> Hell, I have never seen a ReactOS installation in the wild
It's not especially common, but I do know of a couple kiosks and a PoS system that run ReactOS under the hood to avoid Windows licensing.
It's not especially common, but I do know of a couple kiosks and a PoS system that run ReactOS under the hood to avoid Windows licensing.
https://www.reactos.org/project-news/reactos-second-os-russi...
CHD under the PCI standards also covers PII card holder information which does reaches the PoS for handling refunds, managing promotions, club membership etc.
Even vPOS applications like those tiny card readers that hook to an iPAD as the PoS do a lot of leg work despite of them being P2PE. They check for root, they check for iOS version (security update) they check for proxy etc. That’s all part of the PA-DSS certification for the application developer.
While it’s possible that a retailer who’s big enough so VISA can’t say we won’t gonna allow you to take payments with our cards, and the fines are smaller than the cost of adopting compliance to use these.
I wouldn’t imagine any PoS vendor even going with that since it would essentially put them at huge risk from both the PCI standpoint and general reputation damage.
As for certifying these there isn’t a single PA or PCI-DSS QSA out there that would accept ReactOS as a useable operating system because if something goes wrong the QSA is liable if they certified something they shouldn’t have.
These are specifically marketed by banks as not requiring any certifications of the PoS.
If the acquirer bank and the QSA accepts that your use of these terminals is sufficient then sure go a head but that means you don’t intake any PII via the PoS and you don’t use the credit cards to identify members and don’t use those terminals to scan non CC based membership cards, and you have no PII at all which means handling things like refunds and warranty is also not done via the PoS.
Card holder PII is also covered and is even considered more important these days since CC numbers are easy to rotate but your identify isn’t.
Also even if the PoS doesn’t sees the card details it is part of the payment acceptance process and if it’s compromised the payment process can be affected even with P2PE devices.
If the PED is complete separated from the payment process e.g. those in which the vendor has to type in the amount separately and the PoS doesn’t take any any any customer PII ever you may be able to get away with using something like ReactOS on it.
This is a pretty good system, because the terminals are able to be updated really easily. A lot of cafes and stuff also use iPad POS software (one called 'Vend' is really popular here) and it doesn't have to be certified. This is part of the reason that it took hardly any time for almost everywhere to support contactless six or seven years ago. For example at Myer the POS systems look 15 years old but the attached card terminals are usually only a year or so old.
As for the terminals on older PoS as long as the PED is certified and the PoS is certitied its not a problem.
Both very small Australian companies, probably about 100k deployments between them.