Windows for Submarines (2008)(blogs.msdn.microsoft.com)
blogs.msdn.microsoft.com
Windows for Submarines (2008)
https://blogs.msdn.microsoft.com/ukgovernment/2008/12/17/windows-for-submarines/
64 comments
Very interesting choice. I work on mission critical systems that aren't as mission critical as nuclear submarines. I don't think we'd ever consider anything other than an open source *nix.
I would have expected qnx or vxworks rather than any open source UNIX personally.
Fair point.
When I said "mission critical systems that aren't as mission critical as nuclear submarines" I meant that a mistake can result in us losing $400 million in 30 minutes rather than the destruction of civilization as we know it.
I don't know what people in the latter case use, but it sounds like they use Windows for Submarines.
When I said "mission critical systems that aren't as mission critical as nuclear submarines" I meant that a mistake can result in us losing $400 million in 30 minutes rather than the destruction of civilization as we know it.
I don't know what people in the latter case use, but it sounds like they use Windows for Submarines.
> $400 million in 30 minutes
You write systems to autoplay Free to Play games?
You write systems to autoplay Free to Play games?
High frequency trading, more like! Or just trading.
Mistakes such as selling 610,000 shares at 1 yen, instead of 1 share at 610,000 yen.
Clash of Clans only makes on the order of ~$2M-$8M per day, according to estimates, so it'd be tough for a Clash of Clans outage to cost $400M. Only when playing with money, or with equipment worth $400M can you lose that much in 30 minutes.
(What kinds of equipment costs $400M and can be ruined in 30 minutes? Offshore oil rigs, I'm guessing. According to Quora, the least-expensive offshore rigs are $200M, while average is $360M. Ruining one of those with a software error would be a very bad day. Another option might be equipment in space such as satellites, though I imagine those are relatively harder to ruin.)
Mistakes such as selling 610,000 shares at 1 yen, instead of 1 share at 610,000 yen.
Clash of Clans only makes on the order of ~$2M-$8M per day, according to estimates, so it'd be tough for a Clash of Clans outage to cost $400M. Only when playing with money, or with equipment worth $400M can you lose that much in 30 minutes.
(What kinds of equipment costs $400M and can be ruined in 30 minutes? Offshore oil rigs, I'm guessing. According to Quora, the least-expensive offshore rigs are $200M, while average is $360M. Ruining one of those with a software error would be a very bad day. Another option might be equipment in space such as satellites, though I imagine those are relatively harder to ruin.)
I've worked on high frequency trading software infrastructure, including having been involved in serious bugs which lead to a lot of broken trades and lost money, and would have said with anything like proper architecture and governance you can't lose $400 million in 30 minutes.
But Knight Capital did manage to lose $440 million in 45 minutes, due in large part to what I would call improper architecture and governance. So there you go. https://dougseven.com/2014/04/17/knightmare-a-devops-caution...
But Knight Capital did manage to lose $440 million in 45 minutes, due in large part to what I would call improper architecture and governance. So there you go. https://dougseven.com/2014/04/17/knightmare-a-devops-caution...
Also think stuff like tunnel boring machines, or a dragline from a coal mine. Autopilot software for cruise liners. Power station control software.
I think there is another side as well, software that may incur a liability if it fails due to loss of human life or recall costs. Eg bridge control, pharmaceutical QA, even electronic manufacturing (think Galaxy Note 7 design phase).
I think there is another side as well, software that may incur a liability if it fails due to loss of human life or recall costs. Eg bridge control, pharmaceutical QA, even electronic manufacturing (think Galaxy Note 7 design phase).
Add life-critical systems to the list. The damages/insurance/claims can be in this order of magnitude. Just need to kill enough people at once, like a big plane or a big boat or a big building.
By the way, trading [should] have fail safes (i.e. stop after some amount of losses). A plane doesn't have fail safe, when the plane goes down, there is never enough parachutes =D
By the way, trading [should] have fail safes (i.e. stop after some amount of losses). A plane doesn't have fail safe, when the plane goes down, there is never enough parachutes =D
Vxworks, IME, is the option of choice for hard real time components. For other (e.g., soft real time) critical components a solid Linux distribution works better -- smaller code, easier checks. I have seen implementations as Linux systems with a few dedicated vxworks boards for specific small components.
Its a good thing you said open source * nix because a lot of the early commercial UNIXes were buggy and unstable. Also I hope you are not using Plan 9 or Open Solaris or MINIX or a few of the other opensource *nixes which are also not suitable. So maybe it looks like you just meant Linux? :)
Unsuitable, how?
Solaris has had realtime capability for fifteen years, and most recently has been the embedded OS of choice for Sun/Oracle storage appliances. plan9 not being Unix (at all) nonwithstanding, Coraid's AoE products have used plan9 as an embedded OS in the past. Certainly in the recent past, US destroyers had embedded signal-processing systems built by a well-known HPC vendor running a derivative of INRIA ChorusOS. Green Hills Software's Integrity RTOS && development environment are also quite commercial, and have many successful deployments.
Any insinuation that military or embedded applications should be Linux (or Windows) deployments, or even necessarily free software, is ahistoric and, IMO, under-informed.
Solaris has had realtime capability for fifteen years, and most recently has been the embedded OS of choice for Sun/Oracle storage appliances. plan9 not being Unix (at all) nonwithstanding, Coraid's AoE products have used plan9 as an embedded OS in the past. Certainly in the recent past, US destroyers had embedded signal-processing systems built by a well-known HPC vendor running a derivative of INRIA ChorusOS. Green Hills Software's Integrity RTOS && development environment are also quite commercial, and have many successful deployments.
Any insinuation that military or embedded applications should be Linux (or Windows) deployments, or even necessarily free software, is ahistoric and, IMO, under-informed.
Or one of the BSDs.
I don't see the big deal with this.
Building a command system on top of a general purpose operating system seems like a reasonable cost-saving decision. It has attendant risks, but so do all of the alternatives.
Security issues are moot, I would have thought, since these systems are not connected to the internet, and the main threat is from people who have physical access to the hardware.
Building a command system on top of a general purpose operating system seems like a reasonable cost-saving decision. It has attendant risks, but so do all of the alternatives.
Security issues are moot, I would have thought, since these systems are not connected to the internet, and the main threat is from people who have physical access to the hardware.
I would have thought the same until stuxnet. Otners know the story better than I but if memory serves, the Iranian nuclear facilities had systems that were not connected to the internet compromised. No internet connection for sure reduces the risk, but for those looking to compromise a sub I don't think it's an insurmountable roadblock.
Right, but my point is that if you have physical access, then the security holes in Windows XP, as compared to more modern iterations of Windows, aren't so relevant. It's not like the sub is going to be compromised via a bug in IE 6.
I also sort of suspect (without making any pretence of knowing what I'm talking about) that it's futile to try to make the computer system itself invulnerable to attack, and that human factors are likely to have a far greater influence on the overall security of the system. After all, Stuxnet was propagated via flash drives, and no-one should be sticking a random flash drive in a military submarine's computer systems.
I also sort of suspect (without making any pretence of knowing what I'm talking about) that it's futile to try to make the computer system itself invulnerable to attack, and that human factors are likely to have a far greater influence on the overall security of the system. After all, Stuxnet was propagated via flash drives, and no-one should be sticking a random flash drive in a military submarine's computer systems.
I don't recall any *nix OS's having automount and autorun enabled by default?
What I'm trying to say is, physical access does not necessarily mean full physical access, and when the virus has to spread through some storage medium connected to e.g. USB the underlying OS certainly matters.
I mean, they probably autorun that for the subs, but I think its indicative of the design philosophy behind most MS products. "Made for those who don't need full control, with politics prioritized over security", because what security-minded programmer would ever enable that by default?
Edit: inserted middle paragraph + fixed typo
What I'm trying to say is, physical access does not necessarily mean full physical access, and when the virus has to spread through some storage medium connected to e.g. USB the underlying OS certainly matters.
I mean, they probably autorun that for the subs, but I think its indicative of the design philosophy behind most MS products. "Made for those who don't need full control, with politics prioritized over security", because what security-minded programmer would ever enable that by default?
Edit: inserted middle paragraph + fixed typo
Wait, do you really think that embedded Windows versions behave the same as end-user ones?!
That's like saying "Linux sucks for embedded devices because Ubuntu automatically updates kernel and breaks stuff".
That's like saying "Linux sucks for embedded devices because Ubuntu automatically updates kernel and breaks stuff".
Point-of-sale Windows dev checking in: yes, mostly they do behave the same. Especially the "embedded" ones, which are desktop versions with different licensing, a few management features, special bits of userland (e.g. the OPOS subsystem) and, most crucially, longer support life.
"Compact" versions (CE, or "embedded compact") genuinely have removed features, but CE will still automount devices if it has drivers for them and you've not turned it off.
"Compact" versions (CE, or "embedded compact") genuinely have removed features, but CE will still automount devices if it has drivers for them and you've not turned it off.
Is that CE Windows CE, which is a completely different operating system designed for less powerful devices?
> Wait, do you really think that embedded Windows versions behave the same as end-user ones?!
After having to install anti-virus software on an 100k+ EUR oscilloscope, yes. Yes, they do behave the same as end-user ones.
After having to install anti-virus software on an 100k+ EUR oscilloscope, yes. Yes, they do behave the same as end-user ones.
You have no idea whether this is true in the case of British nuclear submarines, though.
Wait, do you really think that embedded Windows versions behave the same as end-user ones?!
Typically they're worse, in my experience. Harder to work with, easier to make mistakes.
Typically they're worse, in my experience. Harder to work with, easier to make mistakes.
> I don't recall any * nix OS's having automount and autorun enabled by default?
But I recall * nix-like OS's that have telnet enabled by default with insecure default passwords:
> https://www.malwaretech.com/2016/10/mapping-mirai-a-botnet-c...
"Mirai propagates by bruteforcing telnet servers with a list of 62 horribly insecure default passwords, starting with the infamous admin:admin."
But I recall * nix-like OS's that have telnet enabled by default with insecure default passwords:
> https://www.malwaretech.com/2016/10/mapping-mirai-a-botnet-c...
"Mirai propagates by bruteforcing telnet servers with a list of 62 horribly insecure default passwords, starting with the infamous admin:admin."
> I don't recall any *nix OS's having automount and autorun enabled by default?
If you're implying that Windows does, then that's the consumer version. These settings can be controlled by group policy. In a military or corporate environment operated by an administrator, they certainly should not be assumed to take on their default value, and instead should be assumed to take on their configured value.
If you're implying that Windows does, then that's the consumer version. These settings can be controlled by group policy. In a military or corporate environment operated by an administrator, they certainly should not be assumed to take on their default value, and instead should be assumed to take on their configured value.
Don't they share the same codebase? Of course there's gpedit and probably some other management tools, but I stand by my point that it indicates not prioritizing security, and it makes me supect the military will just have compliance-related differences while the IoT version will have functions somewhat haphazardly removed, with no real improvements on the underlying code.
I also have bad experiences with their open-source products (Visual Studio Community, Xamarin, .NET libraries written by them), their IoT for RPi offering. Their consumer OS's require manual cleanup and yearly full reinstalls. I've had software updates break my drivers, and one game (Gmod) on Windows 7 kill my graphics card twice, the second time taking my mobo with it. Their software installation/deinstallation system is unreliable. I've had automatic disk repair completely wreck a hardware RAID 2 setup. I had about two BSOD's a year until I switched to Linux.
I think my most stable Microsoft software experience I've had was Age of Mythology, and even that crashed sometimes.
I also have bad experiences with their open-source products (Visual Studio Community, Xamarin, .NET libraries written by them), their IoT for RPi offering. Their consumer OS's require manual cleanup and yearly full reinstalls. I've had software updates break my drivers, and one game (Gmod) on Windows 7 kill my graphics card twice, the second time taking my mobo with it. Their software installation/deinstallation system is unreliable. I've had automatic disk repair completely wreck a hardware RAID 2 setup. I had about two BSOD's a year until I switched to Linux.
I think my most stable Microsoft software experience I've had was Age of Mythology, and even that crashed sometimes.
If the devs lack sufficient clues to turn off automount, it really wouldn't matter what OS they used. I think there's a danger of comparing the current solution to some hypothetical perfect solution, which could never in fact be engineered within budget. An interesting comment on the Microsoft blog post:
> I have an insider view on this as when the ‘Vangard’ class of subs were being built in Barrow I was a member of the command System trials team…this was long before Windows and Microsoft and needless to say niche software, produced in very small quantities was much, much more unstable and buggy than any Windows release! I remember one long session where the only way the system would pass a particular tiral was for every one to ‘hands off’ their ‘pucks’ (and upside down mouse) for 15 mins. All went well until 2 minutes to go and some one brushed by the puck. The system went down!!! After a very long day we manged to get past this step!!
> Give me Windows anytime!!!
> I have an insider view on this as when the ‘Vangard’ class of subs were being built in Barrow I was a member of the command System trials team…this was long before Windows and Microsoft and needless to say niche software, produced in very small quantities was much, much more unstable and buggy than any Windows release! I remember one long session where the only way the system would pass a particular tiral was for every one to ‘hands off’ their ‘pucks’ (and upside down mouse) for 15 mins. All went well until 2 minutes to go and some one brushed by the puck. The system went down!!! After a very long day we manged to get past this step!!
> Give me Windows anytime!!!
> Their consumer OS's require manual cleanup and yearly full reinstalls.
I don't think this has really been true since the bad old days of Windows ME. Maybe even XP.
I've never done a Windows reinstall for myself or for friends since the early 2000s.
> I had about two BSOD's a year until I switched to Linux.
BSODs too are largely a thing of the past unless you have some kind of hardware/driver issue, in which case you'd of course also have kernel panics, though at least if you have a bad Linux driver you can hope it's open source and fix it yourself.
> I've had software updates break my drivers,
I don't doubt it, but I can't tell you how often a software update broke sound and/or WiFi in Ubuntu. :) That said, I quit running it on bare metal and ever since I haven't had any issues with updates I can recall.
All in all, my experience with hundreds of installations of both, is that enterprisey Linux and both consumer/enterprise Windows are on the same level of reliability, although if you want Windows for reliability purposes you're probably going to spend more time in configuration. I really don't see any issue with running Windows in mission-critical systems.
I don't think this has really been true since the bad old days of Windows ME. Maybe even XP.
I've never done a Windows reinstall for myself or for friends since the early 2000s.
> I had about two BSOD's a year until I switched to Linux.
BSODs too are largely a thing of the past unless you have some kind of hardware/driver issue, in which case you'd of course also have kernel panics, though at least if you have a bad Linux driver you can hope it's open source and fix it yourself.
> I've had software updates break my drivers,
I don't doubt it, but I can't tell you how often a software update broke sound and/or WiFi in Ubuntu. :) That said, I quit running it on bare metal and ever since I haven't had any issues with updates I can recall.
All in all, my experience with hundreds of installations of both, is that enterprisey Linux and both consumer/enterprise Windows are on the same level of reliability, although if you want Windows for reliability purposes you're probably going to spend more time in configuration. I really don't see any issue with running Windows in mission-critical systems.
>though at least if you have a bad Linux driver you can hope it's open source and fix it yourself.
IF you're the US or UK governments, you can get access to pretty much any driver or OS source you want.
IF you're the US or UK governments, you can get access to pretty much any driver or OS source you want.
Wow, you must have been really struck with some bad luck. All of my Windows desktops typically see months of uptime (till I reboot for updates). Linux ofcource is equally good now if you choose a reliable distribution.
Heres my current desktop which I rebooted 15 days ago
http://imgur.com/a/3ZjBE
Heres my current desktop which I rebooted 15 days ago
http://imgur.com/a/3ZjBE
Do you honestly think a state actor doesn't have Linux zero days coming out of their ears? You're talking about a government entity that created stuxnet by stealing driver signing certificates.
Linux would provide exactly 0 additional protection over embedded Windows if China or the US decides they want what you've got.
Linux would provide exactly 0 additional protection over embedded Windows if China or the US decides they want what you've got.
> since these systems are not connected to the internet,
Brave, brave assumption.
Brave, brave assumption.
As someone who actually worked on software for submarines, I can attest to all the machines not being connected to the internet. I had to have a separate laptop with me at all times so I could do google searches. Not that I needed to do that most of the time, considering the level of proprietary libraries being used on machinss that didn't behave like any OS you've seen before...
I was hinting more to the assumption that the internet is the only way to expose such systems.
Expose them to what? All the computers I developed on were generally supposed to replicate the hardware on the sub itself. Everything is self-contained on a sub. (maybe they have Ethernet going between computers, and never wifi because that could generate findable "noise" by sensors in ships or other subs, but not to the internet at large) This is by necessity as subs don't get access to the internet when they're underwater for 6-9 months or so, except in VERY limited cases where they can connect to a satellite for a very brief period of time and get something like 1kb of download.
It's not, but I see no reason to think that Windows XP is going to be more vulnerable to other kinds of attacks than any other OS.
I for one dont feel safe that Microsoft is running on critical systems. I guess its natures way of dealing with human overpopulation - and merry xmas / happy hanukkah
If you're afraid of critical systems running Microsoft software, boy do I have news for you..
The vast majority of businesses run on Windows too.
So, Windows is quite obviously a much, much better choice for general purpose computing than whatever hipster-fad OS you prefer :)
Also, I thought hipsters-fad followers were natures way of dealing with over-population since they're less likely to ever have kids.
Merry Kwanzaa to you!
So, Windows is quite obviously a much, much better choice for general purpose computing than whatever hipster-fad OS you prefer :)
Also, I thought hipsters-fad followers were natures way of dealing with over-population since they're less likely to ever have kids.
Merry Kwanzaa to you!
Sorry I only speak english and Afrikaans try run that through google translate..
The article is 8 years old... thank god :)
I don't know why the age of the article is reducing your fear. If anything they probably do more and more this.
And the OS is out of service (thank god :)) but the submarines running it aren't (oops)
I guess that they can think about upgrading from XP right now.
Yes it is. I found this link when I googled 'Windows for Submarines' when I read about it in Eric Schlosser's New Yorker essay "World War Three, by Mistake" which was featured earlier on HN.
https://news.ycombinator.com/item?id=13249976
https://news.ycombinator.com/item?id=13249976
Do not assume technology has been rolled out just because an article was a while ago. The military deals with just upgrading a version number of software very seriously and it takes years to happen. I can personally attest to Windows being installed on computers emulating a submarine environment. (it was probably XP)
Not so bad when you consider windows NT is a descendent of VMS. VMS was the system you went to when unix wasn't considered reliable enough.
I would imagine for a system like they remove all the crap, and just use the kernel and some well tested custom programs.
I would imagine for a system like they remove all the crap, and just use the kernel and some well tested custom programs.
Nit pick: They share the same core designers, but NT wasn't a direct decendent:
http://m.windowsitpro.com/windows-client/windows-nt-and-vms-...
http://m.windowsitpro.com/windows-client/windows-nt-and-vms-...
Brings a new meaning to 'Blue Screen of Death'. ;-)
DO NOT OPEN THEM
> equip the nuclear-propelled and nuclear-armed warship fleet with a Windows-based command system
We are all going to die...
We are all going to die...
It saddens me greatly when smart people work on stupid things.
However you turn it around, a nuclear submarine is an incredibly dumb thing to invest your intelligence in.
Intelligence without wisdom is very dangerous.
If you're a young brilliant mind, please stay away from military applications. You're not contributing to anyone, no matter what the (military) propaganda tells you.
However you turn it around, a nuclear submarine is an incredibly dumb thing to invest your intelligence in.
Intelligence without wisdom is very dangerous.
If you're a young brilliant mind, please stay away from military applications. You're not contributing to anyone, no matter what the (military) propaganda tells you.
Does this 'wisdom' contradict basic game theory?
The news article on Popular Mechanics and the actual original Guardian article: https://www.theguardian.com/technology/2016/jan/16/trident-o...
are January 2016, and confirm that they are still running that custom XP.