Air Force Orders Up A Custom Windows Monoculture

Soulfader writes "It seems that the Air Force has not learned from the Navy's folly in single-source mammoth contracts and their attendant problems, and is now working on something similar with Dell and Microsoft. Particularly interesting is the article's assertion that the Air Force is 'fed up' with Microsoft OS problems--but not enough to switch to something else. Instead, they're going to be getting a custom 'solution' of Windows products specially configured for their use. Is this the ever-hoped-for 'good' version of Windows, or more along the line of the sucks-in-new-and-interesting-ways version of Highlander II?"

Comments

What's wrong with OS X?

[sockonafish]

The FBI uses OS X, why won't the military consider it?

And no, it's not because of the don't ask don't tell policy.

Re:What's wrong with OS X?

[Coryoth]

More importantly, what's wrong with a mixed shop based on requirements of the tasks. What's wrong with running Sun for your mission critical servers, NetBSD for your web and mail servers, OS X for basic business/management desktops, Linux for developer and research desktops etc. All of those will play together quite happily. It's only when you try to throw MS Windows into a heterogeneous mix that things start having issues.

Throw out Windows, and everyone else will play nice together. Seems pretty obvious as to who should go in any hetrogeneous environment.

Jedidiah

Re:What's wrong with OS X?

[Linuxathome]

I've always thought that Linux evangelists should advocate the Windows user to buy Macs. If users who switch at all wanted to learn *nix, they could always crack open the terminal application and learn a few commandline commands and shell scripting techniques to make their Mac experience all the more useful and efficient. Then after they become more adept at *nix in general, the migration to Linux is easy (that is, if they want to give up the niceties of Mac OS X :). For example, how many of us Windows users wanted to be able to send email without the need to setup SMTP settings in Outlook or Netscape mail -- thus avoiding the terrible restrictions our ISPs have on email transport? Mac users have it easy, they can easily enable sendmail in their systems, since sendmail is packaged but inactive in the standard Mac OS X system.

Re:What's wrong with OS X?

[sdmacguru]

I think this post is borderline trolling, but I can't be sure. In case it isn't, I wanted to pipe in with some counter-points.
One, the FBI does use Mac OS X. The article referenced by the GP is at http://www.securityfocus.com/cgi-bin/sfonline/colu mnists-item.pl?id=215. It is anecdotal, but unsurprisingly, the FBI doesn't seem to publish an official document detailing which OS's they operate and in what numbers.
Two, it doesn't matter how many el-cheapo Intel boxes you can get at Fry's from the bargain bin: what matters is how many can an institutional buyer like the Air Force get. Yeah, I think they can get a pretty good price on Macintoshes by agreeing to buy truckloads of them.
Three, the initial cost is far from the largest factor in the lifetime cost of a PC to the military. Focusing on purchase cost of a commodity good is really a case of diminishing returns. TCO is the place you want to focus.
Four, to get that large a price-differential on initial cost, you must be comparing bargain bin boxes with a Mac, or a 'typical' Dell box with the absolute highest-end Mac workstation possible. If you go apples-to-apples, feature-to-feature, you find that the price differntial between a Mac suitable for general purpose computing (iMac) and an Intel-based box from a major vendor like Dell or HP to be very small, under %10, plus/minus %15. Yeah, sometimes the Mac is cheaper.
Five, that security dig at the end of your post really sets the troll-tone for the whole message. Market share isn't installed base, please go do some research on that point. It is one of the most commonly misconstrued pieces of data that appears in technical columns. Security isn't synonymous with a lack of viruses, either, it goes well beyond that.
Lastly, cost, security and viruses are all tangential to the main question: which platform is going to actually perform with the necessary functionality, with the necessary uptime and meeting all other requirements? It may not be Mac OS X, but I really doubt its going to be Windows.
You know, I'm reading your message again, and now I'm sure: IHBT. You aren't advocating anything in your post and don't have any references to back up anything you do say. You assure us that Max (sic) would have their fair share of viruses if they had a larger market share, by which I must assume you mean installed base, but without any evidence to support the assurance. Has there been even a proof-of-concept virus for OS X? Not root kits, and not some kind of honor system virus ('Please email this shell script to all your friends and ask them to run it as root. Thank you!'), but an actual auto-execute and auto-propogate virus?
No.
Could it happen? You betcha, but the fact that it hasn't after this many years tells me that it is far from easy.
I'll assure you of this: so long as Windows is so easy to target with viruses that kids in VB classes do it for class projects, there won't be a virus issue on Mac OS X or Linux. Why would there be, when there is such a susceptible population of machines available? Even when Windows installed base drops to 30%, it will still have the majority of viruses. Why? Because its just too damn easy.
Stick that in your troll-pipe and smoke it.

Re:What's wrong with OS X?

[hunterx11]

Great, just what the internet needs. Thousands of Joe Users attempting to run mail servers on their desktop machines.

Unfortunately, Joe User already runs a mail server because his box was owned by a spammer.

Our tax dollars hard(ly) at work.

[yoder]

Doesn't say much for Air Force Procurement. I wonder (silently to myself) how much money changed hands and who was promised what job at Microsoft when he/she retires from the Air Force.

Re:Our tax dollars hard(ly) at work.

[bm17]

I have had some experience with military procurement. It is scary and has nothing to do with logic. The people who do the purchasing are not in the military. They are career civilians. The military officers who oversee them only spend a few years in that capacity before moving on to other posts. They have no real opportunity to institute reforms even they are the ones affected by the purchases. The civilian purchasers develop (I believe) unethical reletionships certain prefered vendors. I've also seen a tendency for government emplyees to avoid taking responsibility for anything. I assume that this has something to do with the way blame is passed around. Furthermore (and possibly due to responsibility avoidance) the military generates a huge amount of rules that must be followed to the letter. This is done mindlessly. If at some point there was an incident involving a Delrin part, then Delrin might be banned from all future milspec parts. The amount of money that an item costs means nothing compared to the need to satisfy paperwork. And speaking of paperwork I doubt that and Linux distributor can hold a candle to Microsoft when it comes to filling out the endless reams of paperwork required to contract with the military. It's just insane. And you have to know all of the bizzare customs they have. So, in short, don't expect military procurement to make any sort of sense until such time as the entire system is overhauled.

Actually, Windows can be quite stable...

[jarich]

I've found at work and at home that Windows (since late NT4) can be quite stable ~if~ you don't install tons of junk software.

I've had to put my 6 year old on her own machine because her kiddy games makes Windows unstable, but my wife and myself both run tons of "mainstream" software, ranging from Doom to UT to banking software to Eclipse to video editing software.

My machine doesn't lock up and it doesn't crash and neither does hers.

If the Navy gets a cut of Windows with all the games cut out and they remove the ability for the field user to install the junk apps, they might have something very useful (in a work environment... not for home users)

Re:Actually, Windows can be quite stable...

[Foolhardy]

Non-root users and software can't screw up your system (short of using a root exploit, and that generally requires malicious intent) so as soon as your child is done, (s)he logs out, you log in, and all your stuff is as you left it.

On Windows (NT based) non-admin users and software can't screw up your system (short of kernel exploit), so create seperate (non-admin) accounts for your users. Each will have a seperate profile insulated from all the others. If you have some crappy software that requires admin just to run, make a SU -C file (it's like what setuid does) for it.

Almost no malware can install without admin priviliges (even then only for that one user). Normal users can't infect the system with a virus. Still, you may want to install Firefox anyways, for its other benefits.

Re:Actually, Windows can be quite stable...

[Foolhardy]

with the IE api hooks into the kernel

What are you talking about? Internet explorer is a 100% user mode shell environment. It is not, has never been, and never will be integrated into the kernel, or given special hooks or privileges. All of the entry points into the kernel are exported by ntdll.dll. Tell me which of those functions hooks IE into the kernel.
The objects you would need to control to take over the system are kernel objects which IE plays no part in managing.
Since the Win32 server moved into kernel mode (in NT4), it has its own system function table, and none of those functions are a part of IE either.

Show me ONE malware program that can install itself for all users when only a normal user runs it.

This is the Government....

[Anonymous Coward]

Hey, contractors.... I have a job that needs to be done.

I also have $1,000,000,000 to throw at the problem. Any contractors that have the ability to accept and be responsible for receiving a pre-payment, please step forward.

Sorry, only top tier contractors will be accepted.
Oh, Sorry again. Because of a new requirement added by Congress, only the largest company in this industry will be allowed to submit a bid. And only one bid will be accepted. We don't have time to evaluate other solutions.

Good to see some honesty in government

[Nine Tenths of The W]

I'm glad Microsoft are getting the full value of their PAC contributions, I'd hate to think our government was dishonest

To you naysayers

[mordors9]

Go back and reread it.... this is a custom "solution". You just can't go wrong with one of those.

They never learn...!

[bogaboga]

One would easily think that the US, being a very old democracy/civilization, would be wise enough not to fall into such traps. But alas, they never learn!

This confirms to me that the US will be behind the world in a few decades. I am also very sure that portions of this custom Windows will be outsourced. The Russians will get some insight to what runs the so called "greatest military machinery" in the world.

Question is: Why are the American bureucrats making mistakes such as these?

Short answer: Some official's hands must have been greased for this deal to get a "seal of approval."

Before Slashdotters mode me unfairly, I'd like to mention that it has always been the case that whenever obvious mistakes have been made, one's hands have always been found as having been greased. Numerous inquiries have shown this.

Yes, it's the new verion of Windows That Doesn't..

[AugstWest]

...Suck, and it's brought to you by the new Halliburton That Doesn't Screw America.

Thanks for playing.

Was mentioned on CNET and ZDNET on 11/19/2004

[antdude]

CNET News.com and ZDNet.

"The Air Force is consolidating its 38 software contracts and nine support contracts with Microsoft into two all-encompassing, agencywide agreements, according to a statement seen by CNET News.com.

The contract, done in conjunction with Dell, will call for the installation and configuration of software as well as ongoing maintenance and upgrades. The deal, which includes 525,000 licenses of Microsoft's Windows and Office, is valued at $500 million over six years, according to Microsoft."

Posted this on my AQFL Web site and even submitted to /. (rejected) on 11/19/2004.

Re:WTF?

[Coryoth]

It's worth noting that massive amount of Air Force computing needs are not "critical shit". There are an awful lot of desktop machines running basic office apps to fill in reports in triplicate, make requisititons, do accounting, and all the other "needs" of any bureaucratic system.

That such problems can't be readily addressed by a nice locked down desktop distro (anything from Novell desktop 9 to Sun's Java Desktop) using OpenOffice and the like, well that's certainly up for debate. When the claim to be fed up with MS it is a little odd that they didn't even bother to evaluate the competition.

For all those out there who will say "But Linux isn't good enough on the desktop", or "OpenOffice is no replacement for MS Office", I would point out that both Linux and OpenOffice can be perfectly serviceable in some situations; Why didn't the Air Force at least evaluate these products to see if their situation was one in which they would work?

Jedidiah.

Sorry. =)

[Soulfader]

Guess you should have made fun of Highlander II. =)

SELinux?

[nocotigo]

Why the hell did the U.S. government even bother with SELinux if they won't use it?

Re:SELinux?

[Coryoth]

Head over the the NSA and read some of their papers about SELinux, and what it was intended for. It was not intended to be the ultimate secure OS. If you read between the lines, its mre like a bunch of NSA people got so pissed off with the current complete lack of security in commercially available OSs, so grabbed Linux and hacked in Mandatory Access Controls without any real difficulty and turned it back to the community as a demonstration to say "See, it isn't so damn hard to make things a lot more secure".

I wouldn't make any bets as to whether the NSA themselves make a lot of use of SELinux. They won't really tell you what they use. They do certainly know alot about writing secure OS code though, considering how fast they managed to put SELinux together.

Random fact: The NSA web site has never been hacked or defaced. The CIA, FBI, the White House etc. have all been hacked, even if it is rarely and briefly. The NSA... never. You can't tell me it's for lack of trying.

Jedidiah.

Re:SELinux?

[moosesocks]

Wow. If the design of their website doesn't give you a 'Big-brother' impression, nothing will.

Seriously... are they GLOATING at the fact that they're an agency which literally nobody knows what they're doing.

Heck, I remember reading somewhere that during WWII, the mere existance of the British equivilant to the NSA was known of by somewhere along the liens of two or three people outside of the agency itself -- Churchill was one of them.

Re:WTF?

[Anonymous Coward]

First of all, it's highly doubtful they are starting with no desktop computing infrastructure. If they have any inhouse applicaitons that run on Windows, that pretty much puts the ball in Microsoft's court.

Second, I imagine that such decisionmaking processes take years to complete. If they started in 2001, those fairly recent Linux desktop distros were not available. Face it, Desktop Linux faces a long long haul among large shops, and hasn't proven shit yet.

Finally, the AirForce is doing exactly what 99% of corporate America has done -- standardize on Windows desktops. I'm always puzzled why slashdot feels that government should lead the way with speculative IT projects. It makes more sense to save the taxpayer's money and stick with the known factor.

Highlander II? There was no Highlander II

[voisine]

Highlander II? What are you talking about? There was no Highlander II. Even the writer and director of Highlander III admited there was never a Highlander II.

Re:Poor Highlander II

[Coryoth]

Man, I didn't like Highlander 2 as much as the next guy, but the article summary was kick in the nuts out of nowhere. Isn't there a statute of limitations on crappy movies? Does a time ever come when we can forgive them?

There is no reason to forgive it. I am quite positive they never made any sequels to Highlander.

Please don't ruin my carefully crafted delusions.

Jedidiah.

Re:WTF?

[The Snowman]

It's worth noting that massive amount of Air Force computing needs are not "critical shit". There are an awful lot of desktop machines running basic office apps to fill in reports in triplicate, make requisititons, do accounting, and all the other "needs" of any bureaucratic system.

Of course there are a lot of desktop apps too, but the Air Force does run a lot of critical shit. However, most of those servers run some form of Unix or a mainframe OS. Some run Windows, but those are not the big ones that need lots of speed and runs millions of database transactions per day.

The Air Force is Microsoft's single largest customer, according to the speech Ballmer gave to us about a year ago. It is no wonder that the only way not to have a Windows desktop is to be a developer for a Unix system. As a whole, the Air Force is dead set on having a single sign-on web-based portal system (ASP), using Active Directory to run all the communications.

Not only are they moving toward locking the whole Air Force into proprietary Microsoft technology, they are consolidating services into a single point of failure. If a terrorist could take out a single data center, they could essentially take out the whole Air Force. Yeah, the planes might be able to fly, but where would the generals get their information? How would mechanics keep track of what needs to be done to the thousands of fighter jets, making sure that routine maintenance is done on time? Military hardware takes a beating, and computers track all that stuff. One dirty bomb. One pickup truck full of fertilizer. It could disable "the greatest air force on earth."

No, I will not say which datacenter I am talking about, I do not want Ashcroft's goons to drag me away to Guantanamo ;-)

uh ya

[tacokill]

uhh, yea it is for lack of trying. Who the hell in their right mind would want to show up on THIER radar?

:-)

Re:Such BS

[Anonymous Coward]

The cost of software isn't the only factor - management and maintenance of the software costs way more than initial aquisition cost.

Linux, quite simply, blows in a managed environment.

Active Directory Group Policies, WMI, systems management server (inventory, software distribution, remote control), Operating System Deployment Feature Pack, MOM for the servers... management tools.

Oh, and they all work together, with relative ease.

I'm by no means an MS aplogist, but the Linux crowd has a long way to go before I can take them seriously enough to deploy on the 2500 desktops I am responsible for - and the 20K desktops that are in our entire enterprise.

Linux works great on the server - we have 'em all over. But it would be more practical for us to switch to Mac OSX than Linux on the desktop. And that ain't gonna happen either as we have really good pricing (as does the Air Force and Navy) via our enterprise agreements. All that stuff I quoted above - bundled in as part of our EA - the whole package. It really does work well together and makes managing my 2500 desktops quite nice.

Set up in a managed enterprise environment, windows is a stable and capable performer with lower cost of integration than any other platform out there. Might change someday, but not today.

So, when the armchair slashdot quarterbacks out there are really responsible for 2500 desktops and have their job hinging on their ability to carry out the organizations core mission instead of half baked IT experiments, then I'll be listening. Show me the tools, show me they work and I'll consider it - I enjoy the hell out of tweaking our MS sales rep - I would love nothing more than to have a real stick to hit him with instead of a bunch of trash talking on an "advocacy" web site...

automated updates???

[lkcl]

AUTOMATED UPDATES???????

*gibber*. the US military is happy for _microsoft_ to push automated updates onto 500,000 windows desktops???

what did i miss. is there something i haven't quite understood?

Re:WTF?

[shufler]

They think this because the government has lead the way with speculative projects in general. Most citizens and companies don't have close to the amount of money the government has to spend on figuring shit out. That said, in a way, the government is where citizens can pool their money together and tackle huge projects.

The trouble is (just like in corporate environments), people don't give a shit what sort of system is used, as long as in the end, it works.

Now, most of the people on slasdot do care, because this is the sort of shit we live for. I'm sure the government gets a similar deal to what the piraters get (close to, or free), only they don't have to download ISOs, but rather get CDs shipped to them. This fact removes the "Linux is cheaper" stigma that most people will shout whenever someone dares to consider Windows as a solution. Support contracs probably come cheap too, or whatever.

As you mentioned, they'll standardize on Windows, since chances are, the majority of outside contacts use this as well. Plus, it sounds like they already use Windows on their desktops, which means they are giving Microsoft the ultimatum: Give us a working system, or we walk. Even with all those potentially cheap licenses and support contracts, it's probably a very large chunk of change, something that ideall Microsoft wouldn't want to lose. The Air Force is probably banking on the idea that Microsoft will get it's shit together and deliever a wicked fucking system.

This also gives them a choice to see how alternatives have come along during this do or die period of time.

Re:Yet another uninformed piece of blather

[The Snowman]

Blah, blah, blah. You talk a good line of shit, but, alas, that's all it is: shit. You have no idea how the military's tactical computer systems work or you wouldn't have spewed that odiferous blather. Give your anti-Microsoft zealotry a break and quit making up stuff in order to sound like you know what you're talking about. I know that you don't and you know that you don't.

You may be a troll, but I'll bite. First of all, I am not anti-Microsoft, I am anti-monoculture. If the Air Force picked Red Hat as the desktop OS of choice, I would object. Same with MacOS, FreeBSD, Solaris, whatever. Diversity is key.

"The military" is a broad term. I have been working in Air Force IT for over four years now, developing database applications deployed world-wide for a variety of tasks from maintenance to intelligence. Notice I make no claims about the Army, Marines or Navy. Only the Air Force, where I know first hand how things work. I know how the pieces of the IT puzzle fit together, and I am upset by what I see. All of these critical database systems that handle the Air Force's data are consolidated in a few locations. Yes, a single truck bomb could severely cripple the Air Force. If you are so smart, you tell me where to detonate it.

Re:WTF?

[The Snowman]

The military plans so that there is no single point of failure.

Yes, in some ways, but in others they do not. I don't know about the other branches, but the Air Force is pushing for consolidated IT. For example, the application I currently work on runs on a server in a building with about 500 other applications. Not all are critical to day to day or combat operations, but enough are that a single terrorist incident could cause catastrophic loss of mission capability. Sure, we would be able to fix it, but it would take long enough that terrorists or foreign governments could attack in the window of opportunity and have better chances of succeeding.

Couple that with the fact that countries such as China are training teams of hackers to wage computer warfare, and maybe terrorists don't even need to detonate a car bomb to take our systems out.

The military have a joke that if someone took out the Pentagon they would be doing them a failure by eliminating a lot of red tape. They won't relly completely on anything. Datacenter get destroyed and they will work around it.

That is a different thing altogether. If the command and control was taken out, we have backup plans (e.g. NORAD) to take command. Besides, most mission critical systems are not located in Washington, D.C. There are a few data centers scattered around the nation, and any backup command center would still use the same data centers. That was my point, although I agree with what you said.

Windows and the Air Force

[vwgtiturbo]

I just got out of the AF after 8 years of Avionics maintenance, and this is actually what the Air Force needs. For about the year or so before I got out, they bought an INSANE amount of Dell systems. We were running PII 350s, and 450s through 2001 or 2002 (If you were an officer, you were lucky, and had a 1.5Ghz system, but not us enlisted folks). Talk about frustrating... There is actually a lot more computer work done that just the accounting and forms that you think... everything from documentation of maintenance actions to a database, to doing the usual forms, troop performance reports, etc. Anyways, the AF has a HORRIBLE track record with software. They changed the personnel information system to a new, fangle-dangle thing, hailing it as a new wave. Unfortunately, by the time it was implemented, it was outdated, and never tested. Troops spent anywhere from 6 months to a year and a half getting paid at a lower rate, because the system wouldn't register their promotions (just one example of the poor quality of this system). If you had ever worked around the AF 'Small Computers' shop, you would know that they CANNOT handle Linux, or anything other than Windows. These people are MORONS. It got to the point that when one of my workcenter's 6 systems failed, I ended up formatting it and reinstalling Win because when the system was unrecoverable, they would rather spend 5 days running Norton AV than spending 1 hour reinstalling the OS. They always thought a virus was involved for some reason (that tells you about the quality and security of the networks, I suppose). In any case, I witnessed the incompetence first-hand, and think that, although Win sucks, the AF can't handle anything less user-friendly.

Re:Such BS

[Aadain2001]

Well, where I have worked had several hundred Linux desktops rolled out to several hundred engineers (and not the kind that know how to use computers, only custom applications) and it was support by just a few people with no problems. OpenLDAP, Samba, NFS, NIS, etc, etc, are all free, open, configurable, and time tested approaches to managing large numbers of files/computers/users. Have I personally done this? No, but I talked with the guys that did and they had more problems from all the Windows boxes on the network spewing viruses than they ever had with the Linux boxes (the Windows boxes were managed by the Windows guys, different group). Oh, and they managed over 3,000 Linux servers with very little effert. They could drop a new rack of 40 in place and have it running in a day (usually before lunch). The biggest problems with running Linux in large numbers is that you need to know what you are doing (and not try to integrate with an existing Windows network/server design. Windows doesn't play well with others).

The US Navy has a great saying...

[Nick Driver]

"There are a lot more airplanes at the bottom of the ocean than there are submarines in the sky"