Hacker News Reader

Comment by whalesalad | Hacker News Reader

I wonder why these die hard Windows fans stick with it when they realize what kind of things you can do with Linux.

I wonder about the mindset that allows one to accept running MacAfee on a freakin' Point of Sale device is something that just has to be done?!

If credit card data is going to pass through the device, anti-virus software is mandated by PCI-DSS.

It's still wrong. Anti virus software in general are not very far from virii themselves in what they do to your computer. This whole macafee story just proves the point, but it's not the first time such a thing happens. AVG had that happen to them too a year back.

Hmmm interestingly, the "unix exemption" seems to have been dropped from 1.1 to 1.2 of DSS document.

Part 5.1 used to include this note:

Note: Systems commonly affected by viruses typically do not include UNIX based operating systems or mainframes.

Consumer grade MacAfee that auto updates is still probably a very poor choice for this application as they should have a test bed in the lab that they beta all changes on before they roll out to thousands of machines that likely need a truck roll if something goes wrong.

You can run McAfee on linux now as well (mostly for scanning email and CIFS shared files, I assume?). PCI DSS and DoD IA controls require it.

Enterprise grade McAfee still sucks, it's just a more manageable suck. Despite that, it still blew up with the bad DAT file - those are the same between product lines.

The WTF here is that anti-virus software is mandated by PCI-DSS and not procedures that stop virii in the first place.

> If credit card data is going to pass through the device, anti-virus software is mandated by PCI-DSS.

Even when the POS is not running Windows? Or does the PCI-DSS assume all computers are running Windows?

Its a perfect example of the classic "if it can then it must" brainless rule application.

I once had a car that had a bad bulb socket in the "cyclops" brake light so it wouldn't pass inspection. Did I fix the socket to get past? Hell no. I removed the whole light. If it wasn't there, it didn't have to work. Those were the rules.

It doesn't have to be done. I've worked on POS and smart-weighing systems that were cross-platform (Windows and Linux).

Neither used AV, but they were tightly locked down. My impression was that most customers don't care about the OS. Some prefer Windows, they already have the tech personnel in place. On the other hand, the Linux ports were done because a very big customer said that they had to have Linux... It certainly cost them more than licensing Windows. :)

From a dev point of view, Windows was easier, as it is generally more friendly towards C++ development. The OSes were about equally capable, I didn't see any Linux technical advantages in practice.

Reminds me of http://xkcd.com/463/

Except now, the condom isn't just pointless, but it's an active threat in itself.

You might even say it's... a trojan.

groans

As I noted on his blog, it is rather unfortunate that there aren't more Linux based point of sale systems out there.

I guess point of sale software is considered 'enterprisey' enough to warrant vendors wanting to run Windows and SQL Server for 'support' reasons.

Maybe it's to do with the lack of working drivers for most ticket printers in Linux.

Not really sure how accurate that is....most ticket printers, magnetic card readers, weigh scales, barcode scanners, and other POS related devices adhere to the Unified POS standard.

There is a Java implementation of the standard (called, unsurprisingly, JavaPOS) as well as a .NET implementation (called POS for .NET). I've run a Linux based point of sale that used JavaPOS to interface with peripherals without issue.

Lots of vendors are also MS resellers and will turn a profit by selling their client all the Windows and SQL Server licenses they'll need to run the provided solution.

The guy was just as impressed with his Windows colleague's skills.

Who sticks with what, where? Windows and Linux both have their uses. I use Windows because in my opinion Visual Studio is the best native code debugger ever created. I'm hardly a fanboy though, and I use Linux a lot (valgrind is awesome).

Did the "use the right tool for the job" message in the article go over your head?

Reply on news.ycombinator.com