Oxide Computer Company

The analyst community put Oxide Computer Company in the HCI category. I'm calling that out. HCI = software-defined, commodity hardware, distributed hypervisor. Nutanix , VMware vSAN, Microsoft Azure Stack HCI. The hardware is almost irrelevant — it's the software layer that matters. Oxide = custom silicon service processor, proprietary switching, no BIOS, no traditional BMC, hardware and software co-designed as a single rack-scale system. The hardware is the entire point. Dropping Oxide into HCI because it converges compute, storage, and networking is like calling a mainframe HCI for the same reason. The convergence is superficially similar. The architecture is fundamentally different. This matters because Converged Infrastructure — the category that would have been a closer fit — was quietly retired by Gartner years ago. And now everything on-premises gets forced into HCI or the catch-all of "private cloud" regardless of whether the architectural model bears any resemblance. Enterprise architects deserve better taxonomy than that. The on-premises cloud landscape actually has at least four distinct categories: → Traditional HCI (software-defined on commodity hardware) → Engineered / Converged Systems (FlexPod, reference architectures) → Public Cloud Extensions (Outposts, GCP Distributed Cloud, Azure Arc) → Fourth Cloud (rack-scale, co-designed, hyperscaler-grade architecture on-prem) I'm building a Fourth Cloud Capability Matrix — a structured framework with defensible architectural criteria that places vendors honestly across these categories. Oxide. Nutanix. Azure Stack HCI. Amazon Web Services (AWS) Outposts. Google Cloud Distributed Cloud. Hewlett Packard Enterprise . Dell Technologies . All of them, mapped against what actually matters to architects making infrastructure decisions. This is serious research. If you're an enterprise architect or infrastructure buyer who feels this taxonomy pain — I want to hear from you. #FourthCloud #EnterpriseArchitecture #OnPrem #CloudInfrastructure #CTO

The analyst community put Oxide Computer Company in the HCI category. I'm calling that out. HCI = software-defined, commodity hardware, distributed hypervisor. Nutanix , VMware vSAN, Microsoft Azure Stack HCI. The hardware is almost irrelevant — it's the software layer that matters. Oxide = custom silicon service processor, proprietary switching, no BIOS, no traditional BMC, hardware and software co-designed as a single rack-scale system. The hardware is the entire point. Dropping Oxide into HCI because it converges compute, storage, and networking is like calling a mainframe HCI for the same reason. The convergence is superficially similar. The architecture is fundamentally different. This matters because Converged Infrastructure — the category that would have been a closer fit — was quietly retired by Gartner years ago. And now everything on-premises gets forced into HCI or the catch-all of "private cloud" regardless of whether the architectural model bears any resemblance. Enterprise architects deserve better taxonomy than that. The on-premises cloud landscape actually has at least four distinct categories: → Traditional HCI (software-defined on commodity hardware) → Engineered / Converged Systems (FlexPod, reference architectures) → Public Cloud Extensions (Outposts, GCP Distributed Cloud, Azure Arc) → Fourth Cloud (rack-scale, co-designed, hyperscaler-grade architecture on-prem) I'm building a Fourth Cloud Capability Matrix — a structured framework with defensible architectural criteria that places vendors honestly across these categories. Oxide. Nutanix. Azure Stack HCI. Amazon Web Services (AWS) Outposts. Google Cloud Distributed Cloud. Hewlett Packard Enterprise . Dell Technologies . All of them, mapped against what actually matters to architects making infrastructure decisions. This is serious research. If you're an enterprise architect or infrastructure buyer who feels this taxonomy pain — I want to hear from you. #FourthCloud #EnterpriseArchitecture #OnPrem #CloudInfrastructure #CTO

Unbeknownst to many, there is a hidden control plane lurking in your commodity server. When we started Oxide Computer Company in 2019, part of our vision was ridding ourselves of this hidden control plane -- and its ability to hijack your computer. The outermost part of the hidden control plane is the baseboard management controller (BMC) that handles the physical control of the machine (power sequencing, thermals, etc.) On the one hand, you do need something to do this, but the mechanism that the industry consolidated around -- from entirely proprietary vendors that you likely haven't heard of (e.g., ASPEED Technology) and connected to the brainstem of the system -- is unacceptable from a security perspective. We had seen vulnerabilities like the one Eclypsium, Inc. discovered -- dubbed "USBAnywhere" -- that (scarily!) allowed for total remote access to commodity servers: https://lnkd.in/gAipfrhp At Oxide, we eliminated the BMC, replacing it with a microcontroller running an open source operating system of our own design (aptly dubbed Hubris). You can learn more about our approach in Cliff L. Biffle's excellent OSFC talk: https://lnkd.in/gse9JcYB Just replacing the BMC with a slimmed down, fit-to-function service processor was a herculean undertaking, but there was actually something much more insidious that we had our eyes on eliminating: the UEFI BIOS. This is the software that first boots on the CPU; its job is supposed to (just) be a boot loader: to find the operating system that you actually want to run, and run that. But here's the problem: to boot the operating system you need... a booted operating system. That is, to load the payload that contains the operating system image, you need to read from a disk or over the network -- exactly the job of the operating system! So the UEFI BIOS contains within it ANOTHER entire operating system, but it's an opaque and proprietary one. And, unsurprisingly, it's riddled with vulnerabilities: https://lnkd.in/gepNFvb9 And what does the UEFI BIOS do when it actually boots the proper operating system? Ideally, it would obliterate itself, but it unfortunately stays resident, where the operating system can request things of it. But wait, it gets worse: the BIOS also installs software to be executed in something called System Management Mode (SMM) -- a backdoor that the processor can enter more or less whenever it feels like it. At Oxide, we managed to pull off what the industry thought impossible: we eliminated this layer and its backdoor entirely. So there is no UEFI BIOS because there is no BIOS. More on this in my OSFC talk on holistic boot: https://lnkd.in/gQfwtnuj So when you run an Oxide rack, you can be assured that this hidden control plane is gone -- and gone with it is the substantial attack surface that poses a real threat to infrastructure!