A few weeks ago, VMware, inc. released a new version of their “open source” VMware server software, in addition to a new VMware Player (2.5). VMware server 2 takes a few radical steps never taken before in the world of virtualization, most likely in an attempt to compete with Microsoft’s Hyper-V. The new build has not, however, been released without numerous bugs mostly centered around the new (botched) user interface.

VMware has always been the leader in virtualization, with the most recent competition being Microsoft’s Virtual PC, Parallels inc.’s Parallels workstation (and its unrivaled ability to run IBM OS/2 on any platform), and VMware’s biggest competitor, Microsoft Hyper-V. VMware has sought to compete with Microsoft’s Virtual PC and Windows Server-integrated Hyper-V with its own almost-open source and free VMware server, which has become a popular server virtualization package for host machines (reserving ESX for hostless machines).

Recently, however, VMware has released version 2 of its free-as-in-beer virtualization software, and it can hardly be considered ever being out of its beta stage because of the large amount of bugs and security holes present in the new release.

The most radical change in recent virtualization news is VMware server 2′s new user interface, a Java-based web application. Using a web application to very system-dependent software sounds like a disaster, and believe us, it is.

Using Java to power the web app in the first place must have seemed like a good idea to ease cross-platform development, but as a bash quote once said, “Saying Java is good because it works across all operating systems is like saying anal sex is good because it works across all genders”, and the lack of lower-level system access without specially developed (and extensively debugged) libraries is for the most part makes Java a terrible language to use for this type of virtualization, and the hacks used to initiate the virtual machine and system-dependent code from the web application must be horrendous, as made apparent by the constant null pointer exceptions that surface even from the web app sitting idle.

VMware server 2 launches the virtual machines using a browser-dependent plugin, which is also used to display the output of the running virtual machine. Our tests included Mozilla Firefox 3 on Linux (running the VMware server 2 software), as well as Internet Explorer on Windows XP to test remote connections. Firefox 3 required a plugin, and Internet Explorer required an activeX control to visually run and interact with the virtual machines, with guests operating systems (attempted to be) tested such as Windows 98, Novell Netware 5.1, and Windows XP.

Our tests were impossible to complete due to the web application constantly crashing with null pointer exceptions (fairly common in Java, especially with JNI code), and the only successful runs of Virtual machines turned out to be extremely slow (both on the host and remotely), and we had multiple issues with VMware tools from the older VMware server in the virtual machines.

As if the bugs themselves weren’t bad enough, the application could very easily compromise system security if exploited. During the initial setup of the software on the Linux host (Ubuntu 8.04, fully updated), the installer asked for a user to be named the administrator. I used my own personal account name (“anthony”) for the administrator, but instead of an expected password prompt, the installer continued installing. Later, when we pulled up the login screen of the web app (the installer botched the correct port number as well), I entered my username and no password, only to be kicked back to the login until I entered my system (e.g. /etc/shadow) password.

The fact that a remotely-accessible application that buggy (with pointers of all things) directly accesses my system passwords, decodes them, and uses them freely really turned me off with the whole application, as it violates the sandbox rule of security. If VMware Server 2 ran the user permissions with a separate user/password database like most other application, that would be fine, but directly accessing the system passwords in that manner really says a lot regarding VMware’s security habits, despite my support for their past products.

VMware server 1′s user interface was one of the most criticized aspects of it, but it was fairly secure, and best of all it worked without a hitch. Not only is the new web interface buggy and insecure, it leaves quite a bit to be desired as far as looks go much like the other interface despite the freedom XHTML, CSS and JavaScript would give a graphical frontend.

I also downloaded the new VMware Player 2.5 to run my own extensive virtual machine library, but while it steered clear of the bugs and security flaws of its server companion product, it also botched the VMware tools installed previously in my virtual machines and mis-mapped the keyboard codes, requiring a configuration hack in order to correct the problem.

Other than the bugs, VMware Server 2 does show promise with its new VIX API, 2 SMP per guest allocation, and a new 8GB RAM per guest threshold. If it weren’t for the major bugs, these would all be very desirable features to see in VMware server, while lowering the TCO due to its lack of a cost. But as mentioned, the bugs and performance overhead really hide all of this.

If VMware expects to compete with the rapidly-growing Hyper-V (refer to Netscape’s similar past regarding Internet Explorer), they really need to get their act together with their software. One could hardly call VMware’s second release of virtualization products production-quality, as the bugs revealed in the application are what I would expect from an application still in beta with a full bugzilla website. This recent turn of events has made me really wince at the idea of virtualization in any production networks, in addition to giving me “upgradephobia” regarding my VMware Fusion installation on my mac.

While VMware’s products are some of the best virtualization applications out there, their recently released products are some of the worst applications I have seen come out of a long beta-period in a while, and in my opinion they need to knock off the “solution-without-a-problem” Cell phone virtualization crap and continue to develop what they do best before Microsoft or Parallels inc. takes another chunk of their customer base away from them due to buggy products giving them an easy means of doing so.