Hacker News Reader

> This is a poorly written article.

This article seems to originate from the Netherlands, drumming up anti Microsoft rhetoric that was very prevalent a few years ago here.

It is important to understand with these types of articles, that Microsoft and their local partner companies (disclosure: such as the one I work for) has competitors who stand to benefit from stories like these. Other companies (like IBM, Oracle working with local ISV's and service companies) want to sell their, also propriety, but non-Microsoft based solutions. They promote independence from Microsoft as a feature of their software, and have budget to hire PR firms and run a lobby too, just like Microsoft.

But their solutions often come with a worse type of vendor lock-in. The Oracle type. In the Netherlands, most public backend administrative software is not based on Microsoft technology, and it is completely closed, unable to integrate with (Microsoft based) front end systems or web api's.

The article states that Microsoft makes 2 billion in the EU public sector, I don't know if that is true, but in the Netherlands spending on Microsoft software is somewhere around 1-2% of total public IT spending, and I'd say they provide relatively good value for that.

> unable to integrate with (Microsoft based) front end systems or web api's.

It's not 1992 - Oracle databases can integrate with all sorts of web APIs and front end systems. You may not like how its done or how much it costs, but it's a little over the top to claim that it can't be done.

> Oracle databases can integrate with all sorts of web APIs and front end systems

Of course, however the problem is not a technical one. IT suppliers simply use their ownership of the software and support/maintenance contracts as leverage to claim a stake in any project connecting to 'their' software, and make their customers pay through the nose for anything they want.

" You may not like how its done or how much it costs, but it's a little over the top to claim that it can't be done."

It can't be done in a business if the vendor decides it costs too much or will be done in a way unsupported for good reasons. Whereas, with FOSS, they might pay someone to fix that or someone might do it themselves. The arbitrary costs and limitations the proprietary vendors can force on locked-in users is an important risk of their model for users.

> The problem is lack of control over vital parts of state operations, leaving European countries at the mercy of a foreign company and government.

This is a very valid point.

> This doesn’t only weaken Europe’s ability to stop the US snooping around, it also leaves security flaws for anyone with the know-how to exploit.

https://www.theguardian.com/society/2017/may/12/hospitals-ac...

I agree that it is not a very precise technical article. But the main issues hold true.

Disagree entirely - for me it hits the nail on the head immediately. And what a timely article given the impact on the NHS today. Are we seeing NSA tools used in the wild? The EU handed Microsoft its biggest fine and still we have this unacceptable state of affairs where we have secret code running public utilities and services, especially of a foreign/extra-judicial entity. Unfortunately getting out of that lock in is going to be tricky.

You think that if an entire government was running a specific *nix operating system that the NSA couldn't develop an exploit to gain access to the OS?

Android phones run Linux and get hacked to get root access. Routers, IoT devices, and lots of other hardware run Linux variants and get hacked all the time.

This idea that people hold that if only we didn't run Windows we'd all be more secure is silly and naive.

It would certainly be harder, since they don't have the political option of compelling Microsoft to add a backdoor.

you're implying that coercing major companies is easier than few hours researching vulnerabilities?

I think you are grossly understating the difficulty of penetrating actual defenses.

Once a vulnerability is used it is likely to be patched. A group that cannot be coerced to do something for you will close vulnerabilities as it learns of them because they are liabilities.

Also, moving away from microsoft will likely lead to the end of software monoculture. You need to research those vulnerabilities for each target. Oh, and it it would be much more than a fewer hours of research.

Gah, this brings me back to the glory days of slashdot.

The software monoculture exists because of USERS. The vast majority of users don't want to have to learn three different OS, look+feel, GUI rules, etc. They just want the goddamn excel file that the CPA sent over that they need for their accounts receivable report to OPEN. Trying to convince governments to go to FOSS doesn't well work because the users slip back to things so that they can do their job the way they know how.

See, e.g. the city government of Munich, which after a decade of trying never got above about 60% of their users to switch to Linux, and is considering abandoning the effort.

For people outside the United States, switching away from microsoft really is a matter of national security (It kind of is inside the US too, but that is a different argument). If leaders of a nation allow their civil servants to be so lazy that they damage national security they deserve whatever results they get.

Using new software today isn't like it was in the 90s, the OS is much less important. UIs can be delivered by web and all the user friendly UIs (all mobile OSes, and no desktop OSes) area ll similar enough that many users can't tell the difference. If this is the barrier to someone's national security...

i.e. http://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-a...

There's been multiple attempts. Linus has even been directly asked to put backdoors in Linux.

There is even a contest to make code look normal, but do something malicious https://en.wikipedia.org/wiki/Underhanded_C_Contest

I'm sure the NSA is very good at that.

NSA would find lots of exploits. Many black hats would, too. The key difference I see from high-assurance security is that there will be a diverse array of protections developed that might stop anywhere from some to all attacks. There's a pile of them out there in CompSci, private sector, and so on for Linux, FreeBSD, and Android. Tiny portion of that R&D goes to Windows kernel or privileged userland. Microsoft Research even builds great tools Microsoft themselves won't even use in the general case even though they applied some of them.

To put this into perspective, there's CPU modifications that can make a Linux or FreeBSD system mostly safe and secure against known classes of attack instantly just at the compiler and CPU level with a certain performance hit. Anyone wanting improved security could then use Linux with those CPU's probably buying some extra chips, too, to cover performance loss. You don't have that option with Windows.

http://www.cl.cam.ac.uk/research/security/ctsrd/cheri.html

http://sva.cs.illinois.edu/pubs/KCoFI-Oakland-2014.pdf

https://www.cs.rutgers.edu/~santosh.nagarakatte/softbound/

> The operating system that runs on a system has no bearing on how the data for various applications is stored

It's not impossible for a motivated user to go against every UI (dark) pattern to keep work on an open format, but it's so unlikely as to be irrelevant.

While the file formats may be open, it's widely known that MS keep enough secret sauce in Office so that an MS Excel nightmare won't open correctly in LibreOffice. Being able to decompress and parse the contents of the file (the open part) is not the same as humans being able to interactively retrieve information from it.

The user's intuition is to blame LibreOffice, but as technologists we should recognize that if you won't ship a working reference implementation for effective use of your 'open standard', then it's just malicious marketing.

I do see an issue with storing your nation's critical data in a OS with security backdoors enforced by a foreign country.

I heard that China got a special treatment from MS on that, Windows 10 without the spyware...

http://www.computerworld.com/article/3183664/microsoft-windo...

https://arstechnica.com/information-technology/2017/03/red-f...

I suspect this article is referring to legacy systems written with Microsoft software, that communicate with a server through binary applications that only work on Windows.

It is getting harder to remember, but only 10 years ago, having Microsoft as the only supported platform was easily justifiable in most organizations. Even if your software was customer facing!

Yeah, it's click-bait. There are also lots of non Microsoft systems in use in Europe. It's just as complex of an environment as anywhere else in the world.

This was an article for Microsoft haters to upvote each other for saying the same thing they have been saying for years.

"[T]ax information, health records, etc." would likely be stored in SQL Server databases.

It looks like SQL Server import and export file formats are defined, but I am not aware that the native format is standardized.

> Even so, if they are using Excel/Word, the Office Open XML file formats are ISO/IEC standards, not proprietary.

You aren't serious about that, are you?