US Army struggles with Windows to Linux overhaul

In multiple media reports over the past two weeks, the US Army has professed its love for the penguin. The Army eventually intends to move from a Windows-based infrastructure over to Linux for its new, roughly $200bn weapons program. But the Army has largely been prepping new Linux-friendly weapons, vehicles, and devices …

[Morely Dotes]

I beg your pardon?

"That potentially presents a major problem for the first brigade of Linux-based FCS vehicles expected to be introduced in 2015. Linux-based systems have a limited ability to communicate with Microsoft-based systems. And interoperability issues aren't something you want to deal with in a war zone."

That comment is incorrect, and in the wrong sequence. The correct phrase is:

"Microsoft operating systems are deliberately designed to limit their ability to interoperate."

Linux follows industry-wide standards. Microsoft does not. Furthermore, there is little or no actual communication problem between Linux and Windows; "file shares" (aka SMB) work, ordinary TCP/IP network traffic works, SQL queries work, remote desktop clients and servers on both sides work.

Your article throws FUD at people who don't know the truth about Linux and industry standards. I prefer to think that's caused by ignorance, rather than malice or corruption.

[Andy]

Oddly enough ...

I thought the military would be more into a BSD style solution.

[James Le Cuirot]

Struggles?

That doesn't really seem like the right word. Sure, it'll take some effort, but it doesn't sound like they're having major problems. Interoperability isn't usually THAT hard.

[Steven Swenson]

No wonder...

Windows based satellite tracking system? No wonder the international space station fell to earth.

Blue Screen Of Death -> Blue Planet Of Death

[Steven Swenson]

Er...

I mean Spy Satellite.

[Anonymous Coward]

The Left Hook: Army Upgrades to Linux

Err..., I could also have written this article with this hook:

The Army upgrades its latest battlefield software with Linux. Spokespersons say they require more open, more flexible, and more secure software than Windows. In addition, they will save money on licensing fees, and be able to use multiple vendors for support. They anticipate some problems with integrating their old Windows software and its proprietary network interface and clumsy implementation of network standards. Red Hat etc etc

The only way you can claim there is a networking interoperability problem between Linux and Windows is to look at SMB networking, called "Samba" in the open world. Since SMB is a quite insecure local protocol, I doubt it is in use on the battlefield, where I assume they use only encrypted connections like ssh, sftp and so forth.

But then American voting machines use MSDOS or Windows with hardly any security. So maybe fire control websites only work with IE 6.

(sorry its irresistible)

Gives a whole new meaning to "blue screen of death"

[Mark]

@Andy

So you think the army would be trialling BSD(M)?

Hopefully icon not necessary.

[SpitefulGOD]

No Matter

Iran uses my OS.... mwah ha ha ha ha, I foresee a nice collapse for your crummy country and their crappy hippy network.

[Don Mitchell]

Is Linux A Squishy Target?

There is no proof that Linux is more secure. That is largely a faith-based viewpoint in the context of a political movement surrounding open source. But I guess in the Bush administration faith-based initiatives are trendy now. I've watched CERT advisories for over ten years now, and Windows and Linux have had a roughly equal number of security holes reported during all that time.

Operating systems don't become secure because thousands of amateurs are looking at the source code, as Eric Raymond would like you to believe. They become secure by reacting to and learning from attacks over and over for years. Windows is not only a constant target of real hackers, Microsoft has hired an army of "penetration engineers" to work on it and make it tougher. You're fooling yourself if you think Linux is secure.

This decision is probably largely the result of a few open source "true believers". The Army should carefully examine this on the basis of security and also on the basis of supporting American business.

[steogede]

@Don Mitchell

You forgot your flame icon. Or should it be an Angel Bill icon, or even a Paris icon?

[netean]

linux... over BSD?

Why go Linux... with all it's crappy code validation and NOT for validated and pretty secure code from.... know which one is it.. it's a BSD, I know that much... is is OpenBSD that is the really secure one?

[Mark Nelson]

Good maybe things will improve

Once the ARMY no longer uses MS.

[Anonymous Coward]

Dear Don...

I'm not Eric Raymond, but I would like to contradict your assumptions:

Because Linux is open source, and because thousands of eyes are looking at the code (anyone could look at the code!), the chances of getting security issues fixed are MUCH HIGHER compared to MS solution which was caught few times leaving known security holes open for 6+ months.

When you buy RHEL or SLES, you get the standard promise of 5 years for security fixes. If you insist, you can get 8 years, depending on your negotiation skills with the vendors.

The Army could basically hire a developer or any software house which could backport security fixes even 10 years from now since the code IS open, and when you go the "MS way" you can only pray that MS will fix the issue after stating EOL for an OS (example: Windows 2000 products).

That way the Army is not dependent on 1 company and the army could do whatever it wishes with the OS without any stupid restrictions, compared to buying any MS OS.

[James Le Cuirot]

@Don Mitchell

To be fair, the article didn't say anything about them choosing it because it's supposedly more secure. They just don't want to be beholden to Microsoft, which sounds like a good reason to me.

[Mike Moschini]

CERT - schmert

There are always going to be 'security holes' found in any operating system. The difference between Windows and Linux is the fact that Linux developers publish 'fixes/patches' right away and their code is reviewed by 100's of other developers around the world. Microsoft waits around till some hacker finds a vulnerability, exploits it, and then eventually a "security update" is made available to the general public.

The Army's decision to transition to Linux will ultimately mean a secure and stable operating system for our nations defense. Additionally, the American taxpayer should be extremely gratified that tax dollars aren't being wasted on licensing fees.

[Anonymous Coward]

"I'm in your SMB share, destroying your targeting .exe"

"There is no proof that Linux is more secure."

There is also no proof that NP=/=P. It just looks that way.

"The Army should carefully examine this on the basis of security and also on the basis of supporting American business."

Yes yes. Defense Budget for 2007: $668.6 billion. I do not think the industry of the Socialist States of America needs additional state intervention.

[Anonymous Coward]

Re: Is Linux A Squishy Target?

Don,

You've managed you fashion your own noose and I fear hang yourself too. You say that Windows and Linux has has a "roughly equal number of security holes reported", I'll choose to believe you there because that sounds reasonable to me. The problem with this fact is the circumstances behind it, your point is in effect this: That security researchers with complete access to the code of linux and it's applications have only discovered an equal number of holes, compared to a closed source OS where they have to guess at the attack vectors.

Having found these holes by being able to review the code, they are spotted faster and due to the nature of open source, usually fixed faster too. With closed source, security researchers are reliant upon stumbling across security holes in a very long and boring game of blind man's bluff. They are frequently months behind the blackhats who have plenty of time to exploit these holes.

However it's not security that should be the driving force behind linux. It's the standards and interoperability, the lower cost of modifying the OS for your specific purposes and the reassurance that comes from being able to look at the code.

How anyone can say that it is a good idea for a public body to be locked in with one monopolistic vendor baffles me? It's your money and your government, how can you not be outraged that the IT infrastructure effectively belongs to a single private company?

[Andrew Williams]

Look for Microsoft to take a share hit on this...

Big risk with potential takeover of Yahoo + Army waving goodbye. Who knows, maybe the Navy (remember the fun and games with that Windows implementation?) and even the Airforce might decide Penguin power is cool enough for them too.

Cry havoc and let loose the penguins of doom!

[Adam Williamson]

So...

...in the end all actual communication will be done with walkie-talkies by grunts, as has been the case for decades? Check.

[Nigee]

French connection

IIRC a few years ago the French MoD if not the entire govt announced they were going to develop a secure version of Linux. Licensing presumably means this is/will be in the public domain.

[Anonymous Coward]

switching catch phrases

from 'Blue screen of Death'

to

'root of all evil' ....

Let's hope the good side coders are smarter then the 'bad side' coders. Especially now the 'bad side' has got the source to the kingdom ...

[Anonymous Coward]

Cool, linux's problem has always been...

people to maintain it, drivers, etc. Now maybe the Army will take over that role. I can see the future:

"Are you running US OS or PRC OS?"

"Neither I am running EU OS"

"Really they finally released that?"

"No, its in beta, and the French components aren’t out yet because the developers are on strike, but the language packs are great."

[Anonymous Coward]

You know theres a problem when you're arguing about the colour of the wheels...

Sidestepping the whole Linux versus Windows pissing contest, surely lessons learned would recommend that our (mine, yours, whichever country that refers to) militaries should be focusing on simple, even open (if you are feeling game), APIs and protocols. The question should be "How do I make my Linux ammopack speak to my Windows pistol" but rather "We all speak MilNet 5.5, lets get along harmoniously to wreak highly efficient havoc on yonder agrarian-cum-freedomfighter..".

30 years of internet messaging has been built on this principle. Just because one company has a tendency to reinvent wheels (or at least attach painted lanterns to them) is no reason to follow suit.

The old philosophy of "in order to be secure, we must have something unique and secret" is dying. Secure methods built on commodity infrastructure/protocols allow far greater agility. Todays criminal can communicate securely with other criminals around the world far more easily than our law enforcement agencies can, and can adapt to threats and opportunities far more quickly.

While our law enforcement/military looks at developing monolithic novelties that lose any secrecy advantage the moment someone blabs, mere mortals are squirting hardened messages across the public internet. Sure, they may cock up, but they can adapt a dozen times before "InterpolChip2008" gets off the drawing board. It is Asymmetric information warfare, and the "good guys" are still counting on battleship solutions.

I use the term "criminal" to also refer to the enemy du jour on the a la carte menu of bad guys.

Back to the pissing contest, if the windows guys would stop pissing on everyone, and the linux guys would stop pissing into the wind in a vain attempt at pissing on the windows guys, we might all be much better off...

[Herbys]

@Anonymous Coward

> That security researchers with complete access to the code of linux and it's applications have only discovered an equal number of holes, compared to a closed source OS where they have to guess at the attack vectors.

That might be a decent argument for a normal user (which I do not agree with). But we are talking about people controlling weapons systems, whole wars could be decided based on such a flaw. So the fact you recongnize that having source code makes finding holes EASIER acts against the platform for these uses. Yes, your argument might indicate that Windows has actually more holes (which, again, I do not share, based ont he fact that Microsoft has a few thousand engineers looking for holes as well, with source code access and a FULL TIME JOB, TRAINING AND SPECIFIC ASSIGNMENTS TO FIND SUCH HOLES) but that would irrelevant, as a dedicated hacker trying to achieve a specific goal with access to source code will have a much easier time than one without such code.

[E]

WOW?

What about Windows for Warships? Will not the US Navy use it?

[Martin Usher]

This article doesn't make any sense

I don' t know of any problems interconnecting Microsoft and Linux systems -- provided you keep to the standards. Since you're trying to make a robust system that's also secure there's also a lot to be gained from keeping things relatively simple (a lot of Microsoft's inter-application information sharing and other innovative "features" seem to be accidents waiting to happen).

Microsoft as a company has a poor track record with standards. It can't resist tweaking things, it seems to be a throwback to the early "Hack-DOS" days, with the result that their kit is a pain to work with. This is something you have to put up with in the desktop world because there's so much of it about but its not the way people build reliable embedded systems -- for those there is nothing that Redmond has to offer except a gut feeling of uncertainty about what's going on and when is it likely to crash.

[Anonymous Coward]

@Austin

You missed a great opportunity for article sub-titles. Here are a few suggestions for next time:

- "March of the Penguins" ......... "Penguins: Armed and Dangerous" ........ "When Penguins Attack" ......... "Penguin: Reloaded" .......... "Full Metal Penguin".

And when the US Navy and Marine Corps come around:

- "An Officer and a Penguin" ......... "A Few Good Penguins".

[Anonymous Coward]

This is a custom implementation

Someone has latched onto a big chunk of development revenue on this one.

But let us not forget this is undoubtedly a custom system from end-to-end.

I am far from a worshipper of Linux, but it seems to me that full control of software source code is needed for what they are trying to implement and support. They can have this with their own build of Linux(also OpenBSD, Open Solaris, ... etc I'm sure there others). Short of some extraordinary agreement with Microsoft it does not seem possible with Windows.

It is always a disconcerting to me that folks forget they are tying themselves to Intel when they go with Linux but nothing is ever perfect.

[Anonymous Coward]

Security advisories....

In addition, advisories about Linux often cover an entire distribution of software, which may include several database implementations and thousands of packages that the average user will never install. They are often lumped into the Linux bug camp, because they come with the OS (even if they aren't installed by default). The up-side of this is that the distribution usually takes the lead in fixing the bug, often even before the code is fixed upstream.

Microsoft claims responsibility for only Microsoft software, often takes weeks or months to fix a bug, and largely disclaims responsibility for 3rd party software being able to take over or screw up a PC. Their attempts at security also seem to be driven by business objectives, such as the case of Vista's "worm protection", which blocks many P2P implementations, and requires you to upgrade to a more expensive version of Vista if you want even an ounce of that functionality back (or completely disable code signing and hack DLLs).

[Steven Hewittt]

Mixture

The US Army uses a mixture of platforms, and rightly so. A part is being migrated to Linux.

Regarding the arguments of being more secure, it's a myth. Open Source DOES NOT MEAN that it's more secure. Some OSS has better securtiy, some non-OSS has better security. 1000's of amature developers looking at the code after all these years has still resulted in hunderds if not thousands of security holes and patches every year on Linux.

Not saying Windows is more secure, just that having it peer reviewed means shit all. Check out Ubuntu and Vista Secunia statistics.

A mixture of platforms for the Army is a good thing. Last thing you want is them using a single OS, regardless what one it is.

Although $3.1bn for the Linux shop migration rather than the $0.62bn to stay with the Windows solution as well as the whole integration issue sort of highlights a lot of what people argue about the total cost of ownership...

[Jeff Dickey]

Re: Frenching Connections

@Nigee: They'd be even denser than their usual neutronium-headed worst if they don't have a few boffins actually looking at it and evaluating a fork.

@AC re @Austin: Damn you, sir! You're going to have me laughing randomly for the next four hours as one or another of your alternative titles pops into mind. Definitely time to grab your coat, go home to the missus and have a well-deserved pint!

[Anonymous Coward]

@Don Mitchell

So Microsoft employs an army of penetration engineers, eh? Nice job title, but how do you sell that to your girlfriend's mother first time you meet her?

On a different note: Now Linux developers will de facto be working for the death industry. MS might even use that as basis for a future marketing campaign - "green, peaceful, hippie Vista".

[Paul van der Lingen]

Secure..

Why don't they switch to Macs.. then the field commanders could be safe, secure *and* look fabulous with their trendy white macbooks. Senior officers could be given Air's as a bonus afforded to their Rank.

yes?

hehehe

[Sceptical Bastard]

How reassuring

Bloody 'ell! you're telling us that the US military's weapons systems are based on Windows? THAT makes me feel really secure - blue screen of death, indeed!

A fatal exception error has occurred at OMG:000FUD00SNAFU in module Iraq (01) + Afghanistan (02). The current action against insurgents will be terminated. You will lose any unsaved civilians in all current conflicts.

* Press any key to terminate civilians

* Press CTRL+ALT+DEL to restart the conflict

* Press the Backspace key to withdraw troops

[I. Aproveofitspendingonspecificprojects]

Blue Farce of Death

It explains all the blue on blues.

But someone mentioned the police force vss criminals. The criminals are not more secure or better oriented toward modern communication. Far from it. Their difficulty lies in lessons learned.

The police can get away with making mistakes. One after the other. And because of command lines they may never get rectified. But they use work arounds, unofficial protocols.

Criminals are lucky to survive making one mistake. They can amass fortunes until that happens but someone else will be spending it if they make one mistake.

And so we must assume the same reasoning on the battlefield. Only with communication errors, the military will only get to make one mistake per man killed until someone tells the chimp he is making a mistake.

The problem then is getting the fool to listen.

It won't matter if you use Linux or what.

I wonder what version of Windows the military is using. I bet it is a cut down version of Win 95.

[Anonymous Coward]

Why argue about the make of tools in the carpenter's toolbox?

Architect drawings and craftsmanship has much greater influence on the end-result.

[Anonymous Coward]

Windows vs Linux - neither wins

As a software developer with many years experience on many platforms, I have to point out that in the great OS battle neither Windows nor Linux win. Solaris is better than them both - by a long way. In the context of a closed military system, the security arguments above are largely irrelevant. Connections between boxes will be over mil-spec encrypted lines, and no insecure lines will connect to any of them. This means that whether someone can hack in or not is pretty much a moot point. What matters more than anything is how stable your boxes are and how good the custom code you write for the boxes is.

Now, on box stability, Solaris wins hands down. Just look at the way each system copes with memory failures for example. Inducing a kernel panic through some bad code is far far easier on Linux than it is on Solaris. For stability, Solaris > Linux > Windows.

On the subject of coding, the best code will be written on the platform with the best tools to debug and fix that code. Now the windows dev tools are actually pretty good. They aren't great, but they do at least work. And in some cases you get best of breed tools on windows (think Rational Quantify/Purify and Intel's VTune - both of which are available for other OSs, but the most fully featured versions are on Windows). On Linux the development tools suck. Anyone out there who thinks that GDB is even remotely fit for purpose clearly has never used it. GDB is unstable, and outright doesn't work for multi-threaded code. In fact GDB is proof that open source does not automatically equal good. On Solaris you have Sun Studio which is an excellent development system, and you have DTrace which is a killer app. For developing robust mil-spec code it is clear that Solaris > Windows > Linux.

[DrXym]

Interoperability

I don't understand the "no interoperable" argument. We all know that MS loves to invent their own proprietary standards and embrace & extend existing ones. But there are still plenty of well documented open protocols for doing just about anything between the two operating systems. There is also plenty of middleware that runs on Windows & Linux that could facilitate messaging, transactions, RPC or whatever. I don't see any reason you can't have Linux & Windows talking to each other.

[James Pickett]

Eh?

"Linux-based systems have a limited ability to communicate with Microsoft-based systems"

Shouldn't that be the other way round?

[Anonymous Coward]

Interoperability is only a problem if

thou believest that there is no true God but the one MS God, and thine eyes seeth only that which thine one true God hath created.

And if thou dost believe that, then you're in for troubled times ahead, dude.

[Carl]

Interoperability

"Linux-based systems have a limited ability to communicate with Microsoft-based systems". I think this is misleading. Let me suggest:

Communication==Standards

Linux/UNIX/BSD==Standards

Microsoft==Embrace and Extend

It is an established FACT that Microsoft has an ongoing policy of modifying standard communication protocols, then inventing its own, without telling anyone else what they are and then threatening to sue anyone who tries to find out. There are and have been for many years court judgments about this exact kind of thing. Hell, even Billy boy himself has appeared in articles espousing the strategy.

This isnt a technology issue. It's a management issue. Management have clearly failed to identify and mitigate the risk implicit with going balls-deep into a proprietary technology "owned" by a notoriously sharp idiot-savant\h\h\h\h\h\h\h\h\h\h entrepreneur.

[Ken Hagan]

Two points

"So in the end all actual communication will be done with walkie-talkies by grunts, as has been the case for decades?"

No, these days they use mobes and civilian-grade GPS.

"IIRC a few years ago the French MoD if not the entire govt announced they were going to develop a secure version of Linux."

And someone else has already noted that BSD has a better reputation in security circles. And-also-and IIRC, the NSA similarly announced that they would develop a secure linux kernel. I don't know what happened to either project, but if they actually exist then one wonders why the whole world isn't using them. Isn't "being open to third party improvements" supposed to be one of the major benefits of open source?

Maybe the "Linux" brand now has the critical mass of religious adherents needed to stay afloat despite known limitations and the existence of a free and technically superior alternative.

I'll get my flame-proof jacket...

[Edward Rose]

Security?

I'm guessing hackers shouldn't get a look in to most of it.

If it isn't a (mostly) closed off / private system then people are just looking for trouble.

I'd say the security / bug risks could well be equal either way, the difference is, one of them you can't guarantee a fix. The other you can. When it comes to your own life, I wouldn't start putting all my trust in one other person who is only interested in money (Okay, Boeing are only interested in money, but you could find someone else to take over the maintainance, even if you must make the government body yourself.... Which I'm pretty sure would work out cheaper in the long run over a range of projects).

[Matt Williams]

My theory today is that

If this article is correct - www.heise.de/tp/r4/artikel/5/5263/1.html - then it could be that the US military don't want the NSA to have easy access to their systems.

[Anonymous Coward]

suggested applications

friendly-firefox

amarok-et

B17 Thunderbird

konquerer

er ... that's it

(dayglo pack-a-mac by the umbrella stand)

[Michael]

SMCS-NG as first deployment of "Windows for Warships"

So when is the British Navy changing over? .....wiki page below. http ://en.wikipedia.org/wiki/SMCS

[amanfromMars]

Advanced IntelAIgent Virtual Defense ......

..... ...... for PsychoPathic Controls in Deep Underground ControlLed PsychoSIS

Seems like a job for Special Forces, Austin. White Hatted Wizards with Above Top Secret Clearance. And Fully Licensed and Loded to Thrill [and not too many of them on the Dance Floor, I'll wager] ........ for AIDefinitive OverArching View with HyperVision... IT HyperTechnology Delivering ITs Future Goods in Advance of Product Placement for Sharing. The NeuReal Paradigm for the Change AIgent.

"So they're bringing some 70 programmers, engineers and other IT professionals to Washington to brainstorm in four "Battle Command" summits." ...... Hmmmm...... I wonder who, and by what criteria, that motley selection is made? It is bound to be an eclectic eccentric extravagant mix, though. Anything less than Unique will be Failure before it has even begun.

One would not unreasonably assume, that if monitoring of Technology Use is so supposedly widespread/ubiquitous/intrusive, then they would have an assembly of the Best of the very Best. Anything Less and the Dream is Lost and ITs Fakes and Fakery XXXXPosed. False Prophets and False Profits unmasked.

Some Real Positive ProAction with some Real Slick Monetary Transactions will Plug that Hole in Defenses and Energise Shield Repairs, Immediately, if not Sooner.

[Steve Renouf]

Military machine Windows based?

No wonder they keep killing so many Brits when we're supposed o be on the same side!

[Danny Vader]

I wonder...

how the os-communists how are going to deal with this. Because the Opensource Community is full of socialists. Nothing to do with the quality of software but those leftists are now faced with there biggest problem: giving their code - for free- to the biggest military-complex in the world. Proof in the pudding that politics and software don't mix...Never...In a political sense the whole Opensource movement is flawed. Got it, ladies...

[Gavin Nottage]

Re: This is a custom implementation

"It is always a disconcerting to me that folks forget they are tying themselves to Intel when they go with Linux but nothing is ever perfect."

So Linux doesn't run on alpha, arm, ia64, m68k, mips, ppc, sparc etc.?

[Nìall Tracey]

Re French connection/Two points

French connection

Nigee said:

"IIRC a few years ago the French MoD if not the entire govt announced they were going to develop a secure version of Linux. Licensing presumably means this is/will be in the public domain."

Ken Hagan:

"IIRC, the NSA similarly announced that they would develop a secure linux kernel. I don't know what happened to either project, but if they actually exist then one wonders why the whole world isn't using them. Isn't "being open to third party improvements" supposed to be one of the major benefits of open source?"

Yes, but you've both missed the bit in the GPL where it says you only have to release your source code to recipients of your program. It follows logically that if you don't distribute the program outside your own organisation, you don't need to distribute teh source outside your own organisation.

The consequence of this is the SaaS controversy: companies such as Google who work from a GPL code-base, but by providing a "service" and not "software", sidestep the obligation to release improved source code that might interfere with their business model.

[Glen Turner]

@Ken's two points

OpenBSD does have a better reputation than Linux in computer "security circles" but there are factors other than security when choosing a platform. One is continuity of supply, and if you read a few e-mails from Theo de Raadt you'll see that it is a miracle that the OpenBSD project hasn't imploded. It's reasonable for a large project to trade off some small security risk to avoid supply risk.

"IIRC, the NSA similarly announced that they would develop a secure linux kernel". I doubt the NSA said any such thing. A proof of correctness of something as large as the Linux kernel isn't possible, but that is required for the strictest level of Common Criteria security (ie, a device which may contain Top Secret data but connect to an Unclassified network). See the seL4 kernel for an idea of what is required.

What the NSA did do is to initiate and sponsor the development of a "mandatory access control" (MAC) feature for the Linux kernel. This lowers the amount of revealed by application security failure and can be configured to allow multiple levels of classified data, following Bell-La Padula or other classification models.

MAC is a required but not sufficient item for using Linux to store data of varying classifications. This is very operationally desirable: it allows one computer to store all the documents related to a task or project; and prevents data at a low classification level being upwardly classified simply because it is being stored on a computer of higher classification.

OpenBSD lacks a MAC feature and thus isn't as useful for some defence applications as you might initially suppose from its reputation with non-defence security people.

[Richard Kay]

@herbys: do any crooks and spies not have Windows source ?

"So the fact you recongnize that having source code makes finding holes EASIER acts against the [open source] platform for these uses."

Sorry but since when were well-funded attackers with bad motives denied access to the Windows source code ? Windows products would not be sold to any government or military without source code, other than to very small countries with so little market clout that Microsoft salesmen would turn down a sale to them if they claimed they will use Linux instead if denied Windows "shared source" access (which is very unlikely). Since when were recipients in foreign governments of Windows source code not bribable by local crooks ? And since when was Microsoft's own programming shop leak free ?

It seems that all the people you wouldn't want to have access to Windows source code have this already. The people you do want to have access are user organisations wanting to be able to improve the security of the products they use and who are willing and contractually able to share information to help this happen. But the group you want to have access are likely to be those who respect copyrights and non-disclosure agreemenents, probably don't have access or are prevented from sharing the knowledge gained through EULAs when and where it is needed.

A fellow academic recently put a Windows source code CD on my desk - released under some academic source code access licence. I havn't looked at it and won't until I can share knowledge about it freely enough to be able to distribute modifications without having to accept restrictive EULA gags, when it will be in the same category as any other open-source software. Anyone at my workplace is welcome to it - and I havn't accepted any EULA in connection with it either.

This really is the worst of all possible worlds. Users who could help Microsoft improve their software are prevented from doing so while those who have no intention of disclosing security vulnerabilities they intend to exploit for criminal profit or reasons of state are hardly likely to respect the copyright and contractual figleafs theoretically preventing them.

[Anonymous Coward]

@Danny Vader

Right! You, me, outside, now!

[Peter Gathercole]

...are tying themselves to Intel when they go with Linux?

Huh?

I don't know of any OS which is available on a wider selection of the worlds 16, 32 and 64 bit processor archetectures than Linux. It would be easier to list the archetectures that have NOT had linux ported.

A quick off-the-top-of-my-head list of supported procs:

PowerPC and derivatives, ARM and derivatives, Sparc, MIPS, Motorola 68000 and 88000, Alpha, HP Precision, Itanium, zSystem (IBM mainframe), VAX, Transmeta, Zilog z8000, and oh, Intel and non-Intel x86 and derivatives.

I would be very surprised if there were not Prime systems with Linux running on them somewhere. Wonder what is the most obscure Linux port?

[Derek Hellam]

@Adam Williamson re grunts

If my memory serves me correctly this is what happened in the Falklands and the Balkans when the British Army radio's and its associated tech did not work as expected (memories of Arnhem?). The troops on the ground just used their mobile phones to talk to each other. Lets see the enemy try and decipher a broad geordie, yorkshire, Liverpudlian accent eh? Next generation of communications code is based upon "Chav speak" LOL

[Peter Mellor]

Windows vs Linux security: Register paper

On Friday 22nd October 2004 07:26 GMT, The Register published: "Security Report: Windows vs Linux" by Nicholas Petreley. (Sorry, I can't find be bothered to look for the URL, but I downloaded the paper at the time.)

The paper is well researched, and bases its conclusions on several measures of "security" (whose validity it discusses), as well as on a qualitative discussion of the relevant properties of the two operating systems. It concludes that there are sound objective reasons for thinking that Linux is genuinely more secure than Windows, and discounts (for stated reasons) as a myth the often-repeated claim that Windows needs more patches because it gets attacked more often.

[Anonymous Coward]

Open source code is looked at and fixed....

For the roughly 3-5 % of PC users that use Linux (spread across an innumerable amount of distros of course) I have a question.

Apparently because the code is open-source (and differs from distro to distro, and all the hundreds of versions of the same server applications ), how many of you can actually program in C (The language used to code your OS's)?

Then of those that can PROPERLY program in C, how many of you actually go through the code with a fine toothcomb looking for errors/bugs/security holes etc?

Then, based on this percentage of coders, what percentage of that is hackers? And would a hacker be so friendly as to make all the loopholes known to the rest of the linux community, or rather keep those invulnarabilites to themselves, and use them to their own advantage? Is that a secure state?

Just checking....

[Anonymous Coward]

Linux Windows interoperability sounds a red herring

To hide the fact these systems are not being designed to interoperate in the first place - as generally these systems will operate as TCP client and servers anyway - so no Microsoft specific protocols to cause grief

Just sounds like an excuse for the company to make lots of money with fud - so good job in is USA tax not UK

[Mahou Saru]

Blue Flag Linux

Now the real question is what would the US army call their distro?

[Viet]

Beg your pardon ?

"It is always a disconcerting to me that folks forget they are tying themselves to Intel when they go with Linux but nothing is ever perfect."

Last I checked linux was only second to NetBSD in terms of CPU agnosticism (and might be ranking first in actual support for useful CPUs, if we prune out legacy chips that are of little actual interest). I had personnaly the opportunity to run linux on Sun Sparc 4m and 4u, Apple PowerPC, Alpha, and of course Intel. I tried a fair deal of other OSes, windows included, but none came close to the ability of linux to run on top of everything you throw at it. For instance, OpenBSD is certainly more secure by default but couldn't use my 2nd processor on Sparc. FreeBSD has long been restricted to Intel. Windows... could theorically be bolted on top of any micro kernel (or so it is said), but MS has always concentrated on Intel, halting developpement of any other platform support (NT4 could run on alpha, albeit in 32 bit mode only).

If I had to choose an OS solely on that basis, linux would be a clear winner for its ubiquity from smartphones to big irons.

(this message posted from an old, linux driven, sparcstation 10).

[Mark]

Re: I wonder...

This has been discussed a lot in the past. It has always been the intent of the FSF that even locking code freedom from those you disagree with is incorrect.

If you're free to do good, you're free to do evil too, else all you have is being told what to do, and that isn't freedom.

[Anonymous Coward]

Don don don de don

Don - the notion that Linux/BSD/Open Source software is developed and code reviewed by amateurs is a myth. Partly propagated by loud voiced amateurs with big egos.

They provide some contribution, yes. But far more important are all those commercial firms using and contributing - you know, IBM, Oracle, Apple, Google, Yahoo, etc, commercial Linux distributors like Novell or Red Hat, manufacturers of embedded systems like Linksys, Netgear, TiVo, etc. Do you worry that your wireless router is insecure because it's running open source code??

Having an army of people maintaining your security is not a sign of anything - if a building needed hundreds of people to maintain it, that would not be a sign it was secure but that it was badly designed. Or as another comparison - let's say 20 security flaws were found in your house and a bank vault. Which one of them is more secure?

Now Windows certainly gets better with each version - more secure and more stable (also of importance on military grade equipment) - but it is about performing surgery on a legacy system whose origin was as a simple operating system for a single user non-networked personal computer, rather than something designed ground up as a multi-tasking, multi-user networked system.

As a final point - resource usage and performance. If you're talking a lot of portable equipment it's something you'd have on your mind.

[Mark]

@Ken Haigan

By noting that you'll need your flame retardants, you're admitting that your arguments are a load of crap. You defend yourself by saying that the people who tell you it's a load of shite are merely religious nuts.

[Mike]

Its not about OS security...

Its about Freedom (we love that word here). Sure it may be the freedom too crush all that oppose us. But its all about freedom. Microsoft is your basic dictatorship or monarchy, one man, or group of men decide what is best for you, without your input. Linux is somewhere between a complete democracy and a hippy commune, open free and happy, and everyone (no matter what kind of idiot they are) gets to have their say. And if you are going to crush all that oppose you, in the name of freedom, you should use a freedom branded OS.

(sorry couldn't help myself, I like the idea personally).

Off to the pub...

[Richard Kay]

Re: Open source code is looked at and fixed

"For the roughly 3-5 % of PC users that use Linux ... of those that can PROPERLY program in C, how many of you actually go through the code with a fine toothcomb looking for errors/bugs/security holes etc?" .

Firstly you will find Linux more commonly used in popular and cheap embedded systems and more expensive Internet servers than Windows. Desktop Linux tends to be used by power users, developers and within smart organisations like Google that don't waste their employees time and money.

Secondly the amount of review code gets depends upon the extent of collaborative development for any of hundreds of millions of lines of source code that comprise Linux, its device drivers and application which run using Linux (and other OS) kernels. The less the collaborative development, the more likely it is that the source code in question only runs on one system and isn't patched into the mainstream versions of whatever software packages it associates with. The more people who use a program or patch option, the greater the degree of collaborative development and the more likely it will be promoted to become an inegral part of a mainstream kernel or distribution.

This is a job done by the many developers and power users out there, not by the much greater number of non-developing users of any given program. I have submitted patches for mainstream inclusion to fix bugs in very few programs compared to the greater number and variety of OS programs I use.

[Jonathan Richards]

@Nigee - Linux licensing

Nigee posted

> "IIRC a few years ago the French MoD if not the entire govt announced they were going to develop a secure version of Linux. Licensing presumably means this is/will be in the public domain."

I'm astonished that nobody has pointed out that Linux is NOT in the public domain. Neither the kernel, nor the GNU utililities that make up the GNU/Linux distributions, are PD. Those components are copyrighted, and licensed under the GPL, version 2 for the kernel, at least.

Bastille Linux and the NSA-hardened kernel are already available, of course, licensed under the GPL as you would expect.

[Simon Painter]

I love this dumbass stuff...

Myth #1: Linux is all standards and Microsoft doesn't comply.

Sorry, princess, get back to your mom's basement. If 90% of machines do something a certain way then *that* is the standard. The french really do believe that the prime meridian passes through Paris and may have written it down as an international standard on a whole heap of occasions but the rest of the world population are happy to agree on it passing through Greenwich. You can write as many RFCs as you like (and they are *Requests* *for* *Comment* and not *standards* *to* *be* *adhered* *to*) but if 90% of the world's PCs adopt a different standard then you can either join up or lose out.

Myth #2: Linux is more secure than Windows.

Maybe, but it's not been proven either way.

Myth #3: Making software open source means that you immediately get thousands of highly trained security conscious programmers crawling over the code improving it.

Dude, it just does not happen. Because people *can* see the code does not mean they bother. It also doesn't mean they have the skills to do anything with it. There are the odd exceptions but most Linux fanbois who use that arguement couldn't fix a bug even if they had the inclination to because they rely on their imaginary army of Microsoft busting superheroes to do it.

Saying that making something open to the public makes it more secure is like saying that Wikipedia is more accurate because anyone *can* change it (and I think that's been proved wrong enough times - who wrote that S Club track again?).

Myth #4: Getting indignant about how Microsoft are in the wrong makes some sort of difference.

Hahahahahahahahahahahahahahahaha. Tosser.

[Anonymous Coward]

Ahhh... they were using Windows!

That would make me cranky and want to fight all the time too!

[George]

Surely this Linux vs Windows is rubbish....

because "Security by diversity" is always the best option.

Just like you wouldn't defend your country with just army or navy or airforce. A combo of all is best.

[ryan]

@ george, Security by diversity...

.. is all well and good, but i'm not looking forwards to the O/S2 Warp operated nuclear missile silo.

[Anonymous Coward]

MS interoperability.

http://www.theregister.co.uk/2007/09/17/microsoft_european_commission_verdict/

“The Court found that Microsoft had indeed failed to supply competitors with sufficient information to allow servers to interoperate effectively.”

Microsoft was fined a svelte 497 Million.

In my humble opinion this is a rather clear indication that Microsoft servers are not fully interoperable, as opposed of course to any (open) standards based system.

...mine's the flameretardant monty with the penguin hide collar and dazzle motif...

[Jack Moxley]

Microsoft Paper Clip

"Hello, do you want me to show you how to use your nuclear capabilities? Click fire to continue."

[mike]

@Simon Painter

roflmao-well put!

[George]

Very true Ryan...

I did mean some security by diversity with a little lateral thinking.

Though by previous defence procurement history the chances of this are very slim!

As for the EU Court, they are so right-on hippy headed judges what they say has no bearing on the argument. Just look at all their previous decisions in the human rights courts.

[Richard Kay]

@Simon Painter

"Saying that making something open to the public makes it more secure is like saying that Wikipedia is more accurate because anyone *can* change it (and I think that's been proved wrong enough times - who wrote that S Club track again?)."

So Linus has started taking kernel patches directly from everyone without checking them first through his most actively developing colleagues ? I really must be out of date and out of touch. He has stopped requiring signoffs too ? Thank you so much kind sir for enlightening me.

[Stuart Castle]

My thoughts (for what they are worth).

I am neither pro nor anti Linux (I actually believe in using the "right tool for the job", so am equally happy with Linux, OSX and Windows), but a couple of points spring to mind.

First, the "Linux is more secure because it has more people working on it" idea. Not true for a few reasons:

It assumes that the majority of people are honest. In most cases, this is true, however, it is possible for someone experienced to posion the source code with holes. This *should* be picked up, but may not be.

It also assumes that the bulk of people developing for Linux are able to spot potential security holes. This is OK, assuming they are talented and/or old hands. Development is open to everyone, so they may be neither.

Also, if the security surrounding the system (such as on comms lines) as good, the idea is largely irrelevant anyway, as the system will be difficult (if not impossible) to access regardless of which OS it is running. Even a non patched installation of NT 4 is secure if it's physical connections are secure.

[Ron Luther]

@Herbys .... Control

Okay. So the 'bad guys' have found a security hole and people in your military force are dying because of it, right? Which would you prefer? Firing off a sternly worded email to Richmond demanding that they issue a patch as quickly as possible and then assuring your boss and the public and the families of those dying that you really have done everything that is in your power to do ... or spending money on a room full of bearded rent-a-geeks that you can rant and rave and throw pizza at? Which provides the best appearance of your sincere concern to work on and resolve the problem at hand?

[theotherone]

um...

"the Army has largely been prepping new Linux-friendly weapons"...funny that, seeing as Linux was largely developed by pacifists and peace-pipe smoking hippies!

[Anonymous Coward]

@Simon Painter

For any process, material or system to be considered a standard it has to be accepted by a recognised standards body as being complete, sufficient, self-consistent, repeatable and able to be used for interoperability or reproduction ........ and then, of course, *published in full*. 'Nuff said.

[David]

OK the answer is Vista

If all systems are Vista then no problem.

Trading speed and stability but poor interoperability for slow performance, viruses, but interoperability is obviously the answer. Just ask Steve Ballmer and he will confirm what I am saying.

[Captain DaFt]

All this discussion

And nobody's pointed out that the US government has rolled out their own, security hardened version of the linux kernel long ago: www.nsa.gov/selinux/

That's the value of linux, don't like the way it it works, roll your own version!

Like this one: tinfoilhat.shmoo.com/ Tinfoil Hat Linux, linux for the true paranoid!

(Yes, It's real)

Now, I'll take my coat, it's the rough canvas one with the brass buckles and the sporty, tie-behind-the-back sleeves.

[stizzleswick]

Funny that few here got the point of the exercise...

...which is that the U.S. armed forces want to detach themselves from a closed-in, closed-source codebase and get onto something THEY can control. More power to them (figure of speech only, mind you...)

The basic thing here is codebase access and standards compliance. BSD is OK here, but has a few limitations that were noted in earlier posts here, which I can imagine would rule out their use in a situation like the U.S. armed forces.

In my view, the advantages of breaking out of the MS box outweigh any possible advantage of any closed-source OS: Unlike DOS or NT (the latter includes w2k, xp and vista, the former all MS PC OSs up to WMe), stable BSD and Linux kernels are already available for just about any piece of hardware that was commercially available since the mid-1970s. Compare to a comparatively unstable NT kernel available exclusively for one processor architecture totally dominated by only two vendors.

Compared to any closed-source OS, Linux (or BSD for that matter, but note that BSD seems to be out because of other issues) is almost trivial to port to new (or modified) special-purpose chips and chipsets used in weapons systems. That alone is going to save billions on development costs in the next few years. Which, as far as I can follow the reasoning of the DoD, is exactly the point.

@ theotherone: "'the Army has largely been prepping new Linux-friendly weapons'...funny that, seeing as Linux was largely developed by pacifists and peace-pipe smoking hippies!"

Actually, Linux has so far for the most part been programmed by experienced software developers. Many do it in their spare time; a large number are even paid to develop Linux full-time by companies like Silicon Graphics, Novell, IBM and many other recognizable names in IT.

[Not That Andrew]

Pacifists And Hippies?"

theotherone, you poor deluded child, do you really think

"Linux was largely developed by pacifists and peace-pipe smoking hippies!"

I take it you have never heard of someone called Eric S Raymond?

[Former Gas Mask Jockey]

Blue Force Tracker on Windows? Not when I was there.

After having used the Blue Force Tracker platform in combat over two tours in Iraq...I'm relatively sure that it did not run on a MS platform....can't remember if it was Unix or Linux....but I know that it wasn't running on a Microsoft OS.....

Also, most of the Marines I worked with were so hopelessly computer illiterate, I can't imagine how much more difficulty they'd have with another OS to learn....Not that Marines are expected to be more computer savvy than the average civilian....

[theotherone]

@not that andrew

oh dear, you develop Linux too do you? I was talking about the general perception....you know, bearded geeks sipping light beer and getting excited about how a school district in a southern Chinese province has decided to switch to Red Hat....

[john]

I dont think this will be an open os

I would expect DOD to make a very secure OS, based on linux because they have the source, but with enhancements they will not release.

Which sounds potentially very good. Altho, I am not clear why not contract a secure os from the ground up. Their needs will be different from ours I expect.

[mackenzie]

"Hackers" I do not think it means what you think it means

"Then, based on this percentage of coders, what percentage of that is hackers? And would a hacker be so friendly as to make all the loopholes known to the rest of the linux community, or rather keep those invulnarabilites to themselves, and use them to their own advantage? Is that a secure state?"

Right well, see, before any patches get accepted, they have to be reviewed by a few top-level coders, and if it's for the kernel (the part you have to be most careful of), Linus himself. Also, just about everyone working on the Linux kernel is a hacker, by definition. Being a hacker just means you are an amazing coder. When you consider that some of the world's best hackers are in charge of the Linux kernel and reviewing every line that gets in, yes, that's a very secure state.

And WTF is an "invulnerability"? That'd mean "not vulnerable" or "invincible," wouldn't it?

[Abraham de Clercq]

Linux Hippies!

Love that....

Just the other day we were all included as Terrorists because of our aptitude for Engineering... and since most (if not all) the Linux geeks I know are Electrical or Software (by far the lesser.. by count) Engineers... I kinda think we're not really the 'pacifist hippie' type!

Face it- Hippies are irrational and controlled by substances/forces outside of their control which they 'trust' coz it's 'natural'- we, the Engineering Geeks, only 'trust' what we 'know' and by sheer overpowering OBVIOUSNESS, Windows cannot be trusted and Linux can. Then... we like to take things apart to see how and why they work... again... only something you can do with ease (yes, engineers are lazy) in the Linux world. (ok... BSD too... but it's not cool at all)

We like being in control too- so if we want to mod/hack or "improve" something, we do not want to wait for a stupid windows machine to complete its spinning-cursor routine before we can actually do something. If it is annoying, we want to stop/fix it. Code to comment style control is really great. Do you like freedom of choice (i.e. best tool for the job)? Linux (like grandpappie UNIX) giveth the greatest range of modular tools which can be strapped together rather quickly to create anything you can dream of- You are the Creator, the Radiant Light of Amen-Ra! Imagine that glow as it spreads from your ego... across the world, bringing joy to the Breed.

So- the US Army going the way of The Penguin is really in line with the whole megalomaniac syndrome as experienced by *true geeks* (i.e. engineers).

Was it not DARPA that gave us the internet?

Hmmm.... remarkable how the 'not-so-hippie-pacifist' institute can bring enlightenment to the world. Stereo-typing is fun. But... alas... only really cool if you are one of 'us'...

hehehehe...

The Article was ok and I am sure that the 'interoperability' issues refer rather to Excel, World, Access and a plethora of other applications (in house development/contracted propriety mscentric) than to networking or chips.

We all know that the Great MS is guilty of Obscurity and that they do that to maintain their stranglehold on Western Civilization. As does all other commercial software vendors.

(I got that rush of 'No bloody way!" too.... but, reason won out over emotion as it always does with 'us').

[Mark]

Re: Open source code is looked at and fixed....

Given that MS can't even say about decade-old software how it works (see the "Specification" of MS's OOXML, lots of "as Word97", or their response to the EU court that they could not document what their code did, so source code is the documentation), what's the percentage of Windows coders that look for and resolve windows errors?

[Justin]

Ummm...

Will the military use open source software, that anyone can get their hands on... how safe would that be?

[Jason Rosenthal]

Huh?

Did I miss something? The Washington post is reporting that the project may be going very wrong. Why are linux supporters so proud that a huge project based on their stuff is going south? Don’t get me wrong, its cool that people can celebrate mediocrity like that.

[stizzleswick]

@Justin

How can you imagine that what the US armed forces will actually run would be accessible to anyone but the US armed forces?

The idea here AFAIK is to take the basics already existing in OSS code and adapt them to the needs of the military.

This does not necessarily include the publication of any code written by the military (OK, I guess the FSF would take issue because this would be a breach of the GPL and LGPL... somehow, I cannot really imagine they are going to sue the US armed forces over this issue, though...)

[Ken Hagan]

Re: Ken's two points

"By noting that you'll need your flame retardants, you're admitting that your arguments are a load of crap. You defend yourself by saying that the people who tell you it's a load of shite are merely religious nuts."

Er, no actually, I was merely aware that there *are* people like you.

In fact, I was grateful for the replies from Nìall Tracey and Glen Turner. They avoided all mention of bodily waste but included a helpful explanation of why I was mistaken.

[SImon Hobson]

I hope they can hit the target better than you lot !

The main point here is that the military have recognised that having systems dependent on a commercial OS that WILL be end of life and dropped long before end of life of the system is not good. So say they used Server 2003 as the basis for a system - at some point MS will stop selling licences and so the military will have a stark choice, stop building new boxes, or go through a costly process of adapting and revalidating their custom software.

Since they can take an open system such as Linux and not have to buy licences, they can develop and fix a system - they don't HAVE to change it unless THEY decide they want to. Thus the end user is in control of what they do, not a commercial enterprise with money as the sole motive.

It's not about "Linux good, Windows bad" - it's about having control of your own systems.

Others have mentioned "Windows for Warships". Knowing what I do about procurement cycles and system lifetimes, I can almost guarantee that whatever version of Windows they base the system on will be obsolete before the ship goes to war. If they find a problem with the OS (testing is never going to be 100% perfect) then they'll be having to negotiate with a commercial vendor to provide extended support.

OK, the military will generally be doing that in advance as part of the procurement process (they aren't THAT daft), but it's a serious issue. I know that I've been involved, and one of the questions asked is what guarantees are provided by commercial software vendors over future availability - and sometimes code escrow is demanded lest the vendor of a key component should disappear.

NB - it's not just the software. Hardware obsolescence is a big problem too. For example, components used in military system may well be out of production before the system is finished. And I gather that London Underground even scan eBay in case any bits of "old junk" come up that can provide vital spares for their decades old infrastructure !

[ian hewines]

Linux Wins

There must be many reasons the US military has chosen to invest so much cash in Linux. The Department of Defense is one of the most powerful (the most powerful?) and best budgeted (the biggest budget?) software buyers and developers on the planet. Via US companies they are the world's biggest supplier and manufacturer of weaponry.

That's a lot of Linux based software and the ultimate 'Why choose Linux' report to go with it..even if their software development is restricted to camouflaged versions of Excel the implication is that a linux platform scored highest overall from the list of -

return on investment

speed of development

freedom of development

security

interoperability

usability

reliability

flexibility

fit for purpose

profit making

patriotism (immigrant Torvalds over citizen Gates, US jobs)

learning curve

etc etc etc

Even if they got it wrong (and they have been known to) , from an organization that believes, absolutely, in the need for technical superiority and associated skills (with the conviction they posses these attributes) their choice is supremekly influential. This battle is the turning point in the war and the one the stock market will be changing sides after.

Is 'hippy hacker' concern at Linux becoming the 'Oppenheimer OSS' the reason celebrations are so relatively muted? If so, txs developers for showing this glimmer of emotion winning out over *reason* and would you please code a 'Swords into Ploughshares' switch into the core?

[Anonymous Coward]

ABOUT TIME

Took them long enough to realise that Linux will provide them with a controlled, secure, stable code-base on which to build proper defence systems. Proof that Linux is more secure than Windows? Give me a break! Anyone that has taken the time to use them both will after 30 minutes realise that Linux leaves Windows far behind. We use about 300 Ubuntu Linux desktops/notebooks in our business and I can say that we have far less security issues than when we were running Windows (unfortunately we still have around 100 on Windows but will migrate these over the next 12 months).

Let me also back other views expressed here that security was merely one of the factors taken into account in the evaluation process. Yes, I do have inside information on the process and, believe me, it was extensive.

'Linux takes wisdom, foresight and guts.' Quote borrowed from Mike Kovacevich.