.

However all this surely misses the point. If there is code ( or concepts and
techniques )which have been copied you should be able to identify them by the
starting ( original code ) and end points ( alledgedly infringing material ). If
they are so completely different that this can't be done ( which seems to be the
case here ) aren't we in a realm where someone ( the progammer ) has had a
sufficently original idea to make the end result a new piece of work ?

[ Reply to This | # ]

Dr. Ivie Declares his Suppositions
Authored by: Anonymous on Monday, March 26 2007 @ 09:39 AM EDT
8. There are several fundamental flaws in the use a change control system, such as CMVC or RCS, to track a software development effort. A typical change control system allows a programmer to “check out” a module, to modify and test it for some unspecified amount of time, and then when satisfied to “check it back in” to the system. Perhaps this might be compared to trying to see what is going on in a darkened room with a strobe light. However, the strobe only illuminates a small part of the room (the code checked in and out) and the strobe is controlled by a programmer who may or may not want you to see all that is going on (visibility only at check-in time).

The question was always bothering me.

Is IBM responsibility to all what their developers do?

Because frankly, my experience is completely reverse: vendors are only responsible for shipped versions. Because it is only shipped version which has "blessing" (signatures, required legal filings - copyrights & trademarks) of company. Whatever developer does in her/his sandbox - is totally irrelevant since company generally cannot be held responsible for internal wrongdoing of employee.

All contracts I have signed to date were pretty clear on that point: I am fully responsible for what I do on my working place. If something anything leaves my workspace (e.g. illegally copied code checked in into repository/gets into released version) again it has little impact on company but instead exposes myself to broader responsibilities.

I'm sure that IBM has similar provisions in their employee's contracts.

I'm very bothered by SCO repeating that stuff over and over again. Were there any such precedents - when company was held responsible for wrongdoings of its employee? Cases where illegal code gets into public release? Patent claims are abundant, but copyright claims are really few and all cases I know are local to me/out of U.S. And they support my view of things: it is developer who is responsible for her/his "sandbox" - not company.

[ Reply to This | # ]

Sandboxes
Authored by: jmc on Monday, March 26 2007 @ 09:43 AM EDT
Having spent the past 34 years programming the past 26 with UNIX and Linux I
have to say I've never heard the term "sandbox" before.

My method of working which serves me well, is to keep everything on RCS and
check in all changes - sometimes checking in null changes to some files to keep
version numbers in line. I do it consistently and don't "cheat" so
several of the checkins have comments like "oops that made things worse try
again" for everyone to see and for me to (hopefully) learn from my
mistakes.

Most of the time I'm doing all the coding so the scope for confusion is
limited.

Where things can go wrong is where you have multiple half-edited un-checked-in
versions of the same file. Someone has to collate the changes and produce a
definitive version. It can be quite tedious doing that (from time to time I've
done that months later with my own code) and it's not hard to imagine someone
having spent hours staring at "diff" output from a dozen different
versions of the same file, maybe under pressure because some customer has
somehow got one of them and he doesn't know which, saying "please can you
delete all versions of files like this unless you're actively working on
it".

That's my take on the "instruction" to delete - I think that the email
was sent out by a "techie" not some senior executive as SCO like to
make out.

[ Reply to This | # ]

Dr. Ivie Declares his Suppositions
Authored by: Kirby on Monday, March 26 2007 @ 09:50 AM EDT
Long time reader - first time poster ...

Some clarity here. I am a professional developer of some 23 years experience,
so I feel qualified to comment.

I am currently developing code for a major health care provider. My local
workspace does not contain:

design documents or functional specs - these are on a network share.

The definition of interfaces between software entities.

The specification of structures, file formats, etc.

The testing approach to be used.

The test schedule.

The reasoning behind algorithms (aside from code comments).


All of the above are in documentation external to the source code management
(SCM) system. The heading for Section 6 'Information in Programming
Environments (e.g. Sandboxes)' is completely disingenuous.

While the aforementioned documentation could be reasonably described as being
part of my 'development environment', it is not part of my workspace. I have
the database schema tacked up in my cube and the object model and interface
definitions by these are not in my workspace.

And, perhaps most important, even if I had a stack of UNIX SYSV code sitting on
my machine as reference, I would not be checking it into SCM.

Then, quite curiously, the next section of the declaration is entitled 'CMVC and
Other Systems Are not a Substitute for Programming Environment Information'.
Well, yes, the SCM is part of any development enviroment...

So all of the stuff that you just listed in sections 6 and 7, you wouldn't
expect to be in the SCM? This section is so flawed that that I'll have to take
it bit by bit.

Section 8: What does this really say? No SCM is perfect? It's a good idea to
keep your workspace current?

Section 9: Presume that I have a big stack of SYSV code on my machine and I am
using it as reference. Following the chop shop analogy, no part of that code
will exist in my local workspace.

Section 10: Yes I can, and do, have multiple workspaces. If I had SYSV code in
one of them, then I would have had to fetched it from SCM. Was this code in the
SCMs in question?

Section 11: As others have pointed out, this is laughable. It has been a very
long time since any UNIX actually updated the last access time.

Section 12: The huge leap. No wonder we couldn't find any evidence, 'CMVC and
RCS would not show ...' Ah, what we really needed was a developers workstation
with a complete development environment. And, I'm sorry, the 'intermediate
drafts' saved in my local workspace does not have a complete history. And what
editor were they using, BTW? Emacs, Vi? You know, the one that keeps
indefinite history ....

Finally, the metamorphosis is complete. 'Importance of Programming Environmant
Information to SCO/IBM Case'. We aren't talking about a workspace or sandbox,
we are talking about a 'Programming Environment'.

We are claiming spolation of evidence based on the deletion of temporary
development workspaces. After admitting that the workspaces would not have
helped in the first place, what we really needed was the 'Programming
Environment'.

And then the insult of Section 15. How can anyone say this with a straight
face? _IF_ I had access to all drafts (probably not in workspace or 'Programming
Environment'), _IF_ there were AIX code present (again, probably not in a
workspace), then maybe I _COULD_ have found something.

How does this declaration in any way support the motion? Dr. Ivie is
essentially saying that he really needed this whole nebulous 'Programming
Environment' to find evidence. Well, we aren't talking about the developers
workstations, all of the documentation available on the LAN and some limitless
number of imaginary revisions that were never saved.

[ Reply to This | # ]

Anecdote on copying code
Authored by: Wardo on Monday, March 26 2007 @ 10:03 AM EDT
I don't see the fuss in the files that shoulda'/coulda'/woulda' proven SCOs
case. Mostly because I don't think they have a leg to stand on so this
"missing" evidence between AIX/DYNIX and Linux is simply
misdirection.

When I was taking a CS102 course, programming in C/C++, two of the students
decided to lighten their workload by sharing projects. One took the odd
numbered projects, the other the evens. They did a find and replace on variable
names and other quick revisions, but the structure was basically the same. It
was similar enough to get them into trouble by about project number 4. These
programs were not major undertakings, maybe 3-4 .c files with matching header
files. Most were programmed in a week or two depedning on the size of the
program. I'm not sure what tipped off the instructor, but there was enough
similarity for him to notice. There was also enough difference among the 15 or
so other students that nobody else was implicated...

Same end result, a tic-tac-toe game for instance, but 95% of the students came
up with significantly different answers to the simple problems presented. The
instructor didn't need to see anything but the final products to know something
was amiss.

Wardo

---
Wardo = new user();
Wardo.lawyer = FALSE;
Wardo.badTypist = TRUE; //don't bother to point out tyops
Wardo.badSpeller = TRUE; //or spelling misteaks

[ Reply to This | # ]

Dr. Ivie's statement is nonsense
Authored by: Anonymous on Monday, March 26 2007 @ 10:31 AM EDT

I've been a full-time software developer since 1974. I simply do not recognise Dr Ivie's description of sandboxes.

Intermediate versions of design documents get checked in to the version control system. The only way to preserve anything is to check it in to the version control system. Anything not checked in gets deleted, because you can't let your directory get cluttered up with history. That's what the version control system is for.

[ Reply to This | # ]

Dr. Ivie Declares his Suppositions
Authored by: tangomike on Monday, March 26 2007 @ 10:51 AM EDT
What I find really annoying about this is that IBM have to spend time, and
effort, proving they're NOT guilty, because this whole accusation is without
proof. It's speculation about something that, had it existed, MIGHT have had
some proof in it.

This is a huge abuse of the process and the court.


---
Deja moo - I've heard that bull before.


[ Reply to This | # ]

Dr. Ivie Declares his Suppositions
Authored by: Anonymous on Monday, March 26 2007 @ 10:52 AM EDT
I can summarize Ivie as follows:

"If I had cheese, I could make a ham and cheese sandwich -- if I had
ham."

LexLaw

[ Reply to This | # ]

Dr. Ivie Declares his Suppositions
Authored by: Anonymous on Monday, March 26 2007 @ 10:54 AM EDT
There is little doubt that the SCO boys definition and use of the word sandbox is hilarious at best. Sandboxes only lives on a particular developers machine and/or work area and only for a short while.

Now if they’d been talking about feature branches then it would be an entirely different story. These are forks from the main trunk in order to develop a particular feature and are later on merged back into the main trunk (when accepted). We do this stuff all the time in ClearCase.

/John

[ Reply to This | # ]

BSF Will Continue Filing Motions Until The Money Is Gone
Authored by: karl on Monday, March 26 2007 @ 10:58 AM EDT
My sense is that SCO set aside $35M to pay for the attorneys for this litigation, and it hasn't all been used up yet. All those luscious greenbacks with no one to fondle them...

So until the money runs out you can expect BSF to continue filing "Renewed Motion to Reconsider Order Denying Plaintiff's Renewed Motion to Reconsider Order Denying Plaintiff's Request for Further Delay and Relief from Defendant's Counterclaim That Plaintiff's Avalanche of Motions are Tiresome and Pointless" Boies negotiated a killer deal where BSF wins either way. If the case is BS and goes in the toilet, BS-F gets $35M. If they win, BSF gets the $35M and a huge additional chunk of change. Like the friends of the prodigal son, BSF will happily create unlimited opportunities for SCO to spend their money and, once it's gone, so shall they be as well.

[ Reply to This | # ]

This boils down to...
Authored by: Anonymous on Monday, March 26 2007 @ 10:58 AM EDT
SCOX saying A) There *must* be some evidence *somewhere* of illegal or
against-contract copying by IBM or B) we have totally and completely shot both
feet off and are working our way up our legs.

[ Reply to This | # ]

A point worth emphasing.
Authored by: PTrenholme on Monday, March 26 2007 @ 11:03 AM EDT

You development consultant, in his comments after item 7 states:

In my experience the source control system is likely to be the most complete repository of the code development history. The workspaces I have used rarely, if ever, had a history of the various code changes I made with each edit. However, I often checked the code back into the source code control system prior to completion to insure that, should some thing happen to me or the computer on which my workspace was resident, the code would not be lost.
(Emphasis added)

In fact, when I managed a programming group, I strongly encouraged every programmer to check in their code before quitting time every day, and required that the code be checked in before they left for a weekend or holiday.

It should not be too difficult for IBM to produce a copy of their programming group’s procedures, and, if they followed a similar procedure, a code history from their version control system would show that the developers were adhearing to those standards.

---
IANAL, just a retired statistician

[ Reply to This | # ]

Dr. Ivie Declares his Suppositions
Authored by: Anonymous on Monday, March 26 2007 @ 11:24 AM EDT
I've heard the term "sandbox" before as used in a
programming environment. I assume that sand is refered
to because it can easily be pushed around into different
shapes as needed; just like software under development.
Nothing "real" gets broken.

From what Dr Ivie says, it sounds like it should be a
"cast-in-conrete" box if every key press is recorded.

Didn't IBM give a complete set of their version control
system along with H/W to SCO?

Where does SCO find these people?

[ Reply to This | # ]

Positronic computing
Authored by: Alan(UK) on Monday, March 26 2007 @ 11:25 AM EDT
If a file containing AIX or Dynix/ptx code was viewed in proximity to access to a Linux file, or even after the Linux files were created, that would cause concern that the AIX files were used to develop the Linux files.

Clearly this would indicate that IBM are developing positronic computers. Anti-particles can be considered as normal particles but travelling backwards in time. SCO should demand to see all the annotated copies of Asimov's novels held by IBM staff.

---
Microsoft is nailing up its own coffin from the inside.

[ Reply to This | # ]

My 20+ years of experience
Authored by: Anonymous on Monday, March 26 2007 @ 11:31 AM EDT
In 20+ years of programming, I've worked for small companies and some of the top
10 largest software compaines.

In some, we didn't have source control. (Or a network, beyond sneaker-net,
etc).

In some, we had source-control, with what you could call 'sandboxes' - note that
sandboxes can mean 2 things - some systems let you create sandboxes *within* the
sourc-code-database. (If IBM did this, SCO would have that info). In other
systems, the 'sandbox' is just what is on my harddrive, but not yet checked in.
THAT GETS *NUKED* OFTEN. If I sync to the latest code and something is screwed
up (ie product doesn't build, something seems missing, etc) amongst a number of
solutions is: just wipe the drive and resync. And this is at one of the largest
software compaines in the world (not IBM).

And as for 'design documents' - well UI docs/mockups, maybe, but we don't have
many technical (code/architecture level) documents. I don't even bother writing
it down on in a notebook. Maybe a scrap of paper if it is really complicated
(and that gets thrown out once the code is done and under source-control - any
necessary documentation becomes part of the comments in the code, where it
belongs).
Mostly, it is all kept in my head until it gets coded. Maybe that's dangerous
(if I get hit by a bus), but that's the reality of typical software companies.

Anon

[ Reply to This | # ]

Reasonable but incorrect Supposition
Authored by: Anonymous on Monday, March 26 2007 @ 11:34 AM EDT
Having worked with both Clearcase and CMVC at IBM, I see the value of sandboxes
but Dr. Ivie's supposition that they must have existed are incorrect.

I only used Clearcase briefly so I don't know i all the information that SCO
seeks would be available there. I do know from my experience it definitely would
not be available in CMVC. In a lot of ways, CMVC was like working with very
little net. I worked in one of the WebSphere groups up until 2001 so I can
describe my process though I'm sure it varied by group.

For any change that I did, I followed the same basic steps:
1. Extract all of the code for the project into a directory
2. Copy that code to my project directory.
3. Make the modifications that I needed and perform unit test with the files in
my project directory. Ideally, you checkout the files to lock them before
modifying but it didn't always happen.
4. Run a diff program and determine all of the changes from the checkout
directory and check in the changed files into CMVC.
5. Pull everything down again into my project directory and do a build to make
sure that my changes did not interfere with changes made by other people.

If I worked on a file, the only difference I had was between what was checked
out from CMVC and my latest working version. Yes, it was a nightmare since if I
made an incorrect change, I couldn't compare it to what was working 5 minutes
previously. In that model of working, issuing a subpoena for a programmers
workspace would only get you the changes since the last checkin and not a list
of discrete changes as Dr Ivie supposes.

Sorry to post anonymously but I really have no idea what I'm allowed to say as
an ex-IBMer. Since IBM already in a way explained what a piece of garbage CMVC
is, I don't have much of an issue elaborating though.

[ Reply to This | # ]

Item 7
Authored by: Anonymous on Monday, March 26 2007 @ 11:34 AM EDT
ClearCase was omitted. It is a software configuration management tool owned and
marketed by IBM. It's likely in use by them for in-house projects.

[ Reply to This | # ]

  • Item 7 - Authored by: Anonymous on Monday, March 26 2007 @ 12:44 PM EDT
    • Item 7 - Authored by: Anonymous on Monday, March 26 2007 @ 03:29 PM EDT
Dr. Ivie Declares his Suppositions - "touch" anyone?
Authored by: Anonymous on Monday, March 26 2007 @ 11:38 AM EDT
11. Another specific example of valuable information that would have been in a programming environment or sandbox, but not in a change control system such as CMVC or RCS, is the timing of access to code files. Most computers, including Unix and Windows, maintain the last access time of each file they store. In other words, the computer keeps a record of the last time a file was viewed. If a file containing AIX or Dynix/ptx code was viewed in proximity to access to a Linux file, or even after the Linux files were created, that would cause concern that the AIX files were used to develop the Linux files.

Has this man never heard about a touch command? I've got files which were created, updated and last viewed in 2010...

Robert

[ Reply to This | # ]

Will SCO be delisted soon?
Authored by: Anonymous on Monday, March 26 2007 @ 11:41 AM EDT
The share price has been under $2 for almost 4 months.

When does Nasdaq finally delist them?

in any case, it should be soon.

[ Reply to This | # ]

Why Do You Suppose it's Called a 'Sandbox'?
Authored by: Tim Ransom on Monday, March 26 2007 @ 11:42 AM EDT
Because of its ephemeral nature. Things in the 'sandbox' can and *will* get
blown away. Sand shifts, hence 'shifting sands'. Not to mention the 'sandbox'
itself. Nothing gets saved. You rake it clean so you can see what you are doing.
Anything worth saving gets submitted to the RCS/CMVC.

The same could be asked about 'Revision Control' and 'Source Control' systems.
Why do you suppose they are named that way?

To suggest that they are not useful for tracking software development begs the
question: Why then did SCOG's experts spend hundreds of hours perusing them
when, in their expert opinions, it is really these alleged 'sandboxes' that are
required in order to properly track software development?

The salient item they left out of their list of 'things not found in the
CMVC/RCS' is:

Evidence.

Also, if, as they are now trying to claim, all of Linux is a derivative work,
then why not simply point to the code in Linux, then point to the code they own
it is infringing? Why the need for 'sandboxes' etc?



---
Thanks again,

[ Reply to This | # ]

300 Hours in the CVMS?
Authored by: GriffMG on Monday, March 26 2007 @ 11:45 AM EDT
Well, that's interesting, if he spent 300 hours in the CVMS does IBM have to put
much effort into helping them out (as requested so nicely of them at the last
hearing)?

At first glance 300 hours seems quite a long time... about six weeks?

On reflection though, SCO could probably invest a lifetime in the CVMS and never
find anything definitive that would help them - because it's all a bit
one-sided, it doesn't contain any Linux code!

Ho hum... that was six weeks of wasted fees on the good Dr.

---
Keep B-) ing

[ Reply to This | # ]

Programmers and sandboxes and version control
Authored by: tknarr on Monday, March 26 2007 @ 11:48 AM EDT

Well, Dr. Ivie is right about one thing: the Linux programmers almost certainly did use sandboxes. That's about the only point he's right on.

The whole point of version control (which both IBM and the Linux kernel have in spades) is to insure that sandboxes do not have the kind of history that he imputes to them. The whole idea of a sandbox is that it's like a sandbox: able to be wiped clean quickly to give you a fresh start on things. The whole point of version control is to insure that, if every programmer's sandbox gets wiped out completely by some sort of error or disaster, minimal work will be lost. If you suggested to my boss that my development area had critical history about the code in it and needed to be preserved, he'd laugh in your face.

Now, I don't check everything into version control. When I'm starting on a project, I start with a development branch that's identical to the release branch. My first changes probably completely break the build, the code won't even compile. No point in checking that in. As things progress I check code in when I hit milestones where I want to be able to recover back to that point, not have to start over from scratch if anything goes wrong. The point where the code actually compiles is definitely one of those milestones. By the time it completely builds and passes a smoke test, it's solidly in version control (checked in along the development branch) and I'm committing changes regularly (at least at the end of the day, and often several times a day as I fix bugs and get another bit working correctly). Once the project's done and tested, the changes are merged back into the release branch, conflicts resolved, the code's retested to make sure other people's changes since I branched don't break my work, and I wipe my sandbox out and start on the next project. I don't have to wipe the sandbox out, but I almost always do simply because I'm trying to minimize the number of them I've got hanging around. I usually have several, one or two for my main projects and a couple transient ones where I'm doing a bugfix or minor change that's outside my major projects, but I try to minimize the amount of state I've got laying around that I have to keep track of and manage. As a plus, that also minimizes the chances of having anything important not in version control. If it was important I'm going to notice I've deleted it when I go back for it and it isn't there, and after the second time that happens you'd better believe I'm going to change my work habits so that That Doesn't Happen Again.

Linux also has it's own version control system completely outside of IBM's setup. Any changes will be recorded there regardless of whether they're recorded by IBM or not. In fact, it's entirely possible that IBM's programmers used the Linux version-control system directly in addition to or even in place of IBM's own version control. If they were working on stuff along with non-IBM programmers, that would in fact be the easiest way to keep everybody in sync with code changes. Dr. Ivie may have missed this since it's something you never ever run into in proprietary software, but in Linux the ultimately-authoritative version control can't be within a single entity because the development team isn't within a single entity.

[ Reply to This | # ]

Dr. Ivie Declares his Retirement
Authored by: blang on Monday, March 26 2007 @ 11:58 AM EDT
From the world of upstanding and truthful citizens.
For a few pieces of silver he is willing dress up in full clown costume and
dance for SCO.
<p>
What an embarassing show. Not the kind of humiliating acts an elderly professor
ought to engage in.

[ Reply to This | # ]

Not even a developer
Authored by: Anonymous on Monday, March 26 2007 @ 12:13 PM EDT
I'm not even a developer and this 'sandbox' idea doesn't make any kind of
logical sense to me.

Version control makes sense. Introduce a bug? Go back and find where it
came from. But it sounds like SCO wishes that IBM kept a record of every key
press of every developer for every day that they worked. Why would anyone
do that?? So they could go back and check their failed attempts? Not only
would that be a waste time and of disk space but it would be almost
imposible to find anything due to the huge overload of information. All for
what exactly???

Stuff mostly gets deleted for a reason. Because it's useless. To call throwing

away useless code 'Spoilation' seems like the height of insanity.

[ Reply to This | # ]

Dr. Ivie Declares his Suppositions
Authored by: Anonymous on Monday, March 26 2007 @ 12:20 PM EDT
While I don't have the 20/30 some odd years experince that other posters do, I
have been involved in industry for about a decade now, so here's my voice to add
to the chorus of "he's wrong"...

1) In 99% of the cases with development environments (IDE, simple text editor,
or otherwise), intermediate versions aren't stored. At the end of the day, the
only thing that is stored within the systems is either the files as they exist
at that specific point in time, or the items checked back in the repository.

2) Many times, individual workspaces (or sandboxes) are blown away for a variety
of reasons (such as to get back to a fresh copy from the repository, remove
projects that have since been completed or not worked on any more, etc).
Therefore even if a "sandbox" as he calls it stored complete revision
history, it'd still be gone for a variety of reasons.

3) I don't even pretend to know how the IBM teams have their internal CM plans
set up, but it's sufficiently eveident from the comments posted thus far that
there are a wide array of development practices regarding CM. Most of which do
not function in the way this "expert" seems to think.

4) Not to give any ammo to the dark side so to speak, but the only way the info
that Ivie wants could be obtained would be to recover each version of a
workspace from backup of the development area (incrementals usually run ever 24
hours, so even then, you'd only get the backuped snapshot). This may be what
Ivie is alluding to, but it's definately not worded that way.

5) If the info isn't in the CM system, then why the heck did they want it in the
first place? Remember many moons ago when the SCO line was "the info is in
their CM, we need access to all of it to find it!", now it's moved one step
lower, so the first battle over the contents of the CM system was irrelevant.
By SCO's own admission in this, don't they contradict their earlier statements?

In any case the kind of access these people say they "need" to prove
copying goes well beyond the relm of a fishing expedition. It's more akin to
cartography: "we need a map of every thing development at IBM, then we
'might' find something that may show some evidence of copying"...
Grumble.

-TomcaT-

[ Reply to This | # ]

Rochkind Declares his Suppositions
Authored by: DaveJakeman on Monday, March 26 2007 @ 12:29 PM EDT

Having been on holiday for a few days, this was a late comment I posted about Rochkind's Suppositions, which seems more appropriate here, as Rochkind's and Ivie's suppositions are similar enough for their similarity to be worthy of comment itself:

Roachkind draws an analogy between CMVC and RCS compared to a library:

A change control system, such as CMVC or RCS, is like a library, and the AIX and Dynix/ptx files in those systems are like books in a library. Just as a library has records of (a) which books have been checked out, (b) when they were checked out, (c) who checked the books out, and (d) when they were checked back in, a change control system, such as CMVC or RCS might have records of (a) which files in AIX or Dynix/ptx were checked out, (b) when they were checked out, (c) who checked them out, and (d) when they were checked back in.
This analogy is flawed. Why?

A library is intended to handle read-only, published materials, such as books; not modifiable materials, such as electronic files. A library does not check whether a book returned is the same as the book, bearing the same reference number, checked out beforehand. A cursory check for ripped pages or coffee stains might be made, but no librarian re-reads the entire book on return to see if its content has changed. A library only retains one copy of each book checked out and assumes it to be the same book, with the same content, as when lent out previously. This is an important difference. Roachkind glosses over this and pursues his library analogy, carefully avoiding the most significant aspect of a code/version control system, namely, that all versions of the code's development history are retained and can be subsequently reviewed. The net result of any changes that occurred within a sandbox can be seen by comparing the appropriate two versions of any given code module. Roachkind complains he can't see the programmer's keystrokes and review the programmer's thought processes as he edited that code: so what? If the code modification was accepted, it was recorded during check-in; if it wasn't, it wasn't and that experimental copy was irrelevant.

Roachkind suggests a code copy might have been taken when the code was checked out. But if said code made it into Linux (ignoring for a moment that IBM might have rights to IBM-written code), then where is it? Have SCO pointed that out? With specificity? By version, file, line? By the required deadline? No. Apart from, er, 326 lines. It's up to SCO to first produce the infringing copy, prove it is infringing and the show the steps committed by IBM in making that infringing copy. SCO are merely suggesting similarity, implying IBM wrongdoing in making infringing copies and not producing said infringing copies as evidence.

Roachkind is complaining IBM threw a mountain of hay at him and after a mere 200 hours of work he was unable to find specific evidence of copying because IBM didn't also include the rootstock of the plants that hay was cut from. Worse, IBM burned the stubble, ploughed over the soil and planted another crop. Criminal! Well, is that infringing hay he's got there or not?

I find it interesting that both Roachkind's and Livie's declarations follow pretty much the same pattern and end with the same heart-rending refrain that had they been able to ferret about in those sandboxes, they might have been able to identify the copying that occurred with "even more" specificity. As PJ would say: puh-lease.

So that would be specificity as in at least being able to say: well, this code looks like that code and not: look! this file was accessed at such-and-such a time and therefore must have been copied! Well, they already have everything they need to do that - the complete source repositories and version histories of the relevant software - don't you think?

What I'd like to know is why should SCO be allowed to slip in yet two more ex- spurt reports at this late stage. This seems like another end-run which SCO are so unashamed of making.

---
I would rather stand corrected than sit confused.
---
Should one hear an accusation, try it on the accuser.

[ Reply to This | # ]

Dr. Ivie Declares his Suppositions
Authored by: Anonymous on Monday, March 26 2007 @ 12:35 PM EDT
This is truly painfull...

This whole case started after SCOX showed everyone a
briefcase with millions of lines of stolen UNIX code.

Now this stupid case has take more turns and twists than
a poorly writen made for TV movie.

I don't understand why someone hasn't called for a dismisal
of the case based on a lack of evidence?????

[ Reply to This | # ]

Reasons for Using a Sandbox
Authored by: DaveJakeman on Monday, March 26 2007 @ 12:41 PM EDT

Ivie:

Below is a list of some of the activities performed in a programming environment or sandbox:
  • the creation of design documentation specifying the functionality of each module, routine, subsystem, etc.;
  • the definition of interfaces between software entities including arguments, parameters, flags, sequencing, etc.;
  • the specification of structures, file formats, databases, constants, variables, etc.;
  • the approach to be used in the testing each function, subroutine and module;
  • the plan for subsystem and system level testing;
  • the specific tests to be undertaken, the test scenarios, the test data, etc.;
  • the capability to perform such tests in the context of the total system;
  • 3 the creation of code modules, the compiling of that code, and the linking of it together;
  • the reasoning, behind algorithms and the motivation behind the various designs;
  • all of this documentation for each software entity at each level of abstraction; and
  • suitable backup to protect the system and so that when programmers hit a roadblock the system can be rolled back to an earlier state and development can begin again there.
Of the activities listed, the only one you actually need a sandbox for is "the capability to perform such tests in the context of the total system". And even then, using a sandbox would be optional, depending on the nature of the development.

---
I would rather stand corrected than sit confused.
---
Should one hear an accusation, try it on the accuser.

[ Reply to This | # ]

Misdirection And Other Silliness
Authored by: sproggit on Monday, March 26 2007 @ 12:42 PM EDT
OK, so this is where I go out on a limb a little.

This filing doesn't make sense to me. It's just too obviously wrong. The
mistakes are _too_ blatant.

Although IBM's Legal Team will, undoubtedly, go through this with meticulous
care and correct every misconception, respond to every accusation or argument, I
just don't see this filing as being something intended to work at face value.

In short, it is either :-

1. Designed to Hurt
IBM will have to spend legal fees to respond to this filing and [if TSG are
every so lucky as to dribble this case into trial] possibly deal with at
cross-examination of this witness. Either way, this is going to cost money to
prepare defenses for.

or

2. Misdirection
In as much as The SCO Group's ongoing campaign of obfuscation seems to include
the idea that if they throw truly enormous amounts of theory at the Court and
IBM, they might be able to later point to a needle in a haystack and extract an
argument. In other words, this could just be background noise for Yet Another
Sandbagging Attempt.


Of the two, I think I'm inclined to suspect the former over the latter. The last
time they tried sandbagging they had their case shredded by Magistrate Judge
Brooke Wells, so I can't imagine they would be mad keen for a repeat
experience.


But in one important respect my views are changing. I think that a part of this
strategy might actually be to ensure that there is nothing left of TSG when this
is done.


Here's the reason. If you were in TSGs shoes and were serious about the case,
would you be trying to expand your claims and slide in more material at the 11th
[or in their case 13th hour?] No. You would not be silly enough to try that.
You'd want to make sure that your best arguments were already in there. You
would scale down the other motion practice and activities to ensure that you had
funds to see this to the end of the potential jury trial. You would want to make
sure that your best arguments won the day.

They just don't seem to be following any strategy that can bring them victory.
It seems to be trial at all costs. Delay at all costs.

I wonder if the plan is simply to guarantee that they run out of money before
this ever gets to trial. That would, after all, help perpetuate the FUD. Then
someone else could buy up the precious IP and launch another attack all over
again.

[ Reply to This | # ]

CMVC Doesn't Work Like CVS
Authored by: Anonymous on Monday, March 26 2007 @ 12:50 PM EDT
CMVC uses the concept of code towers resident on servers, whereas CVS creates
copies of code in a space specified by developers. I use both daily, and we use
IBM's CMVC on Solaris servers.

The fact that IBM is saying they use CMVC is an incredibly important argument
that most have missed. CMVC doesn't require or create local copies of code for
developers to work on. You work on the code in place on the servers. Checking
a source module out simply makes the controlled code editable. Checking it in
makes it read-only and records differences. No copies.

Ivie really missed that one, but I guarantee IBM didn't.

[ Reply to This | # ]

ANOTHER late expert report?!?
Authored by: Anonymous on Monday, March 26 2007 @ 12:59 PM EDT
So let me understand this . . .

SCOX is filing an export report (after the deadline for such reports) that
"explains" to the judge how she was "wrong" because she did
not understand the material laid out (incorrectly) in the "expert"
report that was submitted after the deadline?

Let's see:
-Your homework [for debate class] was late, no credit for late homework.
-Your [late] homework denied your opponent their right to respond to the alleged
"facts" presented therein (Methinks that was the whole point and
nothing but the point).
-Your homework is bald supposition as there is no way that you could know the
events that may or not have occureed when you were not present.
-Your homework supposes that there is only one way to "skin a cat".
-Your homework was submitted anyway knowing full well that it was late, and had
no value other than wasting resources.

IANAL, but the /most/ appropriate thing to happen would be for this report to be
stricken as it was not submitted prior to the deadline for expert reports,
prejudicing IBM by denying them the ability to rebut it, and was mere
supposition which would not have any effect upon the earlier rulings, even if
IBM had rebutted it.

It's a shame that the magistrate would probably get in trouble if she made
SCOX's crack leagal team stay after court, sit in her chambers and write "I
will turn in my homework on time" 10,000 times. Each. She would definitely
get in trouble for picking up a nice heavy 18" ruler after asking them to
put their hands flat on the table . . . Although a gavel would work nicely in
lieu of a ruler . . .

It is not like SCOX have not already have reports and such ingored in whole or
in part because of failure to listen to prior instructions, so its not a
dispositive issue. It is purely a discovery issue.

Quick, someone should patent the reality distortion field (Don't forget to cite
LSD as prior art) and then sue SCOX for unlicensed use.

[ Reply to This | # ]

Source control
Authored by: Yossarian on Monday, March 26 2007 @ 01:00 PM EDT
>they are certainly more useful than any CMVC-type of system.

There are several open source projects that did fine with CVS.
Commercially, I used CVS in a couple of start ups that were
too short of money to have a "professional" tool, and we
did just fine.

My basic assumption is that IBM's Linux programmers used the
same source control tool as the rest of the Linux project.
It just makes life *MUCH* easier if you have to sync versions.

[ Reply to This | # ]

  • Source control - Authored by: Anonymous on Thursday, March 29 2007 @ 11:43 AM EDT
Dr. Ivie Declares his Suppositions
Authored by: billposer on Monday, March 26 2007 @ 01:01 PM EDT

Since SCO at least used to write code, IBM should ask to see one of SCO's "sandboxes" containing all the information that Dr. Ivie says it should. They won't, of course, be able to produce it, because people don't work the way he says they do.

[ Reply to This | # ]

Dr. Ivie Declares his Suppositions
Authored by: gbl on Monday, March 26 2007 @ 01:14 PM EDT
As it is usually a serious crime[*] to break the nightly build, you don't check in code that doesn't work --- ever.

You don't check in every single minor code change. It's pointless, bloats the code database for with no benefit and means that you have to fix any problems before you leave for the night because it is a serious crime[*] to break the nightly build.

[*] I heard a story recently from a Sun developer who checked in bad code and broke the nightly build. For the next 24 hours he got email complaints as various developers in various time zones woke up to find that the build failed.

---
If you love some code, set it free.

[ Reply to This | # ]

Isn't it about time for sanctions?
Authored by: Anonymous on Monday, March 26 2007 @ 01:16 PM EDT
Surely objecting to the court's original order with absolutely nothing but speculation in the deposition and then misrepresenting those fantasies as fact must draw sanctions of some sort?

Otherwise what does?

It's not like SCO's lawyers can claim they didn't know what they were basing their motion on.

[ Reply to This | # ]

Why is this evidence important?
Authored by: SteveHil on Monday, March 26 2007 @ 01:17 PM EDT
I've lost the plot here.
Why is this evidence so important to SCO anyway? All it would show, if it
existed in the first place, is that IBM has put some modified AIX code into
Linux. But IBM makes no secret of this and argues that it is allowed to do so
anyway. All SCO need do is rifle through Linux and look for code with the IBM
copyright notice included. OK, so not all of that will have come from AIX, but
they have the AIX source code already so they can check against that.

I guess though, that they get better headlines with a spoilation charge.

[ Reply to This | # ]

Technical flaw or logical flaw?
Authored by: Anonymous on Monday, March 26 2007 @ 01:27 PM EDT
Naturally everyone here is focused on the technical content of Dr. Ivie's
declaration, but it's the logic of SCO's whole argument that makes no sense to
me.

If you showed me a car and said "This car contains stolen parts--your job
is to prove it by looking through the shop that did the work." What
evidence am I going to produce from the shop that would overturn the fact that
the car itself shows absolutely no evidence of any stolen parts?

All the file access times in the universe will not prove that a file is copied
from another if the two files in question are not at all similar.

[ Reply to This | # ]

  • Raving bonkers - Authored by: Anonymous on Tuesday, March 27 2007 @ 07:06 AM EDT
SCO may have a point
Authored by: Anonymous on Monday, March 26 2007 @ 01:27 PM EDT
I don't believe SCO has a case against Linux any more that most of the Groklaw
readers, but in this particular case, I don't think IBM is entirely right.

As I will try to explain, IBM's actions may not rise to the level of spoliation,
but they could do a better job preserving the evidence.

I completely agree that most programmers don't care much about preserving their
sandboxes, but their sysadmins do. It is hard to believe that at a place where
programmers are likely paid six digit salaries, their work would not be backed
up at least daily. It would take a trivial amount of resources to keep
incremental backups of developers' sandboxes compared to a possible cost of
losing someone's months of work. A smart backup system could exclude non-source
files from saving, further reducing the cost.

If I recall correctly, a mandate to clear AIX/Dynix sandboxes was issued to IBM
Linux programmers when the SCO litigation was already underway. I do believe
that that was done with the best intentions, but it was done sloppily. I
remember reading that half of the programmers did not even bother to delete
anything.

If a manager thought it was a good idea to isolate Linux programmers from Unix
code in response to SCO allegations, the smart move would be to consult with the
lawyiers first, and then hire a neutral party to identify the material that need
to be removed, preserve forensic images of all hard drives and document
everything that was removed and why.






[ Reply to This | # ]

Dr. Ivie Declares his Suppositions
Authored by: Anonymous on Monday, March 26 2007 @ 01:34 PM EDT
This is nuts. In all my many years of software development, with and without
revision control systems, the only versions that are retained are captured in
the revision control system or a specially retained copy of your development
tree.

I often delete working version of source code that don't work, and get a new
copy from the revision control system to start again. What happens to that
previous sandbox code? Gone. Forever. The code no longer exists, and since
it's not saved, forever irrelevant.

If a writer was going to violate a copyright, you would see it in the finished
product. You would not need to search the trash can for re-written passages,
note scraps, or rough drafts. And never has any court ordered that for a
copyright case was the normal act of throwing out the trash a "spoilation
of evidence" for a writer.

If the finished product has no evidence of copyright infringement, there IS NO
infringement.

[ Reply to This | # ]

Just to show how ridiculous this is
Authored by: Anonymous on Monday, March 26 2007 @ 01:43 PM EDT
Just suppose for a moment, that an IBM programmer had on his machine some
experimental code, which was half Linux, and half SysV code.

Is that illegal ? No, of course not: IBM can use the SysV code internally for
their own purposes however they wish; and the GPL allows for any use provided it
is not distributed.

If such code was never released to the public, then there can have been no
breach of any contract. It doesn't matter if the code was still there or if it
was erased.

[ Reply to This | # ]

Dr. Ivie Declares his Suppositions
Authored by: ExcludedMiddle on Monday, March 26 2007 @ 01:56 PM EDT
Does anyone else find it interesting that SCO has stopped inventing new legal
strategies, and has gone on to just trying to get the court to reconsider prior
rulings that have gone against it?

I mean, how likely are these rulings to be reversed? One would think that the
chances are quite low.

BSF was so inventive in the past. I wonder if the lawyers that came up with
those ideas must have moved on to other cases.... :)

[ Reply to This | # ]

From the Law Offices of Bolder, Stupyd and Funnie
Authored by: Anonymous on Monday, March 26 2007 @ 02:35 PM EDT
SCO:

If it pleases the court…

"As we cannot find the proof we need to show that IBM is guilty of
destroying our evidence, one can only infer that because it's missing, IBM has
in truth and in fact, destroyed it. And our expert says because of that, IBM is
guilty."

Several snickers heard from the back of courtroom.

Gavel slams down! Bam,Bam

"Order in the court, order in the court. I'll be havin' no snickering in my
courtroom!"

SCO:

"Of course, if we had the proof that the evidence was, in fact, destroyed,
Your Honor. That also would have showed that IBM is guilty."

"Sooo, You Honor, IBM is guilty no matter what we say."

"Can we have the money now? Pleeeeeeease…?"

Judge: I've read your brief and have made a decision.

"Muhahahahahahahahahahah !"


And BSF gets paid for this?

Anon46





[ Reply to This | # ]

Dr. Ivie Declares his Suppositions
Authored by: Lord Bitman on Monday, March 26 2007 @ 02:40 PM EDT
My boss was a programmer for IBM long ago. From how he describes it, even using
a managed version control system is pushing it as far as expectation of how old
code was "versioned". Talking about very-structured methods of
tracking changes /without using a version control system/.
IBM being IBM, I'm sure that by now they have gotten rid of such nonsense
(in-file change tracking, complicated directory structures with hundreds of
copies of files), though it all makes a fair amount of sense as "the way
things were before anyone had anything better" + resistance to change.

Still, reading about SCO thinking "this can't be all your version control,
I demand more!", I can't help but think about columns 73-80.

---
-- 'The' Lord and Master Bitman On High, Master Of All

[ Reply to This | # ]

Dr. Ivie's Suppositions
Authored by: filker0 on Monday, March 26 2007 @ 02:52 PM EDT
Dr. Ivie has been in the industry for a long time, so let's try to look at this a different way:
I've been in the industry since 1981, and was in college for some time before that. At that time, Lisp was being used for some pretty interesting things, and the big Lisp implmentations mostly had a-lists (Association Lists) that retained previous values for data objects in a history that could be scanned for purposes of backtracking or other heuristics. A lot of computer science graduate students, especially those in Artificial Intelligence (AI) were very big on Lisp.

If you assume that the FSF was started by someone from the MIT AI lab (or at least who had an office there), you must assume that the Lisp-centric thinking of the AI crowd influenced them (as is evidenced in Emacs' e-lisp). Linux is released under GPL2, which is a product of the FSF, so we assume that its development is also done in an environment influenced by Lisp. Further, Lisp started out its life on IBM hardware (cadr and car are based on an IBM architecure), so obviously, the file systems and programming environments (or "sandboxes") would naturally be Lisp environments, where every change is stored in an a-list that could be examined to find the evidence that SCO insists is there.

On top of this, versioned file systems have been around since at least the 70s, and probably the 60s, so all programming environments at IBM will be using a versioned file system, and old versions of files are never purged.

Also, nobody *ever* uses grep or any other utility that might update the atime unless they're looking at specific code. This versioning is essential to the sandbox; only an idiot would do any code development without it, as it's been a common practice since the 70s.

So, if there is no sandbox with an infinite retention of both a-lists and versioned files, IBM must have destroyed the evidence.

QED

Note:I don't believe any of the above claptrap.

I've been a Software Engineer since the early 1980s when most programmers did not call themselves "Software Engineers". Sandboxes are places where you muck with code, make a mess, and then clean up. Their purpose is to protect the project from local changes until those changes have been tested, and at the same time to protect the local environment from changes being made by other people on the project.

What exists in the "sandbox" is a snapshot of the current code base modulo local changes. After the desired changes have been checked back in, it has always been my practice to wipe out my local copies (my sandbox) and refresh it from the RCS. That way, I don't fall out of sync with the other developers on a project.

---
--
The opinions expressed here are my own, and do not reflect those of my current or previous employers. IaNaL.

[ Reply to This | # ]

Real world version control
Authored by: evought on Monday, March 26 2007 @ 03:10 PM EDT
I am an experienced software developer. I have worked inside many large
companies, including IBM, typically as a consultant and have also run my own
business, setting up development standards.

I have never seen an environment like Dr. Ivie describes, at IBM or elsewhere,
including at companies with SEI and ISO certifications.

A sandbox is just what it sounds like, an area to try out new things without
affecting anything else. Things which do not work out are thrown away, not as a
means to hide anything, but as a matter of process. The version control
repositories are there to store the history of the project; there is no point to
storing a history of the sandbox as well. In fact, in many places, including my
own business, the developers workspaces were specifically excluded from backups.
It is expected that developers check their work in on a regular basis.

Temporary and intermediate files are deleted on a regular basis. Most project
automation, such as 'makefiles', included commands to automatically clean up the
workspace ('make clean') and it is not uncommon to simply delete the entire
workspace every so often in order to get a clean checkout from version control.
This helps keep the local build from being polluted by irrelevant local
changes.

There would be absolutely no reason or benefit to keeping a history of
intermediate changes as it would simply generate a morass of data which would be
impossible to analyze and largely meaningless. What would it mean to someone
years down the road that I had to correct three typos before a function
compiled?

If there are any design or test documents in the local sandbox, they will also
be in version control. The sandbox is generally created from the version control
checkout. Any stray documents that are not version controlled would get
destroyed frequently. If they are not version controlled, they may be in some
other system, such as a Lotus Notes system, content managements system, bug
tracker, etc. System test information and high level design are likely handled
by a completely different team. At IBM test teams were in different departments.
Test teams would only test certain versions that the development team considered
stable releases as system test is often difficult to automate. One of my
contracts with them was to improve automation techniques so they could run more
tests against more builds.

At the end of a project or even a phase of a project, the workspace is deleted
to free resources. I have never seen anyone store the project sandbox for any
reason. It is quite common to see the entire *workstation* reinstalled or
re-imaged so that it can be used for other tasks and to make sure there are no
leftover changes from the previous project. IBM used Ghost in its labs for this
purpose. From project to project a box would likely change OS or OS version
anyway and possibly undergo hardware changes.

Additionally, why would the workstations in question even exist any more?
Workstations are updated frequently to keep up with CPU and memory requirements.
Does IBM have a responsibility to retain old workstations in case someone needs
a forensic analysis of the hard drive years later? Even if it did exist, how
would they identify it or the hard drive which it might have contained?

When working on a project for external delivery, the relevant files and
documents are packed and handed off to the customer. It is common to delete or
at least significantly trim your own project repository at that point. The
project has become someone else's maintenance headache, what is the point of
wasting storage? For instance, when we turned over code to Open Source projects,
we would export the CVS files and delete our own project from our repository.
This was true for at least one project I worked at IBM for an IBM client. I
imagine this would be true for Linux code as well since they were turning it
over for someone else to maintain.

Aside from my own experience, I have participated in conferences, organizations,
and regularly followed journals on development practices. I have never even
heard rumors of anyone working as Dr. Ivie describes. It would require either an
auto versioning file system (VMS?), significant custom software, or a
hierarchical VC system (like subversion with local checkins) to do what he
contemplates, where even the capability is very rare, and such a system would be
rapidly choked by the day to day changes from software development.

I could see an argument (in some world) where IBM might want to hide something,
but the SCO hypotheses is so ludicrous, that I cannot make myself consider their
point of view even for the sake of argument. I would have to conclude that his
experience is either very insular (limited to a single very odd environment with
unlimited disk space (years ago) and workstations which are never upgraded) or
that he is suffering from dementia. I will assume, for the moment, that he is
not simply lying for money.

Lastly, even if what he said were true in every respect, how is it relevant?
Even if a developer accessed AIX code while developing Linux code (and the OS
kept a history of access times ?!?), AIX is owned by IBM. Even if a developer
looked at Sys V code, (which would be irrelevant to, say, JFS development), they
(SCO) have admitted that they have no protectable patents or trade secrets. If
their (alleged) copyrights are not recognizable in the final work or were
removed prior to publication, the intermediate versions are not relevant. I
could copy the whole of Sys V into my sandbox and then delete it and I would not
be committing infringement of any kind. Additionally, I would be much more
likely to have any of the published books on UNIX internals at my workspace
sitting on my desk and work from that. Lastly, CMVC controlled files can be
viewed without checking them out anyway.

[ Reply to This | # ]

Every byte is sacred
Authored by: blang on Monday, March 26 2007 @ 03:22 PM EDT
There are Rubies in the world.
There are greybeards.
There are crunchies and BOFHS, and then
There are those that follow Steve Jobs, but
I've never been one of them.

I'm an Expret Witness,
And have been since before I was born,
And the one thing they say about Experts is:
They'll say what it takes to get a watrm meal.

Because
Every byte is sacred
every byte is good.
If I byte is wasted
God gets quite irate.

Every byte is sacred
every byte is good.
If I byte is wasted
God gets quite irate.

Let the crunchies spill theirs
On the dusty ground.
God shall make them pay for
Each byte that can't be found.

Every byte is wanted.
Every byte is good.
Every byte is needed
In the network neighbourhood.

Crunchies, Greybeards, Yuppies
Got bit buckets just anywhere,
But God loves those who treat their
Bytes with more care.

Every byte is sacred.
Every byte is great.
If a byte is wasted,...
...God get quite irate.

etc.

[ Reply to This | # ]

IBM knows what SCO is up to
Authored by: Anonymous on Monday, March 26 2007 @ 03:37 PM EDT
MR. SHAUGHNESSY: Your Honor, if the Court would like us to do that, I'm happy to undertake that. What I want to make sure we're very, very clear about, Your Honor, is that we are not reopening discovery.

SCO is just trying to create more "discovery" after discovery is over.

After every "ruling" they just fabricate another non-issue with non-facts to delay.

[ Reply to This | # ]

Word games...
Authored by: Eric Damron on Monday, March 26 2007 @ 03:52 PM EDT
Here is what I got: Dr. Ivie puts forth his own overly broad definition of
"sandbox" and then say's that IBM is lying when they say they don't
use them. I guess it is kind of a twist on the "straw man argument."

"I understand that counsel for IBM represented that sandboxes were not used
for Linux development. Any creative process requires an environment and facility
where that creative process can take place."

He defines sandbox as a "programming environment." Well duh… I guess
he wants us to think that IBM told the Court that it doesn't use any programming
tools; just codes using the VI editor and magically compiles the source into
machine code without using a compiler. I doubt that is what IBM meant when it
said that it doesn't use a sandbox.

Perhaps Dr. Ivie might consider that his definition of "sandbox" isn't
the same as IBM's.

[ Reply to This | # ]

IBM CEO Sam Palmisano's sandbox
Authored by: grouch on Monday, March 26 2007 @ 04:01 PM EDT
All this talk of sandboxes reminds me of Sam Palmisano's speech in which he dispelled Linux myths:

Let's go to myth number two: Linux is only a niche play.

Have you heard this one before? Think about this? Web servers, Internet service provider, telcos, Internet applications. If you measure the revenue opportunity of our industry at over a trillion dollars, that's about 40 percent of our industry. That's a niche? That's a niche! That's big enough for IBM to play in! Believe me, we need big sandboxes when you get to our size.

-- Sam Palmisano
Keynote Speech at LinuxWorld
January 31, 2001

SCOG is just jealous of the growth of IBM's sandbox. The only castles SCOG can build are of air instead of sand.

---
-- grouch

http://edge-op.org/links1.html

[ Reply to This | # ]

Question about suppositions and rules of evidence
Authored by: tiger99 on Monday, March 26 2007 @ 04:20 PM EDT
Not looking for a "legal opinion", of course, as I am not involved in any case and don't need the services of a lawyer.

But, I am wondering if "suppositions" are in any way admissable in a court of law. Seems even worse than hearsay, to me at least. And, from a supposed "expert".....

Surely courts don't accept junk like this? Maybe some lawyers or even those with experience of courts (as a jury, for example) could tell us whether they have ever heard such stuff being admitted as evidence?

Basically suppositions are guesses, and guesses are not facts..... Or am I missing something?

[ Reply to This | # ]

Ivie is just making stuff up
Authored by: rweiler on Monday, March 26 2007 @ 04:23 PM EDT

I've only coding for ...let's see ... 26 years or so, including 3 years working
on source code control systems, and lot's more years as SCM administrator for
various companies, and Ivie is simply making stuff up. First off, as a none
lawyer, expert or not, I can't see that Ivie's imagination about how IBM
programmers work is evidence of anything. He wasn't there, and he doesn't know.
In addition, whatever might have been in developer's sandboxes is irrelevant.
IBM had a iron clad license to use SysV for internal purposes. If SCO can't find
anything in a release of Linux that came from SysV, then IBM didn't violate
their license. In any event, Ivie is simply, (how shall we put this delicately?)
off the deep end when he suggests that in any professional development
organization, there is relevant information in a developer's private workspace
that is more useful than what it in the source control system. Workspace, or
sandboxes, or whatever you want to call them are transient. Nobody saves
hundreds of old versions of transient code. That is why they have a source
control system in the first place. Finally, perhaps Dr. Ivie has worked in
places where it is common to violate your third party license agreement and
spend time obfuscating code, and then claiming it as your own, but I've never
worked anyplace where that was encouraged or condoned. On the contrary, every
place that I have worked required that I sign an employment agreement that I
would hold third party information in confidence as well as our own proprietary
code. I've never worked at IBM, so unlike Dr. Ivie, I won't speculate on what
IBM does, but I'd be astonished if they sanctioned code theft.


---
Sometimes the measured use of force is the only thing that keeps the world from
being ruled by force. -- G. W. Bush

[ Reply to This | # ]

SCO is still missing the point
Authored by: Anonymous on Monday, March 26 2007 @ 04:49 PM EDT
It doesn't matter if a piece of code started out as SCO code. If IBM changed
a chunk of code so much it you can't ID it any more. Then IBM has effectively
rewritten it.

[ Reply to This | # ]

Sandbox cleaning
Authored by: Anonymous on Monday, March 26 2007 @ 04:52 PM EDT
Is absolutely essential! Remember, its not just the kids who play in the
sandbox...

The cat likes it too.

[ Reply to This | # ]

SCO's lawyer conceded this point, Ivie shouldn't bring it up again
Authored by: Anonymous on Monday, March 26 2007 @ 05:06 PM EDT
Page 26, starting at line 22 of the exhibit's PDF:

"THE COURT: But what I need to determine is whether you can show that any
evidence was lost or destroyed.

MR. JAMES: The evidence that was lost or destroyed is what particular developers
at a given time had what access on their sandboxes in their own computer when
they were working on Lunux code." (this argument is garbage, because there
should be a "developer X checked out code" log in CMVC, but ... )

"THE COURT: But it has not been destroyed.

MR. JAMES: ... *So while the code itself has not been lost,* apparently, the
evidence of what code existed with respect to particular developments in a
particular location has been."

Checkmate.

[ Reply to This | # ]

Dr. Ivie Declares his Suppositions - Updated: Jan. 18th motion hearing transcript
Authored by: Anonymous on Monday, March 26 2007 @ 05:31 PM EDT
There are some true Gems from Shaughnessy in this transcript...

----
MR. SHAUGHNESSY: ...And since no molehill isn't worth trying to dress up as a
mountain...

----
THE COURT: Thank you, Mr. James. Mr. Shaughnessy anything further?

MR. SHAUGHNESSY: Despite being very tempted, Your Honor, I would not say
anything further.

Genius :)

[ Reply to This | # ]

Sandbox~current file
Authored by: iabervon on Monday, March 26 2007 @ 05:32 PM EDT
SCO is using (obsolete, obscure) jargon for a concept that every computer user
is familiar with. The sandbox (more commonly known as the working tree or
working directory) is the equivalent in software development of the office
documents you're working on in word processing. There are only two differences:
(1) programs tend to consist of a bunch of related files, instead of one large
file, because it would be hard to find the section you want in one big file; and
(2) software developers save really, really often, like everybody probably ought
to, because you don't get to see your changes until you save.

So SCO is correct that the developers were using sandboxes (almost certainly),
and that they destroyed information which had been stored there. And the
sequence of states of the sandbox is a much more accurate picture of how
development went than what went into the version control system. But everyone
using a computer destroys information in this way. Nobody sane would even bother
to subpoena all of the drafts of a memo which the author had in the process of
writing it. This information isn't normally retained. It's not even retained by
obsessive packrats. It would be like demanding the Watergate tapes as of when
they were still half blank. It's only by confusing the terminology that they
hope to make this sound like there's something bad about this.

[ Reply to This | # ]

    Dr. Ivie Declares his Suppositions - Updated: Jan. 18th motion hearing transcript
    Authored by: Jaybee on Monday, March 26 2007 @ 05:40 PM EDT
    Here is a link to an abstract of Dr. Ivie's 1977 paper describing the PWB (Programmer's Workbench).

    Could it be that the mechanisms he describes only exist in this environment and he cannot conceive of any other development process? I find his reference to the 1950s & 1960s revealing as this paper dates from the 1970s - of course version control CAN'T have moved on since then (sarcasm). BTW when did he retire?

    The only environment that I know that contains the kind of tracking described here is VMS, which tracks every file save with an incremented version number. However the maximum number of versions usually gets set to 2 or 3 unless you want to chew up all your disk space in short order.

    ---
    You can have peace. Or you can have freedom. Don’t ever count on having both at once. (TEFL RH)

    [ Reply to This | # ]

    Linus does not control Linux
    Authored by: dscho on Monday, March 26 2007 @ 05:51 PM EDT
    Dr Ivie (his PhD notwithstanding) has a huge thinko (maybe money-induced? You
    never know in a society which values money more than pride), yes.

    But there's a small (but crucial!) error in the article: Linus does _not_
    control Linux. Neither does he _want_ to.

    Ever since he worked with BitKeeper (and now Git), his intention was to
    _liberate_ Linux. The main goal is to have a project which is controlled _by
    everyone_. It is true, you can take the source code (with Git, it's called a
    "clone"), and start hacking from there.

    There is no _single_ "upstream" version, or even "official"
    version of Linux. You can pick the changes you like, and can leave out those you
    do not like.

    _That_ is the power of Linux. You are _not_ bound by the control of a single
    entity, be that a company, or a person.

    And if you think about it, control by a single entity is absolutely
    contradicting the ideas of democracy.

    Now, I only wait for the day when people grasp what democracy is about, and do
    away with parasites, who just want to feast on their work, and never contribute
    back.

    Ciao,
    Dscho

    [ Reply to This | # ]

    Disputed fact?
    Authored by: spectro on Monday, March 26 2007 @ 05:55 PM EDT
    - SCO Expert says: "a sandbox is this"
    - IBM Expert replies: "No, a sandbox is not that, it's this"

    Voila!, another disputed fact for a Jury

    [ Reply to This | # ]

    The email evidence
    Authored by: filker0 on Monday, March 26 2007 @ 05:55 PM EDT
    From looking at the transcript, it looks as though the IBM memo that was sent to
    various managers that SCO is so worked up about was reminding people to remove
    local copies of AIX files before working on Linux code in order to better
    preserve the separation of the Linux and AIX code bases. This is a perfectly
    reasonable thing to do.

    I've worked on projects where we had to clense our development environment of a
    previous project to prevent contamination (real or potential), as different
    customers were paying for the different projects. We could not use code
    developed for customer A in a project to be delivered to customer B. Some
    people worked on project B and occasionally did maintenance on project A, and
    they were always reminded to expunge one from their workstations before starting
    to work on the other.

    I was there during a code audit (I was a contractor), and this sort of
    separation was one of the things the auditors were very strict about.

    SCO wants to characterize the memo as IBM telling its programmers to destroy
    evidence, but I'm pretty sure that it was intended to prevent exactly what SCO
    is accusing IBM of doing (copying SysV or AIX code in Linux).


    ---
    --
    The opinions expressed here are my own, and do not reflect those of my current
    or previous employers. IaNaL.

    [ Reply to This | # ]

    Wild Goose Chase!
    Authored by: Anonymous on Monday, March 26 2007 @ 06:10 PM EDT
    How does any of this matter?

    The linux source is GPL and publically available!

    How can unreleased code have any bearing? If it's not in the source tarball, it
    is not part of Linux, it's bits in the wind.

    Next they will want to pry open the heads of the developers to see what they
    were thinking! Come on, there MUST be keystroke logs or surveillance cameras or
    something!

    Oh, I know. The developers ate at McDonalds. Their change was calculated by a
    SCO system, the developers gained proprietary SCO knowledge, so therefore all
    their code belongs to SCO! What, they tore up the receipt? They destroyed
    evidence! Aren't I brilliant! I should be a SCO lawyer!

    They can chase this wild goose for a very long time, but what does it have to do
    with anything?

    [ Reply to This | # ]

    Incredible shortsightedness by SCO
    Authored by: Anonymous on Monday, March 26 2007 @ 07:21 PM EDT
    There is a short part of Shaughnessy's presentation that utterly destroys anything that SCO is trying to say here, and either it's been mentioned before or everyone was too entranced by the testimony of the kind Dr to see it.

    Here, read this portion from Shaughnessy's presentation, quite close to the beginning of his time.

    "As counsel has explained, there are basically three subject areas, Mr. Swanberg's e-mail and the eight developers to whom it applied, Mr. Frye's testimony concerning the Lunux technology, ... Now with respect to Mr. Swanberg's e-mail, context is incredibly important here, Your Honor. In April of 2003, IBM's open source steering committee had a meeting to discuss a particular project, a particular issue concerning the Linux for PowerPC project. At the time of that meeting, Your Honor, eight AIX developers had been assigned to do the work on that project. The work that those eight AIX developers were doing was writing entirely new code specific to IBM's PowerPC hardware."

    So, let's review, an internal meeting about a Linux project. The folks at the meeting recognize that there are 8 AIX developers assigned to the project and they discuss the matter.

    "These eight developers, since they were writing new code, had no need for access to AIX. During the course of this meeting, the question came up about whether these eight developers' access to CMVC had been removed. It had. Mr. Swanberg knew that it had and advised the people at the meeting that was the case."

    So the folks realized that the 8 developers didn't need AIX access for their assignment.

    "The question then came up about whether any of these developers might have local copies of AIX in their --"

    Here we are, can you guess what happened next in the meting? Shaughnessy goes on to explain about the use of IBMs version of sandboxes in AIX development and how Linux work differs.

    "Mr. Swanberg, as I said, knew that these eight developers didn't have access to CMVC, but he didn't know one way or the other, and to this day doesn't know one way or the other, whether any of those eight developers may have had sandboxes. So out of an abundance of caution, they said, well, like CMVC, let's make sure they don't have access, so have them get rid of those sandboxes as well."

    So, lets get this straight. Swanberg is basically saying that they need to make sure that the AIX devs moved to the Linux project don't have any old AIX code lying around. In other words he is actively trying to prevent AIX from accidentally making it's way into Linux. And yet SCO is trying to take that very same instance and turn it into an instruction by the manager to destroy evidence. Ha! What a dishonest bunch SCO are. Far from it, Swanberg is doing precisely whet he's supposed to do to protect the precious UNIX sekret sauce in AIX.

    I think what makes this worse is that the entire discussion about spoilation is predicated by the deliberate mis-understanding, mis-characterization and deliberate twisting of what happened here. If anything deserved sanctions from the court in this motion it was SCO for bringing it in such dishonest fashion. I am impressed by Shaughnessy because of the restraint he shows in this hearing. This is another of the examples of what SCO is about, but it's a truly awful one.

    As usual, disgust reigns supreme.

    [ Reply to This | # ]

    tSCOg seem to be down to ...
    Authored by: dmarker on Monday, March 26 2007 @ 07:28 PM EDT

    The facts are that we haven't found the proof yet (even though we have passed
    discovery phase) but we have lots of really interesting theories on where we
    might find some evidence and unless the court allows us to persue these theories
    as evidence that IBM must have hidden the real evidence, we will be
    disadvantaged in our case.

    Our theories were developed with the cooperation of IT
    'experts' so must be listened to evan at this late phase.

    I can't see it as being any more than this !

    Doug M

    [ Reply to This | # ]

    Simple Solution Kills Two Birds
    Authored by: Anonymous on Monday, March 26 2007 @ 07:31 PM EDT
    Let's make a major assumption here and say that what Mr. Ivie says is completely
    true. Couldn't IBM say "OK, SCOG, if this is the only way to do
    development of this type, we would like you to produce all 'sandbox'
    environments from between June 1995 and August 1995 for the development of UNIX
    that happened at that time."

    SCOG would have to admit that not even they have this information (thus they
    must have destroyed it), and also that they were not involved in any development
    at that time.

    This is just a joke.

    [ Reply to This | # ]

    Something Dr Ivie fails to mention
    Authored by: devil's advocate on Monday, March 26 2007 @ 08:24 PM EDT
    So the sandbox contains a complete record of every change the programmer made to
    his code rather than just the "strobe light" snapshot provided by the
    version control system? What kind of fancy sandbox is that? Whenever I develop
    code in a checked out copy of foo.c or bar.java every change I make obliterates
    the previous version. Only the versions checked in to the repository are ever
    preserved. So there can be nothing in the sandbox of any value, except perhaps
    the final alterations not yet checked in. Perhaps he means recovering deleted
    data from the hard disk, then he should say that, not this nonsense about
    sandboxes.

    [ Reply to This | # ]

    How to destroy your reputation
    Authored by: SilverWave on Monday, March 26 2007 @ 08:54 PM EDT
    Wow! He really has blown it here - the only ppl not laughing at him are pointing
    and shaking their heads.

    ---
    Ubuntu is like a breath of fresh air after the smog.
    Free yourself
    Y1 Use foss apps as replacements ff tb ooo
    Y2 Ubuntu dual boot
    Ubuntu user as of 181206

    [ Reply to This | # ]

    There are very serious problems with paragraph 11...
    Authored by: Anonymous on Monday, March 26 2007 @ 08:56 PM EDT

    Paragraph 11 has some very serious problems that haven't been fully addressed. I would expect any expert in the field of computer science with significant understanding of Linux and/or UNIX to understand why the following is completely fallacious:

    11. Another specific example of valuable information that would have been in a programming environment or sandbox, but not in a change control system such as CMVC or RCS, is the timing of access to code files. Most computers, including Unix and Windows, maintain the last access time of each file they store. In other words, the computer keeps a record of the last time a file was viewed. If a file containing AIX or Dynix/ptx code was viewed in proximity to access to a Linux file, or even after the Linux files were created, that would cause concern that the AIX files were used to develop the Linux files.

    The "last access time" (atime) is entirely meaningless on many systems. All versions of UNIX that I'm familiar with offer a "noatime" option at mount time (when a filesystem is attached to the system) that disables recording of access times. The reason why is very simple -- very few applications care about access time, but recording it is very expensive, because each time a file is read, this information must be written to the disk (and yes, I'm aware that there are some optimizations, but ultimately it must be written out). Many system administrators use the "noatime" mount option for this reason as a matter of course. It has absolutely nothing to do with trying to hide anything.

    Furthermore, "In other words, the computer keeps a record of the last time a file was viewed" (my emphasis) is completely incorrect. The operating system records when the file was last read for any reason at all, whether it was ever viewed by a human or not. Furthermore, a file may be viewed many times after it was last read -- it may have been loaded into an editor buffer (at which point it was indeed read from disk), but then actually viewed days, weeks, even months later, if the editor session remains intact. Personally, I frequently keep a single emacs session active for many weeks, so even if my system did record the access time, it would say very little about when I viewed the file.

    In addition, the file may be read for many reasons other than viewing. Leaving aside backups (which if well written would typically use utime to reset the modification and access time), there are lots of other things that read files -- compiling, dependency analysis (make depend), source browsers (etags or the like) that have nothing to do with someone actually "viewing" the file.

    I find it very hard to see how Dr. Ivie could not know this -- particularly the last paragraph -- if he really is an expert in this area with any practical development experience at all.

    -Robert Krawitz
    -rlk@alum.mit.edu

    [ Reply to This | # ]

    Trying to confuse non programmer ?.
    Authored by: Anonymous on Monday, March 26 2007 @ 11:00 PM EDT
    This is one of the ivi's statement :
    "CMVC entry admits that JFS is based on System V Unix."

    Every programmer certainly know what is the different between "product
    that's designed to work for something" and "product that's designed
    based on something".

    SCO seem to exploit this matter to non programmer (judge, jury). It's why they
    use header file and comments, instead of real code.


    [ Reply to This | # ]

    Spoliation
    Authored by: Anonymous on Monday, March 26 2007 @ 11:02 PM EDT
    Wow, I've been reading Groklaw for quite a while, and never once noticied that it's "spoliation", not "spoilation". Even the transcription errors here are educational. :-)

    (Please don't tell me I'm the only one...?)

    [ Reply to This | # ]

    Visual Age?
    Authored by: Anonymous on Monday, March 26 2007 @ 11:42 PM EDT

    So ... is Ivie describing Visual Age? Anyone else here used it?

    Briefly: a SmallTalk environment, expanded to provide an IDE for a variety of languages, it was IBM's entry in the IDE wars until it was abandoned in favor of Eclipse. Don't let the SmallTalk mislead you: it provided a fairly powerful (for the time) set of tools for programming in, among other languages, C, C++, and Java.

    True, it's hard to imagine kernel hackers, regardless of sponsorship, using the thing (it was a bloated beast, in my opinion), but it was *definitely* an IBM tool, and was in use in the right time period, and most importantly:

    it contained internal workspaces that closely match Ivie's description of "sandboxes" (like others here, I don't recognize this as a term of art for software developers, but the description *does* seem to match VA's internal storage of code).

    I worked in several places where VA was an option permitted to programmers (including IBM, as a contractor), and it was always a problem, because it effectively amounted to a per-programmer version control system. Not only did the programmer using it have to "export" code in order to check it in, they had to "import" the code that other people committed while they were off in their own little world. We always knew when one of the VA'ers had checked in, because the build would be broken for a day or day and a half until they managed to catch up and complete the merges (not that I'm prejudiced against VA ... no, this is mature reflection and postjudgment on a bad idea that got far too well entrenched until it mercifully died out :-).

    Thing is, VA's internal code control functionality really does provide more information, programmer by programmer, than the stuff that got into version control. That the information is completely and entirely *irrelevant* (if it didn't make it off my machine, who cares? Prove the chain! SVr4 -> anything -> Linux) wouldn't much matter to SCO, it seems.

    BTW, in the period in question (late nineties to early years of this century), Linux kernel stuff in the main tree wasn't under source control. Linus resisted that for a long time, until bitkeeper-guy convinced him, and then the kernel core geeks hacked out git when bitkeeper-guy wanted cash on the barrelhead. The Linux version of "source control", up to the implementation of bitkeeper, was the kernel developers' mailing list (where patches were submitted), supplemented by direct email from Linus's lieutenants to Linus (they sometimes received patches off-list), all of which was rolled up (or dropped as unwanted) in each kernel release on kernel.org. SCO might have originally hoped that the fog thus engendered would buttress their case, I suppose.

    [ Reply to This | # ]

    This is really stupid
    Authored by: Glenn on Tuesday, March 27 2007 @ 12:42 AM EDT
    The whole thrust of this declaration is really stupid. All of IBM's
    contributions to Linux are documented publicly. They were even required to
    produce all Linux work which was not accepted, which is still publicly
    documented, unless possibly it was something that was worked on but never
    submitted, which is not an infringing activity except in the SCOG's distorted
    world.
    How hard is it to search through the iterations of AIX and Dynix for code
    that matches the any of that which IBM contributed to Linux? (Not very).
    But that is irrelevant. The existence of sandboxes or not is irrelevant.
    There is no Linux in the CMVC system. If there was AIX and linux code on the
    same computer, so what? The code that IBM contributed to Linux is already
    known.
    The only relevance is whether the SCOG's viral contract theory (all your code
    are controlled by us if it has ever been included an any product that is a
    derivative of Unix System V) is correct. If that theory is not correct, none of
    the sandbox squabble matters. If the theory is correct (heaven forbid), the
    possible exixtence of any sandboxes and there deletion is still irrelevant. All
    of IBM's contributions are publicly known.

    [ Reply to This | # ]

    Dr. Ivie Declares his Suppositions - Updated: Jan. 18th motion hearing transcript
    Authored by: Anonymous on Tuesday, March 27 2007 @ 01:23 AM EDT
    In Dr. Ivie's own words, a proper sandbox includes a "suitable backup to protect the system and so that when programmers hit a roadblock the system can be rolled back to an earlier state and development can begin again there." That's right, a tool to remove those embarassing "learning experiences" that break the code, so that you can start over with a different plan. By his own admission, there's nothing sinister about cleaning out the sandbox. That's what the roll-back tool is for: you can try just about anything, because if it turns out to cause new problems or morphs into an embarassing kludge you can start over on a clean slate. It also allows you to build and test the final set of source files, and only those files, before checking the work back into CVS as a working product. It's Software Quality 101: test code built exactly the same environment as the code you intend to ship it, and ship code built in exactly the same environment you used for testing. Any differences, such as leaving old "unused" files in the sandbox during the test build, casts doubt on the validity of the test.

    [ Reply to This | # ]

    Spoilation of Evidence - How it Happened
    Authored by: Anonymous on Tuesday, March 27 2007 @ 02:01 AM EDT
    I want to apologize for all the down time over the weekend. Yes, more hardware troubles. I think we have a solution coming soon, but for the moment, things are rather delicate, so bear with us, please.
    Likely story. What really happened was that IBM was in over the weekend spoiliating the evidence hidden on the Groklaw servers. Mountains of code don't just dissappear over night. Even with ibiblio's massive server farm working day and night, it took all weekend to spoliafate it.

    Let's face it, does IBM's story sound plausible? "The code spoilated when the server room a/c failed and it thawed, so they had to throw it out". I know it'spring and the weather is getting warmer, but bit rot just doesn't happen that fast. SCO likes their OS a bit gamey anyway. If it was up to them, they would have just trimmed the mould off the end and called it a new release.

    So look where this incident has left us. We're all standing around the evidence arguing about whether it's gone off. SCO's expert takes a sniff at the evidence and says he thinks it might still be OK. The judge takes a look at the best-before date and says it's probably gone bad. BSF says let's just cook it up and see if anyone dies when they eat it.

    We can't have this happen again. IBM ought to be kept out of the ibiblio server room before they do any more damage. We're all depending upon that dual processor Compupro 8/16 running the Groklaw web site and we can't afford to take any more chances.

    [ Reply to This | # ]

    Shome mishtake shurely?
    Authored by: devil's advocate on Tuesday, March 27 2007 @ 02:37 AM EDT

    Can it be that Dr Ivie's sworn testimony contains an outright falsehood, not just omissions?

    A programming environment or sandbox is the only place where the progression of code drafts can be viewed, from the initial version to subsequent versions. For AIX code, CMVC shows the initial code that was checked out, and the final code that was checked back in, but not all the steps in between. RCS, the system on which Dynix/ptx code is saved, shows even less. These intermediate drafts, – saved only on programmers’ sandboxes or similar workspaces –would have been important to develop further proof of IBM’s copying.

    From what I understand of RCS, on which CVS is based, all versions checked in are preserved and can be retrieved. I have no knowledge of CMVC, it being an IBM product and no longer used, but it would be incredible if it only recorded "the initial code that was checked out, and the final code that was checked back in, but not all the steps in between". That, after all, is the entire purpose of a revision control system like RCS. What he seems to be saying here or at least trying to imply, is that there are only two versions in the repository. I guess it turns on the meaning of "final" - this could mean "final" in that version, not final final. By coupling that misleading assertion with another, that a "sandbox is the only place where the progression of code drafts can be viewed" this implies the exact opposite of the truth. Of course, only the last version is in the sandbox - all the other preserved versions are in the repository.

    [ Reply to This | # ]

    Dr. Ivie and his Fiction
    Authored by: Anonymous on Tuesday, March 27 2007 @ 06:24 AM EDT
    I agree with the other posters that Dr. Ivie's declaration is misleading in the
    least part.

    As a programmer of 40 years and having been involved with UNIX since its first
    port to a non-digital machine (the Interdata/Perking Elmer/Conucurrent Computer
    8/32) and having been involved with Linux for the last 8 years. I have worked
    for and with more than 25 major corporations during that period.

    Mr. Ivie's work is mostly a work of fiction. He was asked to produce fiction of
    the form "taking everything in the worse possible light and assuming the
    worst possible motives and the worst possible combination of environmental
    elements what could possibly happen". He then wrote this report which
    asserts that his "Supposititions" have the same basis as fact. You
    notice he very carefully did not investigate what the programmers actually did,
    if he had he could not write such a report as that would undermine many of the
    wild assumptions he has based it on and thus discredit it. If you notice he
    does not qualify his statements with probabilities for to have done so would
    have him stating that the probability of his report resembling the truth is
    approximately equal to my being struk dead by a meteorite this morning a 9:09
    am, possible but not probable (my statistics and probability teacher was the one
    who presented the analogy of a particular jury being chosen in a fair and random
    manner to the Supreme Court as being approximately equal to you pointing a hand
    gun out a window overlooking a cow pasture and being struck dead by the buller,
    possible but not probable).

    He mixes technologies and techniques from all over the place, never referencing
    the physical reality in this situation, in order to come up with a theoretical
    one which will support SCO's assertions. For the record the last accessed time
    on any file on any system in the real world is probably when it was last backed
    up, not a terribly useful thing. The process of doing a search for a particular
    string will also update the last accessed time in every directory and file entry
    involved in the search, again not particularly interesting (worse in Windows a
    simple directory search can update the last accessed time). In most major
    corporations design documents are in source code control, it is the easiest
    methodology to keep track of and distribute such, thus blowing more of his wild
    assertions. Again agreeing with other posters you end up checking out much more
    in the way of source, all of which is recorded in the source code control
    system, into your sandbox to do compiles. Since you are duplicating large
    portions of the development tree sandboxes need to be cleaned frequently if they
    are used a lot (as anyone with a cat would have toled SCO or Ivie).

    But what is most gauling here is the idiocy and lack of logic of Ivie's
    asertions, these programmers deleted all UNIX sources and information and thus
    possible sources of "contamination" from their systems BEFORE they
    started working on Linux. SCO is trying to punish them and IBM not for having
    included SCO code in Linux but rather having the temerity to do things as they
    should be done and isolating the two development enviroments and thus depriving
    SCO of the ability of accusing them of refering back to UNIX code. The
    spoilation is not of evidence but rather of the spoilation of SCO's ability to
    corrupt and misinterpret motive and actions.

    [ Reply to This | # ]

    TSG Asks For The Impossible
    Authored by: Anonymous on Tuesday, March 27 2007 @ 07:58 AM EDT
    When TSG doesn't get what it wants, it asks for an appeal.

    TSG is moving the pea around and around. Next, TSG will want
    to know what the programmers had for lunch.

    Sandboxes do not exist as formal entities. That is why they are
    sandboxes.

    Releases are the formal entities. TSG knows that. I hope the
    judges also know that.

    [ Reply to This | # ]

    Dr. Ivie Declares his idiocy
    Authored by: mtew on Tuesday, March 27 2007 @ 12:58 PM EDT

    First, my normal laptop is suffering from brownout disease and I do not have access to spell check. As a result, my spelling handicap can not be compensated so comments on that score are not helpful. (The handicap happens to be due to dyslexia, not ignorance. I also drop a word from a sentence from time to time because of it.)

    Secondly, my comments are unabashedly sarcastic. I'm in a horible mood and barely fit for the company of nice people. You have been warned...

    1. I was retained by counsel to SCO to analyze the technical evidence in this case and to serve as a consultant and expert witness. I have been asked to comment on the use of sandboxes or similar programming environments in the development of Linux code at IBM, the importance to the case of information in such sandboxes, and whether other sources of information such as CMVC or RCS might suffice in evaluating what went on in that development process in sandboxes. My qualifications are set forth in my May 19, 2006 report submitted in this case.

    No comment on his choice of employer other than noting that some people will do anything for money.

    Programming Environments (e.g. Sandboxes) Were Used by IBM Linux and Dynix/ptx Programmers

    2. I understand that counsel for IBM represented that sandboxes were not used for Linux development. Any creative process requires an environment and facility where that creative process can take place. An artist creates paintings in a studio. A woodcarver creates carvings in a woodshop. Artisans, craftsmen, and skilled workers develop facilities where they can perform their work: workbenches, body shops, bakeries, etc. Programmers are no different.

    Artist create art where ever the art is. Sometimes the art is in a studio, sometimes it is on a noisy street corner. A woodcarver may work in a woodshop, but they are notorious for working on front porches. Any professional does his work in the place and in the way that produces the best result for that particular person. And indeed Programmers are no different.

    3. At Bell Labs I decided to use Ken Thompson’s newly developed Unix operating system as the basis for a Programmer’s Workbench (PWB), a facility where programmers could create software. Unix was an ideal environment for such work when enhanced with the set of tools that we developed. Within Bell Labs, and at a number of other companies, the PWB became the standard environment for software development at that time. Whether you call this workspace a programmer’s workbench, a sandbox, or some other name, it is essential to the software development process. IBM has used the term “sandbox” in a number of depositions and other documents.

    Gag. Name Dropping. Argument for authority. One of the forms a falacious argument. Ignore the people he worked with but check the quality of HIS work.

    While I would conceed that UNIX was a good environment for programming, 'ideal' is at best a personal opinion. A professional works where the work is. If that happens to be UNIX, then you will probably want to do your development in a UNIX environent. If it is MS DOS, then you will probably want to do your development in another environment and having to move things to a DOS environment will slow things down some, but not as much as doing all the development in DOS. If it is another environment, well it's another environment -- adapt. The work and the product are what is important. The envoronment may make the work easier or less easy and the product better or worse, but it is still secondary.

    "sandbox" -- a safe place to play. NOT necessarily the entire work environment. A sandbox is valuable because you can run its component (sand) through a sive to remove any undesirable contaminants (like cat droppings) easily and be fairly certain that you can continue to play in it safely.

    4. Thus, contrary to IBM counsel’s representation, I believe that IBM programmers for Dynix/ptx and Linux, as well as AIX, used sandboxes, or other similar workspaces or programming environments, to draft, revise and implement computer software for those systems.

    He can believe anything he wants. That does NOT make it true.

    Sandboxes are most useful when you are working with things that can contaminate the rest of the environment. Operating systems are notorious for the contamination they can introduce into an environment. However Linux is also well known for its safety. In particular, it provides strong isolation for file system development. It is perfectly reasonable to have a testing area for Linux with only minimal safeguards.

    Work spaces and other kinds of wroking environments are NOT necessarily 'sandboxes'. So his use of the term 'sandbox' is inappropriate, but I can, and I hope the rest of you can work around that misuse of terminology on his part.

    5. If IBM had not adopted and/or developed some type of suitable environment for their programmers, it would have taken them back to the late 1950’s and early 1960’s and would have made programming an incredibly inefficient and slow process. This would be like taking a tractor away from a farmer and giving him a shovel. Even if IBM had tried it, programmers would have resisted the move.

    IBM may have taken away the 'tractor', but that does NOT mean they replaced it with a shovel. More like they replaced it with a series of specialized machines that make the particular work being performed easier. He designed PWB. That's a good tool, but Eclipse, CMVS and a whole host of other tools have made PWB obsolete. There have even been enough conceptual shifts that PWB isn't even a good name for a 'tool set' these days.

    6. An adequate programming environment provides a place where all of the basic functions involved in software development can be performed. This includes the storage space to keep code, data, documents, and other information. It also includes suitable tools to perform the functions needed to create a software system. Below is a list of some of the activities performed in a programming environment or sandbox:

    And there is his big mistake. He ASSUMES that the 'programming environment' is a monolith with uniform properties. After all that is what PWB more or less provided, except that it didn't. A modern computer working environment tailors the properties of the tool to the job being performed. It is NOT a one size fits all proposition.

    1. the creation of design documentation specifying the functionality of each module, routine, subsystem, etc.;
    2. the definition of interfaces between software entities including arguments, parameters, flags, sequencing, etc.;
    3. the specification of structures, file formats, databases, constants, variables, etc.;
    4. the approach to be used in the testing each function, subroutine and module;
    5. the plan for subsystem and system level testing;
    6. the specific tests to be undertaken, the test scenarios, the test data, etc.;
    7. the capability to perform such tests in the context of the total system;
    8. the creation of code modules, the compiling of that code, and the linking of it together;
    9. the reasoning, behind algorithms and the motivation behind the various designs;
    10. all of this documentation for each software entity at each level of abstraction; and
    11. suitable backup to protect the system and so that when programmers hit a roadblock the system can be rolled back to an earlier state and development can begin again there.

    I have changed his 'unorderd list' to an enumerated list so I can reference each item.

    (1) There are specialized design tools, but a lot of the time a simple text editor is more than adaquate. Versions with spelling errors will almost always end up in the bit bucket. The stuff that will always be saved is the stuff that communicates information between people. Saving anything else is idiosyncratic.

    (2) The handling of this kind of information is NOT uniform. If the project uses tools that automatically generates this kind of thing, then intermediate forms are NOT likely to be available (but the sources used to generate this type of file WILL be recorded.) If the project is small enough, this stuff may be maintained by hand in which case the intermediate forms will probably be saved.

    (3) See (2). These are different browser capabilities, but they are usually available.

    (4) This is the same kind of thing as (1). Just substitue 'test managmement tools' for 'design tools'.

    (5) The results of an analysis of (4). Since the tools at this level are usuall assistive, not automated, the major intermediate results are likely to be saved, but not every intermediate result.

    (6) A lower level testing requirement. See (4) and (5) but note that automation is possible at this level.

    (7) Yet more testing. Done less often the (6) and often less automatable.

    (8) This was automated a LONG time ago. The results are available to the team but, at best, summaries are all that are likely to be saved.

    (9) Similar enough to (1) that this does not need a seperate discussion.

    (10) See (1) and (9).

    (11) Backup and Roll back are enough different that the tools have specialized. Roll back is MUCH more common than Disaster Recovery (the main function of backups). The version maintainance system does Roll backs.

    7. In addition to the sandbox or programming environment functionalities enumerated above, any sizable software development effort requires the use of a change/version management and control system. The SCCS system developed by Marc Rochkind is the granddaddy of such systems. Other such systems involved in this case include CMVC, RCS, CVS, and bitkeeper. A source code control system is one good source of information when trying to track a software development effort, and I did a number of searches of revision control information in these systems. One example of my use of this information is found paragraph 98 of my expert report where I note that a CMVC entry admits that JFS is based on System V Unix.

    More name dropping... I'm not entierly certain but wasn't RCS contemporanious with SCCS? Personally I ran into RCS before I ran accross SCCS.

    IIRC someone opined that he read more into that comment than was actualy stated. It is also hear-say.

    CMVC and Other Such Systems Are Not a Substitute for Programming Environment Information

    8. There are several fundamental flaws in the use a change control system, such as CMVC or RCS, to track a software development effort. A typical change control system allows a programmer to “check out” a module, to modify and test it for some unspecified amount of time, and then when satisfied to “check it back in” to the system. Perhaps this might be compared to trying to see what is going on in a darkened room with a strobe light. However, the strobe only illuminates a small part of the room (the code checked in and out) and the strobe is controlled by a programmer who may or may not want you to see all that is going on (visibility only at check-in time).

    Straw Man. Falacious Argument. Version management is PART of a programming environment, NOT a SUBSTITUTE for a programming environment. Also, 'programming environment' is too restrictive a term for modern use.

    Further, FLAWS is WAY to judgemental and is a personal opinion. The fact that a version managment system records checkpoints rather than 'everything' is one of its advantages, NOT one of its weaknesses.

    'Strobe' is a totally inappropriate analog. He's trying to invoke the idea of a poor quality motion picture. Version management systems are scrap books and file cabinets. They serve a different function.

    The fact that he is looking for a 'motion picture' does NOT mean a 'motion picture' is available. While some places do have 'security cameras' with continuous recordings as part of their business records, in most cases even those tapes are recycled with some frequency unless there is a good reason to save a particular tape. A version management system is NOT an analog to a 'security cammera'. It is however a long term business record and valuable as such.

    9. For example, let us assume that the programmer is developing a module for Linux, but is basing it on a module that comes from a contractually-protected operating system owned by another company. If the only visibility that we have is the module after it has been appropriately disguised, then tracing the source becomes much more difficult. Perhaps one could compare this to a body shop for processing stolen cars. It is much easier to prove auto theft if one can find the body shop being used. After a paint job, changes to upholstery, options, accessories, and careful modification of the engine and body numbers, it is much more difficult to identify the theft.

    And he jumps into the deep end of the pool without looking to see if it contains any water...

    Someone already mentioned that examining the 'Body Shop' would produce no admissable evidence. That is not quite true. If there was a security camera, the tapes might have a usable record. If the shop kept normal business records, they could also produce usable evidence. Neither would be as good as finding stolen parts in the car. What they are much more likely to prove is that the shop was a legitimate shop and the parts in question came out of the parts department, like everything else, and that the parts in the parts department came from legitimate sources. The CMVS records are analoges to the parts department records.

    10. It should be noted that a developer’s computer can hold more than one sandbox. They could be different versions of the same project, or they could be different projects. Take for example a computer with both an AIX and Linux sandbox. This creates the capability for a programmer to copy code from one sandbox (that had been checked out from the change control system) and use it in developing code for another sandbox.

    He's misusing the term 'sandbox' again, but that is at best a minor problem.

    11. Another specific example of valuable information that would have been in a programming environment or sandbox, but not in a change control system such as CMVC or RCS, is the timing of access to code files. Most computers, including Unix and Windows, maintain the last access time of each file they store. In other words, the computer keeps a record of the last time a file was viewed. If a file containing AIX or Dynix/ptx code was viewed in proximity to access to a Linux file, or even after the Linux files were created, that would cause concern that the AIX files were used to develop the Linux files.

    And from here on he is operating in a world of fantasy...

    'atime' records are a single value indicator. They record the LAST time a file was accessed if they record anything at all. They do NOT provide a complete access history of a file. While backup programs often (not always) preserve 'atime', it is very rare for other programs to do so. Compiling a program will change the 'atime' on the source code. Checking the code into CMVS will change its 'atime'. Deleting a file destroyes the 'atime' along with a lot of other information. 'atime' simply will NOT provide the evidence 'Dr. Ivie' says it will.

    The fact that SCO is presenting this as evidence shows so much contempt to the legal system that it is obscene.

    ---
    MTEW

    [ Reply to This | # ]

    Miscue?
    Authored by: Anonymous on Tuesday, March 27 2007 @ 02:03 PM EDT
    THE COURT: Now I'm going to ask you, Mr. Shaughnessy, to answer that question: What if anything is IBM willing to do or do you have an obligation -

    MR. SHAUGHNESSY: Your Honor, the day for asking for that passed a long time ago. That discovery in this case is closed. SCO has had that now for almost two years. And they were the ones who came in and told you, Your Honor, that they had to have this and that it would have the very information you just described. We have given them detailed instructions on how to use it.
    [...]

    THE COURT: The standard I think is reasonably available. I am going to ask IBM, in the spirit of cooperation, Mr. Shaughnessy, to do what you can or have others do it to see if you can assist in identifying it. That doesn't mean that anything is going to change in terms of the deadlines and the scheduling order cutoffs. But if there is somebody who readily has that information, I would ask you to assist in doing that.
    I think IBM misunderstood this part? I don't think the judge wants IBM to provide this to help SCO, but to rebut any attempt at appeal. In other words, while the judge is convinced that SCO is full of hot air, they lack the technical know-how to say that "all SCO had to do was run the FOOBAR command on SMVC and they'd have had the stuff they wanted" absolutely killing SCO's chances to appeal this to some tech-illiterate judge who might just buy it, not knowing SCO and trying to give it some small measure of credit due to their doubt.

    Or maybe IBM is more worried that they'd use it to create "new" evidence and go for even more bites at the apple?

    [ Reply to This | # ]

    • Miscue? - Authored by: tknarr on Tuesday, March 27 2007 @ 03:59 PM EDT
    • Miscue? - Authored by: Rann on Wednesday, March 28 2007 @ 12:00 AM EDT
    Dr. Ivie Declares his Suppositions - Updated: Jan. 18th motion hearing transcript
    Authored by: Anonymous on Tuesday, March 27 2007 @ 02:09 PM EDT
    I think a better analogy would be copying song lyrics.

    In order to determine if a composer copied pieces from song X into his own song
    Y, it is NOT necessary to get all his written notes about the song, all his
    musical scores scribbled onto scrap pieces of paper, then complain that these
    pieces of information are not enough...

    ...then demand access to the author's surveillance cameras so they can see if he
    hummed any pieces of song X while composing song Y...

    Geez. All you need to do is compare song X and song Y. That's enough.

    Personlly, I think we need a new word in the English language to adequately
    express the level of idiocy demonstrated by the SCO lawyers.

    [ Reply to This | # ]

    Dr. Ivie Declares his Long Ju,mp attempt
    Authored by: BassSinger on Wednesday, March 28 2007 @ 02:52 PM EDT
    In addition to the comments made in blue by the Groklaw member, I would add that
    picking up a copy of "Wicked Problems, Righteous Solutions: A Catolog of
    Modern Engineering Paradigms" and reading the "Parable of the Two
    Programmers" would help Dr. Ivie understand the development process much
    better.

    ---
    In A Chord,

    Tom

    "We cannot solve our problems with the same thinking we used when we created
    them." -- Albert Einstein

    [ Reply to This | # ]

    Sandbox - Dr. Ivie Declares his Suppositions - Updated: Jan. 18th motion hearing transcript
    Authored by: Anonymous on Wednesday, March 28 2007 @ 06:26 PM EDT
    Before I make a change to a file, I make a copy of that file. It tends to eat
    up disk space, but I'm a little bit paranoid, so I make the copy. Periodically
    I copy all of these files to another medium. Now I know you are supposed to
    delete the old stuff you no longer use, but I'm a pack rat. People complain
    that I use too much disk space, so I will copy the old files to another medium
    (other than that listed above.) and delete the old files. If one desired they
    could put together every thing I've done to a file since I first started working
    on it years ago. But this is only for my personally developed work. I would
    imagine IBM would need a more organized approach.

    [ Reply to This | # ]

    Dr. Ivie Declares his Suppositions - Updated: Jan. 18th motion hearing transcript
    Authored by: Anonymous on Friday, March 30 2007 @ 10:21 AM EDT
    SCO:
    > [...] programmers were instructed to destroy information that was in their
    sandboxes [...]

    AFAIK this is normal practice in IBM when teams are given new assignments or
    simply rotated. IBM has many customers and has strict policies on what people do
    with information when switching from project to project.

    Of course all on developer workstations what is off CMCV must be deleted. (And
    what may be checked is also regulated.)

    At least that what my friends software developers from IBM tell me.

    [ Reply to This | # ]

    Groklaw © Copyright 2003-2013 Pamela Jones.
    All trademarks and copyrights on this page are owned by their respective owners.
    Comments are owned by the individual posters.

    PJ's articles are licensed under a Creative Commons License. ( Details )