hpr-knowledge-base/hpr_transcripts/hpr0035.txt

Episode: 35
Title: HPR0035: An interview with John Whaley
Source: https://hub.hackerpublicradio.org/ccdn.php?filename=/eps/hpr0035/hpr0035.mp3
Transcribed: 2025-10-07 10:33:41

---

5
Hello everyone, this is Hacker Public Radio and today we have a special guest from Mocha
5.
Please introduce yourself.
Hi, I'm John Whaley, I'm one of the founders of Mocha 5.
And could you tell me a little bit about yourself?
Sure, so I graduated from Stanford with my PhD in computer science and Mocha 5 was actually
a research project at Stanford that was called the Collective.
Before that I worked at IBM, Japan for a little while and before that I graduated from
my undergrad at MIT.
Pretty darn sporty.
Let's see, what exactly is Mocha 5?
So we'll go ahead, what we do is we have a complete desktop lifecycle management solution
that we deliver as a managed service.
Our technology enables IT administrators to easily manage virtual computing environments while
at the same time giving end users the freedom to work any way and anywhere that they want
using any operating system on ABC.
Are you reading these questions?
Are these answers or do you pull them out at the top of your head?
You said it started from this paper called the Collective, could you explain that a little
bit?
Sure.
I would remember that we have all ranges of technical knowledge of people that are listening
to the show.
Sure.
Okay.
So the Collective was this research project at the Stanford Computer Science Department
and the goal of this Collective project was really to make computing a lot easier.
We saw like a lot of people having a lot of pain, administering their machines, keeping
them up to date, keeping them from free of spyware and malware and so there's just a lot
of pain around system administration and keeping computers working.
And so what we did is we kind of took a look at this problem and thought there's probably
a better way to do this.
And so we came up with this idea of using virtual machines to help with system administration.
And so the idea is you run everything on top of your virtual machine and we have a special
virtual machine format called the Live PC.
And this Live PC has these three key features.
First of all, it has an automatic update to the latest version so the users are always
be running the latest version.
The second thing is it has an intelligent streaming and caching system so that users
can get started quickly and also work offline once they have the whole image they can disconnect
from the network and keep working.
And the third key feature is the smart rejuvenation.
So every time you start up you get a fresh copy of the OS and the applications but your
user data, which is your documents and settings, that will persist.
And so this Live PC provides an easy way for the IP administrator to administer a large
number of users.
While at the same time it gives the end user the freedom to work however they want, where
they want.
You can run any actually fixed operating system on top and it works exactly the same.
Okay.
Now your client runs on Windows and it runs on a left-hand, do you have a Linux client?
So we have a version called Bare Metal and what it is is it's a Linux client that's
bundled with a stripped-down Linux OS and kernel and so you can install that directly
onto the machine and it will boot up and then you'll have a list of Live PCs there and
you can just use it to launch these Live PCs.
And you get the Live PCs, it's all up your website and I actually installed the Bare Metal
installer and you can browse through and look at all kinds of different stuff.
I actually found it through HIKU which is a derivative from the BOS and it's really
neat to be able whenever they have an update that it's automatically there and I'm running
it and I don't have to download the ISO and run it to a CD and then run it.
So it's really cool stuff.
That's great.
Yeah, we have the, so on our website we have this Live PC library and this is all like
community contributed with these Live PCs that people have built and there's like hundreds
of these community contributed Live PCs and it's mostly free and open-source software and
we get a lot of people using it just to play around with different OSs and kind of just
see what people have done and have built and it's really nice because you know, you
know, we have people who are interested in things like Linux but they didn't really know
how to get into it or how to try it out and so our system using the Live PC, you just
click once, you click on the website, you can just click the download it and it'll start
streaming that virtual machine to you and you can start it up before the entire thing
has downloaded it and you don't have to install anything or anything like that and it all
runs within this secure virtual environment.
Because we have a lot of users who use it just to just to try out Linux or try out some
other alternative OSs.
Now, a lot of your users of Mocha 5 are just people that are just trying to play out with
it, try out with things, play around with them and obviously you're trying to, this
is a business you're trying to make some money and you all want to do this at a business
to help the administrators, you know, administer things for lack of a better word.
Do you have any clients that are actually doing that or are you still testing?
So we're planning to launch our company and our 1.0 products in the second quarter of
this year, so pretty soon.
We have some companies and trials doing some pilots and things like that and so there's
a number of interesting uses of the technology right now that people are using it for.
The first is the disaster recovery solution where, you know, let's say you're executive
that has a lot of caring around the laptop and something happens to that laptop.
They can carry around a USB stick that has a Mocha 5 on it.
They can then plug that into any PC that, you know, they go to the best buyer or whatever
to go buy a PC, they can just plug in the USB and it has all of the secure environment including
like the secure VPN and those kind of things so they can kind of be up and running quickly again.
So we have a few people using it for a customer using it for disaster recovery.
Another big one is lab management where you have a computer lab.
You know, maybe it's a training lab.
Maybe it's, you know, in a school, things like that where you have a number of machines
and an administrator needs to administer those, the software on those machines.
And so what the administrator can do now is they just maintain one image.
They maintain the one IPC image and that's automatically distributed to all of the different machines.
So it makes their job easier.
I'm sorry, go ahead.
Yeah, so the rejuvenation aspect means that, you know, so like if somebody messes up the machine somehow
and saw software and things like that, all they have to do is reboot and then always goes back to a pristine state.
And whenever the administrator wants to post an update, you know, there's a new hot fixes or a new versions of software
and install new software and things like that.
They just, on their machine, they just start the IPC.
They install the software and test it out and make sure it works.
And then they post it to the server.
And then, and then all of the clients, all the subscribers of the IPC automatically get the latest version
and start running the latest version.
So this makes it a lot easier to administer a large number of machines and keep them up today and keep them working.
At the university, I attended, they did this with Ghost and they'd have to go around and physically ghost all the machines
and whenever there was an update, they had to make a new ghost image and all that mess.
And this would really save them a lot of time, you know, a reboot a lot easier than actually sitting there.
Yeah, so I mean, Ghost is really, is focused on the deployment aspect that you wanted to deploy some image.
But we're really focused much more on the entire lifecycle.
So it's like, it's not, like, beyond just deploying the image, you have to keep it up to date, keep it, you know, keep it maintained and all these things.
So that's, we're much more focused on this, on the whole lifecycle of a desktop rather than just the initial deployments.
So what are some of the disadvantages of this model?
Do you know what I'm saying?
Well, I mean, I think, I mean, this is definitely a radical, you know, a different, a radically different way of doing computing.
You know, now you say, I'm going to run everything on top of a virtual machine and I'm going to, you know,
and the virtual machine is automatically going to rejuvenate on every reboot and things like that.
And so this works particularly well in the cases where you have a, you have kind of more of a controlled desktop or locked down desktop where you have people, you know, basically, you want to have a large number of computers who are kind of running pretty much the same software.
You don't need to have a lot of customization on each, on each machine.
In that case, you know, you really get this, you can use our system to get much better scale to, you know, scale up to more, more computers are a lot easier.
But like, if, you know, in the case where you have, you know, like, a lot of like, if the way I think about it, this is like, this is really the computer, the type of system that works really well for people like my, my parents, or, you know, my,
not so tech savvy friends who I always have to go and help doubts and, you know, go fix their printer because it doesn't print or go clean up their system of spyware and things like that.
This, this system works, works really well for, for those kind of cases.
Good deal. One of the disadvantages that I thought of, as I was reading the paper on the collective, was that, you know, I'll talk a lot about the security and how it would, you know, protect people's data, this that and the other.
But I thought about the underlying operating system that's running the virtual machine. You have to walk around and actually physically secure all of those still on top of the image that you all are hosting on the, on the server.
Yeah, so that's why in the bare metal case, we, we, we use this Linux kernel that we stripped out like most of the services and stripped out as much as possible just to try to make that, that lowest level, the most, the most secure possible.
I mean, for example, if you are running the Windows clients, well, then you're still, you know, kind of subject to what the underlying Windows is to some extent, even though your, even though your live PC contains all the bits for the operating system.
And you're actually running, you know, right, right off of those, you're still, you know, for example, could potentially be subject to key loggers or things like that on the underlying OS or exploits in the underlying OS.
And that's why I feel like for, for high security applications, we recommend the bare metal version because that, that has, has better security because of the underlying Linux, stripped down Linux.
Good deal. What kind of open source software does Mocha 5 use like in their office or in their product?
So like, in our product, we make a, make use of a lot of open source libraries like, live curl or live XML and WX widgets.
And those libraries really help us out a lot because they made it a lot easier to build reliable cross-platform software.
And in our data data development, we use a lot of open source development tools like subversion or cruise control track, GCC, things like that.
And this, this open source software works really well for us because first of all, it's cross-platform and we have a cross-platform client.
And we also use a lot of open source software within live PCs.
So if you see a lot of the, a lot of the open source software in the live PC library, you know, we use that quite a bit.
There's some interesting, interesting software out there that we never would have, would have realized until somebody posted it in a live PC and, and let me download it, try it out and find it to be really useful.
I was reading in the paper that you all are doing authentication over SSH and using tunnels to securely send the data from the client to the server.
Not that was really neat.
Yeah. So, I mean, that's, so we, the paper was published, I think, back in 2005 or we sensed, you know, that was, we sensed kind of moved beyond that and, and improved the system in various ways.
So, that was the first information that we had done at Stanford and now we don't actually use the tunnel over SSH in most cases, just, you know, just because of things like proxies, things like that.
So, for better compatibility, we, you know, use other techniques like HTTPS, things like that.
Good deal. Could you all start at Mocha 5 without open source software?
Well, we, we probably could have been able to start the company, but we wouldn't have been nearly as far along as we are today without open source software.
It's definitely accelerated our development and made, made things like that, that community driven a live PC library possible.
So, we, it, we have definitely benefited from, from open source software.
Let's see, going down the list.
Are you planning on open sourcing any of y'all software that y'all write?
So, our current, like currently, we're really focused on watching the company and just getting one point out, out of the door.
That being said, it's definitely not out of the question.
I personally am a big open source proponent and I've started and contributed a number of open source projects on sourceboards and some other sites.
And Mocha 5 itself is also a big proponent of open source, you know, with the community driven live PC library and really kind of helping to promote Linux on the desktop.
And we get a lot of users who are interested in playing around with Linux but, you know, don't know where to start and with Mocha 5 you can play around with.
And we make it really easy to play around the alternative operating systems in a safe way without having to, to install anything.
So, it's definitely not out of the question and, you know, and I think that, you know, in the future that at least some parts of our software may become open source.
Okay, y'all are currently using VMware for your virtualization.
Are y'all planning on building your own, using, continuing to use VMware, using some open source stuff?
So right now we, we, we partner with VMware and, and use their virtual machine monitor layer.
And so right now we focus on VMware just because that one's really stable and has good performance and it's, it's cross platform.
However, the technology is really independent of the VMM layer.
We could take out VMware and plug in another virtual machine monitor with very few changes to our, to our system and to our codes.
And we just happen to be right now just focusing on VMware just because that one is one of the better virtual machine monitors.
But if you look at, if you look at what's happening in the virtualization space, there's definitely a lot of, a lot of new VMMs that are appearing, you know, there's, there's things like Zen, there's things like virtual box, for example, QMU even, you know, a lot of these are free and some room are open source.
And so I think that that in the future, this virtual machine monitor layer is really going to become like commodity, like you can, you can use, there's, there'll be a lot of them available and you can use, you can use any of them.
And we're much more focused on the kind of management of the virtual machines and keep them up to date and, and keeping them working.
And, you know, it's kind of like, once you have all of these virtual machines, what are you, what are you going to do with them?
And so the, we, the MoG-5 is, is really focused on that, you know, making it easy to manage virtual computing environments.
Good deal. So what are you, we are going to take the Linux client out of the bare bones or bare metal installer and just let me download it and use it.
Well, I mean, it just, it comes down to, you know, we, first of all, we wanted to really focus on the Windows client first because honestly that's where most of the pain is.
And we, we do have the bare metal client, which has the Linux client bundle then with the substrate down Linux OS.
And it's just a matter of, you know, kind of question of priority and question of resources, but we're definitely interested in, in doing that.
And I'm sure, you know, some of your listeners, for example, would probably be able to figure out how to take the bare metal and refackage it as a standalone client because it's, it's just kind of in there and, and it's, and it's, it's going to be that difficult.
Good deal. Good deal. Well, do you have any, any questions or anything else you want to say? I know you need to get back to work.
Yeah. No, I think, I think that, that, that pretty much covers it. So I just want to encourage your listeners to go and check us out at local5.com. That's moka5.com.
And we have, we have a lot of IPCs there in our IPC library. You can, you can try out and play around me and thanks a lot for taking the time and thanks a lot for your interest.
Hey, well, thanks for being on the, uh, big radio show.
Thank you for listening to Hack the Public Radio. HPR is sponsored by caro.net. So head on over to caro.int for all of us.
Yeah.
Yeah.