Why is There No Cult of Microsoft?

Michael Singer asks why Microsoft doesn’t have cult appeal like that shared by Apple, Linux, BSD, Oracle, Java, and other platforms (I would add Haiku to his list — a very sinister little cult that is!). He asks,

What about this: Is Microsoft in such control over its own products that nobody really cares to innovate around Microsoft software? Do they just go through the motions because that’s what they use at work?

I think most people aren’t excited about Microsoft because their product line is so pervasive and “traditional” — much like the lack of excitement of going to church or evangelism for most Roman Catholics and other denominations. I think people don’t get very excited about Windows or Office because it’s the standard. They can get excited by something novel — Linux, Haiku — or by a culture (cult) that fosters a certain status or elitism the way Apple has over the years. Microsoft really hasn’t done anything for brand-loyalty the way Apple has, which has led to Apple’s comfortable switch to the same Intel-based architecture that was so long Microsoft’s turf.

Interview With CanSecWest Mac Hacker

John Gruber has posted an e-mail interview of Dino Dai Zovi, the hacker who cracked a Mac at CanSecWest. He exploited a Java-based vulnerability in QuickTime, which he says is accessible via Firefox (including the Windows version) and Safari.

From the interview:

Gruber: I suspect some people might read this and think it’s good news that your exploit “only” gains user-level privileges. But an exploit like this is potentially catastrophic in the hands of an attacker. With user-level privileges, an exploit can read, delete, or corrupt anything in the user’s home directory – more or less all of the user’s own data. Technically, root exploits are harder and more powerful, but practically speaking, user-level privileges are all that an attacker needs. Correct?

Dai Zovi: A remote root exploit is typically much harder to come by than a remote user privilege exploit. However, in general, local user to root exploits are simpler to find than remote user-privilege exploits. So, in general, it is reasonable to assume that once an attacker has local user access to a system, root is not difficult to obtain. One should also point out, that if the user privileges are an admin user, it is possible to write to /Applications/ and /Library/, and this access is quite damaging. On a (primarily) single-user machine like a laptop or desktop, even non-admin user-level privileges are enough for most attacks (reading data, corrupting running applications, etc).

Nobody should run an operating system as a single-user-only, nor should any OS be used that doesn’t have at least two levels of permissions (root/admin and user) to minimize harm to the entire system. This is one of the real shortcomings of Haiku (as it now exists) and one of the reasons I compared it to Windows95 earlier this week — it’s not a trivial matter if anyone can make system-wide changes by obtaining access locally or remotely.

Haiku Propaganda and… haiku

I may as well go scorched-earth since nobody has appreciated my positive comments about HaikuOS. Here are some ideas for peddling your little piece of BeOS.

• Haiku - Insecure by Default!
• Haiku - Almost as Safe and Stable as Win95!
• Haiku - Sure, It Reboots Often — But It Reboots Quickly!
• Haiku - So Easy to Crash a Kid from a Baltic State Can Do It!
• Haiku - All Your Machines Are Belong to Latvia!
• Haiku - Affronting Simplistic Poetry through Instability and Insecurity!
• Haiku - The Last Two Syllables of A Seventeen Syllable Curse!
• Haiku - Because Linux Already Works!
• Haiku - Putting the BE Back in Weekend at BErnie’s!
• Haiku - BeOS’ Ninth Life!

And I’d be remiss if I didn’t offer a little five-seven-five in the spirit of it all:

Haiku has a hole
That some teen from Latvia
Owns computers with.

Is computer on?
All your computers are BE-
long To Latvia.

Be-O-S, Zeta,
Haiku — same shit with same fate.
Nobody wants Be.

Be-O-S, Zeta,
Haiku — all the more reason
To use BSD.

Haiku is the best
Attempt yet to recreate
Windows 95.

Haiku has the same
Security features as
Windows 95.

I used Be-O-S
In the 1990s ‘fore
Haiku was around.

The true BE-lievers
Said Be-O-S’d save the world.
Haiku won’t take off.

How many users
Does Haiku really have, dude?
Fewer than Be had.

The world will adopt
Haiku when pigs grow six wings
And they f***ing fly.

Haiku only has
One vulnerability:
Nobody wants it.

Why build new Haiku
When you could have Amiga
Instead? Dumb. Dumb. Dumb.

Haiku Insecurity

I shouldn’t have wasted my time responding to one of the true believers at OSNews. My previous remarks about BeOS, Zeta, and Haiku aren’t personal — they’re specifically aimed at a handful of issues I think are relevant to the present and future of computing:

• user adoption
• application availability
• technological relevance

Novelty may appeal to a certain breed of user, but it won’t work for the masses. No mass appeal, no application development; no applications, no mass appeal. Vicious circle. But the true believers just can’t see that so they blissfully work on their own little word processor wasting GSoC resources (waste = really bad priorities: your OS doesn’t have a functional network stack yet!).

I’ve also touched on a few issues with respect to technological relevance. One of them is scalability: Haiku OS is 16MB uncompressed. Cool. Linux is 6MB compressed. Linux is scalable, Haiku (thus far) isn’t. The future isn’t the desktop, the future is mobile. Linux is mobile, Haiku isn’t. Etc. Thus, Linux is relevant, Haiku isn’t.

Another issue of technological relevance is security. Sadly, Team Haiku’s goal for R1 doesn’t include much in the way of security. It will be single user — just like BeOS, just like Win95. It will have nil security from levels of permissions to affect system-wide changes, just like Win95 (but something MS dealt with in NT server and workstation editions and carried over to ME, XP, and Vista). So Haiku’s early adopters will be computing in circa 1995 environment where a local or remote exploit can result in full control of the computer on which it’s running. That isn’t going to increase the rate of immigration from other OSes — that’s a barrier to adoption. Why on earth would anyone go from one vulnerable OS (e.g., any flavor of Windows from ME on) that has regular security maintenance to one that has none? Or worse, why would they change to an OS that has a security level about 12 years behind what’s needed now?

Worse, I found this on haiku-security.com:

One I can definitely state as a major security risk is that you can call delete_area() with the ID of *any* area, even of the kernel, and delete it from any process.
When you do that with a kernel area, chances are you’ll quickly find out how quickly your system reboots.

Fortunately, Haiku boots in just a few seconds. That may not be of much use, though, when a Baltic nation grade-schooler has control of your Haiku computer.

Ease, Stability, Etc.

One of the Haiku fanboys at OSNews gave me a challenge:

Talk to me about the ‘ease’ of configuring certain parts of any GNU/Linux distribution you care to mention. Talk to me about stability, reliability issues, re-installing Windows, failed Linux installs etc.

About a month ago, I had two Linux distros (MepisLite and DamnSmallLinux) and NetBSD installed on the computer I’m using right now. This machine is the same one on which I used to run BeOS exclusively — 400 mhz Celeron, 128 MB RAM, not very flashy at all.

A month ago, I repartitioned my drive so I could enlarge my swap partition because I’m developing something that requires a lot more memory than I’m ever going to put in this little old computer (I need to update that page for a progress report). I reinstalled DSL 2.1b with a normal Debian-type install without apt-get support. This computer has ZERO downtime since the reinstall.

So there’s your stability. No crashes and nearly a full month of uptime. Try that with Haiku.

How long did it take me to back up data, repartition my drive, clear out MBR, reinstall DSL, and get everything set up the way I want? Maybe half an hour tops, but I know what I’m doing. DSL is only 50 MB so installation goes quickly. It uses hardware detection scripts from Knoppix. It was a freakin’ breeze (as usual) — install, go. I also don’t have any goofy hardware because my rule of thumb is to buy hardware that doesn’t require any proprietary driver or that will give me headaches working in the operating systems I use (primarily Linux, BSD, and — very rarely — Windows XP). So there’s your ease of configuration.

I noted two things in my reply at OS News. First, that I’ve never had a “failed install” of Linux. That includes Slackware, Debian, Red Hat, Mandrake  (never tried it since it changed its name to Mandriva), or any derivatives of those (DSL, Mepis, Kubuntu, Knoppix, etc.). Second, there are plenty of distros that are easy enough to set up that even a BeOS user can set them up: Ubuntu and its offspring, PCLinuxOS, and Mepis have excellent hardware detection and will set up very quickly and easily for most Linux novices. There may be some quirky hardware that will give anyone fits, but that’s the kind of dross that shouldn’t be bought in the first place because it was only intended to work (locked in) with Windows or Mac.

Beating a Dead OS Again

The true believers at OSNews won’t give it up, so neither will I. How many BeOS servers are there on the Internet? Were there ever many?

I just did a quick run-through at netcraft to see if any Be-related sites actually run off Be-servers. No surprises. After all, Be is dead (RIP) and Haiku’s (a) not ready for prime time and (b) completely desktop-oriented. So much for it displacing Windows and Linux in the next two to five years, which was one of the more absurd responses I got at OSNews.

Haiku’s website is hosted on a Linux server. BeOS Radio’s site is hosted on a FreeBSD server. BeBits is hosted on a Linux server. Begroovy.com is hosted on a Linux server. BeOSonline.com is hosted on a Linux server. BeUnited.org’s site is hosted on Linux. When Netcraft last checked, the BeOS Max site was hosted on Linux. BeTips.net is hosted on Linux.

BeTips.com is interesting. They’re currently hosted on FreeBSD, but have also been hosted on Windows servers.

Finally, I didn’t even know it was running, but the Be, Incorporated, website is up and hosted on Linux. The site only has shareholder information on it — hope y’all didn’t spend your 58-cents per share in one place.

There ya go, true Believers. That’s how relevant you are in the real world.

More on BeOS/Cast Out the Heretic!

I know loyalties can run pretty deep but I never imagined I would wear out my welcome at OSNews so quickly. It’s a little disheartening considering I attempted an approach that sought to avoid a “my OS is better than your OS” skirmish by pointing out my respect for BeOS’ technical merits and my admiration for those working on Haiku. It’s not surprising, though, that someone would respond like this as if I’m trying to rob him of his joy or that this is an all-or-nothing battle for the “souls” of computers:

What are you afraid of, that Linux will lose the battle? You like Linux so much, then stick with it and let the rest of us enjoy BeOS/Haiku.
–tonestone57

Well, I do use Linux for the most part. I also use OpenBSD and Windows XP (very rarely for work), and I have an old computer with NT Workstation that never gets used anymore. For a long time, I ran BeOS PE on this very computer and even added a BeOS partition to the NT computer. I’m not tied to any single operating system. I’m no fanboy, I’m no zealot. I have no fear of Linux “losing” anything, nor do I fear Haiku or any other OS ascending in usage. I just doubt that’s going to happen. (See below: I’ve heard this tired refrain for years. How long will you sing it while the rest of the world passes you by?)

I suppose shit is always going to hit the fan when pointing a true believer to facts and a reality he or she just won’t face. BeOS is dead. Blue-Eyed OS is dead. Cosmoe is dead. PhOS was never supposed to be released, but is dead. Zeta may or may not have been legally developed, but it’s dead. All of it’s dead because there wasn’t enough interest for any of it to be feasible from a business stand point or even from a hobbyist’s/ free developer’s standpoint. You can whine all you want about “what might have been” — the problem is things didn’t go that way. It’s called reality. Are you in touch with it?

BeOS was abandoned (dead!) in 2001; had it continued to today, then it would have been a different story.
– tonestone57

I don’t care for such circular reasoning or impractical hypotheticals. It’s not a different story because it didn’t happen the way you wish it had. Things turned out very badly for Be, for BeOS, and for BeOS fans.

So that leaves the world with Haiku. I wrote that I admire Haiku. I also know its current limitations, which I believe will have a bearing on future limitations (as it relates to adoption). Guess some people don’t care to hear or accept them. Fine, keep your blinders on and remain so blind to reality that you see only the “potential” without getting bogged down in details like these:

• It lacks a fully functional network stack.
• It can’t run on its own yet.
• It’s not scalable.
• It’s destined for the desktop with no roadmap to mobility.
• There’s no groundswell of interest in it outside those who’ve used BeOS.

It’s also way behind Windows, Linux, and Mac in every single one of  those measures — not to mention the measure of user adoption.

I think Haiku will make it, but won’t happen in 2 years, but take something like 5 years to start being noticed *and* Linux / Windows will lose users to Haiku. 
– tonestone57

This is like a broken record I’ve heard before. It first came from Be and from the Be Users Group — I was a member in the ’90s, but I wasn’t a true believer. I heard it all. Seems like yesterday. I kept waiting for it to happen — the impending wildfire when everyone suddenly would wake up and realize BeOS was technically better than Windows, remarkably easier to configure than Linux, and cheaper than a Macintosh. It never came.

It didn’t seem to matter to the true believers that BeOS never really had “mature” applications, that it wouldn’t work with stuff like that old handheld scanner, that it lacked support for even much of the new hardware it was designed to work with, and that no matter how clever and cute it was Be, in the end, couldn’t even give it away for free.

What relevance can something designed for the desktop have in the wireless age, where mobility counts? What will Haiku offer that isn’t already accomplished with other mainstream operating systems, including Linux?

The answer is the same to both those questions. Nothing. None. Nada.

The people I met at my BUG have moved on, grown up. Most of the people I still keep in touch with and see regularly went back to Macs (all the true believers are now back in the Mac cult). Some are using Linux. A few use Windows. Nobody uses Be, at least they’re not openly admitting it. Nobody’s clamoring for Haiku beyond those who stubborn few who’ve clung to the hope that BeOS would be resurrected and made relevant again.

Only one problem. It never really was relevant.

BeOS Spin-off Bites the Dust

This is a longer rant than I intended to make. I was going to write about this last week when the news was breaking that Zeta, which purported to be the legal offspring of BeOS, had (again) bitten the dust. I decided, though, it was too trivial to mess with. BeOS hasn’t been important for years. It won’t ever be.

As much as I liked BeOS — its speed and responsiveness, its fresh approach, its novelty, and being ahead of its time with its journaled file system, being oriented for multimedia, etc. — I understood the reality that it was built on a poor business model that really put all its eggs in one basket (trying to sell or license to Apple for the Mac). I haven’t been surprised that Palm or anyone else didn’t try to resurrect it because the demand just wasn’t there for it. The nails were in the coffin the day Steve Jobs returned to Apple and OS X’s development was tied to Mach/NeXT.

I replied to some questions while ago at OS News about why Access, the company claiming it owns the old Be intellectual properties, didn’t go after the small-time players involved in Zeta or other projects. In a nutshell, because there really was no financial interest to protect and no financial incentive to go after those involved in Zeta’s development or distribution.

From a business point of view, it’s no surprise Be withered and died and that Palm never even tried to improve it. It would have cost them more and it wouldn’t have ever paid for itself. From a business point of view, it’s no surprise others have failed — and at least as miserably — when trying to resurrect Be. Zeta went through two different distributors in recent months. The business reality finally hit the fan and it appears to be dead. (For now anyway. I have no doubt someone else will either try again or attempt to license or buy the Be IP from Access. They’ll fail, too.)

Looking at it from a technical point of view doesn’t address the business issues in the whole saga. It never caught on with enough people for anyone to make money with it. Changing personnel or distribution channels won’t change the economics. For all its appeal, it was a niche OS.

I’ll admit my admiration for those who’ve tried to recreate an open source BeOS-like environment. Some of the projects, though, only replicated the interface of BeOS — using a Linux kernel with Be-like icons doesn’t translate into the Be API, Tracker, etc. It was still Linux.

Haiku is getting closer to being a legitimate operating system. I haven’t tried it because I haven’t cared to mess with it until it’s mature enough that it can load into its own partition and be booted on its own. I follow its development, but I’m happy using Linux.

I wish Haiku lots of success. I know there’s a loyal group of ex-Be (and many still using it) users who’ll love it. I’m not convinced, though, that it’s the better mousetrap to which everyone will be drawn. The future isn’t on the desktop, it’s in wireless devices.

And I think that’s one of the great ironies: Be paid no homage to the past with support for legacy hardware — BeOS was intended only for current hardware. In recreating an open source BeOS, will Haiku be relevant to our increasingly smaller wireless future or will it be relegated to our increasingly archaic desktops?