Indian Military Organization To Develop Its Own OS

An anonymous reader writes "Several newspapers have reported that DRDO (the defence R&D organization of the Indian military) is planning to create an OS. The need for this arose due to the cyber security concerns facing India and that all [conventional] operating systems are made outside India. About 50 professionals in Bangalore and New Delhi are expected to start work on this operating system." At least one of the linked articles says the new OS, though home-grown, would run Windows software.

Comments

I hope they name it CURRY

[PatPending]

I hope they name it CURRY

Re:I hope they name it CURRY

[jfengel]

Only if they write it in Haskell.

Re:I hope they name it CURRY

[WrongSizeGlass]

Would that mean they'd need to call for 'take out' instead of 'tech support'?

Re:I hope they name it CURRY

[syousef]

The same article links to an actual programming language called Curry based on Haskell.

http://en.wikipedia.org/wiki/Curry_programming_language

Re:I hope they name it CURRY

[jfengel]

Yep, but Haskell came first, and has broader name recognition (and so I thought it made the joke best). And Haskell apparently some real-world uses, which means it must have gotten a LOT better since I first beta-tested it, back when it was compiled into Common Lisp.

Huge fan of it, actually. I don't get to work in it but my coding style was heavily influenced by the things I learned coding in Haskell. My main fondness: by the time you got the damn thing to compile, the program would generally work. Aggravating at the time, but it made me really respect how much work the compiler could do in spotting bugs if your language is REALLY bondage-and-discipline strong typing.

The LP features of Curry won't endear it to anybody who didn't already grok Haskell, but they're certainly a neat addition, and a lot more than syntactic sugar.

Re:I hope they name it CURRY

[aaarrrgggh]

Further irony is that there is a Haskell (American) Indian Nation...

Re:I hope they name it CURRY

[jfengel]

Actually, a Haskell Indian Nations University, named after a guy named (Dudley) Haskell, a white guy tangentially involved in its creation. But the irony is still appreciated.

Re:I hope they name it CURRY

[Anonymous Coward]

That would actually make more sense if it were being made by the UK government. >.>

Re:I hope they name it CURRY

[znerk]

Would that mean they'd need to call for 'take out' instead of 'tech support'?

No, sorry, tech support is in the call center on the next block. Thank you for calling, my name is Steve, I am in Detroit.

Re:I hope they name it CURRY

[BluBrick]

No, sorry, tech support is in the call center on the next block. Thank you for calling, my name is Steve, I am in Detroit.

Thank you Sanjeet, please do the needful and revert immediately.

Re:I hope they name it CURRY

[Anonymous Coward]

please do the needful and provide me with the same - wow I wish my work would hire fscking americans.

Re:I hope they name it CURRY

[Anonymous Coward]

Hilarious ... I looked up an old quote that your comment reminded me of, only to discover it was you that posted it more than 2 years ago! :-)

"Please do the needful. The customer is on fire."

How does it feel to have written something that's been rattling around in a total stranger's head for more than 2 years?

Re:I hope they name it CURRY

[DarthVain]

Caustic Curry?

Who can be trusted?

[Anonymous Coward]

I've always wondered about this. If I was a government I wouldn't trust any piece of software from the outside. Even stuff produced internally would need a lot of checks. Binary blobs from other countries would be totally banned. At least for all sensitive work. Who can be trusted?

Re:Who can be trusted?

[JSBiff]

Don't use Binary Blobs, I agree, absolutely, if you care at all about your Sovereignty. Get the source tree for an already very well secured OS like, say, OpenBSD, or perhaps Linux (though OBSD is, I believe, generally developed with practices that encourage better security - less focus on feature, more on audits and exploit finding/fixing). Have your 'trusted' developers from your nation go over every line of code, to make sure no trojans/backdoors/intentional exploits were added, then build it all yourself.

Of course, there is still always the possibility you have a hacked C compiler. Man, I can't remember the name of it now, but sometime in, I think it was the 80's, someone made a pretty famous presentation/paper about putting a self-perpetuating trojan into a compiler. You could give the compiler source code, and the binary of the compiler to the 'mark', but you could completely remove the exploit from the source code, as long as the exploit was coded to compile itself into subsequent builds of the compiler; that is, the binary was infected, but the source was not, but it didn't matter since the infected binary could build a copy of itself into the next build of the compiler. The exploit could then additionally do something like whenever it built other binaries or libraries, add some exploit code to them as well.

I suppose you need your own people to do a dis-assembly of the compiler to verify that. Or, build your own assembler in machine language, then build your own compiler with your assembler. Once you've done that, if you have a trusted compiler, and verified source code, you don't really lose security by using Open Source. If anything, it'll *probably* be more secure, if it's popular enough to have a lot of devs analyzing it and fixing problems.

Re:Who can be trusted?

[simcop2387]

Of course, there is still always the possibility you have a hacked C compiler. Man, I can't remember the name of it now, but sometime in, I think it was the 80's, someone made a pretty famous presentation/paper about putting a self-perpetuating trojan into a compiler. You could give the compiler source code, and the binary of the compiler to the 'mark', but you could completely remove the exploit from the source code, as long as the exploit was coded to compile itself into subsequent builds of the compiler; that is, the binary was infected, but the source was not, but it didn't matter since the infected binary could build a copy of itself into the next build of the compiler. The exploit could then additionally do something like whenever it built other binaries or libraries, add some exploit code to them as well.

That would be Ken Thompson.

Re:Who can be trusted?

[bsDaemon]

It was Ken Thompson, the man himself, that you're referring to. The talk in question can be found here: http://cm.bell-labs.com/who/ken/trust.html

Re:Who can be trusted?

[Anonymous Coward]

You're thinking of the "trusting trust" attack, where a compiler is compromised, and passes malware onto some important system program, or onto itself, when asked to compile the source code for each.

Re:Who can be trusted?

[Logic Worshipper]

What the fuck? A government checking the code it runs on computers with sensitive data is "national socialist"? You think the United States government doesn't do this on CIA and DOD computers? Or are you a nut against building roads?

We're talking about doing this only for government computers used for sensitive government data.

Re:Who can be trusted?

[Anonymous Coward]

In reality, you don't need to have the whole OS trusted. You need some things trusted:

The boot path. You want a TPM-like chip that can take you from power on to login screen with a chain of custody ensuring that nothing can be tampered with without being detected. With encryption that mounts the data volumes only after the system volumes and the kernel are vetted, tampering can only deny access, nothing else.

Signed executables for stuff that matters. The signing system would require each signature actually be multiple signings, but with different algorithms. This way, if someone TWIRLS RSA into linear time for factoring, DSS will allow validation or not.

The hypervisor or jailer. You can have nontrusted stuff happily running its little malicious heart in a VM, especially if there is protection from the OS to the hardware.

Cut and paste functionality. You have levels of trust (nontrusted, classified, secret, top secret), and when you copy from one layer, you can only paste into that layer or higher security. This way, someone can copy a quote from /. and post it on an internal document while the reverse can't happen.

User presentation. You want to make sure programs cannot masquerade as system stuff. For example, Windows requiring control-alt-delete before logging in makes sure that no process can fake the login dialog.

Re:Who can be trusted?

[Anonymous Coward]

What the fuck? A government checking the code it runs on computers with sensitive data is "national socialist"? You think the United States government doesn't do this on CIA and DOD computers? Or are you a nut against building roads?

We're talking about doing this only for government computers used for sensitive government data.

Nice conflation of multiple unrelated tangents. The shortcomings of American law enforcement and Intelligence agencies at modernizing systems is legendary. There were numerous news items out as few as five years ago about the FBI being unable to perform compound queries and unable to complete an upgrade process that had been underway for like a decade.

It absolutely would require national socialist style dedication from a populace to keep the government anywhere near up to common best practices.

Is the DoD still trying to get the Navy to sign on to MS on subs and battleships via D2? Isn't the CIA still notorious for the deals they cut with private enterprises to get what they need outside of normal acquisition and review channels?

You are overrated and seem to think that just because you are paying taxes something is being done to secure your infrastructure.

There are not bigger failures in the world of IT than the failures of the U.S. I.R.S., air traffic control, law enforcement, and intelligence attempts at deploying and maintaining tech infrastructure.

If you have a problem with that last statement please post links, I am with conventional wisdom here as ten minutes with a search engine will reveal and I can cite billions spent on completely abandoned projects for each agency listed above.

It would take a country of Nazis to even attempt a general technological segregation from the rest of the world.

Re:Who can be trusted?

[man_of_mr_e]

While this is a valid point, it really doesn't take into account the fact it takes a long time to develop a mature, reliable, secure OS. OpenBSD has been at it for more than a decade and still has issues, and some of the finest minds in security work on that, and they started with a relatively secure code base to begin with.

If you're writing your own OS from scratch, you can expect 20-30 years before it will be more secure and reliable than existing OS's (and those OS's won't be staying still so they will mature in that timeframe as well). And that's if you have experts working on it. If you're going to copy an existing OS, then what's the point?

Now, I can understand that a country wants to encourage OS development, and is willing to sponsor a defense project to build an OS, with the expectation it may take 20-30 years.. but it should really stay hidden and not publicised like this, otherwise the people start wondering "Hey, why don't we have this OS yet?" and then you end up pushing it into production long before it's ready.

The sad part is, India has a huge problem with brain drain. A large percentage of the top computer scientists relocate to EU countries, or the US. Only the truly patriotic or mediocre or worse candidates stay home, or perhaps those with some kind of community ties...

However, if India became seriouis about building a world class research program, it might encourage top talent to stay in India. I can see that as another benefit of such a program.

So i guess my point is, there are a lot of reasons why this is a good idea, but sadly.. I doubt that those reasons are the reasons they're doing it.

Re:Who can be trusted?

[Anonymous Coward]

Or are you a nut against building roads?

Admit it, you were waiting for an opportunity to throw that out today.

Re:Who can be trusted?

[znerk]

If I was a government I wouldn't trust any piece of software from the outside... ...Binary blobs from other countries would be totally banned.

These are the same folks who banned Chinese-made telecommunications equipment, no?

Re:Who can be trusted?

[znerk]

You think the United States government doesn't do this on CIA and DOD computers?

Um, are you sure you want an answer to that?
Some fruitbasket over in the UK managed to "hack" (read "log into with blank or 'simple' passwords") some machines in the pentagon, using "sophisticated hacker tools" (read "stock MS RDP client")...

Re:Who can be trusted?

[znerk]

The boot path. You want a TPM-like chip that can take you from power on to login screen with a chain of custody ensuring that nothing can be tampered with without being detected. With encryption that mounts the data volumes only after the system volumes and the kernel are vetted, tampering can only deny access, nothing else.

You mean like that new android phone that reloads a clean operating system if /boot doesn't match the signature (ie, if you root and flash it)?

Re:Who can be trusted?

[hairyfeet]

Well to keep from having to reinvent the wheel they could probably base it on BSD, since the code has been out there long enough any back doors would have already been found by now, and by using BSD they could make all the customizations they want and not have to worry about GPL biting them in the butt if they decide to distribute it to those outside the military.

But in this day and age trying to make an OS from scratch would probably be like trying to hit a dart board moving at 60MPH with a live bumblebee. Even those that has been in the game awhile have been bitten when tech shifts, and with a new OS you are gonna have to predict what kind of hardware you're gonna be running a decade from now when its done. Would any of us had predicted when we were running barely 1GHz CPUs that in a decade we would be looking at 12 core monsters? or look how MSFT got bit in the butt by Vista, figuring Intel would just keep getting faster and RAM getting bigger and then netbooks came along and bit them right in the ass.

So I'd say anyone trying to start a whole new OS from the ground up from scratch would have to be nuts. Even their military is gonna have to buy their chips, and who knows what chips we'll be running when this thing comes out the gate. For all we know they could have another breakthrough and we all end up on 128 bit 512 core monsters, or perhaps like ARM have many specialized chips like we had in the old days of Amiga.

Re:Who can be trusted?

[Anonymous Coward]

It was Ken Thompson, the man himself, that you're referring to. The talk in question can be found here: http://cm.bell-labs.com/who/ken/trust.html

Figure 1 is broken, I was really curious to see what is it?

Re:Who can be trusted?

[e70838]

Indian brain drain is something of the past. It remains true that computer scientists are paid in India a fraction of what they would earn in our countries. But with a quarter of an occidental salary, they can have a far better quality of life.

Re:Who can be trusted?

[Hognoxious]

It's quite possible that they did all the tricky impressive stuff (or rather, some consultants convinced them to hand over lots of cash for it) while neglecting the easy, obvious and boring things.

This is particular common in large bureaucracies; tasks like enforcing sensible procedures require ongoing effort, which is precisely what people join such organizations to avoid.

Re:Who can be trusted?

[leuk_he]

Some secury enhancements like in se linux (or trustedbsd) would (could) be nice.

However, there is a strange effect that is "too much security". Examples: Create an password policy that is too complicated an people start to write down password on a note next to(taped under) their keyboard.
Lock down a system too much and people will find workarounds not to use that system.
Have a too complicated security policy and you need too many administrators (With god mode access) that configure the security.

Having a secure OS is one thing, designing secure way of work is a different way of thinking.

Re:Who can be trusted?

[sempir]

Methinks a couple of people are going to make a killing on this and when the cash runs out it will just fade away and bluescreen. (Is there still such a thing as the blue screen of death? I plead old age in my defense.)

Re:Who can be trusted?

[snsh]

It will be the "Saffron Screen of Death"

Re:Who can be trusted?

[Anonymous Coward]

Indian brain drain is something of the past.

Really? I graduated from IIT-M in 2009 and found that the masters programs in India were an absolute waste of time. Besides there are hardly any research labs in India and very little academic research. Hence, I had decided a masters degree followed by a job in the US was the best and moved here during Fall 2010.

And by the way, its not just me, almost all of my classmates are in US universities.

Re:Who can be trusted?

[LWATCDR]

Checking the code is one thing writing your own OS from the ground up is another.
I can see where you are coming from but it can also be your typical government boondoggle as well.
Take a look at it this way. What would be the fastest and most economical way to produce a standards compliant OS?
1. Write one from scratch.
2. Spent money on auditing and securing an existing OS like OpenBSD, FreeBSD, Solais "the open version" or Linux?
Maybe if you want to be cutting edge like Minix3, Plan9, Dragonfly BSD, or HURD.
The real problem will be trying to secure your entire stack. There will be the driver issue followed by all sorts of firmware. Every time you want to add new hardware to the stack you will have to do a lot of auditing. Frankly that is one reason I would tend to go with Minix3 or HURD. Those both are microkernels. Since performance these days is less of an issue the added abstraction may be worth it.

But before you go off on the fellow about how this is stupid I suggest you read about the R101.
A great cautionary tail about what happens when a goverments thinks it can do everything better. I am not saying that governments have no roll, but one does have to consider what a bunch of politicians really know about computer security and software development.
Over all I would say a from the ground up general purpose OS seems like a huge waste of resources as anything but a research project.

Re:Who can be trusted?

[david_thornley]

If you have two C compilers from different places, and source for one, you can check for the Ken Thompson trick. Neither needs to be trustworthy, you just need to know that they both aren't set up with the same hack.

Call the compilers A and B, with source for A which we'll call SA. Now, compile SA with both compilers, getting A(SA) and B(SA). B(SA) will not have the hacked-in code. Now, you can't directly compare A(SA) and B(SA), but you do know that they're both C compilers.

Therefore, you compile SA with each of the compilations above, getting A(SA)(SA) and B(SA)(SA). These should be directly comparable, and in fact should be identical except for built-in metadata (time stamps, etc.). If they significantly differ, then A shouldn't be trusted, but B(SA) (SA) is probably good.

Re:Who can be trusted?

[JSBiff]

"If they significantly differ, then A shouldn't be trusted, but B(SA) (SA) is probably good."

Unless Compiler B was 'infected', and passed the exploit along to B(SA), which passed it along to B(SA)(SA), no? Just because they are different doesn't mean that compiler binary A was at fault - it could just as easily be B.

However, I do agree that if they are the same, then that would probably mean neither of the grandparent compiler binaries was compromised. I'm going to have to review, when I get some time, that dissertation which David A. Wheeler provided the link for in one of the other replies, to see if there is a refinement to this technique which would allow you to guarantee that you have 'sanitized' the resulting binaries.

Re:Who can be trusted?

[gedhrel]

"Reflections on trusting trust", Ken Thompson, 1984.

Oh For Chrissakes

[MightyMartian]

Oh for Chrissakes, another nation rebranding an existing OS and calling it their own. It's fucking pathetic. What do they think, that the hackers will be fooled and won't think it's just Windows?

Re:Oh For Chrissakes

[the_humeister]

I wonder why they don't just make a fork of OpenBSD?

Re:Oh For Chrissakes

[nashv]

I find it amusing that some people think that a nation's defense research organisation, which helps build ICBMs, supersonic aircraft, tactical software and so on, needs advice from someone who reading slashdot on how to write an operating system.

Re:Oh For Chrissakes

[Daniel Dvorkin]

I find it amusing that some people think that a nation's defense research organisation, which helps build ICBMs, supersonic aircraft, tactical software and so on, needs advice from someone who reading slashdot on how to write an operating system.

Well, in the US -- I don't know about the Indian military -- the same defense establishment that operates those ICBMs etc. also mostly runs Windows. Which is a pretty clear indication that they do need help, and the Slashdot crowd would probably be a good place to get it.

This is at least partly personal experience talking. When I was a medic in the USAF, one of my secondary duties was "computer systems security NCO" for the ER where I worked. Which mainly meant light sysadmin duties, trying to keep machines patched and virus-free with absolutely zero support from the actual hospital IT staff, and debunking "I LOVE YOU virus" warnings and similar bouts of hysteria that Col. So-and-so forwarded to everyone's e-mail ("it must be true, the Colonel said it!") Actual security was a joke.

Re:Oh For Chrissakes

[nashv]

Granted, militaries are usually incompetent when it comes to IT. But this isn't the military, this is the DRDO, which typically includes people like this.

Re:Oh For Chrissakes

[Anonymous Coward]

HA! You were a medic? Being a medic in the Air Force is like being a Maytag repairman. Lotta good pussy, though.

Joking aside, flyboy. 2Axxx scum here, and we ran console apps cobbled together over win2K and NT4 on our classified shit. Kinda scary, eh? At least we had the mighty STU-3.

signed, -- Terrudiger Abercrombie

Re:Oh For Chrissakes

[PhrostyMcByte]

I find it amusing that some people think that the engineers building ICBMs, supersonic aircraft, tactical software and so on, are the ones who make the decisions to create a new operating system.

Re:Oh For Chrissakes

[MBGMorden]

If their intention is to "run Windows software", as the summary states, then I think they'd get farther along by forking ReactOS.

Sure, its basis isn't "written at home", but unless it's merely a matter of national pride, you still have essentially the same advantage with OSS. Namely, that you can look at everything and verify what it does before using it in a security-critical environment.

Re:Oh For Chrissakes

[Anonymous Coward]

Fallacy. Just because it's an organization with a lot of people, has a big fancy title, and has the authoritative trust of government bureaucrats, does not necessarily mean it knows what it's doing.

Re:Oh For Chrissakes

[drdanny_orig]

I find it amusing that some people think that a nation's defense research organisation, which helps build ICBMs, supersonic aircraft, tactical software and so on, needs advice from someone who reading slashdot on how to write an operating system.

Eh? It's their history in such areas that convinced me they could screw up Water Soup with a recipe from Alton Brown.

Re:Oh For Chrissakes

[Anonymous Coward]

Because OpenBSD is Sadly Lacking

Re:Oh For Chrissakes

[Anonymous Coward]

They appear to build all these...so why leave OS?

Re:Oh For Chrissakes

[jimicus]

Really? Because I find it amusing that anyone reckons they can create an operating system from scratch, capable of running Windows applications but not based on Windows, with a team of 50 developers in anything less than the time it would take for the work to become utterly pointless several times over.

The Wine project has been going in one form or another since 1993 and its support for Windows applications is still best described as "patchy". And the Wine project doesn't have to include an underlying operating system.

Re:Oh For Chrissakes

[Anonymous Coward]

Maybe it was a joke in your squadron, but you were also just a CSA --- for those outside of the Air Force, you were the most undertrained example of "tech support" the world has to offer. Even Dell help desk lackeys knew more about the inner workings of a network. You also didn't keep machines virus-free; that's not part of the duty. You picked up the phone when something beyond "insert disc" appeared on screen exactly when you wanted it.

The real joke? The Medical Hobby Shop.

Re:Oh For Chrissakes

[jhantin]

... bouts of hysteria that Col. So-and-so forwarded to everyone's e-mail ("it must be true, the Colonel said it!") ...

Oh my. So what you're saying is you actually had to cope with colonel panics?

*rimshot*

Hilarity aside, such messy environments are entirely unsurprising for a medical environment. Commercial medical-records software is even worse -- in my experience, much of it dies horribly unless every user has admin rights on every PC they use, typically because the software likes to poo random files everywhere, including such places as the root of the system drive.

Re:Oh For Chrissakes

[Anonymous Coward]

Haha... this pretty funny. I assume the people with the know-how reads MSN.com. Face it - the people with OS know-how is either on slashdot or on a porn site. They are not going to comment about an Indian OS on a porn site. So yes - slashdot is EXACTLY the place where they need to turn to for advice. Maybe they should post "We have a problem, does anybody have an idea..." stories.

Re:Oh For Chrissakes

[Anonymous Coward]

So they include the people who churn out the abysmal quality of developers India generally has to offer the world rather than the shit developers themselves? great, that really improves confidence.

All software projects I've seen outsourced to India have been of terrible quality or sometimes just complete failures despite many of the developers attaining their degrees under people like those you listed.

Even if they know what they're doing themselves, they're clearly happy to work in a system where a terrible level of quality and standards is acceptable. Those aren't the sort of people you want working on a military OS.

Re:Oh For Chrissakes

[Anonymous Coward]

You had Win2K? We used Win9x, and transfered data by either carrying diskettes or using a modem (usually twice per day). If we were not wrinting stuff on cardbord with typewriters. (And this was merely 10 years ago) Different country, though.

Re:Oh For Chrissakes

[Daniel Dvorkin]

Oh my. So what you're saying is you actually had to cope with colonel panics?

To be fair, the Colonel wasn't really to blame. He was just following his orders from General P. Fault.

Re:Oh For Chrissakes

[Anonymous Coward]

lol. We're the people they hire to do it, you bloody retard!

Re:Oh For Chrissakes

[Anonymous Coward]

You conveniently left out the fact that the author of the original article (the article OS News links to) knows less about operating systems than Steve Ballmer.

Re:Oh For Chrissakes

[grcumb]

Oh my. So what you're saying is you actually had to cope with colonel panics?

To be fair, the Colonel wasn't really to blame. He was just following his orders from General P. Fault.

And the Colonel usually called on Major Payne, who ensured that Corporal Punishment paid a visit to Private Parts.

Isn't chain of command wonderful? 8^)

I like it!

[Anonymous Coward]

LOLOLOLOL

Confusion

[DoofusOfDeath]

WINE doesn't stand for "Wine is not a complete, Windows-compatible operating system sans the security vulnerabilities".

Re:Confusion

[icebike]

Mod parent insightful.

If you are going to run windows software you can bet they will start with with a Virtual Machine approach or Wine, and neither one buys them much security without diligence.

he idea that a government funded military lab would develop from the ground up and achieve something that would run windows but wasn't as vulnerable seems highly unlikely.

Budgets lapse. People Come and Go. It would be a mess.

Re:Confusion

[Lobachevsky]

Most attacks can be avoided by having a secure firewall. The cyberattacks were all successful because the machines were connected to the internet "naked" - no firewall device.

Re:Confusion

[drolli]

Although....

Wine with apparmor may be safer than Windows 2000....

Re:Confusion

[Anonymous Coward]

Actually, most attacks that I see lately work in spite of both corporate and host-based firewalls. A better statement would be:

Most attacks can be avoided by not having users.

Re:Confusion

[Anonymous Coward]

Most attacks on noncritical system will be from the internet. Well-funded espionage will use far more nefarious channels.

Re:Confusion

[Anonymous Coward]

Most attacks can be avoided by not having any connectivity at all. Here's a computer, look no cords. I gaurantee you it's not going to be infected by malware because... it's not turned on.

Re:Confusion

[interkin3tic]

WINE doesn't stand for "Wine is not a complete, Windows-compatible operating system sans the security vulnerabilities".

No, but WINACWCOSSTSV sure does.

Re:Confusion

[loxosceles]

Don't forget ReactOS.

Re:Confusion

[TheRaven64]

Correct. WINE, in fact, provides no security. Being an entirely userspace package, it does not intercept system calls. WINE apps run in a prefix which defines the file hierarchy that the windows APIs return, but a WINE app can also issue native system calls by using SYSENTER / SYSCALL or int 80h and completely bypass these restrictions. Unless you also use an OS-provided sandbox for your WINE apps, they have exactly the same access to the system as any other apps that you run.

Oh, and before someone replies telling me that WINE can run on a variety of platforms:

It is limited to x86, which means that the mechanism for entering the kernel is fairly well defined. All UNIX-like systems on x86 use the same numbers for a few system calls that are inherited from AT&T UNIX, meaning that you can open and read files, which is usually enough to identify what the host system is. ReactOS is the other alternative, but it helpfully provides an API for letting portable programs know if they are running on ReactOS or Windows.

Re:Confusion

[Anonymous Coward]

WINE doesn't stand for "Wine is not a complete, Windows-compatible operating system sans the security vulnerabilities".

Secure and Windows are incompatible words!!!

Re:Confusion

[Synonymous Homonym]

Could this mean that ReactOS is getting attention again?

is it gonna be open sauce?

[Anonymous Coward]

cause the summery makes it sound like they will use Wine

Cost

[DoofusOfDeath]

I can't wait for the poor bastards to try outsourcing development to India.

Re:Cost

[masterwit]

I can't wait for the poor bastards to try outsourcing development to India.

Um...this is India that is developing this? I do understand the sarcasm though.
On that note, from India's Economic Times

"We have to protect it (data)," Saraswat said, adding, "Only way to protect it is to have a home-grown system, the complete architecture...source code is with you and then nobody knows what's that."

He said DRDO is putting in place a dedicated team of 50 software professionals in the Bangalore and Delhi software development centres to accomplish the task.

I am not trying to be demeaning, but that is a small number of people for one task...considering this is India.

Re:Cost

[Anonymous Coward]

They will - eventually - to private India.

Re:Cost

[mysidia]

You forgot about the ongoing economic calamaties?

In a few years they might consider outsourcing development to the US.

Re:Cost

[Anonymous Coward]

Who does India turn to for outsourcing? Can they understand their tech support people? Is my train of though politicly incorrect? These are the questions I ask myself on a daily basis. That and "Where am I going to have to move next to keep my tech career going?"

SHIVA

[Anonymous Coward]

"SHIVA just went down!"

"Re-summon! Re-summon! VISHNU is also under attack!"

Re:SHIVA

[mfnickster]

"I am become /dev/null, the destroyer of data."

Re:SHIVA

[Anonymous Coward]

That would be the swallower, not the destroyer. rm is THE destroyer.

Re:SHIVA

[Cidolfas]

Sigg'd.

Re:SHIVA

[Anonymous Coward]

All your /dev/null are belong to us!

Re:SHIVA

[No. 24601]

I am become J. Robert Oppenheimer, the destroyer of the English language.

Re:SHIVA

[mfnickster]

It's archaic but perfectly legitimate...

Hamlet: "I am become bitter through ill-met experience."

"Vext the dim sea: I am become a name," Alfred Lord Tennyson's Ulysses

"I am become a fool in glorying; ye have compelled me," Book of Corinthians 2, 12:11, KJV

Buzz words, no content

[Anonymous Coward]

If it's running Windows apps, there's not a lot of room for a "custom os". It'll either be a POSIX based OS so it can run WINE (I doubt they'll rewrite that part since it's a really large piece of code to duplicate) or Windows with their own branding*.

* Actually, it could be a completely custom OS whereby the Windows apps are run via a remote session ala nx or something similar. However, all that stuff has its own set of problems (at the end of the day you're still running Windows behind a firewall in a trusted environment).

Re:Buzz words, no content

[icebike]

Exactly.

If you run windows apps, you have to replicate or emulate, and that would be wine.

They could run VMs that get fresh loaded images each reboot, but that's still windows, and still vulnerable while its running.

Not the best track record

[SplashMyBandit]

I hope the DRDO does better than their previous projects. For example, the Arjun tank has not been a good use of Indian taxpayer money, but internal politics seem to keep it and similar projects alive: http://en.wikipedia.org/wiki/Arjun_MBT

Re:Not the best track record

[ZDRuX]

Sounds exactly the same as their counterpart in the U.S.. Oh, and Canada too, wait.. make that most countries.

Re:Not the best track record

[iammani]

Mmmm, I wouldnt call it internal politics. Its rather to encourage local development of military hardware. In this case, it was the first attempt at an indigenous (completely indian made) tank. Due to improper planning, the project was delayed by years and they even ended up purchasing some of the components from other countries (Israel mainly). Though not a success, I would consider it a good start, and would expect future indian made tanks to be build cheaper and better

There are many other such DRDO projects, like Tejas (indigenously build light weight combat aircraft) which would have been much cheaper to acquire from Russia or US.

There are many instances of internal politics in DRDO, but this is definitely not one of them.

Re:Not the best track record

[webminer]

Arjun MBT is one of the finest tanks in our part of the world. The problem with its development is not because of just DRDO. It has to do with the govt policy, the army constantly changing its requirements and finally the penetration of Russian arms agents in the Ministry of Defense. All these factors have delayed the induction of a tank that kicked Russian T-90s in every environment that the Indian Army fights in. The comparative field trials of the Indian Army a few months ago showed Arjun MBT has consistently performed better than T-90. So, DRDO came out with a better tank that Russians who have decades of tank-building experience.

Re:Not the best track record

[Registered Coward v2]

Arjun MBT is one of the finest tanks in our part of the world. The problem with its development is not because of just DRDO. It has to do with the govt policy, the army constantly changing its requirements and finally the penetration of Russian arms agents in the Ministry of Defense. All these factors have delayed the induction of a tank that kicked Russian T-90s in every environment that the Indian Army fights in. The comparative field trials of the Indian Army a few months ago showed Arjun MBT has consistently performed better than T-90. So, DRDO came out with a better tank that Russians who have decades of tank-building experience.

The real question is:"Who ran these tests?" In my experience, I have never seen a military or defence contractor (from any nation) run test that did end up with "Hooray for our side. We won."

In general, someone who says "Wait a minute. Things aren't as good as they seem" generally gets marginalized and run out of town. See Boyd, John.

Re:Not the best track record

[iammani]

In my experience, I have never seen a military or defence contractor (from any nation) run test that did end up with "Hooray for our side. We won."

See https://secure.wikimedia.org/wikipedia/en/wiki/Arjun_MBT#Trials_and_exercise The army openly released test results that claimed that DRDO's Arjun did not meet their requirements. Its only in 2010, that the Indian Army results showed that Arjun performed better than Russian tanks.

Re:Not the best track record

[Glonoinha]

Its only in 2010, that the Indian Army results showed that Arjun performed better than Russian tanks

I'd take that bet ... put me down for $200 on the T-90M

Re:Not the best track record

[bussdriver]

India has some great computer experts. They should do something worthwhile and open source for the extra eyes - maybe get something going for other nations and corps that produces more jobs for them - like how OS in the west used to boost their economies.

They should seriously look at making a modern Multics! That amazing OS ran longer and with better uptimes and was used in the military. It may have been too complex and big back in the day resulting in the creation of unix-- but a modern unix kernel is so big and bloated that multics does not look so big and complex anymore.

They should also consider NOT using C++. It causes too much troubles. ADA is what the USA military used/uses and was created for their needs to avoid problems. In fact, why don't they tweak or pick the language 1st to avoid all the long term issues as well as possibly create local jobs in a new niche.

As far as running windows... they must be thinking WINE because tweaking windows would be a big mistake. Running windows apps in WINE isn't such a great idea either.

Re:Not the best track record

[dunkelfalke]

Arjun is 10 tons heavier, needs one more crew member, makes a bigger target and is basically Leopard 2A4 with indigen electronics. And the A4 batch of Leopard 2 is already obsolete. Not that T90 is a very good tank, though.

Re:Not the best track record

[Registered Coward v2]

In my experience, I have never seen a military or defence contractor (from any nation) run test that did end up with "Hooray for our side. We won."

See https://secure.wikimedia.org/wikipedia/en/wiki/Arjun_MBT#Trials_and_exercise The army openly released test results that claimed that DRDO's Arjun did not meet their requirements. Its only in 2010, that the Indian Army results showed that Arjun performed better than Russian tanks.

As I pointed out, the contractor insisted the weapon system they developed was fine, for example:

With the September 2007 winter trials, the Indian army deemed Arjun's performance unsatisfactory, including at least four engine failures.[46] DRDO, on the other hand, insisted the tank was a viable choice for adoption and suggested the unsatisfactory performance of the engine during the winter trials was due to sabotage.

Interestingly enough, the Indian Army decided they wanted T-90's:

Subsequently in September 2008, the Indian Army signed a deal with Russia to import 347 T-90 tanks and license build a further 1000. Transfer of key T-90 technologies has also been agreed upon as a part of the deal.

I don't know if export T-90s are the same as Russian Army versions, even so the MOD PR qouted in wiki makes no statement about beating the T-90's:

After many years of trial and tribulation it has now proved its worth by its superb performance under various circumstances, such as driving cross-country over rugged sand dunes, detecting, observing and quickly engaging targets, accurately hitting targets – both stationary and moving, with pin pointed accuracy. Its superior fire-power is based on accurate and quick target acquisition capability during day and night in all types of weather and shortest possible reaction time during combat engagements.

It goes on to say they Indian decided not stop production of the Arjun and instead build a variant of the T-90. All in all it looks like a typical defence procurement game, which is not limited to any one country - contractor builds item, military says it doesn't work; eventually the government decides it really does work and buys them in enough quantity to keep their buds in business happy. Same game, different location.

Re:Not the best track record

[alvinrod]

Reminds me of the Bradley Fighting Vehicle which has both been written about by a colonel involved with the project and had a movie based on the book filmed about it.

What's the point?

[sea4ever]

I suppose they want to make their own OS to be sure of the security.
..but then if you're going to allow it to run Windows software..what's the point?
Windows software is the epitome of insecure, it defeats the whole purpose of making your own OS.

Re:What's the point?

[dmomo]

I can imagine that if their os runs windows programs it would be in some sort of sandboxed environment. I didn't rtfa, but I wouldn't suppose that it is capable of running any windows program. There would probably be restrictions on what input/output ports can be accessed. Same for disk / memory access and network connectivity. Maybe it just has a virtual windows machine on it, in which case, the "bad windows" can be wiped. Heck.. the "good windows" could be wiped daily.

Re:What's the point?

[Lobachevsky]

WindowsNT/WindowsXP has vastly better security than Windws95/WindowsME, even though they all run windows applications. The big difference is that Windows95/WindowsME lacked a memory model that sandboxed each application's memory. That meant one rogue application on Windows95/ME could start modifying kernel memory, or other applications' memory. Instead, under WindowsNT/WindowsXP, an application exits with a general protection fault.

There are stricter security models that go beyond merely sandboxing memory pages. Windows Vista introduced privilege escalation dialogue. It allows you to run applications with lower privileges (non-admin), and when the application attempts to do something that requires admin privileges, a dialog is brought up to prompt you for approval. I can imagine finer grained capabilities. E.g. your web browser should only have file access to its caching directory. If it attempts to read or write anywhere else, the operating system pauses the application and prompts the user for approval.

The Wheel

[Voulnet]

The Wheel: It's tired of getting reinvented.

Re:The Wheel

[Anonymous Coward]

I'm fine with my rubber/steel-belted, how are your wooden`s one ?

Re:The Wheel

[mdemonic]

If it weren't for repeated reinvention of the wheel, they would still be hexagonal rocks. Reinvention is what drives technology forward. Invention is a rare treat.

Re:The Wheel

[HoldmyCauls]

HAH! 'Tired' -- good pun!

Re:The Wheel

[oldhack]

It's necessary in this wheel-within-wheel universe.

Do not despair. Kali Yuga, too, will come to pass. Init command is forthcoming.

Fulfill your dharma.

Ohm.

Re:The Wheel

[Sir_Lewk]

The word for what you are describing is "refinement", not "reinvention".

Re:The Wheel

[mysidia]

If the wheel is 'windows'; it desperately needs to be re-invented.

I would welcome a well-designed, secure, stable OS, that can run Windows apps reliably.

However, I think Duke Nukem Forever will be released before that has a prayer's chance of happening.

Re:The Wheel

[mdemonic]

Im just using the vocabulary of the old stupid wheel meme.

Re:The Wheel

[Sir_Lewk]

Playing with vocabulary doesn't nullify the point of the saying.

Re:The Wheel

[mdemonic]

In order to refine you must usually get back to the drawing board, or at least take some steps back, and "reinvent". If not the whole system, then at least part of it. Which is close enough for my point. No reason to wave your definition penis.

Re:The Wheel

[martin-boundary]

HAH! 'Tired' -- good pun!

Danger Will Robinson! Stealthy Car Analogy detected!

Re:The Wheel

[definate]

Or was it? Given no italics, I'm going to put this one down to a speeling mistake.

Re:The Wheel

[c0lo]

Ah, the necessary "illusion of a fresh start"... fueled by the "NIH" syndrome (soon to became the "Me too" syndrome)...
Given the place where this happens, I think they are just ready for yet another cycle on the wheel of suffering.

Re:The Wheel

[Anonymous Coward]

So early 2011?

Re:The Wheel

[gl4ss]

that's why it's handy to create your own 'os' by rolling your own windows distribution. standard mil way of going about things. then it's your own os. at least on paper.

Re:The Wheel

[Casandro]

Unfortunately you cannot re-design Windows without breaking compatibility. Microsoft has tried and the result is called Vista/Windows 7.

Re:The Wheel

[L4t3r4lu5]

But it'll be revolutionary!

Re:The Wheel

[TheRaven64]

The wheel was last reinvented about a century ago, with the invention of the tension-spoked wheel, as found on all modern bicycles. Earlier wheels used compressive force on the bottom half to keep the axel off the ground. Bicycle wheels use tension between the spokes and the rim in the top half. This means that - unlike spoked cart wheels - the weight is spread over around half of the spokes and distributed through the arching part of the wheel. When you view the wheel as a network of forces, they are completely different (you can see this if you replace a bicycle wheel's spokes with elastic bands - it still works).

Other developments, such as pneumatic tyres, can be thought of as refinement, but going from a pillar to an arch model was a significant reinvention.

Re:The Wheel

[DrugCheese]

The wheel, out of all objects, understands what goes around comes around.

Re:The Wheel

[Anonymous Coward]

That joke fell kinda flat.

Re:The Wheel

[Anonymous Coward]

I am sorry, but I am new to this whole computer acronym thing...

so WHEEL stands for:

Windows:
Hellish
Everflowing
Effluent
Like...

so do I understand the definition correctly ?

offtopic but hilarious

[Anonymous Coward]

A buddy of mine just revealed some news to me. He's been reliable about this shit in the past and he's in a position to know, so I trust it but YMMV.

Backstory: Microsoft eats their own cooking ("dogfood") except in cases of epic failure. Like Hotmail running on NT. Or Visual Safe Source for Windows's RCS. They use a heavily modified version of perforce and a hierarchy of repositories. Yeah, it's a mess and there are a number of technical as well as human/social problems.

Well, multiple groups within Microsoft have had enough and switched to git for day-to-day work (using a gateway to push their changes to an upstream p4 repo). They're trying hard to drop 4 entirely and go with git. From what I know of their development practices, they really need something like git (Linus, himself, agrees). But who's going to tell Balmer that they're switching to software written by arch-enemy Linus Torvaldes? You might think they'd prefer that (we're using your free software, faggots!), but chances are VSS 2011 will contain some sort of half-assed distributed RCS support.

Re:offtopic but hilarious

[nschubach]

Well, multiple groups within Microsoft have had enough and switched to git for day-to-day work (using a gateway to push their changes to an upstream p4 repo).

Are you trying to give the network auditors more work? ;)

Re:offtopic but hilarious

[dwywit]

Hell, Microsoft even used AS/400s for a long time: https://cs.senecac.on.ca/~tmckenna/offline/MS400.html

Re:offtopic but hilarious

[man_of_mr_e]

Hotmail does run on Windows. When it was purchased it did not, and it took them some time convert it. The "stories" about conversion failures were rediculous, the timelines did not give enough time for a real conversion of such systems, and people probably mistook various prototype testing as real attempts.

Sourcesafe was also never meant for anything other than workgroup projects, not large scale. As such, nobody would be expected to run something the size of the windows code base on vss. Nowadays, Microsoft has an enterprise class version control in Team Foundation Server, but I imagine they have a lot of legacy to convert to move that to TFS any time soon.

They also ran a large part of their internal processes for years on an AS/400, including accounting and other aspects. Microsoft didn't have applications to do what they needed on Windows, and didn't really want to invest in building them. However, now that they bought Great Plains.. that's a different story.

Due to legacy concerns, they aren't likely to convert from p4 for a very long time, although the beauty of git is that in workgroups you can use git and push changes upstream. If anything, they're most likely to convert to TFS, for long term overall project.. Already most of the tools development, web development, etc.. is done on TFS.

Re:offtopic but hilarious

[Randle_Revar]

Dunno about other areas, but the Codeplex division uses hg (which is no secret AFAIK)

Re:offtopic but hilarious

[Anonymous Coward]

It's a hosting service, not a "division"...

Re:offtopic but hilarious

[cronius]

From what I know of their development practices, they really need something like git (Linus, himself, agrees). But who's going to tell Balmer that they're switching to software written by arch-enemy Linus Torvaldes? You might think they'd prefer that (we're using your free software, faggots!), but chances are VSS 2011 will contain some sort of half-assed distributed RCS support.

From http://lwn.net/Articles/403903/ :

Microsoft's CodePlex.com has announced the donation of $25,000 to support the development of the Mercurial source code management system.

Looks like they've found what they're looking for.

Re:offtopic but hilarious

[snowgirl]

Microsoft already makes heavy HEAVY use of Perl to compile windows. In fact, the vast majority of the code compiling windows is in Perl. Mostly because they don't have a decent scripting language. There has been some people making components in C# as of my leaving the company, but I didn't like it much at all, because part of the build process is watching the build and fixing things when they break. (The Windows build process is a hobbled together lump of duct tape usually.) As such, having compiled binary blobs doing the work results in not being able to easily modify and work around issues. This is fine for things like compilers, which don't change over the course of the project (once a version of Windows is released, the compilers for that version never change. Correction, almost never change. There were some 2003 releases for IA-64 that needed a new compiler, because of a critical error in exception handling in the compiler.)

So....... I don't think Steve Ballmer would have any problems with using git, beyond his retarded "zomg must use MS products or die!" (The guy wouldn't let his kids have iPods, wtf?) But since it's internal, that's unlikely. But unless git can pass along all the information that SourceDepot (the heavily modified Perforce that Microsoft uses) uses, this is unlikely. SD has a lot of historical information about who checked in what, and when, and what was checked in. The build team depends upon this heavily, and so it's unlikely they would want to switch tools. Not to mention that the build code interacts directly with SD to do a lot of the monkey work, like lock a tree, declare a branch for build, and then unlock the tree once done.

Also, access control. There are strict rules about who can get windows source code and when, and it's maintained by a huge backend website. Also, checkins must have specific information, code reviews, etc, or they are automatically rejected. The idea behind git, my understand is, is that anyone can grab a copy and maintain their own tree, and that other tree would then merge in your tree to encapsulate your changes. The idea that at a widescale Microsoft would adopt such a decentralized model is purely fantasy.

Re:offtopic but hilarious

[RAMMS EIN]

The beauty of Git is that you don't actually have to switch to Git to use it. It interoperates with many other version control systems, and even if your organization uses one of those rare systems that Git doesn't interoperate with, you can always still let that system handle things like you normally would. What Git buys you is the ability to perform local commits and other version control operations without affecting anyone else (e.g. you won't break the build). It's one of those features that made me think "How did I ever code without that?" You can also make your local commits available to others, have code reviews on them before committing them to the main repository, etc.

Re:offtopic but hilarious

[Randle_Revar]

The code that runs Codeplex is kept in hg, and it is a division or sub-department or whatever MS calls such things.

Re:offtopic but hilarious

[snowgirl]

The beauty of Git is that you don't actually have to switch to Git to use it. It interoperates with many other version control systems, and even if your organization uses one of those rare systems that Git doesn't interoperate with, you can always still let that system handle things like you normally would. What Git buys you is the ability to perform local commits and other version control operations without affecting anyone else (e.g. you won't break the build). It's one of those features that made me think "How did I ever code without that?" You can also make your local commits available to others, have code reviews on them before committing them to the main repository, etc.

The Microsoft policy for the Windows source code does not permit for local commits, etc. The code review bundling into BBPacks is already written into the entire process. BBPacks also allow one to get a copy of what they would commit.

You're going to have to eventually checkin your changes or merge your changes into the main tree, and you risk breaking the build. Even if your branch builds just fine, if you merge it into another tree, you can then break that build.

Just 50 people?

[omidaladini]

Then to spend years to patch its vulnerabilities.

I think Novell may have something to say...

[E-Sabbath]

They already own DRDOS.

Re:I think Novell may have something to say...

[Tapewolf]

Bizarrely, I heard rumours years ago about a 'Project Scimitar', which IIRC was basically a plan to port Sun's WABI to GEM Desktop, or in other words, make GEM under DRDOS able to run Windows 3.1 applications. Of course, Win32 was just starting then so it would probably have been a wasted effort.

Re:I think Novell may have something to say...

[Ultracrepidarian]

It's a trimmed down version.

Iron

[Lanteran]

This is going to be like the iron of the OS world; the exact same code base with some user settings and code changed.

Re:Iron

[Lanteran]

code comments changed I mean. Darn edit button reflex.

Easier solution?

[denshao2]

Wouldn't an internal code audit of an open source operating system be easier?

Re:Easier solution?

[BasilBrush]

People have been code auditing Linux for a couple of decades now. They're still coming up with security vulnerabilities. The "given enough eyeballs, all bugs are shallow" theory didn't work in reality.

No, I honestly think it's easier to start with a more secure programming language, and only create as many features as are actually needed, making security the primary requirement of every feature implemented.

Re:Easier solution?

[denshao2]

OpenBSD

Re:Easier solution?

[tibit]

I agree. But there's no way you'll get it to run anything but toy Windows applications when you're done. The native interfaces may be quite productive and well-developed, but implementing winapi is just very, very hard. If you wish to implement against MSDN -- pretty much no windows apps will work.

Unless their stated goal of running windows applications isn't.

Why against this?

[santax]

So many 'fun' comments... If there is one country that is good in software it's this country. Hell, even MS probably has coders working for them there. And if they really manage to make an os that can run windows binaries without all the overhead and presumed NSA-backdoors (not that they need one given the rate new remote exploits come out for every windows version) this is a very smart thing to do. Nothing to make fun about. I would have great interest in an OS that can run windows binaries without all the windows-shit.

Re:Why against this?

[Anonymous Coward]

I would have great interest in an OS that can run windows binaries without all the windows-shit.

I would not want to use a proprietary operating system that is home-grown for "security" reasons.

Re:Why against this?

[Anonymous Coward]

We do. It's called WINE.

And if you think that, for some reason, India is a better country than, say, China, to create its own OS, you really don't know the situation in either of those two countries. Most graduates from most universities in China and India are empty shirts with degrees who can't even get jobs selling computers, much less coding jobs. It is a point of pride (and good business) to claim that India and China are awarding technical degrees to a huge number of trained engineers, but the sad truth is that many universities are doing their students a disservice by pushing them through just to award them the degree at the end of the year. Please, talk to anyone who has been through the university system in either of those countries (and, in my case, these are the people who were able to avoid that situation by going to the rare "good" universities) and they will paint you a sad picture of the state of computer science students there, all for the sake of national pride and encouraging foreign investment.

Re:Why against this?

[Anonymous Coward]

Because, grasshopper, as you will learn as you grow older and more experienced, "write my own OS" is virtually never the solution.

I know you see "virtually never" and assume:
1) The old guy typing this is just afraid to take a chance;
2) It's a big problem but 50 people should be able to knock it down, no sweat;
3) "virtually never" doesn't mean "never".

The real solution, to give you the back of the book answer, is to institute stricter security measures, including physical security (destroying/removing/disconnecting ports, physically secured perimeter with controlled access), network security (separate networks or no networks for highly sensitive material; redundant firewall measures), software security (staying on top of updates to software, most notably), extensive logging and log monitoring, frequent security reviews and regularly changing passwords, etc.

It's not sexy, but it'll work much sooner and likely provide better results almost immediately. That new OS, however, is unproven, has limited use and thus a limited petri dish to analyze attack patterns and weaknesses. Which means if this project comes to fruition, within 18 months there will doubtless be a severe breach with sensitive data loss.

As to the knowhow of the country: Yes, certainly there is a robust software industry with great talent. However, any team is only as good as its worst engineer. The worst Indian engineers have been every bit as bad as the worst American, European and other Asian programmers I've worked with. Likewise, the best are every bit as good as the best from any other nationality. There is no mythical talent that is unique to the subcontinent for programming. It simply happens to be a highly desirable career path for a host of reasons locally.

Bottom line, this is a tremendously dumb idea and they would have been better off:
1) grabbing a linux/BSD derivative of their choice and implementing good security procedures, and potentially modifying source for their unique needs;
2) getting a contract with Microsoft, implementing good security procedures, and using their large customer status to leverage Microsoft into modifying code for their unique needs.

Re:Why against this?

[cupantae]

I would have great interest in an OS that can run windows binaries without all the windows-shit.

Then maybe you can join the ReactOS team. If you're really interested, you might be allowed to become the project leader.

Re:Why against this?

[Anonymous Coward]

If there is one country that is good in software it's this country.

The only reason they are good is because they are taught Microsoft, live on MSDN and are raised to memorize.

I have yet to find an Indian that can think outside the box or one that develops for non-Microsoft technology.

Re:Why against this?

[santax]

Wow, lot of biased people here. AC's off-course. Be a man, use your account. And comments like: have yet to see a indian think outside the box... Never been out of your redneck state have you?

Re:Why against this?

[Anonymous Coward]

Hypocrite much?

And who said I live in the States?

Re:Why against this?

[Anonymous Coward]

one word: Monkeys.

Yes, they can all code. When told what to do. But if they've to come up with it by themselves, it's gonna be tripe.

Example, the commonwealth games.

When I say "they", I really mean "we" - this isn't trolling, coz I know what apparently-"my" ppl can do.

Re:Why against this?

[Anonymous Coward]

Windows software compatible AND thinking outside the box.
Sounds like an oxymoron.

Re:Why against this?

[dakameleon]

The ones thinking outside the box aren't the ones getting hired for $10/hr programming jobs.

Re:Why against this?

[L4t3r4lu5]

I think he just wants to run it, like I do. Windows without the price tag.

As it is, I might start contributing to the project monetarily, but I've no talents which they could use development-wise.

Re:Why against this?

[Jesus_666]

What version of Windows are we talking about? 9x? NT/2k/XP? Vista/7? If they want something that will run Windows software in the future they will need to reverse-engineer and implement not just the Windows kernel but also everything on top of it including much of DirectX and the entire .NET platform. And they will need to keep doing so, matching every new feature Microsoft introduces while remaining binary-compatible, all without falling behind more than a few months.

Excuse me if I assume that this OS will be scrapped and replaced with something more feasible. While a sufficiently determined government could probably do it the costs involved would be ridiculously high. Just migrating the entire country over to OpenBSD would most likely be cheaper, especially in the long run.

Re:Why against this?

[santax]

Hey I would be all in favour for OpenBSD, but directX support? Why would they need that? I assume they are using their OS-es for nationwide, mission critical and confidential processing. One would be an idiot to do that on a system that has directx support. Everyday OS-es are being written. Not so much for the x86 platform, but for every other cpu, pic or microcontroller it's just another day at the office. Sure, you can have some skepticism, so have I, but these dudes are right. It's almost certain that when you install Windows, you install the NSA. At the very least you install something with enough remote exploits that haven't been publicized yet to be sure your system isn't safe. This is just a step in the good direction. Less software from US-soil where the FBI demands backdoors. We want decent software that we can trust and depend upon. OpenBSD would fit the job indeed. But, can't run those windows binaries. I am curious what they will end up with. I wouldn't be surprised if they aren't going to write the OS from scratch but adept indeed an BSD flavor.

Re:Why against this?

[BasilBrush]

I might have missed it but I didn't notice any sign that you'd ever be able to get your hands on it. If security is their main concern, why would they distribute it to the world? That would just put it into the hands of potential attackers to study closely.

Re:Why against this?

[Jesus_666]

Remember that Microsoft is using DirectX for hardware acceleration wherever applicable. While you could probably take these parts and implement them on something else, say GDI+, you'd still have to make sure they behave identically and you'd have to use a more powerful computer since the CPU now does work that Microsoft assumes is done by the GPU.

I don't doubt that India can create a useful operating system from scratch. I just doubt that they can make a fully compatible white-room Windows clone.

Re:Why against this?

[kikito]

What country? India? Have you worked with them on developing software?

Why not do *BSD or Linux code review and use it?

[ad454]

I know this is obvious, but come on...

Seriously, why not take a *BSD or Linux OS release and do a full source code review on it? It will take a lot less effort than creating anything from scratch, plus they can submit bug reports and code fixes back to the corresponding opensource projects. (Everybody wins!!!) Any mature OS would not be plagued by bugs that commonly occur in large new code bases. After reviewing and approving the OS, they can simply track changes of future releases in order to maintain trust.

Re:Have you ever met?

[Anonymous Coward]

Mod parent -1 Racist

Re:Why not do *BSD or Linux code review and use it

[thoughtsatthemoment]

Simple reason: "Everybody wins" is not an option in real wars.

Re:Why not do *BSD or Linux code review and use it

[Anonymous Coward]

Or at least base their version on it.
IBM uses RH Linux as the basis of their client for E-business SW. IBM used a stripped down version called micro-Linux for their Blue Gene supercomputers.

Mod parent up.

[khasim]

Seriously, if you think your people are good enough to write a SECURE operating system from the ground up, then shouldn't they be good enough to take existing code and determine whether that is secure enough for them?

Even Linux for that matter. The NSA has already done some of the work with SE Linux.

Re:Mod parent up.

[slashqwerty]

Seriously, if you think your people are good enough to write a SECURE operating system from the ground up, then shouldn't they be good enough to take existing code and determine whether that is secure enough for them?

Security needs to be designed in from the ground up. Take a look at Windows, Linux, and MacOS. New exploits are constantly being discovered in those systems because security was not a key part of the development process when they were written.

Windows, Linux, and MacOS were all written in C which burdens the developer with safeguarding against all manner of possible security holes. In C a security hole is as likely as a bug with the exception that a bug is likely to be discovered and fixed by the developer while a security hole will go unnoticed until an attacker discovers it. If you want to build a secure OS today you should start with tools that eliminate the most common security holes. That would include automatic bounds checking which none of the aforementioned systems were built with.

If you want a secure system you make sure every action and every module of code is authenticated before it runs. The system will work a lot better if it is designed that way from the ground up. Existing operating systems would at minimum have to be modified to do this.

A secure system would be developed with best-practices that reduce the likelihood of exposing a vulnerability. For example, the potential attack vectors for shell injection attacks would go through a centralized library that safeguards against it.

All of these things are best done by writing a new system from scratch with more secure tools and practices. At the same time, the developers can look to Linux or BSD for example algorithms on how to solve common problems but make sure the actual implementation uses the aforementioned best practices.

Re:Mod parent up.

[nashv]

What says :

1. They haven't already done that

2. They have special requirements that no other OS currently supports

I mean, come on - "We are going to write an OS." isn't nearly enough information either way to start a flame campaign, eh? Just say "Good Luck" and hope to see useful results.

Re:Mod parent up.

[Anonymous Coward]

And this goes triple for the Indians left in India, who are generally fucking clueless. I've worked with some brilliant Indians, but they were all in California.

A new OS from scratch sounds like a wonderful way to provide a kind of sheltered workshop for a bunch of idiot government employed programmers while actually using Windows for the important stuff.

Re:Mod parent up.

[Anonymous Coward]

Security through obscurity don't work that way - It works typically like cryptography.

Re:Mod parent up.

[Anonymous Coward]

Wow, are you a manager? I don't think I have seen a post so filled with bs-words before.

Re:Mod parent up.

[Anonymous Coward]

I challenge you to identify the "bs-words". The only manager type terminology in that post is best-practices which is a term that most certainly applies here.

Re:Mod parent up.

[Anonymous Coward]

I'm sure a lot of people said that "metric" and honestly believed that the code they were maintaining was that bad. But how many of those rewrites actually succeeded at all -- let alone in less time then was needed to work out the old code?

It's not just about bureaucracies, it's about people seriously underestimating development effort: When you're looking at a working product, all the details and hacks and complexities are visible so it looks idiotic, but when you've only designed (but not implemented) "the new system" it's all elegant and clean and simple... That's not surprising.

Re:Mod parent up.

[Joce640k]

Seriously? Security wasn't a key part of Linux/Unix?

Re:Mod parent up.

[Anonymous Coward]

> Back in the day, the informal metric that we used was: "It is twice as hard to work out someone else's code, than to rewrite it yourself."

Of course for 99% of programmers that means: "Only rewrite it if working out someone else's code is 20 times as hard work as you _think_ rewriting will be".
Since their estimate for rewriting almost certainly coveniently forgot to include those 20 years of real-world testing...
(I will make exceptions for rewrites that produce identical object code or is unit-tested to behave 100% identical, there the figure 2 might actually work out for most).

Re:Mod parent up.

[Anonymous Coward]

I challenge you to write a program that runs in OpenBSD with one of the vulnerabilities you mention and exploit it to do anything. In OpenBSD you can't predict where anything will be. There is also W^X protection, buffer and heap guards. All these technologies have been bypassed because of half-baked implementations, not because of some inherent limitation, and actually perform better in general than the managed alternative which is vital for OS code. OpenBSD also invented the strl* functions which are safe and almost no overhead versions of the infamous str* functions, unlike strn* and str*_s(to be introduced in C1X).

A managed environment won't close your inheritable handles. A managed environment won't protect you from setting the wrong permissions to a file. All of which are very likely when you are a bunch of deluded developers who think their programming environment saves them from bugs.

You can keep your all Indian Windows and probably POSIX emulator written in Java, but I wouldn't even trust it my Slashdot handle.

Like a great person once said, beware of bugs, I have only proved that the program is correct.

Re:Mod parent up.

[Anonymous Coward]

Do you really want people who can't work out Linux/ReactOS/OpenBSD/Minix code to write your ultra-secure OS?
Even if they were to rewrite an OS from scratch first I'd make sure they understand the architecture and design of each of these, and are able to understand their flaws and strong points. And if the NDA doesn't keep them from writing the OS take a good look at Windows Vista source as well. Security has been beaten into Windows, it is probably one of the best sources of things gone wrong and right.

Re:Mod parent up.

[CarpetShark]

Seriously? Security wasn't a key part of Linux/Unix?

Yes, seriously.

Re:Mod parent up.

[Chrisq]

Security needs to be designed in from the ground up.

Well OpenBSD it practically is. Some articles claim it is written ground up for security, but in reality they audited the entire BSD codebase many years ago, rewriting large parts and all new code is ground-up secure. In practice it is extremely secure, many of the bugs that occur in other BSDs or linux turn out to have been fixed months or years before in openBSD

Re:Mod parent up.

[mr100percent]

Not really.
Windows NT was written from scratch with security in mind; the current incarnations of Windows are from that base OS
OS X and Linux were derived from UNIX roots which had internal user security policies as some of the first parts of the OS

Re:Mod parent up.

[Anonymous Coward]

That would include automatic bounds checking which none of the aforementioned systems were built with.

An OS written in FORTRAN?
I find your masochistic ideas intriguing and would like to subscribe to your newsletter...

Re:Mod parent up.

[Hognoxious]

I'm sure a lot of people said that "metric" and honestly believed that the code they were maintaining was that bad.

And the people who came after them probably said the same...

Re:Mod parent up.

[TheRaven64]

The NSA has already done some of the work with SE Linux.

And just remind me, how many Linux kernel exploits published in the last year have come with a disclaimer saying 'does not work if SE Linux is disabled'? Half of them? And have any been prevented by running with SE Linux? None that I recall, but maybe there were some.

Adding complexity always decreases security, yet there are still people - even ones employed by the NSA, which is quite depressing - who think 'I know, we can make this more secure by adding another layer of complexity'.

Re:Mod parent up.

[TheRaven64]

If you want a secure system you make sure every action and every module of code is authenticated before it runs

Absolutely not. In a secure system, none of the modules trusts that the others are bug free.

Re:Mod parent up.

[TheRaven64]

Until the early to mid '90s, the term 'UNIX Security' was considered a joke. In comparison to systems like OS/370, VMS, and so on that were designed for security, UNIX was a toy. It didn't even have access control lists for files, and trust was entirely binary - if your web server needed to be able to bind to port 80, it also got the ability to modify every single file on the system, write directly to devices, and so on. Linux adopted the UNIX lack-of-security model from the start, although has recently gained some slight improvements.

In contrast, Windows NT was designed to be secure from the start. Every kernel object (file, thread, process, and so on) has an access control list associated with it. This can grant fine-grained permissions to individual users or processes. Unfortunately, the kernel was then given to the UI and DOS compatibility teams, who decided that world-accessible was the correct permission for pretty much everything and that the default user should be the administrator, who can override most permissions.

Plan 9 is closer to what the UNIX model would look like if security had been a concern. It's recursively virtualisable, so you can trivially jail processes.

Re:Mod parent up.

[Anonymous Coward]

Back in the day, the informal metric that we used was: "It is twice as hard to work out someone else's code, than to rewrite it yourself."

Since most estimates are out by a factor of ten or so this should mean that building on someone elses work should still be five times faster.

Re:Mod parent up.

[jimicus]

Seriously? Security wasn't a key part of Linux/Unix?

Well, not with more modern security practises in mind.

The poster you're replying to is pretty much on the nail. Current best practise for setting up your systems for optimal security is "block everything, only allow through what you know to be good". This is why more-or-less every firewall on the market today has an implied "block all" rule which is quite often impossible to turn off.

It's also why it's generally considered a bad idea to block SQL injection attacks purely by scanning for and refusing to insert fields containing "bad" strings - you only need to forget one tiny thing and your security's blown wide open. Far better to write your code so it only allows known-good stuff through.

And yet with every modern operating system, we do the exact opposite. We execute more-or-less anything that's given to us and rely on some piece of software to detect the bad stuff, and as a result we're only ever one hitherto unknown security hole in away from the entire system being compromised. Windows is the most well-known example, with new holes being discovered fairly regularly, but there's no magic voodoo in Unix that would block most of these holes. The closest you get in Unix is that a non-root user can't mess with applications that are outside of their home directory, but that's little comfort when there hasn't been malware that depends on doing that in several years. This is why the Stuxnet worm has managed to spread as far as it has.

The closest we have to an answer is (or rather, looks a lot like) Trusted Computing, but with the ability for an individual or organisation - rather than the RIAA - to dictate what it is they trust.

Re:Mod parent up.

[RichiH]

That as may be. But look at their relative security track records.

Re:Mod parent up.

[rtb61]

This is not just a 'er' new operating system but an operating system that will naturally run windows programs. So either it is a massive rupee black hole that a few tech companies intend to cash in on or it will be re-branded windows with an incompatibility-compatibility layer built in.

Most computer security experts will tell you that security via obscurity is a fools trap, one just one greedy contractor or employee and your security via obscurity, becomes your hackers playground with penetration by bug obscurity guaranteed. The nightmare of, is it a bug or has someone hacked the system or, how much source code would you need to convince them you have more and demand non-disclosure fees.

The beauty of Linux all you need to do is compare the code you are using with the code that untrusted countries are using in similar situations. Paranoia demands that any discovered bugs are repaired, you can't leave them in place just in case your counterparts also know of them. In makes no sense to spend millions to hack software when it only costs thousands to hack weak willed trusted people and embed a bit of hardware into the system.

Of course the damaging message implied by the Indian government, they have zero confidence in windows security and they do have a copy of the source code to confirm it. Of course it could just be another Android http://en.wikipedia.org/wiki/Android_(operating_system) with a built in wine compatibility layer, the development effort they indicate sounds much more in line with that (of course with windows source code getting the best out of wine http://en.wikipedia.org/wiki/Wine_(software) becomes much easier especially if they 'er' borrow chunks of code from windows)

Re:Mod parent up.

[BasilBrush]

This isn't a question of NT vs Linux. It's a plague on both their houses. The poster who said the thing to do is write from scratch with a language and tools that have security foremost was right.

Re:Mod parent up.

[Chrisq]

Whilst it's written with C, you might as well be trying to repair a roof with swiss cheese.

Whatever language you write an operating system in will have to have the same "dangerous" facilities as C, pointer access, type casting, etc. Remember without an OS you cannot have safe managed code - you need to be able to implement things like page table mappings, page protection, interrupt processing, etc. Basically you are not going to get around the fact that writing operating systems is hard

Arguably in this environment C is safer than C++ because of its simplicity. Now that said, a lot of the utilities around the core OS could be written in safer languages.

Re:Mod parent up.

[Rockoon]

I used to monitor an independent organization that kept track.
Note that in the beginning there, all the exploits were either *nix or VMS-based, and that was because back then the internet was mostly *nix and VMS. It was only with the advent of PPP that brought millions of Windows machines directly to the internet that Windows became a target.

Even when CERT went down in 2003, there were still plenty of new exploits for *nix systems.. The standard sendmail was a notorious problem for more than a decade, with the same problems re-appearing again and again.

Its as if you guys think that people werent hacking networks before the WWW. Hell, my entire teenage years were before this WWW shit and I always managed to be on the internet by illegitimate means. Back then things were far more wide-open than they are now with "insecure as hell windows" .. you guys have no idea what insecure means. With a good exploit you didn't just own system after system.. you owned network after network.

Re:Mod parent up.

[BasilBrush]

This is so much more fundamental than file system permissions. Both OSs were written with in a language that doesn't bounds check strings and arrays as a matter of policy. The major cause of modern security exploits. A modern OS written with security in mind would have to be created with a systems programming language that at least does this.

Re:Mod parent up.

[BasilBrush]

Whatever language you write an operating system in will have to have the same "dangerous" facilities as C, pointer access, type casting, etc.

Nonsense. Object references do not have to be pointers. And casting is not a necessary part of a language. Converting from one type to another is necessary, but that doesn't imply casting (changing the type without checking and/or modifying the raw data).

For sure, at the very lowest level of the kernel you have to have some assembler code, and that's dealing with pointers and untyped data. But that is in the hands of the OS creators. There is no fundamental requirement to allow any third party to run software written in a non-secure language.

Re:Mod parent up.

[RichiH]

And when I was young, we had to walk to school, uphills both ways. We had to wrap barbed wire around our bare feet for traction on the dry ice that formed due to the cold.

In other words: I did claim that *NIX has always been perfect. I am simply saying they got their shit together a lot better, faster and more thoroughly than the Windows world.

Re:Mod parent up.

[MasterRat]

As someone who knows a bit about the origins of NT, with regard to Windows NT, you are full that substance that leads to substantial growth in the business...

Windows NT first several beta's booted using the OS2LDR.EXE file from prerelease versions of OS/2 2.0. The first thing you saw on the console was "OS2LDR.EXE ...". Eventually OS2LDR.exe got renamed, but it remained the same through at least the first release (I left Micrografx before the next release of Windows NT came out). In the end, Windows NT was more secure than it was when it started, but it was not "secure".

Windows NT was not designed for security -- The first version was hacked together using bits of OS/2 2.0 code, ports of existing Windows code, etc. For the record, I worked at Micrografx when they (a) had source code and early binaries of Windows NT, and (b) was part of the team that worked on OS/2.

With regard to your spurious example implying ACLs make something secure, again, you've been shoveling out the stables. ACLs do not make something secure (they may contribute to a security solution) and the lack of ACLs does not make something insecure. Security is not about how you achieve something, security is about what is achieved. Fundamentally, the only truly secure computer is one that not connected to a network, kept behind several locked doors, with guards that are so well paid or loyal such that they cannot be bribed. This goes on and on, no software added after security is certified, no external access other than keyboard, no externally accessible disk drives/cdrom/usb, etc. Everything else is a careful balancing act of risk, vulnerabilities, and mitigation.

Re:Mod parent up.

[Rockoon]

In other words: I did claim that *NIX has always been perfect. I am simply saying they got their shit together a lot better, faster and more thoroughly than the Windows world.

You claimed it, but have provided no citation. There is in fact very little reason to believe that "they got their shit together" .. the evidence, which I gave one citation of, indicates only that the preferred target is now windows .. that *nix is protected by obscurity, not security.

Re:Mod parent up.

[hey]

So ACLs = security ?
The relative simplicity of chmod means that people actually use it.

Re:Mod parent up.

[RichiH]

Next Tuesday, MS will break the record for patches in one day. Before the recent bzip2 DoS hole, I don't even know _what_ I patched last.

Your obscurity argument would hold more water if most *NIX would not dominate the server hosting as much as it does. And those machines tend to be unfiltered while Windows machines tend to be behind NAT/a firewall.

And finally, even _if_ the obscurity argument was valid (I happen to think it's not, feel free to disagree), there is no way to make *NIX less obscure just to prove your point.

So, for all intents and purposes, as of right now, *NIX is more secure.

Re:Mod parent up.

[Thing 1]

Both OSs were written with in a language that doesn't bounds check strings and arrays as a matter of policy.

Interesting... Adding those additional checks to the string and array handling will slow this OS down; it will not be as fast as an OS that does not perform these checks.

That's the theory. However, in practice, Windows chews up an entire extra core just running the antivirus software! I wonder if the additional checks would take an entire core? Doubtful.

Re:Mod parent up.

[slashqwerty]

Whatever language you write an operating system in will have to have the same "dangerous" facilities as C, pointer access, type casting, etc. Remember without an OS you cannot have safe managed code - you need to be able to implement things like page table mappings, page protection, interrupt processing, etc.

Even in an operating system much of the code is basic, ordinary loops, list traversals, indexing into arrays, and other simple stuff that doesn't require pointer manipulation. Which is why an operating system should be written in a language which requires the developer to consciously open up pointer manipulation and disable bounds checking rather than placing the burden on the developer to carefully check bounds everywhere on their own. The latter is virtually guaranteed to leave security holes as developers will undoubtedly forget to check bounds in at least a few places.

As another respondent pointed out, simple object references and type casting don't have to be done so loosely as in C. The careless way developers use pointer arithmetic and type casting in C lies at the heart of many security holes.

Re:Mod parent up.

[Chrisq]

I should have been more specific, you will need unchecked references and unchecked treating of data as different objects. If you introduce these you basically have pointers or casts by another name.

For sure, at the very lowest level of the kernel you have to have some assembler code, and that's dealing with pointers and untyped data.

Or use C

But that is in the hands of the OS creators.

What part of "Whatever language you write an operating system in" didn't you understand?

Re:Mod parent up.

[luis_a_espinal]

So ACLs = security ? The relative simplicity of chmod means that people actually use it.

If by people you mean regular users, then yes, DAC is sufficient. On secure installations, you need MAC, you need a lot more than chmod. A well configured NT system or a Linux distro with AppArmor or SELinux/FLASK can provide just that.

Re:Mod parent up.

[luis_a_espinal]

Next Tuesday, MS will break the record for patches in one day. Before the recent bzip2 DoS hole, I don't even know _what_ I patched last.

Your obscurity argument would hold more water if most *NIX would not dominate the server hosting as much as it does. And those machines tend to be unfiltered while Windows machines tend to be behind NAT/a firewall.

And finally, even _if_ the obscurity argument was valid (I happen to think it's not, feel free to disagree), there is no way to make *NIX less obscure just to prove your point.

Every single production UNIX/Linux box I've encountered has sit behind a NAT/firewall. Machines that are not unfiltered (be it *NIX or Windows) typically sit within an intranet already enclosed by NATs/firewalls.

So, for all intents and purposes, as of right now, *NIX is more secure.

"Being secure" is a broad subject. For many purposes *NIX systems are more secure (from the point of view of users requiring discretionary access control). But I'll ask you, how do you implement MAC on a *NIX system (one that does not have to be retrofitted like SELinux or Linux+AppArmor)?

Explain me how.

I work with UNIX/Linux all the time and it is my preferred platform. It's been like that for the last 15 years. But even then I'll be the first to recognize that a well-configured NT system is much more secure and easier to configure (for implementing RBAC/MAC) than a Linux system. In fact, you have to get a specific distro or tooling (.ie. SELinux which is what I work with, AppArmor, Tomoyo) to get the same type of access control configuration and enforcement.

Saying "this is secure" or "that is more secure" without specifying particular contexts, that's an exercise on fanboyism.

1. Any out-of-the-box Linux system is more secure (from a DAC perspective) than an out-of-the-box system belonging to the NT architecture family (which we will simply refer to as "NT system" for the sake of brevity).

2. Any out-of-the-box NT system tends to be as configurable (and sometimes easier) to be locked with MAC/RBAC for specific business contexts than an "armored" Linux system (be it SELinux, AppArmor, Tomoyo).

3. An out-of-the-box Linux distro cannot be locked down for MAC/RBAC policies. You have to "armor" them as described in point #2.

And that's what's important to recognize, MAC/RBAC is already built-in on NT (though most people are too dumb to do so). Similary, most people don't "armor" their Linux distros because they are too dumb as well and think that DAC is all that is to be.

Security is more than just preventing trojans getting installed on your personal computers while browsing the interweebz.

Re:Mod parent up.

[luis_a_espinal]

And when I was young, we had to walk to school, uphills both ways. We had to wrap barbed wire around our bare feet for traction on the dry ice that formed due to the cold.

In other words: I did claim that *NIX has always been perfect. I am simply saying they got their shit together a lot better, faster and more thoroughly than the Windows world.

Not true. The security model of UNIX is DAC based, reflecting a past when systems were secure by isolation. Almost no one was connected back then. The systems of the day did not reflect any of the realities Windows systems face nowadays. Not that it absolves the security blunders committed in some of the design of Windows. But the security architecture of NT (based in great part on VMS which was a lot more secure from the ground up than UNIX) is superior than what you find in a typical out-of-the-box Unix system.

Very few people armor their Linux distros to support MAC/RBAC (even when there are business reasons screaming for it). And the poor security track record of Windows systems have little to do with the NT security architecture, and more to do with the sheer number of deployments; the ambiguous role of providing "easy of use" in a time of great internet connectivity; and poor configuration practices (of which Linux folks aren't that innocent either.)

That the UNIX world got a security model faster than NT is trivially true. After all, the security model is DAC based and a reflection of the state of systems security and nature of installations 30 years ago.

Re:Mod parent up.

[RichiH]

> Every single production UNIX/Linux box I've encountered has sit behind a NAT/firewall. Machines that are not unfiltered (be it *NIX or Windows) typically sit within an intranet already enclosed by NATs/firewalls.

I know about a load of *NIX machines that are not behind any firewall whatsoever. Some run iptables locally, most don't.

And yes, by secure, I mean "keep others out of the machine". I don't care too much about local access control as different services run on different VMs anyway and the desktop machines only have a handful of users at max. And once there is reason to suspect anything has been compromised it's reinstalled, anyway. I am not sure how SELinux etc don't count as they are clearly something that exists within the *NIX context. That's like claiming the Windows family does not have have anything to write documents with as Office is not on the CD.

So, to be clear "in the context of direct & indirect remote exploits, *NIX is more secure than Windows". Also "in the context of direct & indirect local exploits, *NIX is more secure than Windows". I can't say too much about MAC on Windows as I don't really care or know much about it. I seem to remember several exploits bypassing most security measures, though. And less of those with SELinux.

Re:Mod parent up.

[RichiH]

You are right in a lot of what you say. Yet, none of this matters when Windows keeps on having gaping holes and *NIX seems to manage without those.

Torx is technically superior, yet you are more likely to have real-world success in the world of screwing with a Philips #2. And yes, the analogy is not 100% perfect.

Re:Mod parent up.

[BasilBrush]

I should have been more specific, you will need unchecked references and unchecked treating of data as different objects. If you introduce these you basically have pointers or casts by another name.

It's still nonsense with whatever words you use. There is no requirement for references or type conversions to be unchecked. Back in the 1970s when C was developed, it might have been necessary for performance reasons. Computers are now thousands of times faster and have thousands of times more memory.

What part of "Whatever language you write an operating system in" didn't you understand?

I understood your post perfectly. The point is that most security vulnerabilities are not at the lowest levels of the kernel. And those are the only parts that need something as low level as assembler. And no C won't do. At the bottom of any OS source code you'll find some assembler. Anything above that could be done with a secure language. And indeed it can be mandated that they be done in a secure language.

Re:Mod parent up.

[Chrisq]

The point is that most security vulnerabilities are not at the lowest levels of the kernel. And those are the only parts that need something as low level as assembler. And no C won't do. At the bottom of any OS source code you'll find some assembler.

About the only thing you can't do from C is register manipulation and soft breaks. Though strictly speaking it is using assembler at the extreme you would have one or two instructions embedded in c code.

Re:Mod parent up.

[DrgnDancer]

Uh... If you use 64-bit Linux it was the week before that with the 32-bit compatibility layer privilege escalation bug. I'm not saying that *nix is less secure than Windows, but lets not go pretending that RHN doesn't deliver me 2-4 security updates a week. Most of them are for applications, not the base OS, none the less there's holes and bugs in Linux as a system. SSL and/or SSH patches are pretty common too, and those are pretty much global across all *nixes.

You damage your point by pretending that *nix systems don't have their own patching issues. On the other hand I rarely have to reboot my *nix system for a patch, whereas my Windows systems reboot themselves nearly every time I patch.

Re:Mod parent up.

[luis_a_espinal]

You are right in a lot of what you say. Yet, none of this matters when Windows keeps on having gaping holes and *NIX seems to manage without those.

Torx is technically superior, yet you are more likely to have real-world success in the world of screwing with a Philips #2. And yes, the analogy is not 100% perfect.

Again, what type of security contexts are we talking about? For a point of view of end-user with DAC enabled, then yeah, those security holes you mentioned do matter. Those security holes exist because of a need/desire of having DAC combined with lax (or non-existing) secure systems administration.

From the point of view of isolated systems or those intended to run under a strict MAC/RBAC security model (which I think it's what the Indian Army will look for), then those security holes don't mean much since a MAC/RBAC policy becomes implemented (which can only be done with dedicated, security-aware business-specific systems administration.)

I know that many won't agree with this, and that is fine. My opinion is simply backed from working with secure deployments of both NT and Linux. I'm very biased towards *NIX systems. But even then I have to acknowledge that NT architecture with built-in integration with things like Active Directory and MAC/RBAC capabilities do make for a nice, secure and hardened package.

You can do the same with Linux, but you have to put all those integration pieces together. You have to pull a lot of things together (SELinux or AppArmor, OpenLDAP, Kerberos, etc). As of yet, there is no universally accepted procedure for going about it... and that is a security weakness.

NT architectures provide for a nice turn-key capability for implementing MAC/RBAC. I would still roll my sleeves and implement a Linux-based solution anytime (as a matter of principle and economics). However, I can't let that in good engineering consciousness stop me from admitting a NT architecture provides a superior solution (from the point of view of turn-key integration and configuration.)

Truth to be told, Linux/*NIX solutions for implementing mandatory access control models - as effective as they are - are still mired with the legacy of an obsolete DAC model. Furthermore, that obsolete model not only affects the operating system, but many of the sysadmins in charge of them (who can only think on DAC terms and who still think they can solve RBAC problems by using groups.)

So again, it is a matter of security context. Security holes encountered by a typical Windows users matter most in one security context. In others, they do not (as the security context solves them trivially.)

Re:Mod parent up.

[RichiH]

I don't pretend that there are not security issues within the *NIX world, but for the boxes I maintain, I average a lot less than one patch per week. No idea about differences between RH and Debian, but 2-4 sounds like a lot, to me.

Re:Mod parent up.

[BasilBrush]

And because you can't do register manipulation, you can't handle IRQs. But yes, it's pretty minimal the amount of assembler required. And none of it need be touched outside a core kernel team. Anything above that could be done with a language that does reference, bounds and type checking. Banning C and minimising the assembler would be a hell of a good start to creating a secure OS.

Re:Mod parent up.

[RichiH]

You are right about the turn-key comment. Full (optional) out-of-the-box integration of LDAP, Kerberos, etc in Debian would be a awesome.

Yet, I consider non-configured MAC on Windows as theoretical as SELinux on Linux. Your experience clearly makes you disagree with this assessment which is fine. I hope you can see my POV; I can see yours.

Re:Mod parent up.

[luis_a_espinal]

> Every single production UNIX/Linux box I've encountered has sit behind a NAT/firewall. Machines that are not unfiltered (be it *NIX or Windows) typically sit within an intranet already enclosed by NATs/firewalls.

I know about a load of *NIX machines that are not behind any firewall whatsoever. Some run iptables locally, most don't.

And yes, by secure, I mean "keep others out of the machine". I don't care too much about local access control as different services run on different VMs anyway and the desktop machines only have a handful of users at max. And once there is reason to suspect anything has been compromised it's reinstalled, anyway. I am not sure how SELinux etc don't count as they are clearly something that exists within the *NIX context. That's like claiming the Windows family does not have have anything to write documents with as Office is not on the CD.

On those systems you refer to, where they facing the external world, or where they inside an intranet?

So, to be clear "in the context of direct & indirect remote exploits, *NIX is more secure than Windows". Also "in the context of direct & indirect local exploits, *NIX is more secure than Windows".

Ok, I see now what your argument is, and I agree with you. I'll argue that those exploits are primarily the result of the DAC implementation as done by the NT architecture (and the OS families that follow it). That on itself is a severe weakness of NT, and I wouldn't argue against that.

I can't say too much about MAC on Windows as I don't really care or know much about it. I seem to remember several exploits bypassing most security measures, though. And less of those with SELinux.

Meh, I do have to care about MAC/RBAC on Windows and Linux for a variety of reasons - defense industry, plus I've worked in environments that require much more than what DAC provides (insurance industry, HIPAA compliance, attribute-based access control of private records.)

For some things, a NT architecture provides a nicer, easier to configure turn-key MAC platform than a SELinux based one. And on a business environment, many (not all) exploits would be solved simply by adopting a corporate wide MAC strategy. The reality is that NT systems won't go away anytime soon no matter how we try using modern Linux (or other alternative) distros. We have to work with them.

So the secure thing to do is learn how to secure them and how to manage security using a centralized (but easy to distribute), corporate-wide MAC policy. Ignoring that reality is not (and cannot be) part of a responsible security engineering process.

For the security problems faced by typical users on a DAC-by-default environment, that's a related, yet different problem altogether that requires different solutions (change in the NT architecture, or creation of safer, more secure alternative platforms for end-users.)

Re:Mod parent up.

[Rockoon]

Next Tuesday, MS will break the record for patches in one day.

So because MS issues patches on a monthly cycle that that is your evidence that Windows is less secure? Really? Thats the evidence you have?

Your obscurity argument would hold more water if most *NIX would not dominate the server hosting as much as it does.

# of computers / # of servers = X

If X is large then...

*nix fills the definition of obscurity outstandingly, so your shameful attempt to modify the argument into a "server hosting" twist is simply that.. shameful. Your twist on things is 100% correct, but still doesnt make *nix less obscure. I'm not going to bother to figure out which one of these you are guilty of, here.

They now attack windows because it is the majority of all machines networked, just like they attacked *nix before windows had that majority. Advisory after advisory for *nix and VMS, year after year.

So, for all intents and purposes, as of right now, *NIX is more secure and evidence suggests that this is because it is obscure.

There. Fixed that for you.

Re:Mod parent up.

[DrgnDancer]

Firefox by itself has been updated at least once a week for the last month. I suspect much depends on how you use your machines. A mail server, for instance, probably wouldn't have had any updates (other than the bzip and kernel ones already mentioned) all month. A workstation on the other hand has had (that I can remember off the top of my head, without looking at logs) at least the kernel bug, bzip bug, three or four Firefox bugs, and two Samba bugs. I also remember having to update Apache once this month so there's one for a webserver. SSL had to updated on pretty everything last month (unless you have some box that doesn't use SSL for anything). I tend to notice these things more than a lot of people because I admin several boxes that don't have Internet access and have to be patched manually. That tends to stick out in your mind more than just typing "yum update" or "apt-get upgrade".

I should also note that these were only the "critical" updates I had to do manually. My unclassified workstation has patched several minor security holes through RHN that I haven't had to manually update on the others. Just this morning I got Freetype, Poppler and KDE-utils updates. Firfox, KDE-utils, Freetype, and Poppler may not be part of the OS per se, but they're pretty important to the usage profile of a workstation machine, and fall into the same type of update as many Windows updates.

Re:Mod parent up.

[RichiH]

> On those systems you refer to, where they facing the external world, or where they inside an intranet?

Outside world. If you don't listen on ports anyway, where is the use in firewalling them? (Yes, there can be issues, especially with dDoS. But then, if your firewall has a remote exploit, that is additional risk, as well)

> We have to work with them.

You do, I don't. When I was approached about being the only one with Linux on the desktop and integrating into the Windows infrastructure, I told them that I would quit if I had to work on, or with, Windows. Problem solved.

This may sound like I am wagging my e-dick, but I am truly trying to make my POV clearer. Thankfully, I am in a position where I can truly not care about Windows other than the odd family members' plea for help.

Re:Mod parent up.

[Lonewolf666]

Which is why an operating system should be written in a language which requires the developer to consciously open up pointer manipulation and disable bounds checking rather than placing the burden on the developer to carefully check bounds everywhere on their own. The latter is virtually guaranteed to leave security holes as developers will undoubtedly forget to check bounds in at least a few places.

Good point, and I'd like to add that much of it could be achieved in "traditionally unsafe" languages too with compilers that offer bounds and range checking. You just need to activate those. I know for sure that Borland Delphi offers compiler switches to turn bounds and range checking on and off, just as an example.

Re:Mod parent up.

[RichiH]

> Firefox by itself has been updated at least once a week for the last month.

OK, dunno. I use Konqueror & Chromium.

> A mail server, for instance, probably wouldn't have had any updates (other than the bzip and kernel ones already mentioned) all month.

Also, most mail servers aren't 64 bit with 32 bit compability layer. ;)

> A workstation on the other hand has had (that I can remember off the top of my head, without looking at logs) at least the kernel bug, bzip bug, three or four Firefox bugs, and two Samba bugs.

I don't use Samba (other than on one single server for one client), so I don't see those patches, either.

> I also remember having to update Apache once this month so there's one for a webserver. SSL had to updated on pretty everything last month (unless you have some box that doesn't use SSL for anything).

Those were ones I saw :)

> Just this morning I got Freetype, Poppler and KDE-utils updates.

Assuming you mean KDE 4.x, I think I need to upgrade once I am home :)

Let's be generous and say that the patches above were due two two dozen distinct bugs. I chose a number that is about double of what you listed, on purpose.

Tomorrow, MS will release 49 patches.

Re:Mod parent up.

[DrgnDancer]

I'm not saying that *nix systems are not often better than Windows systems when it comes to numbers of required patches, just that they need their fair share. Your implication in the post I originally responded to ("I don't remember the last time I patched") was that you so seldom have to patch your Linux boxes that it's a completely trivial question. In fact, given a Linux box configured as a workstation, using mostly standard tools, patches are issued for at least several things a week. Patches are typically less painful than in the Windows world because so few of them require anything more arduous than a service restart, true. There are typically fewer of them, true. Just not "gosh I can't remember the last time I had to do this" fewer (unless your memory is really poor).

Questions of whether this number would go up if more people were trying to beat on the OS are difficult to answer, but it is perhaps telling that one of the more globally popular pieces of software in the "typical" Linux stack, Firefox, is also one of the ones that requires the most frequent updates. It could be that Firefox is one of the more poorly written tools in a the stack, it could also be that it's a much larger target because of its cross platform popularity.

Re:Mod parent up.

[luis_a_espinal]

> On those systems you refer to, where they facing the external world, or where they inside an intranet?

Outside world. If you don't listen on ports anyway, where is the use in firewalling them? (Yes, there can be issues, especially with dDoS. But then, if your firewall has a remote exploit, that is additional risk, as well)

I see your point (wrt to exploits on the firewall). Don't get me wrong, I know there are outside-facing boxes that are not behind firewalls (a managed box on a provider for example), and indeed if a box is not listening to ports, then it is typically not open to exploits.

Having said that, I (and this is just personal preference) prefer security in depth - double firewalled with actual firewalls around a subnet and software firewalls on the boxes. The advantage of this is (IMO) that the firewalls can represent corporate-wide policies, which are then further refined/restricted by the boxes (the later being dependent on the actual functions carried by each box.)

A glitch/exploit on a hardware firewall (or a configuration or patch mistake) is an (probabilistic) event that is independent on a glitch/exploit (or firewall config or patch on the box.) The occurrence of one gets ameliorated by the not-occurrence (sp?) on the other. Furthermore (and because these are independent events) the probability of both glitches/exploits to occur is less (sometimes substantially less) than the occurrence of a glitch/exploit on either the firewall or box.

The approach of double-firewalling (or n-firewalling) is safer by a factor of 2 (or n) than the approach of not having a firewall. The cons of this is the added complexity in configuration, management, patching and all that necessary crap.

The approach of not having a firewall is invariably less safe (also by a factor of 2... or n) with the pro of being simpler to configure and audit.

So, just like anything in software and systems, it is a matter of trade-offs, availability of resources and a clear understanding of the specific security requirements of an organization (is it sufficiently secure vs is is realistically manageable.)

> We have to work with them.

You do, I don't.

Lucky you:)

When I was approached about being the only one with Linux on the desktop and integrating into the Windows infrastructure, I told them that I would quit if I had to work on, or with, Windows. Problem solved.

This may sound like I am wagging my e-dick, but I am truly trying to make my POV clearer. Thankfully, I am in a position where I can truly not care about Windows other than the odd family members' plea for help.

Interesting approach. To each its own. For me, each OS is simply a tool, each with their weaknesses and strengths. For me and my purposes alone, I'd chose Linux. But when it comes to a customer or an employer, I'd recommend either one depending on the specific context according to an analysis trade-off. I wouldn't do my job (which is what I'm getting paid for) as an engineer otherwise.

Re:Mod parent up.

[RichiH]

> > Next Tuesday, MS will break the record for patches in one day.

> So because MS issues patches on a monthly cycle that that is your evidence that Windows is less secure? Really? Thats the evidence you have?

As you are into math: 49 / 30 = ?

> obscurity outstandingly
> shameful attempt
> which one of these
> evidence suggests that this is because it is obscure

Neither you nor me seem to have links to hard data handy, but at least one of us manages to stay nice :)

Re:Mod parent up.

[RichiH]

I did not mean to imply that I never need to update. But I do have problems keeping track as the frequency is rather low, for me.

> It could be that Firefox is one of the more poorly written tools in a the stack, it could also be that it's a much larger target because of its cross platform popularity.

I would tend to say it's a both of both plus the fact that by the very definition of a browser, you load & interpret outside stuff all the time.

Though Chrom{e,ium} is really popular as well and it has fewer holes, it seems.

Re:Mod parent up.

[RichiH]

I agree with what you said about firewalling. Some of our customers have two firewalls behind each other, some have none. Personally, I prefer zero or one. And yes, it's always a trade-off. No one but worms really cares about yet another tiny VM serving static HTML. Attackers _do_ care about financial management companies.

> For me, each OS is simply a tool, each with their weaknesses and strengths.

Same here. But same as I will not work with sub-standard screwdrivers (pet-peeve, long story) and rather bring my own bits and/or screwdrivers, I try avoid other tools I consider inadequate for reasons of sanity and efficiency. Windows happens to be among those inadequate tools, for me. I know & respect some people who use Windows exclusively, it just so happens that I can't use it while staying calm for very long.

Re:Mod parent up.

[Rockoon]

As you are into math: 49 / 30 = ?

So you want hard data.. Ubuntu's Lucid Lynx raw update list from 10.04 (April, 2010) to 10.04.1 (August, 2010) include more patches than I care to count. My estimate is 56 pages with 20 bug fixes per page, so well over 1000 bug fixes in 4 months.

Would you argue that it is more or less fair to be counting the number of bug fixes instead of the number of distinct patch packages released? Because right now what you have been doing is count the number of patch packages released while ignoring the total number of bugs that needed to be fixed, all the while ALSO wanting Windows to take the stain of application packages also released via Windows Update (ex: count Internet Explorer patches on windows, but don't count Firefox patches on linux)

Neither you nor me seem to have links to hard data handy, but at least one of us manages to stay nice :)

Hows this for not nice?

I run both Windows and Linux boxes. I have not tried to demean Linux in any way, and have only pointed out that it is Security through Obscurity. Meanwhile you have tried several times to demean Windows with unfair comparisons and logical fallacies. This proves that you wish to paint a specific picture decided upon priori, and are willing to do so shamelessly.

You are a Linux zealot and are thus completely irrational. I'm being nice on this one.

Re:Mod parent up.

[RichiH]

> My estimate is 56 pages with 20 bug fixes per page, so well over 1000 bug fixes in 4 months.

We're both aware that Multiverse & Universe contain a lot more packages than what MS offers. Also, we're both aware that MS can fix more than one bug with one update. So yah, apples & oranges.

Also, I did not say I don't include FF in the common Linux desktop stack. I merely said that I don't know much about how often they patch as I don't use it.

> I have not tried to demean Linux in any way, and have only pointed out that it is Security through Obscurity.

And I pointed out that I disagree with that assessment.

> Meanwhile you have tried several times to demean Windows with unfair comparisons and logical fallacies.

I know you claim that, I have yet to see proof.

> You are a Linux zealot and are thus completely irrational.

A detailed analysis if I ever saw one. As you are a fan of linking to lists for others to pick from, I'll be game: http://en.wikipedia.org/wiki/Ad_hominem /thread.

Re:Mod parent up.

[Rockoon]

We're both aware that Multiverse & Universe contain a lot more packages than what MS offers. Also, we're both aware that MS can fix more than one bug with one update. So yah, apples & oranges.

You want it to be apples to oranges when the sheer magnitude of the number of fixes to ubuntu are actually documented for you (you obviously didnt know that thousands of patches are needed every few months.)

Your attempt to belittle Windows because of "biggest patch tuesday ever" seems to have completely backfired for you. Thousands of patches for ubuntu in no more than 5 months. Thats *THOUSANDS*

I like linux but I dont like zealots that dont know what the hell they are talking about demeaning windows.

A detailed analysis if I ever saw one. As you are a fan of linking to lists for others to pick from, I'll be game: http://en.wikipedia.org/wiki/Ad_hominem /thread.

Did you know that Ad Hominem's must actually be part of the argument, ie, attempt to (oh look, its in your link) link the validity of a premise to a characteristic or belief of the person advocating the premise.
For example, calling you an ignorant dipshit is not an Ad Hominem. Saying that you are wrong because you are an ignorant dipshit would be an Ad Hominem.

Zealots and their faulty logic. Simply amazing.

Re:Mod parent up.

[RichiH]

> Your attempt to belittle Windows because of "biggest patch tuesday ever" seems to have completely backfired for you. Thousands of patches for ubuntu in no more than 5 months. Thats *THOUSANDS*

Yes. And if you would count single commits to all upstreams, it would be even more. Lines changed? Even more. Characters changed? *MORE*.

To cut out the sarcasm: For the 25.000+ packages in Debian, there have been a total of 153 advisories in 2010. http://www.debian.org/security/2010/

From what I remember when I still used Windows, most if not all patches that MS releases are either security fixes or updates for Media Player. But tbh, I don't care enough to look up what the last batch was about.

So yah, apples & oranges.

> > > You are a Linux zealot and are thus completely irrational.

> Saying that you are wrong because you are an ignorant dipshit would be an Ad Hominem.

Fascinating. Anyway, you summed it up nicely:

> Zealots and their faulty logic. Simply amazing.

They might want to review basic security

[antifoidulus]

Their model essentially is "Security through obscurity". Just because nobody else can see the source to your OS doesn't mean it won't be hacked. Indeed experience has shown us the exact opposite is true.

Re:They might want to review basic security

[amirulbahr]

Not about that. It is about having a basic level of trust in the software they are using to be sure that nothing malicious is coded in there.

Re:They might want to review basic security

[antifoidulus]

Yeah, thats my point, it's a really misguided trust. Unless they are so foolish as to believe that the same coders they do not trust to find potential hacks in Linux can code a secure operating system.

Re:They might want to review basic security

[sloomis]

If it is anywhere near some of the code I have seen from some India based developers, no one will ever be able to figure that shit out.

Re:They might want to review basic security

[BasilBrush]

Their model essentially is "Security through obscurity".

How do you know? Have you seen their plans? Or are you just assuming a slashdot summary based on two non-technical articles gives you the full information?

Just because nobody else can see the source to your OS doesn't mean it won't be hacked. Indeed experience has shown us the exact opposite is true.

Well experience certainly hasn't shown us that "with many eyes, all bugs are shallow" to be true. Two decades on and there's still a steady stream of vulnerabilities in Linux.

Security solely through obscurity doesn't work - hard coded backdoor passwords for example. But there's no evidence to suggest that obscurity on top of other security is negative rather than positive on the overall security of a system.

Re:Why not do *BSD or Linux code review and use it

[bsDaemon]

Exactly, and sharing vital technology with the enemy is mostly just a good way to ensure that everybody loses. Parity and equilibrium aren't good once the war starts getting hot, because then you end up with WWI.

Re:Have you ever met?

[Punto]

I've met a bunch of people who tell themselves that to keep feeling superior to them

If the 90s are to be a guide.

[Lord Kano]

6 months after the OS is declared done, all of the developers will have anchor babies in the US and their replacements will determine that the code base is a mass of unintelligible crap.

LK

Re:If the 90s are to be a guide.

[Anonymous Coward]

I suspect that if any of the developers of this OS want to move to the USA, they could easily get their green-cards as long as they went to work for the CIA. (posted anonymously to throw off the CIA monitor)

Re:If the 90s are to be a guide.

[Lord Kano]

Touché

Re:If the 90s are to be a guide.

[rve]

Anchor babies are an urban legend. Having a child who is a citizen doesn't give the parents any right to stay in the US.
Only when the child is 21 years of age and if he meets certain income criteria to show he can financially support them, he may apply for family reunification, which also isn't a right; it can be refused on a number of grounds.

Expats are likely to be in the age range of mid 20's to mid 30's. Younger than that you probably won't have enough experience for a company to bother sponsoring you, and older than that and you're less likely to go because you're already too expensive, have family obligations etc.This 10 year interval between mid 20's and mid 30's is also the time people are likely to have children, somewhere between finishing college and getting too old. You assume that the people you are mocking have children just to have a US citizen in the family. Try opening up to the possibility, however unlikely, that someone, somewhere, makes an important life decision without it having anything to do with you personally.

Re:If the 90s are to be a guide.

[Lord Kano]

Anchor babies are an urban legend. Having a child who is a citizen doesn't give the parents any right to stay in the US.

You're talking about the difference between theory and practice. In theory, no having a baby that's a US Citizen doesn't entitle anyone to stay here. In practice, no one wants to deport such people because a US Citizen, be definition, can't be deported and the no borders crowd will accuse them of breaking up families.

Try opening up to the possibility, however unlikely, that someone, somewhere, makes an important life decision without it having anything to do with you personally.

Try arguing against words that I actually say.

LK

Perhaps

[raind]

They could recruit the Indian recruiters who come to the USA, who call and ask - do you know AD, SQL, Oracle, Cisco, and are you certified in each?
 

"Trusting trust" attack can be countered using DDC

[dwheeler]

You're talking about the trusting trust attack, which was made famous by Ken Thompson.

Thankfully, you can counter the "trusting trust" attack using a technique called "Diverse Double-Compiling" (DDC). See the linked PhD dissertation for details.

question

[Anonymous Coward]

Does any modern military actually use Windows or other none open source in any critical systems?

Would anyone want to have their lives hanging on whether your Windows system won't malfunction or lag?

ReactOS anyone ?

[Anne Honime]

Didn't read TFA, but running windows apps in a reasonable time frame without windows pretty much entails a linux+wine stack or capitalizing on ReactOS. I'm leaning toward the latter in this case, I don't think the military needs something like directX, but a win2k substitute could do the trick if they have a massive windows based investment in terms of existing custom softwares.

Re:ReactOS anyone ?

[MichaelSmith]

Or maybe they had to promise "window" apps to their leaders and will deliver apps which do indeed have "windows", just not the microsoft kind. I doubt anybody will notice the difference.

Re:Why not do *BSD or Linux code review and use it

[king neckbeard]

The answer is to not have an unnecessary war. And besides, they could not contribute back if they really want to 'wage war,' although keeping up a fork would bear an added cost, but still probably be less than starting from scratch.

A new OS that runs Windows programs?

[Anonymous Coward]

Perhaps they should take over the development of ReactOS. (http://www.reactos.org)

Re:Why not do *BSD or Linux code review and use it

[w0mprat]

They probably think obscurity = security. By having their own proprietary OS will give them some kind of extra layer of security.

Which we all know is a fallacy. Like hiding valuables out of sight when locking your car. My wife still insisted she hide her handbag under the seat despite assuring her that security experts beg to differ. *Sigh*

Or could they be wrong?

Absolutely no "racism" at all.

[Anonymous Coward]

"Indian" is a nationality, not a race. So right off the bat there's absolutely no racism involved, as the GP didn't even mention any race at all! Only a nationality was mentioned, and you can't express "racism" towards something that isn't even a race.

At least make sure that race was at least mentioned, if you're going to cry "racism".

Re:Absolutely no "racism" at all.

[Anonymous Coward]

Why are you attacking me? Is it because I'm black?

Re:Why not do *BSD or Linux code review and use it

[Daniel Dvorkin]

The idea that an OS is equivalent to a weapons system is absurd, and thinking of it that way (which means it should be kept secret from potential enemies) is pretty much a guarantee of failure. "Everybody wins" is very definitely an option in the network security realm.

Trusting Trust

[wcl3]

They have a lot to do - they'll have to bootstrap this thing from the assembler on up if they are serious about security - http://cm.bell-labs.com/who/ken/trust.html

Re:Why not do *BSD or Linux code review and use it

[cupantae]

Like hiding valuables out of sight when locking your car.

Correct me if I'm wrong, but isn't that intended to not let the potential burglar know that there's any reason to break into the car? I think the analogy you need is something like developing an alternative to keys, rather than just improving the current designs as much as you can...

How long til they use wine/ reactos source code?

[youn]

Of course it is possible, but for some reason I don't see them reimplementing the whole win32 api on their own

Re:Why not do *BSD or Linux code review and use it

[dachshund]

Seems to me that plenty of countries (including the US) manufacture weapons for use and for distribution to other countries. Thing is, you're not at war most of the time, and you're almost never at war with everyone.

Re:Why not do *BSD or Linux code review and use it

[thoughtsatthemoment]

An OS is more like the blueprint for the weapons sold. Most countries sell weapons (often old versions) but most of time not the technology.

Haskell eq Curry? You're the only one

[Anonymous Coward]

I didn't catch it, not redundant at all

Re:Have you ever met?

[Anonymous Coward]

Exactly, my work with them has shown me that they are smart. They maximize pay by only doing exactly to the letter what I told them to do. If I don't mention to validate input every way I want it validated, they won't validate it that way.

So you can't just say "Make sure input is validated", you actually have to spell it out in every single way. "User should be able to drag X into Y" isn't enough, you need to explain exactly how you want this to go down. Anything you don't not explicitly spell out will not be done.

It's a pain in the ass, but it keeps them paid.

Yawn

[Anonymous Coward]

So they download one of those Fedora or Unbutu Linux source code, rename the Linux to Hinux or some such
and download WINE and say "We now have our own OS, and it will runs some window Apps"

Whoooopeeee, does it runs some windows WORMS too?

Oh please, these people can't even do a CGI

[Sarusa]

Has India ever produced any decent software? No. Every time we've outsourced to them (against my fervent objections every time but the first) they've been unable to deliver something robust, secure, or even functional - it always consists of code snippets they've Googled (TM), pasted together then flailed on till it compiles and produces the exact same output as the specification calls for (hard coded).

There's no freaking way they could write anything as complex as Windows compatible from the ground up (this is a gargantuan task for anybody), so it's going to be WINE on top of Linux or BSD with some splash screens stuck on it. 50 Indian outsourcers sounds about the right amount of people for that.

Less Secure

[Doc Ruby]

It seems to me that an OS developed by an org that's never made an OS before, by 50 people, that isn't examined by many people around the world in many different contexts and from many different approaches, is going to be less tested and less secure than other OS'es. Not to mention the lack of applications, and the burden of creating all the applications from scratch, and a developer community for them, and again the smallness and isolation of that community and its apps leaving security to a very few very busy people.

If I were responsible for protecting India's IT infrastructure, I might start an Indian state project to create an OS. But I'd just start with Android or Linux, and assign the people I have to investigating its open code for security holes and starting applications needed by essential Indian users. A lot less work, a lot more global partners to use (and many to omit from trust without losing everyone). Leveraging the English speaking skills of educated Indians to partner with people around the world to secure India.

Reading the press, it seems they're really talking about a component in their new line of spy and military satellites. They mention they've got orders from other countries. So probably this venture is not at all calculated on security rissk, but rather on a perceived market opportunity. In which case it is even more likely to totally fail, but not after wasting a lot of time and money better spent on actual Indian security risks.

Probably some general's nephew thinks he can sell some Linux clone to the government, and so the rest of the state and media apparatus starts talking it up.

Re:Less Secure

[Anonymous Coward]

But I'd just start with Android or Linux,

Better yet, OpenBSD. It's already audited.

Re:Less Secure

[Anonymous Coward]

You're making the assumption that the goal of those, who have scared politicians into this decision is writing a safe OS for the benefit of India.

Actually, they just want to cash in on the Stuxnet virus news.

Re:Less Secure

[netchaos]

If I were responsible for protecting India's IT infrastructure, I might start an Indian state project to create an OS. But I'd just start with Android or Linux, and assign the people I have to investigating its open code for security holes and starting applications needed by essential Indian users.

There is already a state backed OS named BOSS (Bharat Operating System Solutions) which is a Debian derivative. BOSS Linux

Re:Less Secure

[sconeu]

Not to mention the lack of applications, and the burden of creating all the applications from scratch

<SARCASM>
That won't be a problem. This miraculous new OS will run all Windows apps. RTFS!!!
</SARCASM>

unofficial name

[turing_m]

gollygOS

How to burn a billion $$

[woboyle]

All I can say is, good luck to them! Another bit of proof that those who can't, manage those who can, and those who are clueless want the impossible yesterday...

Re:Have you ever met?

[Anonymous Coward]

Have you ever met a india IT worker that has one speck of innovative Stinking?

Regular bathing and deodorant for the win. Dr. Ravi Chandradeshkar can explain protein folding like nobody else can, yet he never bothers to explain why he chooses to culture that which is fed with curry and grown in his underarms and his groin, to the detriment of those around him.

Re:Why not do *BSD or Linux code review and use it

[timeOday]

Like hiding valuables out of sight when locking your car. My wife still insisted she hide her handbag under the seat despite assuring her that security experts beg to differ. *Sigh*

Are you joking? Leaving valuables out of sight definitely is a good precaution. It wouldn't work if thieves were allowed to methodically search through each car (akin to a port scan) but they aren't.

The ARE expecting security through obscurity

[ka9dgx]

'Though it will be a real-time system with Windows software, source code and architecture will be proprietary, giving us the exclusivity of owning a system unknown to foreign elements and protect our security system,' Saraswat said after unveiling a training facility at the Centre for Artificial Intelligence and Robotics (CAIR), a defence lab in this tech hub.

Classic first timer mistake.

No mention of capability based security either.

At best they end up with a bad clone of Windows or Linux.

Re:The ARE expecting security through obscurity

[devent]

I guess they are just going to have a contract with Microsoft. It will deliver them Windows CE in a new India look.

Seriously, how long it will take and how much do they think in will cost to create not only a full operation system from scratch but add the whole Windows API to it? If they are going do proprietary they can't re-use any code from Linux, Wine or GNU. The Linux kernel (Fedora 9, linux-2.6.25.i686) costs about $1,372,340,206 to develop. Now if you only going to develop 10% of it, it will still cost you 137 million dollars. Add to it the costs for proprietary code (bought code or self developed code, like the compilers, development tools, a window manager) and the Windows API layer.

Maybe the developers are way cheaper than in the USA/Europe but with the costs are going to be at least 200 million dollars. For another invented wheel with the same bugs and security holes like linux 1.0.

Re:Why not do *BSD or Linux code review and use it

[Jeff DeMaagd]

With some 100% home grown OS, then we can be pretty sure that some large military contractor wins, at 250% of the quoted cost. Whether that results in something that's usable in war is an open question.

What about the CPU (and other) microcode?

[PatPending]

Why stop with the OS? I.e., what about the microcode in the CPU and etc.? Is India also going to write their own microcode?

Re:What about the CPU (and other) microcode?

[ChunderDownunder]

China did

It's 'MIPS compatible' but includes Hardware-assisted x86 emulation for running Longene, China's Windows-like OS.

Kind of makes you wonder, if national security wasn't at stake, why India wouldn't just team up.

Re:Why not do *BSD or Linux code review and use it

[man_of_mr_e]

No, an OS isn't a weapons system. But it is a defense system. They are not the same thing.

Why would a military OS run Windows software?

[Anonymous Coward]

If this is a true military project, then why would compatibility with Windows software be a priority?

If it's a more general project that just happens to be run by the military, then it's just a waste of money in the name of nationalism.

Either way, this doesn't seem like a project with a bright future.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Price of software development is within reach

[OrangeTide]

If you were to put together a custom made operating system and software suite for the handful of applications needed for government and military purposes, I'm guessing it would land in the price range around 100 to 300 million (if the US government did it). Probably more like 10 to 30 million if the Indian government did it (they have much better spending oversight). In the grand scheme of things that is relatively affordable.

If you just want an OS and one or two applications for a single platform (PC, custom hardware, I don't care), you can do it on the cheap. about $5m (maybe $10m if you run it like a government operation) by my calculations (8-10 software engineers, managers to support them, working for 2.5-3 years).

As for military level interoperability, that's irrelevent to custom software stacks. if military contractors that historically don't get along with each other such as Lockheed, Boeing, Raytheon, Northrop Grumman and Aerojet can make systems that are compatible with each other for the US and NATO allies (including software and protocols), then it is possible for any nation to define and make their own compatible software systems.

Making an OS that can run one or two Windows apps that you select ahead of time is not actually that hard. It's a solved problem. Wine and ReactOS already have beaten a path there, and Microsoft has made devising third party compatibility easier due to their consolidation of their OS families.

Frankly custom software development is something within reach of any government or large corporation, and has been for quite some time now.

Re:Price of software development is within reach

[dakameleon]

they have much better spending oversight

HAH. oh lordee, the Indian government has better spending oversight than the US? HAH. ...

Wait, I'm sorry, you're serious? The rest of your post makes sense, but that line there just asks to be called out. Got any sources? Because I've got one that says it ain't so, and that's for damn sure.

Re:Price of software development is within reach

[RaymondKurzweil]

they have much better spending oversight)

Somebody else already said a similar thing, I see.. but...

Ha Ha Ha Ha Ha... That is a good one.

BTW: Another possible explanation for the reason that the Indian government can't be fleeced to the tune of some other nations is for the same reason that you usually can't steal a million dollars from a homeless person.

Re:Price of software development is within reach

[amRadioHed]

How quaint, but 100% cost overruns are nothing. Look at something like the F-22, or Boston's Big Dig project if you want to see what real runaway costs look like.

Re:Price of software development is within reach

[nacturation]

Got any sources? Because I've got one that says it ain't so, and that's for damn sure.

What an unfortunate name... from the article you linked: "But the Sheila Dikshit government refuted the party's claim."

Re:Price of software development is within reach

[Chrisq]

Got any sources? Because I've got one that says it ain't so, and that's for damn sure.

What an unfortunate name... from the article you linked: "But the Sheila Dikshit government refuted the party's claim."

Its pronounced Dixit or Dixhit (probably closest English pronunciation),. If that were my surname I would spell it that way too, ISO 15919 notwithstanding.

Re:Price of software development is within reach

[Anonymous Coward]

Worse than the american, Randy Bumgardner?

Re:Price of software development is within reach

[Chrisq]

Worse than the american, Randy Bumgardner?

I once worked with a guy called Alex Dix (I must be careful he was a slashdotter) which when said quickly sounds the same as "Al licks dicks"

Re:Price of software development is within reach

[socsoc]

Look at something like the F-22

Ah yes, the plane with pilots that wake up daily and say "fuck off physics, I'm gonna do what I want."

No other country can match that jet and we don't export it. It coulda been more expensive and I would be okay with it.

Re:Price of software development is within reach

[MaskedSlacker]

That they only bought 187 of before shutting down the production lines because it doesn't meet actual military needs?

Re:Price of software development is within reach

[tibit]

Custom OS + software suite for $100M-$300M USD on a US Gov't contract? What are you smoking??

To give you a sense of scale: the City of New York has had a bunch of contractors working on implementing a city employee timekeeping system. It was around 10-15 contractors from what I recall, working for a decade, each paid $500k+ gross yearly. We're talking $50M-$75M USD for a project where nothing got accomplished at all.

On a big government contract, ten times that will maybe buy you solid paperwork: specs, design documents, validation plans, whatnot. Probably not a single line of code, though.

Re:Price of software development is within reach

[socsoc]

It makes for a kick ass air show

Re:Price of software development is within reach

[Anonymous Coward]

It's not unusual for aerospace projects to implement a custom operating system, and that is just one tiny part of a project that can often be well under $100m.

I wouldn't suggest using NYC (or SF or Boston) as an example of how a typical government project goes. Those three cities have some of the most corrupt and worse mismanagement in the US, DC is not so great either but they don't blow a lot of money of huge projects they just stumble around instead. Federal government projects with dozens of different contracts are not some shining example either, but they are better than keystone cops organizations like SF city council or any NYC board.

Re:Have you ever met?

[Anonymous Coward]

I think you're confusing "smart" with "totally lost".

They aren't trying to maximize their pay while minimizing their effort. They're just looking to be told exactly how to do tasks that should be trivial even for a novice software developer.

Sometimes it gets truly hilarious. You pay them to develop, say, a C# application. You send them extremely detailed requirements written in English. Weeks go by, and any follow-up requests are ignored by them. They finally respond to you a few months later, but ask you to "clarify" the requirements you sent them by C# code. It sort of defeats the purpose of hiring them in the first place.

I'm in awe.

[Tumbleweed]

Obviously, they're not going to develop any such thing. Ever. This is one of the most brilliant job security moves I've ever seen in the computer industry. Kudos!

Re:I'm in awe.

[Anonymous Coward]

Obviously, they're not going to develop any such thing. Ever. This is one of the most brilliant job security moves I've ever seen in the computer industry. Kudos!

It is not the "computer industry". DRDO is the government and once U R employed, it is highly unlikely that you ever are removed from the job.

I hope they call it Sakshat, v2

[Anonymous Coward]

From http://forum.lowyat.net/index.php?showtopic=1561099

The Indian government is to launch its $35 Android tablet in January 2011, surprising naysayers and making it the most accessible tablet computer on the market, which will in turn bump Android sales even higher in comparison with the iPad..... ..... Sakshat is nothing but Hivision Speedpad, a $100 Android tablet made in China.

Even now the Indian government still insists that the Sakshat is "the result of hard work done by top Engineering colleges in India" !!

Re:I hope they call it Sakshat, v2

[Anonymous Coward]

Are you knocking that gruelling 10 weeks they spend in "How to infringe copyrights" and "Re-branding Other Peoples Work 101" before they graduate?

Re:Why not do *BSD or Linux code review and use it

[Anonymous Coward]

umm, the security experts do actually recommend you remove the valuables from sight.

the goal is to make your car less likely to be broken into, since there is less reason for a criminal to break in. You're not protecting against the person who is breaking in and then seeing what's available, your protecting against the person who walks down the street, past the car, glances in, see's a purse, and thinks "easy target, smashing time"

A new OS in $35 Tablet

[Anonymous Coward]

Guys! you are mistaken it is an OS for $35 Tablet that will be used by the Indian Defense.

windows binary compatibility?

[loki_tiwaz]

there is several projects aimed at running windows binaries, one of them being an NT clone, dos clones already exist and can be made to run windows dll's on top for an olde worlde windows, and of course wine. i personally hope what it will involve is a bsd core running a customised and advanced wine fork, i mean, considering brazil and several other countries are going linux and open source it would be stupid of them to not collaborate with their fellow rising industrial stars like brazil who iirc are moving their government IT over to open source. a 99.9% binary compatible framework to run windows apps would be beneficial for everyone who is not NATO, indeed i can imagine some of the more client-agnostic big tech contractors who help build military stuff would love to be able to sell their windows-targeted software to someone else... brazil, india and russia at least would all be interested, china is too closed to alliances in any way but who knows, if india gets their project off the ground and achieve their goal.

remember, a lot of those windows programs are now partially developed by indians... if anyone can make a fully binary compatible windows environment, it's india. they've been doing so much of american-based multinational corporations' development already they have a rich developer skills base.

in house use

[Anonymous Coward]

the source does not need ot be open for others to see. THATS GPL....anyhow...and BSD its almost a do as you want ....

Support?

[dakkon1024]

I wonder who they will call for support?

Re:Why not do *BSD or Linux code review and use it

[osir]

You confuse isomorphism with compliment. While information hiding is not a replacement for all other security measures, it does stack nicely on top of them. Just like locking your car door can only hope to keep lazy people and determined racoons out of your car. The only viable result of security is to delay and deter possible loss. If you think stronger security measures do anything else, and information hiding doesnt do it at all, you are misinformed. I dont think the indian government is trying to hide its keys under the doormat.

Re:Have you ever met?

[Panaflex]

Yes I have met some amazing Indian developers out there. There are also many H1B visa programmers who may be lacking in experience and are desperate to succeed in a foreign country which, lets be honest, considers them outsiders. They make half the pay in many situations and can be fired and sent home in the span of a week for any petty job disagreement.

True innovation requires the ability to make mistakes, learn from them, and try something new - which is contrary and alien to the H1B "cog developer" system. I doubt many Americans could be as disciplined and work under such pressures and situations.

Back home, India is building a truly amazing scientific pool of talent. Expect to see major challenges to American engineering & science - the population numbers game almost guarantees 3x the genius-level talent waiting to be discovered and educated.

Tech Support

[binaryseraph]

Wonder if they will outsource the tech support to the U.S. Oh, Irony.

Re:Tech Support

[seven of five]

Please stay on the line. Your call is very important to us!

a real-time system with Windows software

[flyingfsck]

'Though it will be a real-time system with Windows software'... Uhmm, uhh, yeah, right...

Re:Why not do *BSD or Linux code review and use it

[weicco]

Maybe that would be a sane decision to make but I personally would like to see a totally new OS which is not Yet-Another-Unix-Variant or another Linux distro. I don't mean that there's anything wrong in Unix or Linux or in any other current OS. It's just that, well, new is new, and if they can come up with brand new ideas to do things (and share it with rest of the world on at least some level) then all the better.

Re:Oh please, these people can't even do a CGI

[dbIII]

Here's how some outsourcing places work, and it's an old model used from the Rocket program under Stalin to US and Indian businesses:
At the start you have the experts and they have people that need training but they pretend to be experts. After having contact with your experts for a while they vanish to work on higher priority projects and you are suddenly in contact with a new lot of people that really need training. In the end you are milked dry with nothing to show for it other than what is obviously some first attempts in whatever environment you have. Your project doesn't matter, the technology transfer and your cash are what the outsourcing company is aiming for. It's very similar to the long running project German rocket scientists were put on in the USSR that never got anywhere but trained a lot of staff for the real rocket program.

Re:Why not do *BSD or Linux code review and use it

[martin-boundary]

Parity and equilibrium aren't good once the war starts getting hot, because then you end up with WWI.

WWI was only bad for the soldiers, but it was actually one of the better world wars for the civilians. I don't know about you but that's a win in my book.

Re:Why not do *BSD or Linux code review and use it

[SlashDev]

Euhhh because of licensing issues maybe?

Re:Have you ever met?

[SanityInAnarchy]

Except that's exactly the reason you'd hire a software developer in the first place: to figure out what "Make sure input is validated" means. If you have to spell everything out in English, and you can actually work out the implications, then these "developers" aren't developers at all, they're just glorified translators -- which is even worse if they don't have a solid grasp on English.

Now, I did have an Indian coworker who was perfectly capable of everything any American is capable of doing, and I've never worked with an outsourced team, but I do know that much -- yes, we need clear specs, but if the spec actually spells out everything, why not just write the spec in something Turing-complete?

Re:Have you ever met?

[Tanktalus]

Have you ever met a india IT worker that has one speck of innovative thinking? I certainly haven't, they are fantastic of doing what they are told but ask them to come up with something on their own and expect to be disappointed. I cannot say I am surprised they want to install a branding wall paper and call it the new India OS.

I know I'm going to get killed here, but I pretty much agree. In my experience, the likelihood of finding a competent developer in India is about the same as finding a completely useless developer in North America or Europe. Which is to say, not necessarily rare, but not the normal case, either. And I know the "racism" card will come out, but I'm also not talking race. I'm actually not even talking nationality. I'm really talking about location. The Indians I've met in North America, even if born and educated in India, were, as far as I could tell, statistically the same as the rest of the North Americans (which would also include, with no pun intended, boat loads of Chinese immigrants as well as Arabians, Africans, and, yes, even a few Caucasians): some incompetents, but generally somewhat competent to excellent. The ones who were still in India were almost never competent, though I can think of a few stand-outs that were above-average even among Westerners.

Glorious GHANDUX

[Anonymous Coward]

Maybe the Indian military brass saw an iPhone and thought that every soldier could have a radio/computer.

Rugged, much larger than the iPhone.

Not just one puny cellular radio, but high powered multi-band, multi-protocol radios. Each with an AD/DA. Add a DSP, a crypto accelerator and a communications processor, and you've got every last one of your 2.5 million active and reserve personnel one of these radiocomputers.

Running India's custom OS, part of a national digital encrypted radio grid that covers the continent and beyond. It can deliver intelligence into the hands of every indian soldier, and it can be expanded greatly with india's own personal military area network protocol. Soldiers can be equipped with wireless heads-up displays, communications headsets, life-capturing webcam, vital sign monitors, and even a danger-warning system to shock them mildly in case of imminent danger.

If India wants to deploy over 10 million of these units, to the active military, the reserve, all national security force, police forces and other emergency personel India doesn’t need to use an existing OS. The 50 top indian computer scientists can perhaps create such a system within months Or realize that 10000 of the country’s top programmers must be recruited for the occasion.

In one year, they will have the OS running on experimental hardware and thousands will be working on the software. The sheer amount of raw indian computer genius found in this organisation will create a new OS at an unprecedented speed, of this there is no doubt.

Before the year 2012 India will have finalised hardware and begun mass production. By inauguration day 2013, the indian military will be fully linked by computer. All 2.5 million soldiers will be connected to the central indian military computer also running the new OS – which will have the ability to scale to up to 16384 cores by 2013.

Only 16K ARM cores you say, how could such a puny system (compared to the behemoth supercomputers of America) be used to control an Army?

Simple.

The real computational power will be provided by 16384 commercial off-the-shelf high-end video cards acquired from the open market. Equipped with the most powerful American GPGPUs of the year 2012, this will form a supercomputer of impressive proportions. Of course, American supercomputers are considerably more powerful, but the sheer visualisation power of all these processors will allow one thing:

Indian generals will be able to direct the battle from a vast number of command rooms. Those CAVE-inspired rooms will offer 360 degree 3D display. As many as eight thousand indian generals will each occupy on such virtual war room with his aides, and will direct the battle from afar with unprecented skill and courage. The live intelligence being fed straight to the general will let him understand what his troops are feeling. He will be able to activate the FPV mode and see what any soldier on the field, anywhere in the world, is seeing.

Also, India’s new OS will be able to control drones, many kinds of drones. Drone planes, drone tanks, drone boats Those will form the primary line of attack against the enemy. First drones will crush all resistance at no risk to indian human life, then the soldiers will march in and secure the area. Drones powered by India’s powerful new operating system can easily destroy all enemies with tremendous ease. The artificial intelligence network will be built-in from the beginning, so that drones can adapt to any situation.

This new operating system clearly promises to grant india military superiority in throughout the continent. Today the 50 greatest indian computer geniuses have embarked on the greatest conquest of their lives: the creation of GHANDUX.

Re:Have you ever met?

[Anonymous Coward]

If they are so smart, how come they live in igloos.

Re:Have you ever met?

[Anonymous Coward]

Have you ever noticed that the cultures with the biggest fear of "dirt" are the ones that are the dirtiest?

Re:Why not do *BSD or Linux code review and use it

[oiron]

We don't know from that article, but I suspect that this may be what they end up doing anyway. Otherwise, 50 people to develop a complete OS? Fat chance!

WTF

[SnarfQuest]

They want to develop a secure system, yet they base it on the least secure system in existence? The API was never designed with security in mind, and you cannot ever safely attach a bare Windows system to the net without it getting owned in less than a minute. Do they really believe they can wave a magic wand over the massive amount of Windows code, and make it suddenly secure? The security problems don't sit entirely in the Windows code, it also exists in the innumerable poorly written applications. If you run these apps, then you don't have any change at securing your code.

Re:Why not do *BSD or Linux code review and use it

[mcrbids]

It's obvious. It's also most likely what they are doing.

For most people, Android is a "new" O/S, not a flavor of Linux! China has their "Red Flag" Linux, which likely meets similar criterion. Seriously, Linux is taking over the computing world, showing up everywhere from your phone to your router to your DVR to your State-sanctioned O/S!

Re:Oh please, these people can't even do a CGI

[Sarusa]

That more or less matched what we saw - there were two marginally competent people I can think of in the outsourcing organizations. They disappeared after six months, off to better things.

Both of them were what I would consider intern level - I might trust them to expand a CGI, but not write an OS. But there could be extra levels of this we didn't see where they grind the weak into meal while the rest level up to become super-coders. That would take a hell of a lot of work on this weak material though.

It's cultural, so I'm sure they'll be kicking us to the curb in a few decades once they start valuing results over hierarchy.

Re:Why not do *BSD or Linux code review and use it

[BlindRobin]

From my experience working with Indian software developers this is actually what they intend, however they will rename, shift and colour everything so that it is superficially "new", add the few bits of which they are actually needful and proclaim it NEW OS. They learn from the best such as [Large Ubiquitous American Software Company From Which None Can Escape].

Outsourcing?

[Anonymous Coward]

Do you think they might outsource some of the work here in the U.S.? We have a lot of unemployed software developers and I'll bet they will work for half of what a software developer in India will.

Re:Why not do *BSD or Linux code review and use it

[Anonymous Coward]

In case of an attack, the attack against a brand new unique system becomes a stronger evidence against the intruder about his motive, than an attack against Linux/Windows.

Less likely than a $35 tablet?

[spaceturtle]

India has announced a tablet that costs less to manufacture than the memory chips included in their tablet, though for some reason I can't seem to buy one yet. Once I read that the OS could run Windows, and was (to be) developed in India, I just thought "Ah another one of those announcements". I wonder why no government scientists outside India seem to be able to announce results?

It's not the Wheel

[Casandro]

People today are contempt re-inventing the flat tire.

One prominent example is the light-pen. Back when the first one was invented, the creator figured out it was a bad idea, as it's uncomfortable to hold your arm in the right positions for longer amounts of time. Yet it got re-invented over and over again, and even today we have desktop computers with touch-screens which have exactly the same problem.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Stuxnet ... and a nuclear reactor

[Gopal.V]

I think this has sort of been prompted by what happened to Iran and the recent attack with the Stuxnet worm. India has a significantly advanced nuclear programme, which is (and should be) doing research into thorium based nuclear power, which has potential for export. The Kalpakkam reactor just finished the 25th year of its running and the next generation of engineers are picking up after the recent retirees from that programme.

If I had to guess this would be QNX-ish operating system, not a windows clone in any sense of binary compatibility. The "windows software" comment is very likely to mean that this is a GUI operating system, not an embedded firmware version.

There has been significant work into the Linux kernel locally (like the Param Supercomputer). So OS level work is not as alien to these people as you might think. Either way, it's a good initiative, even if it crashes & burns.

Re:Why not do *BSD or Linux code review and use it

[Kjella]

No, but it's possible that no side is vulnerable to cyberattacks and they have to fight it out the hard way. So you make a choice, do you build the best system you can or do you build a poorer system because the other one might possibly help the enemy? Chances are, most of your enemies are using a completely different system, or they're using it in a different way, or they've hardened it in ways that make it irrelevant. Why did the NSA release SELinux? Make standards like DES and AES? Because it's more important to have secure systems yourself than anything people might possibly learn or take from it. This is "battle-hardened" code, hardened in the fight with hackers every day.

Also, it's not like you need to need to review all 13 million lines of Linux code. Strip all drivers, all archs, all modules you don't need and it'll be a quite manageable size. It'll certainly be far les work and far less buggy than trying to write anything from scratch. At least if you're going for anything like a "normal" OS...

Bollywood

[freelunch]

Bollywoodnix

Microkernel to the rescue!

[VincenzoRomano]

I hope the new OS will be a microkernel one, like L4Ka (or L4 in general) or Minix.

Re:Microkernel to the rescue!

[Troll-Under-D'Bridge]

You forgot the most famous one.

Re:Microkernel to the rescue!

[BasilBrush]

No he didn't.

http://www.googlefight.com/index.php?lang=en_GB&word1=hurd&word2=minix

Re:Microkernel to the rescue!

[ebuck]

I hope the new OS will be a microkernel one, like L4Ka (or L4 in general) or Minix.

<punAlert>
Well, at least then they could join the Hurd.
</punAlert>

Re:Microkernel to the rescue!

[bigato]

I hope the new OS will be a microkernel one, like L4Ka (or L4 in general) or Minix.

Please people, could someone tell me why is this modded funny? I'm serious, minix isn't a good idea here?

Re:Microkernel to the rescue!

[Troll-Under-D'Bridge]

I didn't Gnu that!

Simple reason : Its the money honey

[tanveer1979]

In India, any govt project implementation is chosen based on money laundering opportunity. for example Common Wealth Games scoring software(medals tally thingy) cost 26 million USD). Previous games had similar software for around 7-8 million dollars. And guess what, the current implementation of this solution is buggy and crashes frequently.

So now lets come to the new OS. Imaging taking Linux or FreeBSD, and then looking at the code, this would result in much less money spending which would result in less siphoning.
However, majority(99%+) of the public in India are moronic, and if you say the 3 code words "Patriotism" "National Security" "Terrorism", their idiot mode gets activated, which does not understand that if you are running an application which is malicious, the secure operating system(supposedly) will make no different.

So do not argue on the technicalities, because the decision is not technical. The decision is monetary, and I am sure nobody here can give a counter argument that a more efficient solution will lead to more kickbacks and money laundering.

Re:Simple reason : Its the money honey

[dave87656]

if you say the 3 code words "Patriotism" "National Security" "Terrorism", their idiot mode gets activated

Is that any different in the rest of the world?

Grigoriy Perelman Mathematics Institute

[Baldrson]

So you just set up a Grigoriy Perelman Prize for Mathematics where the Prize is you get to run your own mathematics institute the way you want if you prove RSA secure. Grigoriy Perelman wins the prize. Then all DRDO needs to do is create a virtual machine where the only addresses -- including network addresses -- are secure public keys.

Re:spammer

[Anonymous Coward]

tada, someone has broken the captcha. I've been talking about this for a long long time on those posts full of random garbage, and here we have some actual spam. brace yourselves, boys, we're in for it now.

Re:Why not do *BSD or Linux code review and use it

[pjt33]

But bearing in mind that a number of the participating countries introduced conscription, being a civilian at the start didn't guarantee that you wouldn't be forced to be a soldier and end up dying of chlorine poisoning.

security through obscurity

[Anonymous Coward]

It can be slightly more secure throught old and foolish adage of "security through obscurity". It will sure be full - or perhaps fool - of holes and bugs, but I will not be that easy to find them...

Bummer

[qmaqdk]

...At least one of the linked articles says the new OS, though home-grown, would run Windows software.

Before I read this I was imagining that they might give Theo a run for his money and develop a super awesome Linux-derived OS.

After I read this I was imagining a Windows ME clone based on Wine, with security through nobody-wants-to-touch-it.

Re:Why not do *BSD or Linux code review and use it

[jdc18]

Yeah I was going to make the same comment. Linux and BSD have years of coding. It just doesnt make sense. As far as I know the NSA used linux and that is how SELinux showed up. It is always hard to explain to some people why free software /open source can benefit them.

it's true!

[Anonymous Coward]

They are a proper commonwealth bureaucracy, they will spend £10 to oversee £1. The Americans just assume that 7 out of 8 dollars will be stolen out from any funded project. So a lack of oversight is for them more efficient, even if it is more corrupt.

Not really developing new OS- new GNU/Linux flavor

[Anonymous Coward]

I doubt they are really developing a new OS in the sense we techys think. They probably are just rehashing GNU/Linux and at best removing binary blobs. That would be a security enhancement though. And if they are hardening it in any way it could be a smart move for India. The question is are they doing this? How else would they ever manage to accomplish any sort of MS Windows compatibility?

Easy project?

[xot]

Considering the amount of Indians that are part of the teams that make operating systems and related software, it should be cake walk. Add in the Indian govt bureaucracy, its a project destined for failure.

$20 says it's a Linux variant

[BLToday]

You're not going to start with a blank slate and work from there. I don't care how many programmers you can throw at creating a new operating system, it's not going to be solved in reasonable (under 3 years) amount of time. If anything it's going to make it worse. Probably start with SELinux and work from there.

From the article "DRDO to develop cyber attack proof operating system" that's going to be asking for trouble. I'm going to assume the Windows compatibility is going to be WINE or ReactOS. Come on, "giving us the exclusivity of owning a system unknown to foreign elements and protect our security system", it's going to either be base on something that's already out there or something completely new with holes that haven't been discover. These guys are just asking to be attacked.

Re:$20 says it's a Linux variant

[Teknikal69]

I think your probably right no way they are going to start writing an OS from scratch it will be a in house *nix variant with wine doing anything else would take to long and cost to much in my opinion anyway.

Re:"Trusting trust" attack can be countered using

[jongi_ct]

You're talking about the trusting trust attack, which was made famous by Ken Thompson.

It is not showing figure 1, I was really interested why it looks like.

Re:"Trusting trust" attack can be countered using

[jongi_ct]

You're talking about the trusting trust attack, which was made famous by Ken Thompson.

Figure 5 is missing as well, geez, I was trying to follow this interesting article.

Re:I hope they name it URGENT

[Hognoxious]

I am sure U R not having one doubt about that.

LOLSRSLYWTF?!?!

[Hognoxious]

Sakshat? I'd like to meet the marketing genius who came up with that name.

Re:LOLSRSLYWTF?!?!

[heathen_01]

Sheila Dikshit

Re:"Trusting trust" attack can be countered using

[jongi_ct]

You're talking about the trusting trust attack, which was made famous by Ken Thompson.

There are lot of figures missing in this article. figure 1( On stage 1), figure 3 and 7 (Stage 3), is there anywhere I could find them, just trying to follow the article

$50 says it's a Windows distribution

[ray_mccrae]

After a lot of flag waving, I bet this "new" OS will be a cutdown, pre-configured distribution of windows.
When non-techincal people are speaking it's worth taking what they say with a grain of salt.

Re:Why not do *BSD or Linux code review and use it

[Anonymous Coward]

Seriously, why not take a *BSD or Linux OS release and do a full source code review on it?

There's nothing there to say that won't happen, only that the result won't be open source.

This project is in the planning stages -- the description is intended to make sense to the press and government bureaucrats. 'Written from the ground up' and 'full source review' are similar enough for that audience to mean the same thing, so that's what's being said.

Whereas if DRDO said they were going to do a code review of BSD + WINE for a homebrew fork, that would make easy sense to you and me, but would require an impossibly lengthy explanation to ranks of ADD PHB. Those bureaucrats just wouldn't get it, never mind fund it properly.

Re:"Trusting trust" attack can be countered using

[Anonymous Coward]

You should really learn how to use the quote tag.

Already an open source alternative to windows

[Hojima]

It's called reactOS. It's basically windows (it's NT architecture based), but free. Quite frankly, I don't know why Linux has gotten so much attention in comparison to reactOS. The thing is, it's still a under-funded garage-project. If you could get 50 Indians and a good budget to help them out, I'm pretty sure that it would be better than starting from scratch.

Here's the link if you're interested:

http://www.reactos.org/en/index.html

Re:Already an open source alternative to windows

[erroneus]

The trouble with Windows [compatible] OSes is not that it should be capable of running software written for Windows. It is that Windows itself has design weaknesses for various reasons not the least of which are related to its DOS based origins and support for old, misbehaving "legacy" software. To write a Windows compatible OS, you would also have to mimic a wide range of idiosyncratic behaviors in order to support Windows applications.

Now, if for some reason, all the bad-behaving software were cast aside and only good Windows software were used, the notion might stand a chance. I remain quite skeptical it, or any Windows-compatible OS, would become completely viable.

Looking at it another way, the SaMBa project is constantly playing catch-up against the moving target that is Windows networking. And that is just one aspect of the Windows OS family. Imagine this on an entire OS? It would be hard pressed to actually work.

They'd be better off making a BSD modified OS and pulling in WINE.

Re:Already an open source alternative to windows

[gmack]

The difference is that Linux programs are stable and preform well if written for Linux and it's easy to port software from other Unix and Unix like OS and have them run well.

Writing a MS Windows like OS is a nightmare because even though Windows has some well documented APIs, it is also has a mass of non documented, poorly documented and buggy APIs. Years of Microsoft patching Windows because some major piece of software depended on some bug somewhere has only made the problem worse. To make something capable of emulating Windows you need to implement the whole mess with every last quirk duplicated and until that's done it's a game of chance whether a given piece of software will even run. That is why Wine has problems after over a decade of development, why ReactOS is mostly ignored and why the India's project is wishful thinking.

Re:Already an open source alternative to windows

[BasilBrush]

They don't want open source, they want their own proprietary OS. Code that they control, and isn't available for scrutiny by those that would attack them.

And I expect the comment about running Windows software in one of the articles was a mistake on the part of the journalist or the politician. Possibly a language based misunderstanding. I expect they mean windowing software. A desktop gui rather than a cli.

It just doesn't make sense to make it Windows compatible. It's a monumentally hard thing to do, as demonstrated by the timescales of WINE. And the result would be a system with many of the same vulnerabilities as Windows, and thus it would break the primary objective.

Re:Already an open source alternative to windows

[hairyfeet]

Ooooookay, explain this one to me. How exactly is a Linux based OS with built in support for Windows drivers and software using "shims" ALA Wine going to Bring in "bad behaviors"? and DOS? Hello? It is 2010 and DOS has been dead for over a decade now. it is all WinNT based okay? I haven't actually seen a DOS program in the wild in damned near 8 years, and I deal with some old shit in SMBs. The last DOS program I saw was a DOS 3 based controller for a custom lathe.

So let us please keep the FUD to a minimum. As a PC repairman I can tell you from win2K on through XP SP3 Windows has had decent security, after windows Vista it has damned good security. The problem ain't the apps or the drivers, I can tell you a good 90%+ of infections are directly caused by the users installing random shit from the web without a second thought. Hell you should see how many security tool variants I've had to deal with where the user installed it because it came with some "free app" they wanted or a web page said 'ZOMG! you got teh virus!!!" and changing the base to Linux wouldn't change that level of dumbshit, just introduce security through obscurity. The rest? Adobe based, surprise fricking surprise, which considering from what I've heard Adobe on Linux is if anything MORE a pile of buggy shit than it is on windows, the only thing keeping that mess at bay is again security through obscurity and Linux users having to have a little more brains since they have to install their OS and admin it themselves.

But there is nothing wrong with the basic design of Windows. Running as a low rights user (default on Vista and 7) got rid of the last legitimate complaint on Windows user design. Windows has incredible degrees of backwards compatibility now thanks to a locked down SXS and a virtualized registry and file system that lets the program think it is running on the older OS, this when combined with ASLR and NX bit makes Windows pretty damned secure. Sadly there is no "keep user from doing dumb shit" button in ANY OS, and if you come up with one could buy MSFT and make Ballmer wear a jester hat and do the monkey dance.

Re:Already an open source alternative to windows

[vadim_t]

As a programmer, IMO ReactOS sounds like an uninteresting, often frustrating, and potentially dangerous project to contribute to.

Uninteresting because it's a reimplementation of something that already exists. There's little room for doing something exciting there. The end result of it would be that it'd do what Windows already does, and that's something few people will be able to appreciate. In Open Source programming this is unusual. Generally when somebody reimplements something it's to do something differently. For instance, busybox reimplements a lot of boring stuff but does it for a very good reason. Fitting a Linux system into 4MB of flash is an excellent motivation for working on it, because the standard GNU tools are too big.

Frustrating because it consists in reimplementing something that has no official spec and is not open. That includes things like: figuring exactly how a given system call works including any bugs and edge cases and implementing that, figuring out which officially internal functions are nevertheless used by applications and implementing those. Spending days or weeks figuring out why a closed source application fails to work. In most Open Source coding there's no spec, or the spec is easily available (eg, TCP, POSIX), and the applications that run over that are also pretty much all open, which makes debugging a lot easier.

Potentially dangerous due to issues with software patents and contributors with prior exposure to Microsoft code that could endanger the project. There's no guarantee you won't end as a party in a lawsuit at some point, or that your hard work won't end up being useless if MS manages to shut it all down. ReactOS already ran into trouble with contributions from people who worked at MS in the past (they claim to have done an audit, but how do you tell for sure?), and IMO the only reason MS is not working on shutting it down yet is because it's not yet a viable Windows replacement.

Re:Already an open source alternative to windows

[BasilBrush]

I can tell you a good 90%+ of infections are directly caused by the users installing random shit from the web without a second thought.

So, the new Indian OS can make itself 10 times more secure than Windows with the simple expedient of not allowing users to install random shit off the internet.

Your post actually demonstrates that there IS something fundamentally wrong with Windows.

Sadly there is no "keep user from doing dumb shit" button in ANY OS, and if you come up with one could buy MSFT and make Ballmer wear a jester hat and do the monkey dance.

Seems like a prize worth having. And given that the existing Windows and Unix OSs were not designed with that in mind, the Indians will be off to a good start when they do have it in mind. Good luck to them I say.

Re:Already an open source alternative to windows

[socsoc]

My SMB uses multiple DOS programs daily.

Re:Already an open source alternative to windows

[jedidiah]

A Unix based OS with the facilities in place to assimilate Microsoft's shoddy product isn't safe. That's rather the whole point. Microsoft didn't leave their poor design and engineering choices behind with DOS. The legacy of DOS is laziness and incompetence. The fact that it is not quite as obvious any more doesn't mean that Microsoft still isn't doing incredibly stupid things and doing them haphazardly.

Blaming the user simply doesn't cut it. Microsoft makes crap that's inherently dangerous to operate due to engineering sloppiness can't be tolerated anymore.

Re:Already an open source alternative to windows

[Crudely_Indecent]

As a PC repairman I can tell you from win2K on through XP SP3 Windows has had decent security, after windows Vista it has damned good security.

This guy provides a valuable opinion because PC repairmen are experts on security.

Sadly there is no "keep user from doing dumb shit" button in ANY OS...

Sure there is.

PXE boot to a network stored image with user documents stored on mapped drives.
Or, there is Faronics DeepFreeze that locks the hard drive to a state and discards all changes after reboot.
Or, you could just restrict users from installing apps.
Or, my personal favorite, you could run Linux as an unprivileged user.

Re:Already an open source alternative to windows

[v1]

At least one of the linked articles says the new OS, though home-grown, would run Windows software.

Brilliant. If you're into security, there's one rule of thumb you can always count on. Don't develop your own. Invariably you'll overlook something obscure and subtle and will create a weakness big enough to fly a 747 through. Stick with time-proven methods that have been under the microscope for years and have withstood the test of time and had all the bugs, shortfalls, and subtle problems worked out of them. Basically, you're not smarter than all the people that have contributed to making the currently available selections as secure as they presently are.

If they're going to create an entirely new os themselves, in-house, for the sake of security, they're about to re-learn the above lesson.

And sorry, but runs Windows? The whole security problem there to begin with is its never-ending craving to run old software that just wasn't bothered to be written securely. Look at the giant headache that was the breaking of windows software when XP came out. Then when Vista came out. Then when 7 came out. This is going to be a whole new level worse. They may say it can run Windows software, but either it won't run MOST of it, or they're just going to be defeating one of the primary purposes of writing their own secure OS to jimmy it to run any sizeable portion. If they're insisting on making their own OS, they may as well expect to have to write their own software too. In for a penny, in for a pound.

Re:Already an open source alternative to windows

[kikito]

Linux has a "keep user from doing dumb shit" button. It's called non-root access. And it works.

It's not security by obscurity, it is real security.

Re:Already an open source alternative to windows

[Sedated2000]

The point of it was never to be exciting, it was so people who can't afford Windows can still use Windows based software and use an environment they're comfortable with and used to.

Re:Already an open source alternative to windows

[murdocj]

Windows has the same button, it's called a standard user account.

Re:Already an open source alternative to windows

[thousandinone]

So, the new Indian OS can make itself 10 times more secure than Windows with the simple expedient of not allowing users to install random shit off the internet. Your post actually demonstrates that there IS something fundamentally wrong with Windows.

Isn't there some kind of "eye fone" or something to that effect that does just that? I may be misremembering, I can't claim to be infallible after all. Pretty sure that whatever it was has been known to catch a lot of flak on slashdot specifically for locking functionality away from users...

Re:Already an open source alternative to windows

[DrgnDancer]

Or, there is Faronics DeepFreeze that locks the hard drive to a state and discards all changes after reboot.

This is the only that really prevents users from doing dumb shit. Even it is limiting the effect of users doing dumb shit so that reboots take care of the dumb shit. It's also problematical if you'd like your users to save their work between reboots. I guess you could have them upload the work to some outside repository before reboots. The rest will prevent you from getting your system compromised at the root level, but doesn't really stop lots of types of infections.

In order for a system to be useful it must do several things. It must store the user's data somewhere, somehow; which means the user has to have write access to *something*. It has to have network access to the things the user needs network access too. The user must be able to use the software they need to use to perform their functions. So, storage, network access, and ability to execute software are the three things a user must have to make the computer useful. Those are the things most malware needs to operate at its base level. In other words, malware can operate and be effective using nothing other than the base privileges users must have.

I can install itself (on the users home directory or whatever scratch space they have, as a hidden file of course), run itself (with the user's level of privilege), and phone home (assuming it can get through you firewalls and other external limit factors). It has access to any data that the user has access too (which is probably whatever the user needs to work on and may be quite sensitive). it could even participate in a botnet (assuming the user is logged in and the botnet doesn't ask the system to do anything outside of the users level of rights).

There's this idea that you have to "own" a system to compromise it. Certainly it helps. Certainly it makes it easier to hide the infection. In no way is complete root level ownership of a system needed to do most of what malware writers want to do on a system though.

Re:Already an open source alternative to windows

[digitalunity]

They can have it. They could use BSD as a base.

Or they could just start with Linux and the GNU tools and make their own variant. The code is all theirs. The GPL only requires source code be provided when the software is transferred. Merely providing the software for use doesn't entitle each person sitting behind the keyboard to a copy of the source. If it's all under control of the DRDO at all times, they are not required to provide the source code to anyone.

Also, the GPL is only effective due to strong copyright laws. If they wanted to add a copyright waiver to their laws for national security reasons(which may or may not already be there), that would work too.

All I'm saying is if they wanted to use Linux, they could. And they don't need to share the source with anyone.

Re:Already an open source alternative to windows

[GooberToo]

ReactOS does pull in wine - last I read. But as the wine developers will tell you, Windows basically sucks. There are so many hacks and kludges which have been developed in Windows over the years, the wine guys are forced to constantly re-implement them. Far too many applications actually demand improper behavior from the OS APIs to function properly. Even worse, this behavior can depend on which MS OS variant its running under.

Re:Already an open source alternative to windows

[BasilBrush]

If it's all under control of the DRDO at all times, they are not required to provide the source code to anyone.

For all the parts of it that they don't rewrite, the world has already got the source code. 99% of vulnerabilities that showed up on other distributions of Linux would also be their on India's own variant.

Re:Already an open source alternative to windows

[BasilBrush]

Indeed, providing a user doesn't jailbreak it.

Re:Already an open source alternative to windows

[MaskedSlacker]

And if you, or they, think they're going to write a secure system from scratch ... BWAHAHAHAHAHAHAHAHA ... AHAHAHAHAHAHAHAHAH ... AHAHAHAHAHAHA ... well, you get the idea.

Re:Already an open source alternative to windows

[Yaa 101]

And another button that makes it useless, it's called "Run as administrator".

Re:Already an open source alternative to windows

[farble1670]

The trouble with Windows [compatible] OSes is not that it should be capable of running software written for Windows. It is that Windows itself has design weaknesses for various reasons not the least of which are related to its DOS based origins and support for old, misbehaving "legacy" software.

MSFT windows needs (wants) to be backward compatible. a new windows-like OS doesn't have that requirements.

Re:Already an open source alternative to windows

[farble1670]

So, the new Indian OS can make itself 10 times more secure than Windows with the simple expedient of not allowing users to install random shit off the internet.

Your post actually demonstrates that there IS something fundamentally wrong with Windows.

pick your OS. if you are willing to install random shit off the internet, it can be compromised. period. no OS is going to stop that. mac, linux, whatever. they are all subject to this sort of attack.

Re:Already an open source alternative to windows

[farble1670]

Linux has a "keep user from doing dumb shit" button. It's called non-root access. And it works.

how does it keep them from typing in the admin password when the little dialog asks for it?

and i guess you haven't used windows in oh the last 5 years or more. it has had the same "protection". my wife's win 7 account runs w/ non-admin rights. anytime she tries to install software, she is asked to enter the admin password, which she doesn't have. she's also never had a virus / malware installed.

Re:Already an open source alternative to windows

[farble1670]

They may say it can run Windows software, but either it won't run MOST of it, or they're just going to be defeating one of the primary purposes of writing their own secure OS

i don't think the purpose of running some windows software is to be able to run arbitrary windows software. they probably want to take advantage of a large windows developer base.

Re:Already an open source alternative to windows

[BasilBrush]

I don't know whether they will or they won't. But it wouldn't actually be that hard for a team to put together an OS that is more secure than Windows or *nix given that those are written with a language as liable to creating vulnerabilities as C.

Remember lone programmers have created their own OSs from scratch. It's perfectly doable with a team of 50. And if their primary objective is security then yes, they'll probably end up with something more secure than those other OSs.

But it won't run Windows software. Though it might run windowing software.

Re:Already an open source alternative to windows

[BasilBrush]

if you are willing to install random shit off the internet

RTFA. They've already pointed out that updating software from the internet is insecure. It's an OS intended for secure government usage. There's no need for it to allow installing random shit off the internet. And that is one reason why it'll be better for them than Windows. By the other posters estimate 10 times better for that one feature alone.

Of course it'd be very inconvenient if NO software could be installed from the net. But with known servers, certificates, VPN and such like mandatory for doing so, you could make it so that they could only load up very SPECIFIC software from the internet.

Re:Already an open source alternative to windows

[v1]

OR there's a PHB somewhere up high in the decision tree that can't live without his Entourage and Word.

Re:Already an open source alternative to windows

[h4rr4r]

Because even making windows free does not fix the problem that it is window.

Re:Already an open source alternative to windows

[Anonymous Coward]

Stick with time-proven methods that have been under the microscope for years and have withstood the test of time and had all the bugs, shortfalls, and subtle problems worked out of them. Basically, you're not smarter than all the people that have contributed to making the currently available selections as secure as they presently are.

Oh, pish-tosh. Why aren't we all using MS-DOS 19.3, then? Nobody is smart enough to replace it!

We see how "secure" the currently available selections are every day.

Re:Already an open source alternative to windows

[murdocj]

The same way sudo makes non-root accounts on Linux useless?

Re:Already an open source alternative to windows

[erroneus]

Yes, I already made that observation however, there are other flaws that would need to be built-in. And if they are to run a selection of Windows compatible software, they would have to develop and test for support of each of those applications individually. If they were just going to write their own applications, after all, then the OS wouldn't need to be compatible with anything at all.

Re:Already an open source alternative to windows

[farble1670]

If they were just going to write their own applications, after all, then the OS wouldn't need to be compatible with anything at all.

again, yes, it would. if they want to use MSFT dev tools, then yes the OS does need to be compatible with the applications and libraries produced by those tools.

Re:Already an open source alternative to windows

[Sabriel]

Serious question: how did you so completely and utterly manage to miss the GP's point?

Re:Already an open source alternative to windows

[digitalunity]

The kernel and libc are the hardest parts. They could write a purpose-built set of userland tools and applications on top of the existing kernel and use glibc.

I'd say by and large, security vulnerabilities in "linux" really occur in userland server processes. Linux has had its share of local privilege escalations but remote non-DOS type exploits haven't been nearly as common.

With the weight of a billion strong country, I'm sure they could work something out.

Re:Already an open source alternative to windows

[kikito]

lack of interest

Re:Have you ever met?

[thePowerOfGrayskull]

This was flamebait - but I can see how AC came to feel this way.

The model in place now encourages people with *no* talent for software or systems development to choose that as a career path, and it shows. That doesn't mean that there are no talented people there -- just that the outsourcing craze (and corresponding promise of significantly improved lifestyle for self and family) lures a lot of people who wouldn't otherwise even consider this career. To a lesser extent, the dot-com craze caused the same problem here in the US: a lot of people who had no skill or talent for software development jumping into the business as a way to make money.

The unfortunate truth is that they get away with it - I've seen first-hand how we've evolved our expectations of offshore outsourcing companies to be little more than monkeys behind keyboards. Innovation, troubleshooting skill, and general analysis ability are not requirements at most outsourcing shops. I've even gotten in trouble at work for being 'too stringent' in my requirements. This was because I expected a senior software developer to be able to describe how a hashtable works internally; why you might want to use a hashtable. I also expect them to be able to sketch out an object model for an everyday concept like a house. And when they couldn't , I rejected them. I was told that if they can churn out code to spec we want them.

At least one of the vendors we worked with (TCS) had a habit of listening in on the phone to our interviews (even recording on a couple of occasions, though they haven't admitted it - I know what a beep every five seconds means ;), and amazingly the successive candidates got better and better at answering our basic technical questions. Now I can't say for *sure* that they were getting fed a questions list ahead of time, but I *do* know that the answer I receive from different candidates are remarkably close to identical on non-conceptual subjects. (On conceptual subjects, almost all bomb completely. Unfortunately, I'm not permitted to consider that in most cases.)

Anyway - the net result is that we have a lot of people who would function much better flipping burgers instead writing our code for us. And if our specs don't contain very very precise details (sadly some of our leads have taken to embedding code itself in the tech specs - which can then be copy-pasted, because it's just faster than getting them to fix it when they screw up), they flounder hopelessly. Similarly, they struggle mightily when trying to troubleshoot problems that I consider simple. (Hint: If you can't at least *start* to debug a problem without a log file and/or walking through a debugger, you have chosen the wrong career path.)

The most important thing here is that this isn't some deficiency or inability of any one group of people. I strongly suspect that the same ratio of talented:untalented exists in India as anywhere else in the world -- it's just obscured by the economics which makes being a poor or mediocre programmer a way to become relatively wealthy.

Re:Why not do *BSD or Linux code review and use it

[houghi]

As long as they do not re-distribute, they are not obliged to let "everybody win" i.e. share the source or the software. And that is only true for GPL software. With BSD they do not have to share anything,

So indeed why not start with something that is already out there as it will speed up the whole process. Then you have more people available for specific software.

But then it can also be interesting to see what happens if you start with something completely new. It might never leave the military, but there also might be a chance that it does, which will be great.

Development breakthroughs

[James Youngman]

Writing an allegedly Windows-compatible OS to resolve cyber-security concerns? Are they also developing lead aircraft?

Please remain on hold...

[Anonymous Coward]

I wonder if tech support calls will go to the States.

"Well hey there, my name's Rajeesh, how can I help y'all today?"

Back in the 70ies ...

[flnca]

... almost every custom-built computer (of which many existed) had its own operating system. Many software companies developed OS and application software.

Writing OSes is still very common in embedded systems.

Depending on what you want, writing a Windows compatibility layer (if that's really what they want, if they didn't just want to say "has a GUI") is also no rocket science. The Windows API documentation is readily available, and if you stick to a specific set of APIs, you can come up with a compatible system pretty quickly.

WINE is not a good example for Windows compatibility, since it's ill-designed and bug-ridden. ECMA for instance provides a set of standards registered by Microsoft for Windows 3.x, and that can make a good starting point.

I think the project might be successful.

Oh, and writing compilers is no rocket science either ... if you want to keep it simple, it's just an excersize in recursion ...

Re:Back in the 70ies ...

[Anonymous Coward]

"WINE is not a good example for Windows compatibility, since it's ill-designed and bug-ridden."

Must take after the system it's cloning, then. In fact, I wonder how many bugs in Wine are unique to Wine, vs. how many are Windows bugs that must be brought over for compatibility... I always assumed that a large number were inherited from Windows itself, though.

strange things happen

[Max_W]

Remember an appearance of PHP from nowhere, for a blue sky? Perl, C and CGI were then in full swing too. All it took - a Canadian university teacher, Swiss and 2 Israeli students.

Sometimes a stupidity of an existing software is begging for starting from scratch.

When I try to find a computer on a network in W7 via a set of bizarre icons, or try to find a way to open a file in Media Player, or set a property in Explorer's options I cannot help thinking: "What an imbecile could think of such an interface!"

Besides, in some parts there is still a conviction that using 16th century's Imperial measurements system for modern science and technology is a good idea.

Re:strange things happen

[jimicus]

Really not convinced PHP is the best example. It's led to more security holes than you can shake a stick at, and even today there are bits of the API that tend to break between releases.

Re:strange things happen

[Max_W]

This is the point. The existing "statu quo" multi-billion soft is so mismanaged that sometimes all it takes is a couple of students to make a functional system which overtakes the whole market.

It was the story with the PHP. Two smart students made a better system than an army of Ph.Ds and MBAs.

Even though the PHP is not perfect, but it's de facto the Internet OS by now. It is high time that a new "from scratch" computer OS appears too; sort of the PHP of PCs.

What about Bribes?

[Anonymous Coward]

Well , all of you are ignoring the elephant in the room:

This project gives many government officials (and hence politicians) to collect bribes! That point alone makes it worthwhile to spend taxpayers money on the India OS project.

Moreover, the gov officials can go for serious study/research into Software Research to places such as Macau, Las Vegas, French Riviera etc

Next: Stackoverflow DOSed

[DaleCooper82]

by "sir, send me teh codez 4 secure OS, it is very urgent..."

Re:Oh please, these people can't even do a CGI

[91degrees]

I suspect the main problem is that coding is outsourced to India to keep costs down. So companies pick the cheapest coders. To the outsourcing company, the "best" coders for the job tend to be the ones who can meet the written specification in the cheapest possible way. If you're outsourcing to India you're only going to have contract with this sort of programmer.

OS's are not the problem

[Anonymous Coward]

The security of an OS is directly related to the limitations of the hardware it is running on.

Hardware needs to be split up more, so that security can be enforced on the bus level.

The Kernel of an OS needs to become physically separated from application work space. All connections to/from hardware and the App, need to become physically sandboxed.

Works for IIS

[Anonymous Coward]

I'm certain I once saw an advertisement for a security product to harden IIS web server. Basically, it "cloaked" its behaviour so that it looked as if it was running Apache instead of IIS. So the would-be crackers would think "oh.. it's Apache.. never mind..".

So maybe renaming Windows to DontCrackMeImReallyMuchMoreSecureOs would help as well... stranger things have happened!

What a bright idea, but ..

[cheros]

Having your "own" national OS is not a bad idea, provided it's open enough to ensure peer review. However, making it run Windows apps feels a bit like planning to build a new prison and then only allowing straw to be used as building material. Does it *have* to be Windows compatible? Using Windows apps as platform is repeating the mistake of slowing a whole nation down because it's waiting on yet-another-update-with-questionable-benefits.

IMHO, this will define modern warfare: attack on Microsoft Patch Tuesday. Windows for warfare will be upgrading at that time..

Re:Why not do *BSD or Linux code review and use it

[henrik.falk]

That's because the congress is bypassed.

Also it would be without precedent

[Sycraft-fu]

Something to notice is that ever since Linux has hit the scene any time someone talks about a "new OS" they are making what they really mean is "Our own version of Linux." Developing an OS from the ground up is a lot of hard work. As such it seems to be done very rarely. Since Linux is freely available and quite modular, you can always just take it, modify it, and then use it as a base for what you want.

This is just the way things are done these days, there seems to be very little interest in truly "new" OSes. Hell even Cisco went this route. Not with Linux, but with QNX. Cisco has had their own OS for a long time, since normal computer OSes aren't well suited to switching and routing. However they needed to make it higher reliability. Hence they built IOS XR. Still their own OS..... Except that QNX runs at the heart of it. Nothing wrong with that, QNX has an extremely solid, reliable, microkernel that runs some of the most critical system out there, but it demonstrates what I'm talking about.

The idea that a government would implement a new OS from scratch, and then make said OS Windows compatible is just beyond believability. I mean look at the number of developers MS has just on Windows. Even if you think you are complete badasses and could do it with 1/4th the people (which isn't likely, MS pays big dollars and gets good people) you are still talking a massive staff. Rather expensive. In fact you'd probably need a larger staff since presumably you'd be talking about doing some extremely rigorous verification processes (if the objective is to be more secure) not to mention needing people to reverse engineer the original Windows. You'd actually need those people even if you had the source (governments, research institutions, etc can get the source code for Windows, it is private but not secret) because only through a clean-room implementation could you insure original bugs aren't making it in.

I'm with you: Supposing this sees the light of day and isn't just some pie in the sky project (governments love those) it'll be some version of Linux with WINE on it and probably not at all remarkable.

Re:Why not do *BSD or Linux code review and use it

[Anonymous Coward]

and you're almost never at war with everyone.

We tried that once, didn't work out so well

-- signed, Germany

Jail house analogy

[Troll-Under-D'Bridge]

Agreed. You don't need to be overly secretive about your OS (hello, MS!). For example, there's practically no secret to building a typical jail house, bricks and metal bars. Only in extra special cases (perhaps a maximum security prison for war criminals and other arch villains) do you need to deviate from the norm. So, unless, the India's goal is to craft a real-time OS for missile systems and other highly destructive military gear, adapting (after some serious code review) an already existent FOSS/OS is the way to go.

Re:"Trusting trust" attack can be countered using

[hey]

Seems pretty obvious... just compile the code with multiple compilers.
Or use interpreted languages.

Re:Why not do *BSD or Linux code review and use it

[marcello_dl]

Um but apple plus ibm tried that in the post-system9 era and taligent tanked. They then plundered bsd and osx succeedeed. Then they closed darwin and gave a hell of a good argument to GPL advocates :D

all the other desktop OSes out there seem to be a rewrite of unix, vms/nt, beos.

Re:Why not do *BSD or Linux code review and use it

[BasilBrush]

Because both BSD and Linux fail at the first hurdle of a security review. They are written in C. That's not fixable.

Another way of sinking Tax Money.

[Anonymous Coward]

Indian Government pulls these kinds of Shenanigans all the time. As with most other 'innovative' projects this is going to linger on for years and then it will be scrapped as it was not found 'cost effective' after tons of money was poured into it. Most probably the will be created by a private company/university sharing the profits with the guy leading this project without making anything. This kind of corruption is so commonplace in India that it doesn't even shock anymore. Google DRDO scam for examples.

please send me the codes.

[stickystyle]

Can't wait to see this future post on every java forum.

"Please send me the java codes for operating system to jawadiwahail2243@hotmail.com"

Re:please send me the codes.

[tonekids]

Sorry I don't have mod points. :-)

Re:Why not do *BSD or Linux code review and use it

[kikito]

Yes. Each army rebels and kills all their respective politicians.

Everybody wins.

If They Want a Secure OS

[Greyfox]

They should hit IBM up for the source to Data General's B2 secure UNIX, which had some very spiffy security and logging capabilities. I did security auditing on its C standard library for a few months back in the late '90's and was quite impressed with it. It still had some very UNIX-y holes in it (Such as the Telnetd buffer overflow) but even if you managed to compromise an account on the system you'd have a hard time leveraging that into anything useful. It had mandatory and discretionary capabilities such as you might find in selinux, and if you had logging turned all the way up it would even log an ls.

Or better yet, just improve upon selinux and start a company or a state-run agency to constantly evaluate it for security risks and improve the user friendliness of the security features and install process.

Modern language OS

[Compaqt]

>Both OSs were written with in a language that doesn't bounds check strings and arrays as a matter of policy. ... A modern OS written with security in mind would have to be created with a systems programming language that at least does this.

JavaOS!

It will be linux

[Anonymous Coward]

It will be Linux with all the credits/licenses stripped out of the source code...and running windows software will just be in pirated copies of VMWare. ;)

Re:It will be linux

[shanmoon]

Lol...yes sadly I have seen that happen all too often...

Re:Why not do *BSD or Linux code review and use it

[weicco]

Well, yes, but then you could say that we already have Ford so why would anyone want to manufacture any other cars :)

But for example Singularity seems interesting OS. There's a lot of cool ideas, even allthough I'm not sure if they are original MS Research ideas. Plan9 seems rather interesting too. Now I don't know if any of these exotic OSes are used in production or is it even reasonable to do but who knows, maybe some useful ideas flows from them to current or future OSes.

I think diversity is a good thing especially in research.

Re:Why not do *BSD or Linux code review and use it

[samkass]

Closed darwin? Go ahead and download it for 10.6.4, the latest MacOS release. You'll want the "xnu" package, and its pretty easy to Google for instructions on building it and replacing an installed MacOS's kernel with it.

It's true Apple doesn't release the closely-related iOS kernel, but they never have.

just to make sure

[luis_a_espinal]

I'm not blinding praising one over the other, nor I'm a Windows fan. But you gotta give engineering credit where it is due, even if it is to an aspect of an operating system that is not of your liking. We are all subject to subjective thinking (no pun intended), but technical discussions are worthless unless we put a modicum of effort in being objective.

Re:Why not do *BSD or Linux code review and use it

[Anonymous Coward]

DIdn't the NSA already do this when they put out SELinux?

Re:Why not do *BSD or Linux code review and use it

[ebuck]

Because that's what the US Military did. Selinux was the contribution that eventually came to being due to effort on the part of the NIS.

They want a different code base. It has a lot to do with security by obscurity. Basically NIS knows the pros and cons of something like selinux, and India has to master selinux to really know where the attacks might lie, and how to monitor for them. To them, there is less risk of an unknown leak if they write the whole thing from scratch.

Then the probably looked at the software they were mostly using and decided that the new OS must be compatible to reduce costs.

It is going to be a massive duplication of effort, but at this point in time it is all "on paper", aka requirements. Wait until they get into the details of the implementation where they will likely discover independently that many of the required APIs to run their software require insecure processing to support their compatibility requirements.

They might even know it is a massive duplication of effort. They might even guess that it is not possible. Remember that India has earned a less-than-stellar reputation for outsourcing, so this might be a combined military pork project / public works program. They can't keep graduating programmers at the rate they do and expect all of them to get an overseas contracting job. This is compounded by programming being seen as an "easy paycheck" and their universities printing diplomas as fast as possible for people who are in it only for the money.

Fix the Commonwealth Games first...

[TekNoManIak]

Probably another distraction to the poor quality of Delhi Commonwealth games. It will probably go down in history as the worst Commonwealth games ever organized in this millenia. Why don't they fix their infrastructure first before trying to fix software? What's the point of having a nationalized OS if ur country has power failures at least 1- 2 times a day?

Re:Fix the Commonwealth Games first...

[mjwx]

Probably another distraction to the poor quality of Delhi Commonwealth games.

This is a pretty bad distraction...

Hang on a sec.

Comm games still appalling, no I take that back, this is well above the current standard. Maybe they'll create some decent inflatable accommodation for the athletes, they've certainly created inflatable refs for taking medals off athletes.

Commonwealth OS?

[Anonymous Coward]

That will be good. The Indians will end up building a half finished operating system that falls down a lot. Why not just use Windows Vista.

Re:Why not do *BSD or Linux code review and use it

[Sancho]

If I were to guess, this would throw a wrench in those works. From TFS:

At least one of the linked articles says the new OS, though home-grown, would run Windows software.

Re:spammer

[MightyMartian]

No worries! Slashdot has a new innovation, making the letters upside down, that is sure to ward off the spammers.

Re:Have you ever met?

[Anonymous Coward]

They make half the pay in many situations

Bullshit. Per federal law H1B holders must be paid the prevailing wage.

Re:Why not do *BSD or Linux code review and use it

[Shompol]

Seriously, why not take a *BSD or Linux OS release a ... Everybody wins!!!...

No, everybody does not win. Apparently, US DOD uses Windows, and given recently caught Russian spies used windows as well, any military that adopts open source is in advantage here. I believe French and Chinese already did just that.

Sell those F-22s!

[Anonymous Coward]

We should start selling them to Japan, with full stealth, radar and performance. Maybe N.Korea would start quaking in their boots at the thought of 1000 crack Japanese SDF pilots zipping around in the air in the most advanced fighter money can buy.

Re:"Trusting trust" attack can be countered using

[Anonymous Coward]

Awesome! I like your approach of providing full data for reproducibility and cross-checking.

Re:Have you ever met?

[Anonymous Coward]

This comment is probably the best explanation of the Indian IT talent that I have ever come across. It is all the more remarkable because as an Indian, all of these things you said are an obvious way of life but for someone who is not an Indian (I assume you're not), you seem to have evaluated our profile quite well.

As a former employee of TCS, I heard one memorable statement made repeatedly by our managers: We don't care about geniuses; they are of no use to us. We want average or above average people who can work well in a team. The result of this is that a huge number of students who get hired from colleges do not even know how to program a computer. My induction training had a majority of people coming from a civil engineering background and they were only just learning programming.

Regarding your interview experience, I'd like to add one thing that might corroborate your experience. We Indians are experts at trumping examinations. Some of us might not be able to apply concepts or even understand them for that matter, but we're very good at understanding how a concept is going to be evaluated in an examination. That is why the only way to find out if a guy really knows his stuff is not by quizzing him about the usual stuff (even on a conceptual level) but to put him on the spot by doing something really unexpected. I generally build on peoples experience to try and understand what they have done/understood. And then do something really unexpected like asking him to reproduce some aspect of his project in some pseudo code or something similar. Of course, you can never use the same technique more than 2-3 times, since word spreads fast -- there are forums where people diligently rebuild test papers and interview questions of companies from memory. Yes, we have fantastic memory -- that is what we exercise all our life through rote learning.

The career path and motivations in these outsourcing outfits are also completely different. If you're any good at coding, you're quickly pushed into management. Similarly, new recruits set their sights on team lead positions or management and try their best to learn how to use spreadsheets and try to impress people with smooth talk rather than learning their main trade -- programming. Also, being very good at programming, or actually enjoying it does not pay as well; we Indians don't respect 'coders' either.

I am no longer in TCS. I won't call it a bad place to work though -- I still consider them the best employers in the country for IT. I just realized that I enjoyed programming a lot more than updating statuses of my "reports" in a spreadsheet and hence decided to move to a more technology oriented outfit.

Re:Oh please, these people can't even do a CGI

[rahvin112]

It's cultural, so I'm sure they'll be kicking us to the curb in a few decades once they start valuing results over hierarchy.

Good luck. Given the cultural proclivities in India I would give them just about a zero chance of ever exceeding American innovation. There are a LOT of really smart people in India, but the culture prevents innovation. Taking a risk that could pay off big or blow up in your face 100% of Indian's will choose the safe route and never innovate. You need to understand, if you don't get a positive letter of recommendation from your previous employer you will never find another job. That means you fuck up once and your career is over. Think that encourages innovation and risk taking?

The symptoms of this cultural problem are seen in the Indian Call centers and it's frequently what upsets American callers so much. No one working at the call center will deviate one tiny bit from the script, to do so could risk their letter of recommendation and doom them to never working again. If your problem isn't in the script you won't get help unless they transfer you to someone that has your problem in the script or that can connect you to someone that will deviate from the script (typically an American working in India or a call center in america).

You can't fix a problem like this without a major cultural shift and those take generations to occur. If or when India makes that cultural shift they might exceed American innovation but it's not going to happen until it does. Culture plays a big role in peoples lives.

Halfway through any task

[Anonymous Coward]

The newly developed Operating System will take one of two actions:

1. Deliver the results Late
2. Ask for more resources, and still deliver the results late

And it will be called:

[lazyforker]

DRDOS!

LOL

[tibit]

There's a saying in Polish that quite fits here: Taking on the Sun with a hoe.

What they're saying is, I presume, that they'll get 50 people and somehow get wine and reactos code bases together, to work well enough to be usable in a wide-scale deployment. I wish them good luck. If they, OTOH, think that they can reimplement what reactos and wine did so far from scratch: LOL. They'd need a top-notch team, used to working together and having a significant project or two under their belt to tackle it and have anything to show after 12 months. It'll take them a month or two just to figure out what code is out there in reactos/wine to use, never mind making any design decisions, or heck, actually coding anything.

For starters, a project like that would basically need to hire all wine/reactos/codeweavers/transgaming talent out there. Plus a few key Windows people, too -- and pray they aren't under non-compete contracts that can be enforced in India.

Re:Why not do *BSD or Linux code review and use it

[Anonymous Coward]

LUASCFWNCE? What's that? LucasFone CE?

It's not a technical question

[bigato]

C'mon people... don't take them so seriously! This decision clearly wasn't made over technical facts. You know, the bosses never pay much attention to technical facts. But you may bet, they pay a lot of attention to the political consequences of their actions.

Re:Why not do *BSD or Linux code review and use it

[martin-boundary]

True, but I'll take that over seeing my family burned alive in front of my eyes when the whole city is being firebombed...

War is hell, but total war is worse.

Re:Why not do *BSD or Linux code review and use it

[lawpoop]

And you also have a real good ideas of the capabilities of the enemy whom you sold weapons to.

they overstate things in india

[Anonymous Coward]

The "$35 laptop" was a USB stick.

This "New OS" will likely be an ISO image of Windows XP with Zonealarm firewall and antivirus preinstalled. All pirated, of course.

Re:Why not do *BSD or Linux code review and use it

[dave87656]

They are written in C. That's not fixable.

The interesting thing is, that, if you use another language, the language itself is probably written in C. Any language low-level enough to write an OS in is going to have low-level memory management that will require careful programming.

By the time they complete their OS, it will have more security holes than most OS's because they are human. The advantage they will have is that source code is not public. But, it's like a bank vault. Everyone knows how it's made but you still can't break into it. It's the same with OpenBSD or FreeBSD IMHO.

Re:Why not do *BSD or Linux code review and use it

[mahadiga]

I believe India took cue from Russia
http://linux.slashdot.org/article.pl?sid=09/01/23/1450224

Re:Have you ever met?

[mjwx]

True innovation requires the ability to make mistakes, learn from them, and try something new - which is contrary and alien to the H1B "cog developer" system.

This is not an issue with "cog developers" but with business methods* but more primarily with Indian culture. In many Asian cultures, it's considered a very bad thing to make a mistake, even worse is to admit to it. Indian's aren't as bad as Chinese or Thais in this regard but they still have that syndrome where they cannot draw attention to a failing. As you said, the ability to fail and get back up again after you fail is absolutely vital to innovation and problem solving in general.

That being said, most of the Indian's I've met in professional positions in Australia have broken that, they've had to in order to be competitive.

India is going to have a large pool of talent within the next few decades, but like China it's going to be held back somewhat by their culture.

* business methods refers to the MBA who insist on instilling the fear of god into people and firing them at the first sign of failure.

OS Wars 2011

[Anonymous Coward]

Now if Pakistan starts a similar program they will have a ready product in 12 months. On the other hand, if they have their own IndianVi vs PakistanieEmacs discussion its bound to end up with a nuclear exchange.

Re:Have you ever met?

[thePowerOfGrayskull]

Thanks for the reply - assuming you are who you say you are, what you say is not surprising (though perhaps a bit disappointing). I am American, as you surmised. My impression is gathered from observation, and informal conversation with Indian coworkers here locally. Though of course, none who work for TCS (or InfoSys, or Cognizant -- all suffer similar issues from an outsider's perspective) are comfortable revealing specifics about their employer.

One area I tend to focus on in interviews is the day-to-day. I try to get someone to describe a problem they solved last week, or detail the design of a system they recently completed. Very often this causes stumbling as you pointed out - as real-world experience isn't something that be faked as easily as book knowledge.

Glad to hear that you've moved on from TCS. Hopefully you're in the category of programmers who "gets it"* -- it sounds like you may be.

I don't really blame TCS either - they've found a model that works; and for some reason, clients find this level of service acceptable. I just wish these clients would occasionally look at the *long term* cost of using these firms. The hourly numbers look great up front, but when you factor in the issues, the increased hours required, and the numerous other headaches introduced... I suspect it's not nearly so cost-effective as most would believe.

*Two categories of programmers: "gets it" and "does not get it". The former can take an issue , solve it through logic alone, and feel a thrill of victory upon doing so. More, they'll understand the "root cause" of an issue and not be content to consider fixing a symptom as an effective resolution. The latter... if they ever solve an issue successfully, it's through brute force and luck.

(Addendum: I re-read my original post. Note to self: do not attempt to write a lengthy discourse at 4 in the morning again any time soon. While I get my point across, less rambling and fewer grammatical errors would have been nice...)

Re:Why not do *BSD or Linux code review and use it

[marcello_dl]

They once did delay releasing the source, anyway. I'm glad they did keep it open though.
http://apple.slashdot.org/article.pl?sid=06/05/17/1453206

OS Wars 2012

[IronTomRackham]

If Pakistan starts to develop its own OS we can see the first production version out before 2012. On the other hand VI vs Emacs type of discussions could end in a nuclear exchange.

Looks good

[Anonymous Coward]

I'll buy that for a dollar! :-)

Just Another Way to Loot Public Money

[F.Minusia]

Those familiar with the Indian plutocracy will know that this is just another scheme to loot public money. There are things like BOSS Linux ... of course. The DRDO's announcement also reveals the kind of dinosaurs controlling the organization.