Indian armed forces gives Windows its marching orders, but only for desktop warriors
(2023/08/14)
- Reference: 1692001809
- News link: https://www.theregister.co.uk/2023/08/14/opinion_column_india/
- Source link:
Opinion Indian mythology is rich beyond measure in tales of gods, demons, and humans doing battle. Deception, alliances, betrayal, supernatural weaponry, and devastating consequences tangle with morality and greed. If you think that sounds like today's global technology maelstrom, that's forgivable.
So when the Indian Ministry of Defence announced that it would be ditching Microsoft Windows in favor of "locally developed" open source Maya OS to increase security, it's fair to see this as part of the great cycle of conflict between FOSS and proprietary systems. Such decisions are never purely pragmatic, even though that's frequently the justification, and when policy rather than practicality has the upper hand, the results can be excitingly mixed.
Let's stick to the practical for starters. We all know what Windows is, what it does, and why it has such a special place in our hearts – Maya OS is new. It is also "developed by government agencies within six months [and] is capable of preventing cyber threats and malware attacks," according to [1]reports . It's actually Ubuntu with a Windows-like front end and some extra endpoint security.
[2]
That doesn't seem so bad. Although the system is expected to roll out across the many parts of the Ministry of Defence and armed forces, the migration is staged, with each part going through its own evaluation process. Sane so far. If you look at the rolling news of new vulnerabilities and attacks, then yes, Linux on the desktop is far less malware-y than Redmond's legacy-laden lash-up. If that's because there are fewer targets to attack with a Linux desktop, it doesn't make it not true. That's not the point.
[3]
[4]
The history of migrating from Windows to Linux is not so great. Not so much demons in the details as entire circles of Hell vomiting up squadrons of the beasts. Famously, the administration of Munich signed up to Club Penguin only to come [5]sobbing back to Microsoft . That wasn't because of any technical superiority deep in the guts of the OS, but because the organization needed to use many hundreds of third party line-of-business packages and services that really didn't like Linux. If you spend all your money trying to fix that and fail, it doesn't matter how free and open the alternative is.
That was years ago, and [6]lessons have been learned . Also, the military has a reputation for standing apart from the civilian commercial market – it's prepared to pay to have things work its own way, especially as the strong right hand of the state.
[7]
That's always been a miscomprehension. Sure, the military has a lot of unique features, including weapons-festooned aircraft, ships, and land vehicles exempt from safety standards. Those, and the unfashionably clad people who operate them, are what it's all about. Only they're not: they're the admittedly unorthodox sales, marketing, and distribution departments of a large and ungainly organization. Most of the military spends most of its time doing logistics, budgeting, planning, and general management hoo-ha, much like everyone else. Admittedly, the HR department can shoot employees for missing targets, but it's only the paperwork that's stopped the practice spreading into the bigger consultancies.
[8]Hide and seek in outer space highlights a battle here on Earth
[9]What would sustainable security even look like?
[10]World's most internetty firm tries life off the net, and it's sillier than it seems
[11]Goodbye Azure AD, Entra the drag on your time and money
For any organization with or without guns, it's not the desktop that stops Linux on the desktop. For it to work, you must be prepared to actively drive an ecosystem competitive with the global corporate overlordship of Microsoft. If you don't, you'll fall behind – or you'll end up in the same place as everyone else.
Nor does Linux on the desktop do much to protect data held elsewhere in the infrastructure from phishing, supply chain attacks, criminality, and corruption. You do get extra security, but not much that matters, especially if you're a high-profile target of intense interest to, say, the Chinese defense establishment. Indian policymakers are as bright as any, so they'll know this.
Thus the saga turns from pragmatism to real policy, and that looks very much like flag-flying. Every country has a dose of this, especially in areas like technology and defense, which are prime targets for domestic pride, independence, and state largesse. It so rarely works that way, and history is replete with corpses entombed on beds of burned cash. The UK had ICL, India had ECIL – of which much more can be found on the excellent [12]Asianomics YouTube channel . The temptation is ever there, th ough, especially when a state finds itself dependent on technology from a country it has cooled towards, and 2020s geopolitics has not done much for India and America.
The biggest clue that this is the real motivation behind Maya OS is the official description of it as a native OS developed in six months that prevents malware and viruses. None of that is true, all of it paints a picture of superior local abilities leaping ahead of the rest of the world, in the service of national security.
[13]
There is absolutely a case for using Linux to enhance endpoint security on user platforms. Chromebook provides it — but only when you use it as part of a larger, coherent infrastructure story. If the Indian state decided to take that path as part of a "doing it right top to bottom" with the resources and motivation of a modern state, we could be reading a whole new chapter in the cosmic saga of data and demons.
As it is, the chances are high that we'll have seen this one before – less hit, more myth. ®
Get our [14]Tech Resources
[1] https://organiser.org/2023/08/09/188829/bharat/maya-os-indian-defence-ministry-to-switch-to-indigenous-operating-system-amid-threats/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZNn7UTrihatoY9uoqYW-SAAAAs0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZNn7UTrihatoY9uoqYW-SAAAAs0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZNn7UTrihatoY9uoqYW-SAAAAs0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2017/11/13/munich_committee_says_all_windows_2020/
[6] https://www.theregister.com/2021/11/22/open_source_germany/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZNn7UTrihatoY9uoqYW-SAAAAs0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2023/08/07/opinion_column_voyager/
[9] https://www.theregister.com/2023/07/31/opinion_column_sustainable_infosec/
[10] https://www.theregister.com/2023/07/24/google_air_gap_comment/
[11] https://www.theregister.com/2023/07/17/enra_azure_ad_opinion_column/
[12] https://youtu.be/IZGARNV4Zuo
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZNn7UTrihatoY9uoqYW-SAAAAs0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[14] https://whitepapers.theregister.com/
So when the Indian Ministry of Defence announced that it would be ditching Microsoft Windows in favor of "locally developed" open source Maya OS to increase security, it's fair to see this as part of the great cycle of conflict between FOSS and proprietary systems. Such decisions are never purely pragmatic, even though that's frequently the justification, and when policy rather than practicality has the upper hand, the results can be excitingly mixed.
Let's stick to the practical for starters. We all know what Windows is, what it does, and why it has such a special place in our hearts – Maya OS is new. It is also "developed by government agencies within six months [and] is capable of preventing cyber threats and malware attacks," according to [1]reports . It's actually Ubuntu with a Windows-like front end and some extra endpoint security.
[2]
That doesn't seem so bad. Although the system is expected to roll out across the many parts of the Ministry of Defence and armed forces, the migration is staged, with each part going through its own evaluation process. Sane so far. If you look at the rolling news of new vulnerabilities and attacks, then yes, Linux on the desktop is far less malware-y than Redmond's legacy-laden lash-up. If that's because there are fewer targets to attack with a Linux desktop, it doesn't make it not true. That's not the point.
[3]
[4]
The history of migrating from Windows to Linux is not so great. Not so much demons in the details as entire circles of Hell vomiting up squadrons of the beasts. Famously, the administration of Munich signed up to Club Penguin only to come [5]sobbing back to Microsoft . That wasn't because of any technical superiority deep in the guts of the OS, but because the organization needed to use many hundreds of third party line-of-business packages and services that really didn't like Linux. If you spend all your money trying to fix that and fail, it doesn't matter how free and open the alternative is.
That was years ago, and [6]lessons have been learned . Also, the military has a reputation for standing apart from the civilian commercial market – it's prepared to pay to have things work its own way, especially as the strong right hand of the state.
[7]
That's always been a miscomprehension. Sure, the military has a lot of unique features, including weapons-festooned aircraft, ships, and land vehicles exempt from safety standards. Those, and the unfashionably clad people who operate them, are what it's all about. Only they're not: they're the admittedly unorthodox sales, marketing, and distribution departments of a large and ungainly organization. Most of the military spends most of its time doing logistics, budgeting, planning, and general management hoo-ha, much like everyone else. Admittedly, the HR department can shoot employees for missing targets, but it's only the paperwork that's stopped the practice spreading into the bigger consultancies.
[8]Hide and seek in outer space highlights a battle here on Earth
[9]What would sustainable security even look like?
[10]World's most internetty firm tries life off the net, and it's sillier than it seems
[11]Goodbye Azure AD, Entra the drag on your time and money
For any organization with or without guns, it's not the desktop that stops Linux on the desktop. For it to work, you must be prepared to actively drive an ecosystem competitive with the global corporate overlordship of Microsoft. If you don't, you'll fall behind – or you'll end up in the same place as everyone else.
Nor does Linux on the desktop do much to protect data held elsewhere in the infrastructure from phishing, supply chain attacks, criminality, and corruption. You do get extra security, but not much that matters, especially if you're a high-profile target of intense interest to, say, the Chinese defense establishment. Indian policymakers are as bright as any, so they'll know this.
Thus the saga turns from pragmatism to real policy, and that looks very much like flag-flying. Every country has a dose of this, especially in areas like technology and defense, which are prime targets for domestic pride, independence, and state largesse. It so rarely works that way, and history is replete with corpses entombed on beds of burned cash. The UK had ICL, India had ECIL – of which much more can be found on the excellent [12]Asianomics YouTube channel . The temptation is ever there, th ough, especially when a state finds itself dependent on technology from a country it has cooled towards, and 2020s geopolitics has not done much for India and America.
The biggest clue that this is the real motivation behind Maya OS is the official description of it as a native OS developed in six months that prevents malware and viruses. None of that is true, all of it paints a picture of superior local abilities leaping ahead of the rest of the world, in the service of national security.
[13]
There is absolutely a case for using Linux to enhance endpoint security on user platforms. Chromebook provides it — but only when you use it as part of a larger, coherent infrastructure story. If the Indian state decided to take that path as part of a "doing it right top to bottom" with the resources and motivation of a modern state, we could be reading a whole new chapter in the cosmic saga of data and demons.
As it is, the chances are high that we'll have seen this one before – less hit, more myth. ®
Get our [14]Tech Resources
[1] https://organiser.org/2023/08/09/188829/bharat/maya-os-indian-defence-ministry-to-switch-to-indigenous-operating-system-amid-threats/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZNn7UTrihatoY9uoqYW-SAAAAs0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZNn7UTrihatoY9uoqYW-SAAAAs0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZNn7UTrihatoY9uoqYW-SAAAAs0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2017/11/13/munich_committee_says_all_windows_2020/
[6] https://www.theregister.com/2021/11/22/open_source_germany/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZNn7UTrihatoY9uoqYW-SAAAAs0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2023/08/07/opinion_column_voyager/
[9] https://www.theregister.com/2023/07/31/opinion_column_sustainable_infosec/
[10] https://www.theregister.com/2023/07/24/google_air_gap_comment/
[11] https://www.theregister.com/2023/07/17/enra_azure_ad_opinion_column/
[12] https://youtu.be/IZGARNV4Zuo
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZNn7UTrihatoY9uoqYW-SAAAAs0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[14] https://whitepapers.theregister.com/
If you must drop Windows...
Reginald O.
Seems to me the way to go is MacOS and then staff have an awesome system that plays well with their iPhones and iPads.
I don't know for sure if I am kidding or not.
Can a business create a viable production network using Apple code?
Would it play nice with Windows folks?
What does Apple Inc. use?
I simply don't know.
But, I do know MacOS is Unix based and just really cool for individuals.
Warez
PhilipN
Thanks for the reminder of an expression I have not seen used for a long time.
As to what it actually meant - well what did you want it to mean? That was back when "-ware" was being tacked on to almost any prefix and "-z" was tacked on to anything that was suspect, or fun.
Anonymous Anti-ANC South African Coward
Good luck to the Indians.
They will need it.
All I'm saying is...
I've seen this sort of "mentality" before and it doesn't end well. It's one thing building a secure system, say for example, airgapped up to TS with loads of skilled people with the necessary security clearances, and it is a whole other thing building a system for rabbit holes above that, where security restrictions reduce the knowledge pool and everything is compartmentalised.
6 months will be the POC that someone is crowing about, which is another bad sign. The pen testers are going to be busy.