A national, open-source operating system could help reduce Canada’s dependence on the U.S. while improving security and saving a surprising amount of money.
Author of the article missed the Netherlands going to NixOS by a week.
And Canada already has a homegrown operating system that’s just waiting for someone to read the handbook thoroughly, read the manual, install it themselves, and see what’s up. Canada has already played host to a free operating system with OpenBSD thanks to crypto being a munition back in the 90s and there’s no reason to not look at both Nix and OpenBSD if they’re going to head down that road.
I’ll go ahead and write the international treaty:
Canada and the Netherlands agree to go halfsies on a trusted NixOS and OpenBSD repo.
Yes. I wasn’t trying to exclude any projects, but I wanted to point out that another nation-state is looking to do the same project and for the same reasons (Netherlands with NixOS), and that there’s already an even older project (OpenBSD) that already meets some of the same goals Canada would be trying to achieve.
It’s just that all of a sudden there are a lot of moving parts in this space and we could finally get the year of the Linux Desktop. I’d like to see BSD right there alongside it.
This paper develops a comparative policy analysis of six state-sponsored Linux distributions (China, Russia, India, France, Germany and South Korea) using a dual total cost of ownership (TCO) + strategic autonomy analytical framework, benchmarked against Canada’s procurement landscape, laws and trade obligations.
Originality/value
This paper proposes a Canadian Free and Open Systems Foundation (Crown not-for-profit modeled on Germany’s Zentrum für Digitale Souveränität) alongside a three-phase implementation roadmap and five institutionally targeted policy recommendations. The proposal offers a generalizable middle-power template for reconciling digital sovereignty with open multilateralism, applicable to Australia, Japan, South Korea and Nordic states facing parallel dependencies.
So while the author mentions Debian, that is just an example. The actual recommendation is setting up a foundation to make those decisions after confirming it will meet the requirements + working with other countries on this
The actual recommendation is setting up a foundation to make those decisions after confirming it will meet the requirements + working with other countries on this
I also don’t have the full text. Is there anything in it about having this foundation lead from the front by using “strategically autonomous” software internally and experiencing the teething issues? Just dumping MS Office alone will be difficult. Did the full text go into the final thoughts on scale?
I added a link to the full PDF, it does seem to focus more on the rollout side
It doesn’t have the foundation try it internally, but it does call for a strategic rollout. The way I read it, the organization is only supposed to manage the transition and rollout, while people who are actually using computers for work will be the ones to test it. It will start with those who are less likely to be affected by any teething issues.
Pilot deployment targets risk-graduated workloads sharing four properties: web-first application stacks, low Microsoft 365 dependency, high political tolerance for transition friction, and existing institutional FOSS familiarity. The recommended pilot footprint comprises federal developer workstations (low compatibility risk, high FOSS familiarity), public-facing kiosks (single-application footprint), education ministries (existing FOSS deployments at the K-12 layer), and public library networks (Koha and Evergreen already deployed extensively).
This is also a part of the first phase, which IMO is more important:
A mandatory FOSS-first evaluation clause should be added to the Treasury Board Directive on the Management of Procurement for desktop and server refresh cycles. It should be framed as a technical-specification requirement rather than a nationality preference, replicating the EU’s GPA-compatible FOSS procurement architecture documented by Shaikh & Levina (2019).
He does also talk about MS Office & M365
the biggest user hurdle is rarely the operating system itself, which most users are unaware of, but the applications. Public servants are deeply entrenched in the Microsoft ecosystem and replacing MS Word and Excel with open-source alternatives like LibreOffice can be challenging for some users. Although LibreOffice has overall good functionality, minor changes may be needed, for example in formatting, use of macros or assuring the fonts users want are available
Application incompatibility is rated High likelihood, as Microsoft 365 lock-in is the primary operational constraint. Empirical FOSS migration research demonstrates that web-first sequencing combined with compatibility layers resolves the majority of incompatibilities at the application layer rather than requiring wholesale rewrites (Ven & Verelst, 2011). To minimize this primary risk the following migration sequence can be used (Hauge, et al., 2010):
Inventory applications by dependency class.
Prioritize browser-based and cross-platform applications.
Containerize or virtualize legacy Windows applications.
Replace Active Directory dependencies with open identity standards where feasible.
Maintain Windows virtual desktops for exception cases during the transition
It was a well thought out paper. I thought it was particularly interesting that they just drop any pretense and refer to cloud hosting in the US as a security risk.
I thought it was also very interesting that they describe the Munich case as a risk to the program. If they referenced a technological reason for Munich’s reversal then I missed it, but instead the reversal was purely due to economic leverage (MS dropped prices) and political reasons (MS offices moved to Munich). I’ll bet there’s probably some saavy computer science student working on an economics minor (or vice versa) that could go back and look at that and recast it in modern terms of a ransomware attack to be able to assign some economic risk to it. How low would microsoft have to drop their prices before it’s no longer cost effective to make the jump (ignoring the desire for digital autonomy).
The paper does a really good job putting everything in dollar terms. Even disgregarding the digital autonomy desire, it still seems cost effective to make the jump if you’re willing to eat the transition phase, and their suggestions about setting up a funded foundation, with legislative backing, and a five year sunset gives a good shot at getting started. I think they’re probably underestimating the difficulty with the document formats, though. Somewhere in Canada there’s at least one zip file embedded in a Word document that an organization is dependent on, but has never reached a point where younger people with all their new-fangled techniques has been able to replace. They do cover this (“Acknowledging Lehman’s laws of software evolution, which dictate that software must continuously adapt or face progressive degradation”).
Government procurement culture is risk-averse and will want service agreements for the software.
Some of this might have to be self-underwritten. It’s not like MS service agreements are worth anything, anyway, in light of the ICC shenanigans going on. Nobody should feel proud reducing attack surface and increasing uptime by signing a contract with the Attack Surface.
As shown in Table 1, many other countries have been successful in adopting a national Linux distribution. There are challenges, however, to this approach, which can be grouped into three categories: 1) user adoption resistance, 2) organizational resistance, and 3) language factors.
They also reference all the backend stuff they’re already using Linux with. The paper almost reads like they don’t expect any technological barriers. They’re going to need a replacement for Active Directory that Active Directory can authenticate against, and they’re going to need something that works like Teams.
Debian LTS is a good choice. I opened the door in the comments by talking about Nix because the Netherlands picked it, but really anything would work. After doing “some research” it looks like Italy and Austria have this either completed or underway1.
I think there’s every chance of this “just working,” and I hope it does.
[1] Italy moved to LibreOffice so long ago that I can’t find a recent article about it, so I assume it either worked great or they quietly backed off. Austria is doing something simliar so after some “research” it looks like Canada may be late to the party.
I think the same reason people don’t like NixOS is why it might be good for enterprise / government.
For personal use, it can be a pain to learn and configure everything the way that you want it. There is not as much value in having it be reproducible if you’re the only person using it
For enterprise use, the IT team can set it up and have it work the same way across every machine.
Author of the article missed the Netherlands going to NixOS by a week.
And Canada already has a homegrown operating system that’s just waiting for someone to read the handbook thoroughly, read the manual, install it themselves, and see what’s up. Canada has already played host to a free operating system with OpenBSD thanks to crypto being a munition back in the 90s and there’s no reason to not look at both Nix and OpenBSD if they’re going to head down that road.
I’ll go ahead and write the international treaty:
Canada and the Netherlands agree to go halfsies on a trusted NixOS and OpenBSD repo.Wasn’t Arch made by a Canadian?
Yeah, Judd Vinet. He’s no longer involved with the project, though.
Yes. I wasn’t trying to exclude any projects, but I wanted to point out that another nation-state is looking to do the same project and for the same reasons (Netherlands with NixOS), and that there’s already an even older project (OpenBSD) that already meets some of the same goals Canada would be trying to achieve.
Whoops, sorry if I sounded accusatory. It was just a question because I wanted to make conversation about some old info I wasn’t so certain about.
I didn’t take it as accusatory. :-)
It’s just that all of a sudden there are a lot of moving parts in this space and we could finally get the year of the Linux Desktop. I’d like to see BSD right there alongside it.
The author does discuss that actually
Here is the study it is referring to, which the author put out last week
(although I don’t have the full text right now): https://www.emerald.com/dprg/article-abstract/doi/10.1108/DPRG-06-2026-0347/1400436/Open-source-digital-sovereignty-the-case-for-a?redirectedFrom=fulltextEDIT: Full paper here: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=7585538
So while the author mentions Debian, that is just an example. The actual recommendation is setting up a foundation to make those decisions after confirming it will meet the requirements + working with other countries on this
I also don’t have the full text. Is there anything in it about having this foundation lead from the front by using “strategically autonomous” software internally and experiencing the teething issues? Just dumping MS Office alone will be difficult. Did the full text go into the final thoughts on scale?
I added a link to the full PDF, it does seem to focus more on the rollout side
It doesn’t have the foundation try it internally, but it does call for a strategic rollout. The way I read it, the organization is only supposed to manage the transition and rollout, while people who are actually using computers for work will be the ones to test it. It will start with those who are less likely to be affected by any teething issues.
This is also a part of the first phase, which IMO is more important:
He does also talk about MS Office & M365
It was a well thought out paper. I thought it was particularly interesting that they just drop any pretense and refer to cloud hosting in the US as a security risk.
I thought it was also very interesting that they describe the Munich case as a risk to the program. If they referenced a technological reason for Munich’s reversal then I missed it, but instead the reversal was purely due to economic leverage (MS dropped prices) and political reasons (MS offices moved to Munich). I’ll bet there’s probably some saavy computer science student working on an economics minor (or vice versa) that could go back and look at that and recast it in modern terms of a ransomware attack to be able to assign some economic risk to it. How low would microsoft have to drop their prices before it’s no longer cost effective to make the jump (ignoring the desire for digital autonomy).
The paper does a really good job putting everything in dollar terms. Even disgregarding the digital autonomy desire, it still seems cost effective to make the jump if you’re willing to eat the transition phase, and their suggestions about setting up a funded foundation, with legislative backing, and a five year sunset gives a good shot at getting started. I think they’re probably underestimating the difficulty with the document formats, though. Somewhere in Canada there’s at least one zip file embedded in a Word document that an organization is dependent on, but has never reached a point where younger people with all their new-fangled techniques has been able to replace. They do cover this (“Acknowledging Lehman’s laws of software evolution, which dictate that software must continuously adapt or face progressive degradation”).
Some of this might have to be self-underwritten. It’s not like MS service agreements are worth anything, anyway, in light of the ICC shenanigans going on. Nobody should feel proud reducing attack surface and increasing uptime by signing a contract with the Attack Surface.
They also reference all the backend stuff they’re already using Linux with. The paper almost reads like they don’t expect any technological barriers. They’re going to need a replacement for Active Directory that Active Directory can authenticate against, and they’re going to need something that works like Teams.
Debian LTS is a good choice. I opened the door in the comments by talking about Nix because the Netherlands picked it, but really anything would work. After doing “some research” it looks like Italy and Austria have this either completed or underway1.
I think there’s every chance of this “just working,” and I hope it does.
[1] Italy moved to LibreOffice so long ago that I can’t find a recent article about it, so I assume it either worked great or they quietly backed off. Austria is doing something simliar so after some “research” it looks like Canada may be late to the party.
Netherlands going to NixOS? I mean ok I hate Nix but it is slightly better the MS.
What are your arguments to hate Nix? Must have a lot to be almost as bad as Microsoft.
I think the same reason people don’t like NixOS is why it might be good for enterprise / government.
For personal use, it can be a pain to learn and configure everything the way that you want it. There is not as much value in having it be reproducible if you’re the only person using it
For enterprise use, the IT team can set it up and have it work the same way across every machine.
Plus it’s kind of immutable, so presumably pretty hard to break for regular office people who aren’t techy.
There’s some Anti AI grumbling about Nix too 3 weeks ago over this:
https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md
Yes. I found out about the effort about their DAWO effort through lemmy. It’s only recently been in the news, and the barrier to entry should be much lower than joining the GCAP program with observer status.
If you missed it, it’s a developing story: https://lemmy.world/post/53135123