What if Microsoft just turned you off? Security pro counts the cost of dependency A sharply argued blog post warns that heavy reliance on Microsoft poses serious strategic risks for organizations – a viewpoint unlikely to win favor with Redmond or its millions of corporate customers. Czech developer and pen-tester Miloslav Homer has an interesting take on reducing an organization's exposure to security …
While the premise of this article is spot-on, and the necessity of confronting IT monoculture is beyond question for serious professionals, I submit that every business, by the very mathematical nature of business itself, simply operates to minimise risk and maximize profit. Successful ones anyway. Choosing a known OS, with known personnel and capital budget requirements, simply reduces the chance of systems failure. And in the event of a failure of IT services, recovery and repair is likewise understood well enough to model and price, thus creating a large motive to stay with the herd. If there is ever going to be a departure from M$ monoculture, we will need some type of government mandate in order to overcome the above described risk profile bias. I have for years hoped that this would transpire. However, despite a few European and authoritarian government initiatives, most nations with free-market economies are shying away from such heavy-handed tactics. Should they be bolder and do this? Yes, probably. Will they? I guess it really depends on how bad the monopoly gets. And it's pretty bad right now.
"every business, by the very mathematical nature of business itself, simply operates to minimise risk and maximize profit."
It is well known that efficiency and robustness are the essential trade-offs. High efficiency (high profit/low price) means easily disrupted. High robustness (works always) means inefficient.
The risk part is about the probability of a disruption. That has become high with a US president that is willing to endorse and advocate ethnic cleansing and dumps people in concentration camps in Central American or South Sudan based on their skin without legal recourse.
Trust leads to peace and prosperity, distrust leads to (civil) war and poverty. Do you really trust the Orange King and the US rule of law?
Try telling Marks & Spencer that their current setup minimised risk and maximised profit.
You're stating known odds and outcomes. Businesses, thinking themselves to be smart, are risking unknown odds and consequences but the evidence seems to be that the odds are getting shorter and the consequences higher. Without being told it's as if you discover the hard way that only 2-5 pay £100 while 1 & 6 lose £1,000.
You are right. The issue here is that in the current political situation risks are going up for the people that depend on American products. We have been quite fast at ditching Russian AV Kaspersky, at least at corporate level (not at home level). Still we are not even thinking about ditching American everything. And we are really using ONLY american IT assets. Most of the hardware, 99% of the software, 100% of the OS, 100% of the cloud services.
This is absolutely wrong, because it turns a blind eye to an ever increasing risk factor that we do not want to see. In the current political situation we are handing the switch to our whole world to Donald Trump. And we are also handing our purse to the unobstructed greed of MS, Broadcom, Oracle, Amazon, and Google. We are slave to their whims regarding pricing and licensing. And here "we" means every business and every government, too. Total collapse of the system is one Executive Order away and we choose to look the other way.
I'm doing my part since forever in avoiding this, as a freelance consultant I tend to drive my customers to open source locally hosted solutions for IT, but still Windows (at least as a client) is everywhere even at my customer's places.
> it's quite rare for Microsoft products to stop working randomly
Have you never used Windows before? It stops working randomly all the time! Aside from weird problems like known good networks suddenly failing to connect or printers suddenly failing to print you can add in a good share of botched Patch Tuesday updates which break features or occasionally brick the whole machine.
If you also consider how bloated and excruciatingly slow modern corporate Windows deployments seem to be (bogged down with 3rd party security tools, employee tracking software, lockdown/control etc) I really don't understand why corporate bigwigs tolerate it :-(
> Have you never used Windows before? It stops working randomly all the time!
This ^^^^^^
All the C suite see is Windows OS and MS Office. Nobody apart from home users install the vanilla OS and even then the users will (or at least should) customise settings.
What they don’t understand is all the endless twiddling of group policy to conform to a half decent security policy and how bloody awful MS documentation is on the subject.
I’ve not tried it but some editions of Linux offer FIPS lockdown out of the box(ish). Surely that must be a better starting point. Plus MS deciding to EOL products when they feel like it so businesses are forced to cough up for upgrades whether they like it or not.
I feel we need one or more of the Linux vendors to start selling PCs preloaded to the mass market, along with TV and cinema ads, not to mention Superbowl half time.
Let me clarify. From the nature of pentesting work I saw plenty of various companies and their inner systems.
Yes, the things you describe happen. Random windows workstations have their quirks and they can't compare with an expertly tuned Linux beast.
But on a company scale, say 10000 machines managed by an overworked team of 6 people, you will have a smoother experience with windows.
Also, the company spyware is a desired feature.
Here in the US Trump is trying to bully and blackmail corporations, universities, law firms, etc. Hopefully democracy and the rule of law will stand, but if he's allowed to do that by either the courts or the fact that CEOs see it as a good strategy to keep their head down and not speak up, he and future presidents could arbitrarily command Microsoft (or any other US corporation) to disable services for any country, organization or individual for whatever reason he has or no reason at all.
That's a HUGE risk. Maybe there would be more CEOs willing to stand up to the orange toddler if other countries make it known that if the US goes down this road that they will abandon US technology wholesale to de-risk their countries and citizens. People in the EU etc. should take corporate silence as compliance, and announce policy accordingly.
M$ has acted like this for decades. How is Trump suddenly the problem? M$ has been working towards its current products as far back as Clinton, or has everyone forgotten all of M$s crimes from before 2024?
Whatever dude, whatever it takes to knock M$ off its throne. If it has to be Orange Man Bad that spurs people to action, so be it. You have 3.5 years to make your inroads, or you may as well accept the teachings of Satya into your heart.
> We've had a few abusive comments and emails from anti-vaxxers following our coverage of Xlibre
I'd hoped most of them would died from something eminently preventable by now - the phrase "unsanitised telephone handset" springs to mind. But if you can get a Flame of the Week out of one of them, I'd be very happy to laugh at them if that would make you feel any better.
And selection doesn't need to be natural, or left to nature.
Whether you see the memes around antivaxism* as faulty or a competitive cognitive organism, that's where the need to remove, suppress, or patch is nowadays.
More Dawkins than his predecessor Darwin.
* etc
That's easy to say, a lot harder to do.
Start from the mindset that "we have this OfficeMicrosoft 3654 suite that does everything for us" - and start looking at what the task entails.
OK:
There are alternatives to the MS AD stack, but they don't come "out of the box" rady to serve the rest of your non-MS stack.
There are alternatives to Outlook and Exchange - but they don't have the level of integration that the MS stack does.
There are things like LibreOffice - but it's different and doesn't integrate with everything else the same.
And I could go on and on.
Summary: Yes, there are alternatives to every piece (I think), but they come as a kit - a bit like buying a load of random Lego bricks which you have to somehow assemble into the model you want, v.s. just buying something already made ready to unpack and put batteries in. And as time goes on (has already gone on), Microsoft keeps hunkering down on the integration - using proprietary glue that's designed to make it ever harder to rip out any part of the system and replace it with something else. So to a large extent, it's an all or nothing deal - and the "nothing" (from Microsoft) option means a "very large" amount of work in glueing bits from different sources together. If you aren't a "very large" user, then the cost would be prohibitive.
They think because it hasn't happened it's not going to happen. Just a few months ago Canada thought it was best buddies with the USA. Not any more. Trump is already coercing Canada, he could easily cause them more trouble and the effects would be instantaneous. It's one thing to deal with tariffs, which take time to take effect. it's another if you can't get into your email and documents at all. Local backup? I bet a huge number of people don't do it.
I don't think the prospect of building a non-USA software infrastructure is hopeless. That is defeatist. Start by doing it piece at a time. Declare it a national emergency (even a Europe-wide emergency), and then start doing something about it.
Agreements and 'guarantees' with MS don't mean anything when Trump knocks on their door.
Are you implying that they meant anything they said before Trump was elected? Remember when Windoze 10 was first released and they said it would be the last operatieng system ever needed? Trump wasn't even running when this was all said. They were probably already working on Win11.
Dear God in Heaven ... I am going to agree with VoiceOfTruth !!!
Trump has just neutered the Courts in the US of A, which means that he CAN 'knock on a door' and get away with ordering ANY action he wants !!!
How is this any different to what the US of A accuses the CCP of, in China !!!
Trump is in full blown Dictator-mode and he can not be slowed by the law anymore !!!
The Supreme Court is in his pocket and EVERYONE in or outside the US of A should be worried !!!
These ideas about being at risk because countries are 100% in the control of US Tech Behemoths are NOT fantasies anymore.
Watch carefully what Trump does to Canada ... he is going to use them as an object lesson for the rest of the World !!!
P.S. Now would be a good time to 'short' any Canadian stock that belongs to a company 'too entwined' with the US of A.
:)
With Trump it will be a game of 'Both' tightening the vice at the same time and who screams first !!!
Trump will stand the 'pain' longer as he can personally ignore the costs, whereas the people of the US of A may be less resilient.
:)
Potato famine.
Well if you want to be scientific about it : Monoculture and the dangers of depending on it.
Take windows 10... a simple job to re-install it.... we've all done windows re-installs , use the CD/DVD/USB and let it run rampant over whatever is installed before. but windows 10.. I WANT THE INTERNET it screams with all the tact of a 3 year old toddler in the sweats(candy) section of a supermarket.. then refuses to do anything more (unless you know the magic commands which cause a another reboot before you can create a local account) of course a non-techie person would cheerfully sign up for all the 'cloud' services m$ offers without a thought. as do many many many businesses.
But once they've got your data, what happens if you cant get access to it? whether by design "Give us $5/month per user or you'll never see your data again" or by political reasons or by the service they advertise as 365 comes in at more like 350.. and we know which day it will fail.
Stir in just how many people use m$/office and a cloudstrike scale cockup could destroy western cizilisation.
So what do we do about it.... well unless forced to by governments, everyone will still buy m$/office because everyone else uses it, plus no one is going to buy a rival office suite becaue m$ have made the bar to entry in that market so high that only they can supply the software/OS we need.
So unless governments wake up to the danger of relying on basically one supplier for our entire desktop computing needs, we will always face the danger of potato famine.
The potato famine was in part due to the ruling classes
Yup most famines are caused by governments, so it's a curious starting point to lead up to needing to be "forced to [not use Microsoft] by governments".
(I don't know what the answer is, some government regulation is fantastic and absolutely needed but it has to be smartly designed. A lot of people once thought Mao Zedong was smart at farming regulation)
The hungry forties also affected England. Two of my great grandfather's four brothers emigrated in the 1840s, a third in the early 50s and probably the last one did two as I can't find him after 1851. This was a common situation. The population of both countries had spiked to what was, for the time, an unsustainable level. (The fact that we might be in a similar global situation is worth considering.)
Do you see what I did there?
The original cause of the potato famine was the mass planting of a single variety of potato which was susceptible to blight. Bear in mind that the preventive fungicides used today for seed potatoes were not invented then, and blight resistant varieties had not been developed.
I do fully agree that the famine was made far worse by the behaviour of the landowners (both English and Irish) who put profit over lives. The history is relatively complicated and led to the current situation of two Irelands.
I had two Irish grandparents, although mine arrived in the UK in the early 1900s.
> I have 2 words for you: Potato famine.
> Well if you want to be scientific about it : Monoculture and the dangers of depending on it.
Truer than you know.
I think you misunderstand both the true nature of the potato famine (reminder: I'm Irish now and take that quite seriously) and also, in a pleasingly direct parallel, the nature of SaaS, MS services and so on.
1. The great Irish potato famine
It wasn't because of the monoculture. That's fake history.
Ireland was owned by Britain at the time. Most land was given over to cultivating cash crops. Ireland exported food to Britain throughout the famine.
The Irish starved or fled because they could not afford and were not allowed to buy the cash crops grown for England, so they grew what they could on the scraps of land left over.
The famine was not caused by _Phytophthora infestans_ -- it was caused by English landowners and their callous policies.
In this instance it is all about money and ownership and inequality and injustice, not about biology or farming.
2. MS SaaS
> But once they've got your data, what happens if you cant get access to it?
The point here is that having allowed MS to get _so_ entrenched then nobody can come in and do something better, or even as good as a 1:1 replacement.
The answer is the one useful thing I got out of my time working on Agile projects: the concept of the minimum viable product, which is Just Barely Good Enough.
What this means in the competitive landscape is:
* Work out the absolutely essential minimal functionality
* Build tools to provide that _and nothing more_ and focus on making the advantage something unrelated to features or functionality. So, in this instance, that means for example make the product FOSS as up against sophisticated expensive commercial products.
Parallels in other directions:
Google has done OK with Google Apps. It's not FOSS, it's not free for business use, but it sweeps away the entire proposition of rich local apps on rich local OSs and a shedload of rich local state which has to be deployed, then maintained and fixed *OR* increasingly wiped and re-deployed because that's too hard.
For gApps all you need is something that can display a web page and update its JS content fast. That can still be a cheap low-end computer even in 2025. Chromebooks sell at a profit for £200 and remember that means that the cost is more like £100 or less.
ChromeOS is Gentoo Linux with a tonne of self-healing, A/B updates and things.
If Linux can do this then other better tools than the bloated Linux could in principle do it in 1/10 of the space and resources.
"I'm Irish now"
In which case I commend you Frank Mitchell's book "The Irish Landscape"*. He traces the huge rise in the Irish population (graph on p205 or thereabouts) and finds it difficult to find any other cause than the cultivation of the potato as a staple.
* Actually I commend it to anyone interested in Ireland. He was one of the pioneers in the discipline which took me to Belfast almost 60 years ago.
Potato famine was an example.... nothing to do with whether British policies and attitudes of the time were right or wrong.
I should of used one line of bananas being wiped out by a fungus? virus?.. but then you lot would have started a fight over US policies in central america rather than concentrating on the issue actually being discussed. being the monoculture created by microsoft
"Take windows 10... a simple job to re-install it.... we've all done windows re-installs , use the CD/DVD/USB and let it run rampant over whatever is installed before. but windows 10.. I WANT THE INTERNET it screams with all the tact of a 3 year old toddler in the sweats(candy) section of a supermarket.. then refuses to do anything more (unless you know the magic commands which cause a another reboot before you can create a local account"
Only the home version does that - all the others have a non-obvious option to 'domain join'. This doesn't actually mean domain join - it means create a local account!
Same applies to W11.
'Senior management' means 'being ABLE to make decisions that you are not qualified to make'.
That is the problem in a nutshell !!!
Because you CAN then you DO ... to prove you are so senior and therefore obviously have the knowledge to make ANY decision.
This is the problem with Govts and the supporting structures around them ...
Example 1. The Civil Service (Never admit you do not know and make it up as you go !!!)
Example 2. Govts in General ... (Never admit your mistakes and try to 'Brassneck' through everything.)
Sound Familiar !!!???
:)
Senior management should mean being able to consult* the experts you employ and getting considered, independent advice from them. All too often it means either the ability to get rid of the experts because they're expensive or else disregarding them because they're paid a comparative pittance so that's what their advice is worth.
* It should also mean being alert to what's going on in the wider world so as to know when you need to consult them.
So glad you used the word 'should'.
The problem is that getting to the level were you CAN make these decisions OFTEN goes with gaining a level of arrogance that you are actually ABLE to make these decisions with no help.
REAL leaders are able to recognize that they NEED experts to provide advice BECAUSE they do not have the knowledge/expertise to make ALL decisions.
REAL leaders are quite rare !!!
:)
Off-topic, but that whole LinkedIn on Toothbrush vs Mobile Phone Owners is what it wrong with the world right now. In some ways it's actually quite a good article because it spells out many(*) of it's own errors, guesses and caveats which make the conclusion utterly worthless. But I bet the headline will be quoted as gospel in 40 year times and the original article will be long buried so I implore everyone, read it now so you get an idea just how much unabashed bullshit is wrapped up in the 'conclusion'.
(*) Just to give some idea: One of it's own errors it doesn't dissect is the fairly deus ex machina 'fact' introduced near the end that the average toothbrush costs $1.55. A conclusion only an American could find sensible (Alibaba says $0.10 might be a more reasonable wholesale value). This is only somewhat offset by the lazily implicit assumption that the average human gets through only 1 toothbrush a year. (Either my oral care habits aren't as gross as I thought or perhaps I need to try one of those indestructible $1.55 brushes? I never get them to last more than 6 months).
Similarly off-topic, but
> (Either my oral care habits aren't as gross as I thought or perhaps I need to try one of those indestructible $1.55 brushes? I never get them to last more than 6 months).
Go get an ultrasonic toothbrush. Yes, it's a $100 toothbrush, yes, the replacement heads are $5-$10 each, at least. It's the best dental decision I've ever made.
I had always had comments from my dentist, "You need to brush better, don't forget these spots, over here, you have gingivitis, you need to..." and when I started using an ultrasonic brush daily the next visit rated me in the top 5% of dental attendees. No problems. Even "you need to floss" went away. (It's come back every-other visit.)
Where you wear through your toothbrushes is: they're only meant to last 3 months. The texture on the bristles meant to help clear wears off. (Yay, ingested micro-plastics!) Ultrasonic toothbrushes don't need that in the same way, because it cleans differently.
Proper ultrasonic usage is "wanding" the brush over your teeth, without brushing, without pressing - just slowly, gently put it into the right spot, move it around the tooth (or teeth), and let it do its thing. Honestly I've gotten 9 months out of a brush head. Usually their wearing out is a mechanical factor at the brush attachment point, where the joint becomes sloppy, the brush starts "buzzing" loudly, and cleaning efficacy is lost to sloppy mechanical transmission losses.
This is not about the price of tooth brushes, or tooth paste, but of oral hygiene habits.
There are even religious aspects, as siwak or miswak (chewing sticks) are mentioned in India’s ancient Manu laws, the Koran, Buddhism and the Talmud and some orthodox believers consider using them part of their religious life.
So, it is probably true as nearly every human uses a mobile phone nowadays and not every human uses a toothbrush.
This is not about the price of tooth brushes, or tooth paste, but of oral hygiene habits.
Indeed, those are the sort of interesting cultural factors I expected to come into play when I clicked the original link!
it is probably true as nearly every human uses a mobile phone nowadays and not every human uses a toothbrush
25% of the world's population are under 15. And there is 'uses'/'has access to' (parent's, school-provided devices) vs 'owns' and some other technicalities around tablets vs phones. I dunno, of course even poverty-stricken parents will prioritise getting a phone for their children if possible, because they worry about their safety, but I have a hard time believing it comes in above the much cheaper aim of keeping your kid's teeth in good shape.
Maybe I'm just biased because I made it safely through childhood without a mobile. And it must be said, when I realised we get a whole 2nd set of teeth I had some regrets about spending so much time keeping the first set clean.
"even poverty-stricken parents will prioritise getting a phone for their children if possible"
Some 15 years ago I visited Indonesia. It looked as if every highschool kid I saw had a mobile phone. It is not that I saw an unbiased sample, but it most certainly was not "rare" for highschool kids to have mobile phones.
Note, it says mobile phone, not smartphone.
In the UK, do they have dentists and subsidized bi-annual dental exams available for everyone? If so, do the people who take advantage of that receive a toothbrush, toothpaste and dental floss as part of their 'parting gift' bag?
Leaving aside the argument of who pays for the toothbrushes given out at regular dental checkups - insurance, the government, the patient? - I can say as long as I keep visiting my (USA) dentist regularly, I never have to purchase a toothbrush unless I choose to.
I'm still haunted by Lisa Simpson's "The Big Book of British Teeth", and never miss an appointment.
'In the UK, do they have dentists and subsidized bi-annual dental exams available for everyone?'
Never have done. Dentistry wasn't folded into the NHS so the only NHS provision is via contracts with private dentists. The contracts are shit so few dentists will take up the offer which leads to a massive shortage of patient capacity. Even then, it's only subsided and not free for a lot of procedures. Only kids and the spectacularly poor are eligible for NHS dentistry, anyway.
The contracts work by allowing the dentist to claim for the cost of any procedures they do on patients but there's a fixed price list. This leads to occasional outright fraud wherein dentists claim for procedures that never happened. The other side effect is dentists stalling treatment on teenagers with unprofitable problems so that they turn 18 and get kicked off NHS dentistry and are forced to pay the full private dentistry price. Obviously, there's an inherent gamble that the teens don't move to another dentist when they go private but there's also the shortage of capacity in private dentistry to limit their choice.
> Dentistry wasn't folded into the NHS so the only NHS provision is via contracts with private dentists.
Dentistry from private Partnerships/Limited Companies via a General Dental Services (GDS) contract with the NHS?
You mean like the GP Practices which are run by private Partnerships or Limited Companies via a General Medical Services (GMS) contract with the NHS and the "NHS Eye tests" provided by high street private Opticians (Limited Companies) via a General Ophthalmic Services (GOS) contract with the NHS?
You'll be fine, but you're not common.
A lot of businesses really do rely on Facebook, they don't even have a website of their own.
If you do a quick audit of your suppliers and customers, you'll find that most of them do rely on at least one of those four for services you're not involved with - and that none of those have a contingency plan should it fail.
Email is likely the biggest and most common one, but basic document storage is quickly overtaking it.
What you should be asking is "What if I just turned off Microsoft?"
I did, over 15 years ago now. My businesses are running just fine without them, TYVM.
I'm absolutely astonished that the Corporate World keeps falling for it, year after year, decade after decade. You'd think they'd have learned by now.
I wonder how many tens of billions of dollars have been lost in man-hours alone due to Microsoft incompetence. And the Corporate Lawyers allow this crap into the building? Still? Mind boggling.
You'd think they'd have learned by now.
It's not going to happen, and you know it. We all heard people tell you in your role as "techie" that they have to buy a new computer... and then, between the lines, you figured out all they needed is a new BIOS battery. Mobile phone users? Light might be on there, but in the majority of cases I doubt whether there is anybody home. So... Will there be "a change"? Meh. Will "warnings" be heeded? Really? Raise a hand if you heard: "Paranoid!" "Industry standard!" "Inter-connectivity and compatibility!" "Commie!" As Liam writes, more general, do we see people learn from natural disasters (we had a severe flooding here) where "mobile phone availability" was ranked above "cut off electricity and water". Geez, and how to charge that mob? Bicycle with old school dynamo anybody? ... Ah, electric bicycle... Right. What about a digital payment system stumble that makes officials say it would be good to have "50 euros in cash for emergencies"? Have you asked them to read a map (think of that technical invention called paper) to get from A to B? No, it is baffling, but it will not tell you where to take a left...
Will they all come crying at your door step when it all comes goes ...---... ...---... ...---... ?
"Good for you…"
Yes. It is. :-)
"Tell me none of your customers use Microsoft/ Google/ LinkedIn to find your services?"
I have no idea what they might try to do ... but last time I checked, you couldn't find me or my services using microsoft or google. I have never used linkedin. I seriously doubt that they know anything about me, either.
"Completely word of mouth and cash in hand?"
Word of mouth only, ever since I went rogue became a full-time consultant in 1988. I have never advertised, and turn away more work than I accept. Payment methods negotiable, but if you have to ask you probably can't afford me.
"You’re a window cleaner…"
No. You obviously haven't been paying attention ... I don't do Windows.
Raise a hand if you heard: "Paranoid!" "Industry standard!" "Inter-connectivity and compatibility!" "Commie!"
[...]
Tell me none of your customers use Microsoft/ Google/ LinkedIn to find your services?
Completely word of mouth and cash in hand? You’re a window cleaner…
QED
Well, sort of, after all a beancounter is employed to, well count the beans, which is fine, it’s their job.
But the problem is when a company allows them complete control to make company-wide decisions.
For example the IT department might put up an argument to purchase ‘xyz’ equipment but the finance people might object on the grounds that it is expensive.Fine, that is their job. Idealy it should now escalate to the CEO or CTO who can listen to and understand the arguments for and against, make a decision and override any objections. Alas this doesn't seem to happen, it often appears that the senior staff simply abrogate their responsibilities and delegate them to the finance team; whose job is to reduce expenditure.
I’m sure you all see the obvious issue here!
I don't dissent from much of what's been said, but one of the reasons we're so dependent on large vendors is the fragility of the underlying technology.
Nobody in their right minds runs a mailserver. The constant spam and other malfeasance can only be managed at a scale that allows you to improve detection rates and amortize costs.
How are you going to deal with a 5.6Tbps DDoS attack without infrastructure on the scale of Cloudflare?
And Marks and Spencer - a large company itself with significant resources - has recently demonstrated the perils of providing any kind of online service. How's a small company supposed to cope?
We, the technologists, have to take some responsibility for this. A failure to properly anticipate the security risks has led to a dependency on scale that leaves us with all our eggs in someone else's basket.
"Nobody in their right minds runs a mailserver."
Really? The people who run mine definitely seem to be. OTOH there's a good argument for saying that nobody in their right mind would let a large US corporation run their mailserver, not if they're paying attention to what's happening.
"A failure to properly anticipate the security risks has led to a dependency on scale that leaves us with all our eggs in someone else's basket."
The problems of M&S and a good many others seems to be not just a reliance on their suppliers but the suppliers' suppliers. Hence the term supply chain. It's time to reflect on the saying about the strength of chains.
Nobody in their right minds runs a mailserver
As Doctor Syntax says, wrong. Who in their right mind allows <someone else> to dictate what mail you do and don't get ? Who in their right mind uses a mail server that BY DESIGN will silently throw away some of your mail after telling the sender that they'll deliver it ?
At a previous job, I got to build (in a hurry) a replacement mail server as the old one we ran on Windoze was "getting more and more flaky". I used Linux/Postfix/etc. of course, and it was mostly reliable for many years - still running when I left 10 years later. It did get a bit of an update, and I implemented before acceptance scanning for spam/malware/etc. - that means, it decides up front if it's going to be delivered, and either delivers the email or rejects it (rejects, not accepts and discards). It kills spam, but allows senders to know if their email has suffered a false positive.
So naturally, I copied the setup for home - and that's still running.
Would I use a mail service from any of the online providers - definitely 110% not any of the big ones, possibly one of the smaller ones IF they had the right features. But if it's one of the smaller ones, then you lose most of the point of going to a third party.
Perhaps I should clarify that I do use a commercial provider, for myself and for a local organisation. They're Mythic Beasts who definitely seem to be in their right senses. In fact I rely on multiple email addresses to avoid spam. There are a few businesses that seem not to understand spam can lose customers. I either tend to shut off their specific email address except when it's needed (hello, insurance companies) or tailor filters to bounce specific villains (e.g. a dentist sent me stuff to be signed by Docusign so now my medical address has a filter to bounce them).
The question is, who in their right senses would trust their non-US business email to one of the US gargantuans?
"Nobody in their right minds runs a mailserver.”
Really? The people who run mine definitely seem to be.
Now firstly I do appreciate your acknowledgement that you don't run your own email service and hence aren’t in control of it. Now, hypothetically, 'Mythic Beast’ announces tomorrow that they have been purchased by Microsoft, or Google, what do you do? Even now, what platform does ‘Mythic Beast’ use, is it Exchange, is it a Linux system, hosted where and who controls it, who has access to it? Do you know?
None of this is a simple or straightforward as it might seem.
1: My mail addresses are in my own domain. The registrar of the domain can be changed if required. Not only can be, but has been in the past.
2: Communication between client and server is an open standard.
3: That means the operator of the mail server can be changed if required. Not only can be but has been in the past.
In the unlikely event of MS taking over MB I can be gone PDQ.
Separating domain and MSP from ISP makes it easy to move ISP when I need to. It's called planning ahead, the sort of thing that business managements are paid to do.
MB make no secret of what they run - Debian/Exim.
Binary coded decimal was very common to support currency arithmetic. Even microprocessors typically had some sort of support (the 6502 had a separate mode for decimal arithmetic). Sterling (£sd) arithmetic was available on a number of IBM and ICL systems as an option, but used a binary encoding.
The interesting thing about the decimal computer linked from the article is that it didn't use binary to store numbers of a different base - it used special valves/vacuum tubes that did decimal arithmetic only.
> It's still possible to run Android without a Google account
Of course it is. That's why I have written about /e/ OS, the Punkt MCO2, etc.
But it is also perfectly possible to run a company without a single Microsoft product.
The point is, most phone owners don't have a clue how, and neither do most business owners, and managers, and IT departments.
How Google tracks Android device users before they've even opened an app
Another tracker which cannot be removed once created is the Google Android ID, a device identifier that's linked to a user's Google account and created after the first connection made to the device by Google Play Services.
Another write-up states you don't even need to have ever signed into a Google account for all these tracking cookies to be dropped... although if you are everything will also be linked to your Google account because Google.
The OS is actually only a minor part of the Microsoft problem. Working in a Big Corp that is fully into Office365 and Microsoft cloud services, it is easy to see Microsoft has the whole shop by the balls. Office365 can be used via Mac and even Linux (the web interface is pretty good these days as long as you run Edge). Never mind MS just cutting service. If MS simply one day decided it needs more money and raises prices, the company has essentially no other option than to pay up, up to some eye-watering percentage. Moving the data and the intertwined processes elsewhere is infeasible. The ultimate lock-in.
I've posted this before, but it bears repeating.
The big corps will not move away from M$. Their stock portfolio has M$ in its holdings. It's classic quid pro quo and conflict of interest.
As the big corps are the whales, the 800lbs gorilla, the fart in the elevators, everyone else gets dragged along by threat of literal excommunication.
Now add the illegal market manipulation throughout the decades, collusion with Intel and both from the various software companies, and well, here we are.
And I've posted more or less this here several times:
If the whimsical POTUS has a whim that your customer, your company, your country or your continent are to be sanctioned than those big US corps will quit you.
I've also posted here a few times:
If you're in IT management and you're not analysing your risks and making contingency plans you're not earning your salary.
Getting a big corp to pay for new headcount or retrain existing to support Linux and/or non-MS software isn't easy. US corps who are publicly traded work ruthlessly to bring down operational expenses for their bottom line to look good to the shareholders. "Discretionary budget" for a department may amount to a few pizza lunches a year to keep the workers from revolting. Now you want to add new services to IT with no additional budget? Your outsourcing company is going to want more money to support new OSes and applications. Your in-house staff will be pulled from existing projects or asked to work additional hours to learn and support the new tech. "That one guy" who knows Linux is going to quit or retire if pushed too hard, you know how touchy those sorts are.
This leaves aside the additional issues of vetting open-sourced software and getting corporate-level support (patches, features) on a timely basis for said software. I can call Microsoft and get an engineer on the phone to investigate any issue (assuming I'm a Fortune 500 company) but can I get that kind of support from open-source software authors? A few, perhaps. Cloud has been good at forcing companies to diversify their knowledge base and all the SaaS I deal with is Linux these days, so there's progress, at least.
I don't disagree with any of the points in the OP's article. Monoculture is bad for so many reasons. But from my experience, it isn't going to change in Corporate America without another 2-3 Cloudflare-scale incidents and a big shift in corporate spending mentality.
To a large extent TFA looks at things from a European viewpoint. The European - or any non-US - viewpoint has to look at geo-political risks of being dependent on US corporations. If you're top management here you should be asking your senior IT management what they'll do if the services of those US corporations become unavailable. If you're in that senior IT management do you have an answer ready? Do you think something along the lines of what you (and others) have posted will be good enough? Will management be looking for somebody more on the ball to replace you?
About 8 years ago I got a stark reminder of how lax I had been in accepting the status quo of my Google account I opened in 2004 - back when it was just email and Google were doing the free beer thing.
I remember they had invite codes and managed to stir up quite the excitement globally.
I signed up and didn’t look back. Google drive and office arrived and it really was free beer for individual users.
My account was so old I managed to score a freebie with a custom domain for a while, then it became paid but damn cheap.
The stark reminder?
Google algorithms somehow decided I was a bad actor and threatened to close my account, giving me a limited time to try and sort it out.
I did and then promptly moved to self hosting.
Yes, it’s a PITA to self host email and have files available from all your devices wherever you are, but a price worth paying for sure.
Free beer is not free when it comes to Google or Microsoft or any other cloud provider.
They can close your account instantly and then you are screwed if you were naive or dumb enough not to understand what you were getting into.
I would suggest that this threat is why we should be retaining analogue infrastructure - landline phones and postal services (some countries have axed their letter post and in the UK letter post deliveries can be no more than one or two a week - I got a letter today for a hospital appointment that was two days ago). Resilience means that we can function without [networked/] tech. Schools shouldn't shut because the internet goes off and they can't operate 'safeguarding' or some networked product. We also need to retain cash.
It goes further than not using Windows, but in the case of Windows, I would urge people at the very least to shift to LTSC, local storage and standalone software, avoiding SaaS and the cloud.
Perhaps we should have one day a year when they turn the internet off, as a test to see how we do, without networked tech. [Standalone tech is much harder to turn off.]
It might not find much support here, but one day we might actually be better off if the US did turn our tech off. The products that MS now force on us, AI, Recall et al, and the use of the net for universal state surveillance, are polluting our technosphere. As more becomes controlled, monitored and blocked by our governments, having it turned off may save us from an Orwellian dystopia.
"I would suggest that this threat is why we should be retaining analogue infrastructure - landline phones and postal services (some countries have axed their letter post and in the UK letter post deliveries can be no more than one or two a week - I got a letter today for a hospital appointment that was two days ago)."
That seems to be an NHS speciality. I have had similar, but it's only ever NHS letters which seem to arrive weeks after the date on the letter, not any other letters!
kills rando system features or even the entire box......
Farfetched? There are already software makers who have kill-switches built in to their products. Can't connect to the licensing servers 6x a year? Software refuses to start. Not a large stretch to apply the same to operating systems or IoT devices or cable modems or whatever.......
I'm the IT guy for a 50 person equipment hire firm. I agree that Microsoft constitutes a danger that has grown much more severe over the past decade or so for various reasons. I would love to be able to move my firm to a more reliable environment. I get cold sweats every time patch Tuesday comes around and Microsoft's habit of making random changes to their UX for no appearant reason drives my users crazy.
I can't imagine, however, trying to move the firm away from MS and on to a FOSS environment. My users, from the very top of the org chart down, could never manage the transition. Furthermore, the disruption to our ongoing business would likely put the firm out of business. We don't have either the financial or human resourses to handle the job.
I think the only way to solve this general problem is to break up the big tech monopoly and somehow replace the 'move fast and break things' culture with one of reliability, safety and stability.
I'm not holding my breath.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
