Alumni Profiles

Kristaps Dzonsons

Kristaps Dzonsons BS '04

Interview from 2018 Multicast Newsletter

Kristaps Dzonsons graduated from UR in 2004 with degrees in Computer Science and English. In the years since, he has started two companies, and done research in distributed applications, high-speed operating environments, and mathematical and computational game theory at institutions in Latvia and Sweden. He is active in the open-source community, developing BSD tools, giving talks at conferences and gaining an online following. He has spent the years since graduation in about a half-dozen countries (he actively speaks English, French, Latvian, ASL, and basic
Thai), He currently lives on the island of Malta but spends time in Thailand, enjoying free diving and SCUBA. After running his own consulting business for several years, he’s about to begin working with a start-up.

While you were still completing your UG degree, you and fellow CSC alum MengZhu Wang had a business already in the works. I remember a discussion about an attic full of servers in your off-campus house to handle the workload. What happened to that?

KD: Our company, Gradient, did what most companies do—failed. I still think the idea was a novel one: a self-organizing distribution network for security events on large, volatile networks. We still have a patent on it and haven't given up on other applications of the idea, should the time present itself. But in Gradient's day, just following the dot-com bust, the upstate New York market for high-tech firms was limited. If you're a student with an idea, just do it. Pull together a team of the brightest. It's an incredibly worthwhile investment of time no matter the sleepless nights.

Tell us about the tools you have created for BSD. Which tool that you have developed for BSD is the most widely used? Why do you think it has become so popular?

KD: Curiously, my most widely-used piece of open source software is mandoc, a formatter for manpages replacing the traditional groff, apropos, man, etc. I suppose its popularity is license (BSD vs GPL), language (C vs C++), and speed. I stepped down as the maintainer several years ago, however. All in, I actively maintain about a dozen software utilities and libraries, the most popular being kcgi, a library for CGI and FastCGI; and acme-client, a client for ACME certificate servers. I exclusively write for UNIX systems, mainly OpenBSD, and mostly in C.

My most exciting open source project was "mult", which I developed for reasons since forgotten. I think it was in writing a proper jail, as on FreeBSD, for OpenBSD. It was similar to what's now known as namespaces in Linux, but for OpenBSD and NetBSD. I was also writing mandoc (then mdocml) at the same time, which ended up taking more and more time till mult fell to the sidelines. In a scientific capacity, I've written a fair number of open source game theory and numerical analysis tools that may still be in use. Most of these are large-scale domain-specific simulation systems built for clusters or multiprocessors, depending upon the context.

Most of my open source software is available from GitHub. I think it's worth imploring computer science students to participate in the open source community. Not only is it beneficial in terms of knowledge, but it's also about being part of a community. I've met a lot of incredibly talented and interesting folks at conferences and hackathons, not even to mention casual interaction on mailing lists and IRC. Collaborating with OpenBSD folks in particular has given me a significant incentive to write clean, well-documented systems. I always assume what I'm writing is going to be looked at by somebody smarter than me, and somebody who's just had a bad day as they sit to read my code.

After you worked for a while, you went back to school to complete a PhD in Theoretical Computer Science at KTH Royal Institute of Technology in Sweden.  Where did that lead you?

KD: I did about three years of my PhD—I started in 2008, if I recall correctly.  I'd been working on my PhD when I took a leave of absence to work as a researcher for Prof Jorgen Weibull at the Stockholm School of Economics. After realizing how much I enjoyed applying systems, versus studying them, I switched to full-time research work as my own company. I think I knew the moment I started working with Prof Weibull that I'd had enough with theory—the work was so much fun, and so rewarding! I think this period stretched my knowledge to the utmost, as Prof Weibull's work involved tremendous
simulations and systems related to game theory and mathematical biology. There wasn't a single day that went by without needing to learn something about linear algebra, compiler optimization, or floating-point rounding. This research was the beginning of k-Consulting, my business.

I found my clients (or they found me) through word of mouth. It's not enough to write good code or good documentation. You need to be able to network, and I'm still learning to do that.  Sadly, k-Consulting is currently being shut down, as I've since changed work to a company that's still in formation.

In some of your talks on YouTube, you indicate how difficult it is to write secure software. Can some of this be addressed by better education? If so, what improvements would you make? If not, would better tools for software developers help?

KD: Yes, but it's hard to say how in practice. Beyond the very general, such as privilege separation, or very specific, such as ASLR or ROP gadget mitigation, most of software security relates to tools available in the given environment. And most of secure development comes down to process—testing, QA, analysis, documentation, etc.
There's a lot of diversity in system security tools available, as they depend upon programming language, operating system, and even hardware. New tools come out, old ones fall away. Nowadays, there have been many efforts in applying formal methods to prove security, which is an exciting pursuit, but it's hard to say whether this is practical. It's still very wild-wild-west out there. Security processes are more straightforward and arguably more important. Implementing a system with a security process will do wonders. Or at least make it really easy to assign blame.

My suggestion would be to learn the security tools available to your development environment. And if there aren't any, consider changing your environment. Or writing your own, for the boldly inclined! Unfortunately, as we've learned with the recent hardware-level bugs in popular processors, security needs to be part of the whole stack. One weak link can cause all others to fail.

You discuss using operating system features e.g., access controls, to limit application misbehavior and to enforce security policies. However, current operating systems are themselves vulnerable to attack. What do you think should be done to mitigate this risk?

KD: There's a vast amount of research going into compilers and operating systems to protect applications from applications and the kernel from applications—research stretching back well before UNIX. Old ideas (virtualization, access controls, capabilities), are constantly being rehashed. I'm not particularly qualified to speak on mitigation on the current wave of attacks, whether from the hardware level (Spectre, Meltdown, etc.) or above (BROP attacks, etc.). There always seems to be a new attack around the corner, and after a while it gets hard to keep up. Each requires new strategies for mitigation.

What impact has your Rochester education had on your success? What are the classes you took while at UR that have been most useful and why?

KD: A tremendous impact, for sure! The CS and math education at UR laid the foundation for everything I later went on to learn, research, and apply-- from algorithms to operating systems to abstract algebra. I've tried to follow this with an "especially", but can't do so. For example, I don't work directly with AI, but knowing the foundations have helped me, for example, in writing maximization functions for "lumpy" topologies.

I credit Prof Michael Scott and Prof Sandhya Dwarkadas for having the most influence on me and my work. For the former, in having a thorough understanding of operating systems, compilers, and languages. For the latter, distributed and parallel systems. Both for demanding concise, clear documentation and implementations. I use the foundations from those classes on a daily basis.

I also strongly suggest the algorithms courses: every algorithm you learn, no matter how obtuse sounding, will come up again. Yes, even AVL trees. There's a lot of focus these days on new artificial intelligence and statistics. But when it comes to day-to-day work, I've found myself constantly revisiting the classics. This is doubly necessary if you find yourself working in applied mathematics or numerical analysis.

You double-majored in English/Poetry along with CSC at Rochester. How have you incorporated your love of literature and poetry into your busy life?

KD: If I'd need to pick a major I enjoyed most, I'd probably tend toward English. You'd asked which CS courses I felt were instrumental, but if I think of the tools I need in other walks of life, being able to write a decent e-mail can be far more beneficial than a good A* implementation. And as it follows in non-professional matters, having something interesting to say about Edward Albee will generally resonate more than the newest Intel mishap.

You’ve lived in cold weather locations of Latvia, Sweden, & Rochester and now spend your time between warm Malta and Thailand. Is that a business choice or a quality of life choice?

KD: It seems that I've migrated further and further south as I've gotten older. Cold makes me ache. Perhaps I'll curve back upward at some point, but I really enjoy living in warm climates, with cold climates as a controlled choice. When I think of vacation, I think of beaches—not mountains or snow.

I also enjoy living in Asia quite a lot. I think this comes from not understanding very much. There's something very liberating in not being able to read street signs or have more than a pantomimed conversation. Of course, eventually one learns to read the signs.

Many of our recent graduates dream of working remotely while traveling the world. What advice would you give them? Are there places in the world that are more conducive to having a wanderlust tech career?

KD: My advice is first to get an accountant and a lawyer who can handle the interaction between localities. In particular for those with United States citizenships. You do *not* want to overstay your entry permits, especially if you find reasons (romantic or professional) to stay where you are longer.

I'd also advise them to prepare for compromise and slow growth. Not being in constant touch with your employer (or contractors) makes it hard to integrate—which, for a time, may be what you want, but also makes you easy to dispose. In time, being able to move around needs to balanced against having the money to move around and having a path to move forward.

Working as a freelancer is brutally difficult, but is also incredibly rewarding in being self-reliant and knowing all stages of how income gets from your client's pocket to your table-top. And as mentioned elsewhere, open source will serve you very well in having a well-stocked tool-box! On the flip side, working as a freelancer is also important in discovering and celebrating what non-freelancers have but don't necessarily appreciate: stability and reasonable income. Life conditions can change!

Tell us about your very exciting life outside of work.  How many languages do you speak?

KD: I more-or-less actively speak English, French, Latvian, ASL, and basic Thai. And no longer speak a few more. These days I'm trying to improve my Thai (and Maltese), but English is far and away the language I speak most.

I have both Latvian and US passports, but don't have much of an "originally from", having moved around a lot. If pressed, I just say I'm Latvian, as the lion's share of my life has been in Europe.

When not hacking on open source projects or working (though the two intersect fairly often), I free and SCUBA dive wherever and whenever I can. I prefer free diving, but I am certified as a technical SCUBA diver as well. Diving adventures have taken me from fighter plane wrecks at 50 meters to free diving with whales.

I currently live on the island of Malta with my wonderful partner and our dog though I spend time in Thailand as well. When in Malta, I speak mostly English—Maltese is a tricky language, although I love the sound of it. When in Thailand, I try to speak Thai, but that's a work in progress. Thais are incredibly helpful when it comes to learning the language.

One language that's been of tremendous utility to me has been sign language. (When underwater it's integral, though surprisingly it doesn't have a large following in the diving community.) There's a significant deaf community in Rochester, and a very friendly one too! I highly recommend learning a bit and attending a deaf theatre performance.

As always, I recommend spending time in whichever sea is closest to you. Because you don't know what you're missing till you've come up close to a 5m wide manta ray, or bumped heads with a whale. Or learned to surf, or just spent time in a rowboat with a companion of choice. Lastly. No matter where you are, find somebody to spend the time with you.