Hacker News Reader

Comment by cnvogel | Hacker News Reader

The main factor here is probably not the technology of Windows XP (which certainly is up-to-par for the problem at hand), but the possibilities of vendors to absolutely custom-tailor a computer OS, stripped down to the bare minimum of running the ATM, and, if necessary provide all the service needed, down to the kernel.

And currently it's pretty easy to do this, with build-scripts and infrastructure in place. Maybe even using a tailored Android?

But then I somehow doubt that the industry would take that opportunity: I've seem my share of "embedded" devices (signage, control-room-displays) where the vendor just slapped their proprietary .exe in Autostart and left the Vendor supplied Win-XP + Nagware + never-updated-virus-scanner + ... intact.

Why? Because people in industry are lazy (they should be, maximizing their ROI, doing as little own work), and so going the same route, but with an 8 year old Ubuntu will not gain anything.

View on HN

I'm torn between this. On one hand I think you're absolutely right about the possibilities of ATM's and other vendors running a custom tailored OS. On the other, I know first hand how big companies screw up security on very basic levels -- And I don't think I trust the same people who still have an infrastructure built on Windows XP to custom tailor that OS securely.

>> I've seem my share of "embedded" devices (signage, control-room-displays) where the vendor just slapped their proprietary .exe in Autostart and left the Vendor supplied Win-XP + Nagware + never-updated-virus-scanner + ... intact.

This is what scares me. This happens so often and so frequent. I know it may be a shock to HN, but huge amounts of "embedded devices" are built this way. I for one would love to see custom tailored Android or linux -- but I'll say it again -- I really really do not trust them to do it right. Sorry to start the day pessimistically. :)

It's always amazed me that they used Windows. Why would an ATM ever need a full blown OS like that? The requirements are totally different from a desktop PC.

I've done that with hardware that got installed in a factory.

Why not? You pay a one-time, small license fee, you get years of free support from a major company, I don't have to document all the details of my stripped down kernel and how to recreate it, you can hire anybody off the street to work on it long after I am gone (and I am long gone from that company, but the hardware lives on), they didn't have to pay me to build out a unique OS, the low power computer we had could more than handle XP, there was (and continues to be) continued new, unknown requirements and upgrades, the people required to occasionally touch the interface had more PC experience than for any embedded or linux OS, and on and on.

Why wouldn't I slap a copy of XP on there? Well, this story is the counter-argument, of course. I still think it was the right decision.

They took the path of least resistance and it paid off until now. Now that path is a dead end and they face a painful upgrade. But arguably it was still worth it in the long run.

This seems the most salient point. At some point someone said "What if XP isn't supported?" and someone else said "Well we'll deal with that when it comes, but for now we've got a product to ship."

Assuming the developers had half a clue, they don't. They run Windows XP Embedded which can be stripped back to just the kernel and a serial terminal if necessary. It's not like they take a retail XP CDROM and installed it (of course, in the absence of clue this works too...)

It is not necessarily a full-blown XP - it might be XP Embedded, which looks like XP, but is highly componentized to reduce requirements to the hardware or improve on security.

In either case, I don't understand why ATM industry should be pissed - it's not that they were patching ATMs on a regular basis... In case of XP Embedded the patching story is even more convoluted.

I guess that's because back in the 90s there were no practical alternatives to NT and OS/2, then NT4 won. XP was an obvious migration path for the old NT embedded software.

Largely because many of them need to display advertisements these days. I've seen ATMs in gas stations that were displaying ads for the type of stuff you'd find in a gas station/convenience store. The rest I've seen advertising services of the bank they are attached to.

Embedded manufacturers have to deal with parts going out of production all the time. Say that Chinese LCD display you were using has suddenly gone end-of-life and hey, here's a replacement that fits our housing exactly but - oops- it looks like the driver needs a slightly different timing spec and color layout.

The WinXP users are in the same boat as the Ubuntu users - someone is going to need to update that video driver and smooth that new software into the production run without tanking machines that are already out there. Service techs HATE having to deal with 24 different flavors of the same circuit board and crossing their fingers they updated the right file onto the correct board.

So yeah it's lazy that relying on Windows to handle all that lifting but, hey guess what, there's a lot better chance someone has a Windows driver for that new display that the Ubuntu crowd does.

Android has a lot of potential for embedded GUI usage (I'm doing it myself) but the driver stack integration is a LOT tighter than slapping another DLL into the mix.

If they would work together on some FOSS frontend ATM software, probably on top of boot to QT, they could easily have one mutual firm package installer images for some minimalist system that just auto updates itself in the background as a rolling release. It could even use those "hot kernel" patches from Red Hat and the auto-reinit cycle of systemd to always keep those two up to date as well without rebooting.

The main factor here seems to be hardware cost of upgrading to a newer version of Windows. Since Linux can run on older hardware, it is a cost-effective solution (in spite of the cost of developing a new solution).

Also, I didn't get your remark about "8 year old Ubuntu". Why not a newer QT based Ubuntu?

Embedded systems are typically not upgraded. There are still plenty of PoS terminals, ATMs etc out there that still run OS/2.

Whether that's a serious problem depends on how connected they are. If they run only a application-specific set of services on an isolated network, that's not a problem. but if you propose to sell POS terminals in an Internet SaaS model, you can't leave them unpatched.

Reply on news.ycombinator.com