17 ms·
Chinese military to replace Windows OS amid fears of US hacking
- nemild 7y agoI'm surprised that "security by obscurity" is touted as a way reduce attacks. This is almost guaranteed to lead to less diligence in the code — and more risks. https://en.wikipedia.org/wiki/Security_through_obscurity https://en.wikipedia.org/wiki/Security_through_obscurity
- duxup 7y agoIndeed. I wonder how much that has to do with human nature thinking "well this is obscure" so then they don't secure it as if it was 'customer facing' or less 'obscure'.... and thus leave it more open than ever. I knew a place that assumed such things, crazy insecure. They also played the "well this shouldn't be exposed to the internet" game as well.
- MentallyRetired 7y agoIt's closed source, though. The whole codebase is obscure to them. Using it would be obscurity.
- sdinsn 7y agoObscurity isn't supposed to replace security, it just aids it. Note that the US government heavily practices this, with 'Suite A' cryptography. Most other governments have similar practices.
- 781 7y agoQuote from the same page: > In recent years, security through obscurity has gained support as a methodology in cybersecurity through Moving Target Defense and cyber deception.[9] NIST's cyber resiliency framework, 800-160 Volume 2, recommends the usage of security through obscurity as a complementary part of a resilient and secure computing environment.
- duxup 7y agoI'm a bit surprised they run it at all.
- tracker1 7y ago"Chinese military won't move to Linux, but develop a custom OS instead ... it is a Linux distro ..." F*cking morons.
- NikkiA 7y agoThat's talking about RedStar OS, North Korea's linux distro.
- SmokeGS 7y agoStill
- logfromblammo 7y agoRed Flag Linux was China's distro.
- pkaye 7y agoThe meaning of a "custom OS" has changed a lot these days. It basically means a respin of an existing Linux distribution.
- duxup 7y agoYeah that's how I read that term as well now. It's just linux in some form.
- sametmax 7y agoIf they don't use Linux, I wonder how long it will take them to have something productive for the average worker. I mean, Android took a decade to be usable, was built by one of the most talented and rich company on earth. Yet it is still limited in what it allows you to do: no office suite, limited driver support, weak multi-monitor, can use few FS formats, no RAID, etc. And that is despite Android actually wrapping a Linux Kernel. Not to mentions they'll need to get so many basic tools ported. No matter the high competence of the Chinese tech scene, their ability to brutally push an agenda and the number they can throw at it, I can't imagine a scenario where those resources wouldn't be better spent validating and customizing an existing distro. However, I can imagine many reasons they would choose the harder road. And as a geek, I find it sane to remind myself that technical efficiency is not the goal of all entities.
- PhasmaFelis 7y ago> no office suite I'm nitpicking, I know, but do Google Docs/Sheets/Slides count? They're clearly inferior to MS Office, but they do exist.
- Bakary 7y agoI wonder what happened with Ubuntu Kylin. It seems they were on that path already.
- PatrolX 7y agoHuawei happened. Downloading from: https://mirrors.huaweicloud.com/ https://mirrors.huaweicloud.com/ Download cancelled.
- exabrial 7y agoI mean... every country should.
- notimetorelax 7y agoI read somewhere that Soviet Union fell because it spent all its funds on projects like this. I wonder if this is beginning of the end or if they will be able to pull this off? It might be a good sales pitch for “US-hardened equipment”.
- JamesBarney 7y agoChinese is in a much different place economically than the Soviet Union was.
- notimetorelax 7y agoWith the cheap labor coming from rural areas it has similarities with USSR in 50 and 60s. Found some research on the topic: http://www.centrosraffa.org/public/bb6ba675-6bef-4182-bb89-339ae1f7e792.pdf http://www.centrosraffa.org/public/bb6ba675-6bef-4182-bb89-3...
- trufflepig 7y agoi don’t think big-O cares about a couple orders constant
- pjc50 7y agoI'll just point out that "replace foreign vendors with domestic for security reasons" is exactly what the US is trying to do to Huawei. I think the US and China are equally capable of succeeding at this kind of project..
- Cyberdog 7y agoI'd say the Chinese are more capable of this than the US, if for no other reason than that's the place where almost all hardware and hardware components are already made.
- deehouie 7y agoThe implicit assumption in most HN discussion is, if the US's doing it, it's fine and good. On the other hand, if China tries, it's doomed to fail.
- siffland 7y agoI would not be suprised if it is an offshoot of FreeBSD. That way they could get away from the GPL license altogether and wont violate any licensing agreements. If they based it off Linux, unless it was avalible to download online, it would probably infringe on the GPL somewhere. Assuming they care about those things.
- deleted 7y ago[deleted]
- adriantam 7y agoif they moved that way, why they would care about GPL violation?
- kazinator 7y agoBecause each of their copy of Windows is properly licensed now, and they wouldn't want to blemish their saintly compliance record when they switch to something else.
- tombert 7y agoI could be wrong, but I thought the GPL basically said "anyone who has access to the binary must have access to the source code". This is why you're allowed to write a webserver with GPL libraries without having to worry about releasing the code to the users (unless it's AGPL), since the users don't have access to the binary, just the stuff that the binary is producing. If that were the case, I think they'd be in the clear legally to use Linux as long as they offered to provide the source code to anyone in the military who had access to the binary, which wouldn't be the general public. That said, just to avoid the headache, I'd probably choose FreeBSD as well if I were in charge of the Chinese military.
- kazinator 7y agoBecause China and especially their military cares deeply about foreign software licenses? > unless it was avalible to download online, it would probably infringe on the GPL somewhere. The GPL does not mandate redistribution; it imposes conditions on redistribution, if/when redistribution happens. Good luck imposing conditions on what China does "in-house" with some pieces of freeware.
- tantalor 7y agoIs this news from 2002?
- ConfusedDog 7y agoIdeally for improving security, they should invest on supporting open source software, hardware and standards. Open Design Principle is much better long term strategy than Security by Obscurity. But for developers in China, there are a lot of obstacles with contributing to open source communities worldwide, so I can see that probably not going to happen. End of the day, policymakers are more educated with economics than cybersecurity and computer science. They probably still gonna use Microsoft products.
- duxup 7y ago>They probably still gonna use Microsoft products. Even if they did get rid of most MS products. Some senior guy probabbly fires up windows and installs a dozen search bars. I knew a guy who served in the gulf, he was pretty high ranking, handled some security stuff. Got a request from someone important to basically break all the rules because important guy didn't want to walk too far from his CHU to make a call home.... but he was high enough ranking so they did it. It wasn't even a far walk.
- panpanna 7y ago> Some senior guy probabbly fires up windows and installs a dozen search bars. A "security expert" at a F500 once showed my a web page on his laptop. Only 40% of the page was visible due to his 7-8 search bars.
- hutzlibu 7y ago"Open Design Principle is much better long term strategy than Security by Obscurity." Better would be both. You have a strong, open base, like Linux, but you modify it, so you habe a second level of defence.
- andreime 7y agoThis approach ends up blocking you from receiving updates due to do incompatibilities between your changes and upstream so it's not a great solution.
- deleted 7y ago[deleted]
- Manjuuu 7y agoThey could just license Red Star OS.
- UberofXplsgo 7y agoActually North Korea isn't currently allowed to have exports so that would be an illegal transaction
- unicornfinder 7y agoIt's certainly an interesting OS. Reading up on it it supposedly tags all files it comes into contact with.
- anonlastname 7y agoRewriting the whole OS sounds like a really bad idea
- bradhe 7y ago> Beijing officials have decided to develop a custom operating system that will replace the Windows OS on computers used by the Chinese military. Okay. Good luck with that.
- lostmsu 7y agoI wonder if they will use ReactOS. It is Windows-compatible.
- craftyguy 7y agoYou act like it is hard to run an OS on a computer that is not windows (hint: it is not.)
- bradhe 7y agoCreating a custom OS from scratch that's somehow more secure than a system that's 40 years old will be a real interesting feat. If they base it on Linux (didn't see evidence of that but didn't get that far in to the article) then that'll give them some head start.
- craftyguy 7y agoWho said they were creating one from scratch?
- O1111OOO 7y agoFood for thought... I strongly suspect that this new OS will be coming from Huawei. It makes sense that a Chinese company develops an OS for their own government. We are in the spyware era, afterall. I wouldn't be surprised to hear, years later, that Huawei's "backup" effort was never to replace Android on consumer devices but to fork it for Chinese government use. It's too convenient an excuse to have so much work done on so many doomsday scenarios. Huawei, I think, was already tasked for the new OS(es) by China. Similarly, their efforts to replace Windows[0] was to provide their government with a "homegrown" OS solution. Not unlike Sailfish in Russia[1]. As much as I like the idea of a new OS competing on the world stage, preferably based on Open Source... it's simply not going to happen coming from either Huawei or China. Control of data is the the overriding motivator among nearly every tech firm and government. When these transitions take place (gov and Huawei consumer), I might as well be running RedStar OS or a US-based commercial alternative. [0] https://www.scmp.com/tech/big-tech/article/3011660/microsoft-said-stop-accepting-new-orders-huawei-it-moves-comply-us https://www.scmp.com/tech/big-tech/article/3011660/microsoft... [1] https://nokiamob.net/2019/02/09/sailfish-os-is-now-aurora-os-in-russia/ https://nokiamob.net/2019/02/09/sailfish-os-is-now-aurora-os...
- powerapple 7y agoHuawei is not developing desktop OS. It has been developing a mobile/IoT OS. And I don't think anyone would develop a OS from scratch given the obvious option Linux.
- RyanAF7 7y agoLot of the comments seem to miss the point. It's for the military, not consumers. It won't need driver support or features like a consumer OS. The more foreign the layout probably the better as you can train new habits more easily when the environment for old ones doesn't exist. Have a feeling the end result will be the same, "We built it!" spy leaks code hacked
- bigato 7y agoI am surprised that some comments state that it "has to be linux". Since they can't magically reduce the time it would take to develop something that complex nowhere near their time constraints, it obviously has to start with something that already exists. But Linux is not the only open source OS out there, folks. If I were charged with this task, i'd start with OpenBSD, given its focus on security. The fact that most of base is BSD licensed also helps because no changes would be legally required to be opensourced. It also can run modern web browsers and libreoffice, which is a significant part of what goes for "desktop" computing these days.
- Junk_Collector 7y agoWhy would a Chinese Linux derivative need be open source? It's not like you're going to go into China and force the government to comply with your license.
- bigato 7y agoIt would be legally required to be opensource, whereas with BSD it wouldn't. That's all I argued. Whether some country will try to enforce it via whatever means is another question altogether.