The NYC subway system runs on OS/2
tedium.co
tedium.co
It's nice to have a succinct article, but I'd much prefer a long form version. If this article ran in say, the New Yorker, it'd provide a level of depth and information that I'd find really valuable. I assumed from the design of the site, namely the very pretty interludes, that I'd be in for some really good long form journalism. Unfortunately not the case.
Edit: Here's a funny snippet from an article about Andy Byford in which the credit card processing for the Metrocard machines goes down.
> It seemed that only Miguel knew how to log in to the relevant subprocessor and do the reboot.
> “Where is Miguel?”
> He was in a car, apparently, on his way home. He wasn’t answering his cell. He lived in Port Jervis.
> Byford looked at Meyer and Nugent. They shook their heads. Port Jervis was upstate, three hours away.
> “Unbelievable.”
> More calls were made, more cages rattled. Was it really possible that hundreds of vital machines, the main revenue engines of the subways, could be repaired by only one person at the M.T.A.? It seemed so.
Perhaps an upgrade isn't such a bad idea.
Theres a good New Yorker article about him
As a Torontonian, I felt that he did a reasonable job of running the TTC for the years that he was here.
Or knowledge sharing and a manual?
OS/2 was very stable compared to the NT of the same era.
I'm not sure why we laugh at old systems that are still doing their job thirty years later. If anything we should celebrate the resilience and longevity.
Would it be immediately better if we replaced it with a bunch of docker containers connecting to mongodb or something?
I think we'd be better off as a society if we became tech luddites a bit more. Maybe we could start by replacing all of the facial recognition advertising panels with OS/2.
I'm not sure why we laugh at
old systems that are still
doing their job
Because other countries are hacking our infrastructure, as we hack theirs, and those laughing are doing so nervously, because with an operating system that is decades out of date, it's painfully obvious that anything defended by a password protected user account on that operating system isn't really protected against a determined enemy at all, and any of the permissions and privileges conferred by user accounts on that system are likely a facade protected by an honor system, and mostly physical security.In truth, even if the operating system were newer, we would not want it hooked up to the internet, but if the operating system were up to date, and not well isolated and became exposed to any public gateways, it would stand a fighting chance of not spilling its guts to the world.
With such a system disconnected from the internet, one can still bet that a determined attack is going to implant remote connectivity under their own control, and their job is much easier once the implant is connected. They don't need to sweat OS level password rotation, probably won't worry about strong encryption key changes or having to prove identity to policy enforcement tools with signing keys or tokens. Very little in the way of locking the integrity of the system is built into the concept of the OS. The application layer may offer better protection with proprietary controls, but the contents of disk and RAM are very probably possible to dump, inspect, bit twiddle and write back in place to just do anything you want, if your expertise runs deep enough.
I would imagine a determined attacker could infiltrate the system in-person. The question then becomes - how easy is it to compromise the system given physical access? And, assuming total compromise, how much damage and loss of life can be caused? (Do the subways have physical fail-safes?)
Recently, hackers have been buying, studying, and hacking ATM's. They're not secure. You can see them in action searching for DEFCON ATM hacking on YouTube.
We need a way to deal with this. It doesn't make sense to change out the OS of something like a subway system every five years or so.
Maybe it is entirety physically separate and if so that is fine but few things are and infrastructure changes.
I've worked on a lot of things that "shouldn't be on the internet" but it always seems to lead to bad security choices.
Is there something obvious I'm missing here? I can very easily build a computer without any sort of radio in it. Another person could come along and add one, of course, but that would be hardware.
A great presentation on this (and many other things) here: https://www.youtube.com/watch?v=5cWck_xcH64
* It required twice as much RAM as windows to run well. (4Mb IIRC)
* They had a ridiculously tone deaf ad campaign. One ad had copy to the effect of: "OS/2 Obliterates your programs."
In 2003 they started to move the application to PC running Windows XP using a special processor card to virtualise the old CPUs although "Due to the core software limitation (no source code available) we were compelled to integrate some original PDP-11 computer cards into the final product and this resulted in a hybrid PC platform"
https://www.equicon.de/images/Virtualisierung/LegacyTrainCon...
> Generally, where a computer program is reverse engineered by copying the idea of the function presented in the program code, the original computer programmer’s copyright is not infringed. Where a computer program’s expressions in code are reproduced or adapted (including into a different computer programming language), the original computer program’s copyright is likely to be infringed. This means that where reverse engineering occurs by “clean room” design, Australian courts are unlikely to find that there has been an infringement of the original author’s copyright.
Source: https://www.dundaslawyers.com.au/reverse-engineering-of-soft...
We cordoned it off from the network assessment out of concerns that it would be fragile. The assessment went as expected, but as we wrapped that portion the bank manager wanted us to have a go at the HP off hours ‘just to see’.
Never did figure out which part died, emulator or emulatee, but it went down hard within about three seconds.
But if we want to get pedantic, the subway wouldn't exist without revenue, and that revenue is indirectly managed through an OS/2 system. Ergo, the subway runs on OS/2.
This is false:
- You do not need an "internet connected device." (There isn't even reliable cell service at all turnstiles.) You can use an offline device that's previously had a card added to mobile wallet. You can also just use an actual physical credit card that supports contactless payments.
- The MTA has indicated that they're replacing MetroCard with an OMNY-specific contactless payment card, which you can buy using cash if you want. "Although cash isn’t accepted for OMNY right now, cash will always be an option to access MTA services. You still have the option to use MetroCard until OMNY rolls out system-wide." https://new.mta.info/omny
"In 2020, we will enable mobile ticketing in the OMNY app. In 2021, we will introduce a new MTA-issued contactless transit card for OMNY that you will find at retail locations throughout the New York region. In 2022, we will install OMNY vending machines at subway and commuter rail stations. In 2023, we will say goodbye to MetroCard. You will always be able to pay with cash at retail locations and vending machines." https://omny.info
After Microsoft removed the Start button, the former #1 OS/2 ISV (Stardock Systems) created the Start8 utility as a 3rd-party $5 replacement start button. They sold millions of copies, proving market demand and motivating the return of the button in future Windows releases.
> Over the years, we’ve developed and/or published a lot of software that was “ahead of its time”. Sometimes, too far ahead of its time. :) ... Broadly speaking, Stardock is a bunch of “techies” who have let their hobby get out of control ... most consumers would be shocked if they knew the actual dollars earned by reasonably “popular” iOS and Android games and apps ... Our poorest-selling DLC for PC games generates more income than nearly every iOS or Android developer app we've gotten numbers for ... Start8 will undoubtedly be obsoleted by a future version of Windows as its stunning popularity (over 30 million downloads and counting) makes it clear it was a mistake for Microsoft to get rid of the Start menu in Windows 8. In the meantime, Start8 has been an unexpected boon. If it makes Microsoft feel better, the revenue from Start8 has helped us hire a lot of new developers making new Windows software.
> ... In 1998, the OS/2 market died off. Stardock went from a multimillion dollar business to one that made less than $400,000 in one year. The only reason we survived was because our former OS/2 user base bought Object Desktop for Windows, sight unseen, a year before it would be released. While “Kickstarter” is now common, most of you reading this know that in 1998 just doing credit cards over the Internet was a new thing, let alone giving $50 to a company to make a product that didn’t exist.
Long story short, you get what you incentivize for. Incentivize carefully.
Are you sure it will be better later? History is littered with rewrites that ended in disaster.
So what is wrong with the "if it ain't broke ..." mindset instead?
If your repair parts are coming from collectors, it is broke, and you're entering a stage where you can't guarantee that you can actually fix it.
Sure, at a given company or plant, some equipment might be costing more to keep running than it's worth and/or maintenance is just being deferred. But pretty much any industrial location is keeping things running with a lot of used parts.
Incidentally, the mindset that you reference above is also the same mindset which causes places to not kept sufficient spare parts on hand so that fixes can be made quickly. It seems that they would rather experience extended downtime than pay to have spare parts on hand which could minimize that downtime.
Example - there's a production line that's been running 20 years on a 1980s computer. For continuity reasons, there are two spares in the warehouse. There hasn't been a failure in years, the spares are kept because finding replacements would be near-impossible.
Some management consultant rides in screeching about how these two mission-critical systems are "sunk cost" and "need to be disposed of to make the place clean and tidy". So they are.
Three weeks later, the primary fails and there are no spares...
So I can't really judge the MTA too harshly because OS/2 is solid and it'll probably gladly do the job for another 30 years so long as the hardware lasts.
The off-the-shelf answer today is a variant of QNX or VxWorks. No one gets fired for picking those.
For more critical applications, Boeing is using Ada on Linux atop AMD's new embedded CPUs, which have no closed firmware (to ensure auditability).
Sadly, Boeings culture rot has led to some poor design decisions recently.
Usually Linux always runs in a VM sandbox on top of such OSes, like Green Hills INTEGRITY OS.
https://www.ghs.com/products/safety_critical/integrity-do-17...
They probably run Linux in the less-critical stuff on the plane. At one point, they were running some apps on Windows and Linux simultaneously as a reliability technique. I don't know if they still do that.
I'd probably use GNU/Linux, but build it in a fashion that make it easy to swap components (either hardware or software) as needed.
How many OS releases from 30 years ago still have commercial support? How many OS releases from today can still run a binary from 30 years ago? Will the 30 y/o toolchain still work? Will the most recent release of the toolchain be able to compile 30 y/o code? Do you still have all of that 30 y/o code? Are there other dependencies? Can it run on modern hardware or is it readily emulated / virtualized? Is talent with the necessary experience still available in the workforce?
Looking back is pretty bleak and I don't think it's any better looking ahead. Technology is a liability.
Or don't let your software get 30 years old. Reduce the number of components required to run it (avoid complex toolchains) so that when upgrade/porting time comes, there are fewer things to break.
https://www.sfexaminer.com/news/you-hacked-appears-at-muni-s...
So I suppose there are still updates. As an aside, at $129 for the personal edition [0] I want to pick it up just for the novelty of having an OS/2 machine running on modern hardware.
[0] https://www.arcanoae.com/shop/arcaos-5-personal-edition/
Despite being internet connected (sfmunicentral.com) I don't think it was effected by the downtime that the point-of-sale systems saw. That site came about after someone discovered a publicly accessible "admin" interface.
I think you'd need an obscure OS and an obscure organization in order to significantly decrease the risk of the internet hating you enough to infect you with ransomware.
Oops, a third requirement: your obscure OS can't be the same obscure OS used by the biggest subway system in the world. Because if someone did end up hitting NYC Subway why not hit the other instances that showed up in a scan? Is the hacker really going to think the extra 0.01% profit isn't worth the zero dollars it costs to infecting a few more machines?
https://en.wikipedia.org/wiki/RMX_(operating_system)
That OS was pretty much a feature demo OS for the x86. All that task switching stuff is used to the max, and of course the segments are as well. Good luck porting anything, even if you did have the source code and a budget. Also, the popular language was PL/M, which is impressively awful. https://en.wikipedia.org/wiki/PL/M
Would this make the NYC subway system more or less prone to hacking? Can't imagine there are a ton of exploits in OS/2 that modern hackers would know about.
But there was definitely TCP/IP support. I remember the day I migrated my parents off Netscape to Firefox.
¹The cable didn't have anything to do with it. When when finally upgraded to cable, we also got an Ethernet router/switch, so my Windows machine then hooked into that.
Also Galactic Civilizations was a damn good game and only on OS/2 at the time -
https://www.stardock.com/stardock/articles/article_sdos2.htm...
But from the first link in your link… they also made Trials of Battle! That it's listed under "Other Products" does not do it justice, IMO. And Stellar Frontier. I did not realize how much of their stuff I had played.
[1]: https://www.os2world.com/games/index.php/native-games/strate...
The 486DX2-66 (Socket 3) was near identical clock-doubled version of 486DX-33. I apologise for being pedantic.
In the 90s, the CompuServe online service had a dedicated tech support team for people using OS2CIM to connect, and they were pretty evangelical about using OS/2 over Windows or pre-OSX Macs. It's a fun ecosystem, and its users were pretty passionate about it. I'm glad to see it's still being used for something interesting.
The free and open source OS/2 clone OS. Some things cannot be ported to Windows.
1. SkyTrain (driverless monorail) in Vancouver ran under OS/2
2. All street lights in Toronto were managed by a single 486 box running QNX
Not sure how true #2 was, but Skytrain had an OS/2 position open for a while, so it was a part of their setup for sure.
Yep. It runs Alcatel/Thales' SelTrac software. Basically the same system that SF's Muni and London's DLR use.
I was amazed the first time I saw one of these crashed, showing the OS/2 Logo (Warp 3 or 4 I think). From the GUI it was impossible to tell, they had relatively high resolution and even, at some point, videos embedded.
I wonder who developed and updated the GUI, and using what.
For more recent systems (IBM mainframes, Sun/SGI large machines, etc.) the controller also handles things like power sequencing, hardware configuration (e.g. physical partitioning of interconnect buses, resource allocation...) and mainly also enforces the hardware licensing policies.
Is that actually true? Seems like a terrible decision, if so. I fundamentally don't understand why the onus would have to be on the user to have internet connectivity.
London lets you use contactless payments with normal bank/credit cards, Apple Pay etc.
It's out there, in a lot of places.
Shouldn't that be:
> 5.7M The AVERAGE number of people that rode the New York City subway on a weekday in 2016.
You're averaging the number of people, not the weekday. (I guess this is a stylistic linguistic choice, but it's always bothered me.)
Also my mom loved OS/2 Mahjong so it had a long life in my house growing up.
https://en.wikipedia.org/wiki/File:US_Navy_110129-N-7676W-15...
...and a lot of (physical) stores still use a DOS-based application for their POS systems, judging by the appearance, although they might not actually be running it on DOS but a later version of Windows.
https://en.m.wikipedia.org/wiki/Submarine_Command_System#SMC...
But yeah, it was huge in banking when they released 2.0...
but the new york city government must be dumping tons of tax dollars maintaining this outdated technology, i'm speaking mostly about the hardware required to run this operating system and software.