A national, open-source operating system could help reduce Canada’s dependence on the U.S. while improving security and saving a surprising amount of money.
I added a link to the full PDF, it does seem to focus more on the rollout side
It doesn’t have the foundation try it internally, but it does call for a strategic rollout. The way I read it, the organization is only supposed to manage the transition and rollout, while people who are actually using computers for work will be the ones to test it. It will start with those who are less likely to be affected by any teething issues.
Pilot deployment targets risk-graduated workloads sharing four properties: web-first application stacks, low Microsoft 365 dependency, high political tolerance for transition friction, and existing institutional FOSS familiarity. The recommended pilot footprint comprises federal developer workstations (low compatibility risk, high FOSS familiarity), public-facing kiosks (single-application footprint), education ministries (existing FOSS deployments at the K-12 layer), and public library networks (Koha and Evergreen already deployed extensively).
This is also a part of the first phase, which IMO is more important:
A mandatory FOSS-first evaluation clause should be added to the Treasury Board Directive on the Management of Procurement for desktop and server refresh cycles. It should be framed as a technical-specification requirement rather than a nationality preference, replicating the EU’s GPA-compatible FOSS procurement architecture documented by Shaikh & Levina (2019).
He does also talk about MS Office & M365
the biggest user hurdle is rarely the operating system itself, which most users are unaware of, but the applications. Public servants are deeply entrenched in the Microsoft ecosystem and replacing MS Word and Excel with open-source alternatives like LibreOffice can be challenging for some users. Although LibreOffice has overall good functionality, minor changes may be needed, for example in formatting, use of macros or assuring the fonts users want are available
Application incompatibility is rated High likelihood, as Microsoft 365 lock-in is the primary operational constraint. Empirical FOSS migration research demonstrates that web-first sequencing combined with compatibility layers resolves the majority of incompatibilities at the application layer rather than requiring wholesale rewrites (Ven & Verelst, 2011). To minimize this primary risk the following migration sequence can be used (Hauge, et al., 2010):
Inventory applications by dependency class.
Prioritize browser-based and cross-platform applications.
Containerize or virtualize legacy Windows applications.
Replace Active Directory dependencies with open identity standards where feasible.
Maintain Windows virtual desktops for exception cases during the transition
It was a well thought out paper. I thought it was particularly interesting that they just drop any pretense and refer to cloud hosting in the US as a security risk.
I thought it was also very interesting that they describe the Munich case as a risk to the program. If they referenced a technological reason for Munich’s reversal then I missed it, but instead the reversal was purely due to economic leverage (MS dropped prices) and political reasons (MS offices moved to Munich). I’ll bet there’s probably some saavy computer science student working on an economics minor (or vice versa) that could go back and look at that and recast it in modern terms of a ransomware attack to be able to assign some economic risk to it. How low would microsoft have to drop their prices before it’s no longer cost effective to make the jump (ignoring the desire for digital autonomy).
The paper does a really good job putting everything in dollar terms. Even disgregarding the digital autonomy desire, it still seems cost effective to make the jump if you’re willing to eat the transition phase, and their suggestions about setting up a funded foundation, with legislative backing, and a five year sunset gives a good shot at getting started. I think they’re probably underestimating the difficulty with the document formats, though. Somewhere in Canada there’s at least one zip file embedded in a Word document that an organization is dependent on, but has never reached a point where younger people with all their new-fangled techniques has been able to replace. They do cover this (“Acknowledging Lehman’s laws of software evolution, which dictate that software must continuously adapt or face progressive degradation”).
Government procurement culture is risk-averse and will want service agreements for the software.
Some of this might have to be self-underwritten. It’s not like MS service agreements are worth anything, anyway, in light of the ICC shenanigans going on. Nobody should feel proud reducing attack surface and increasing uptime by signing a contract with the Attack Surface.
As shown in Table 1, many other countries have been successful in adopting a national Linux distribution. There are challenges, however, to this approach, which can be grouped into three categories: 1) user adoption resistance, 2) organizational resistance, and 3) language factors.
They also reference all the backend stuff they’re already using Linux with. The paper almost reads like they don’t expect any technological barriers. They’re going to need a replacement for Active Directory that Active Directory can authenticate against, and they’re going to need something that works like Teams.
Debian LTS is a good choice. I opened the door in the comments by talking about Nix because the Netherlands picked it, but really anything would work. After doing “some research” it looks like Italy and Austria have this either completed or underway1.
I think there’s every chance of this “just working,” and I hope it does.
[1] Italy moved to LibreOffice so long ago that I can’t find a recent article about it, so I assume it either worked great or they quietly backed off. Austria is doing something simliar so after some “research” it looks like Canada may be late to the party.
I added a link to the full PDF, it does seem to focus more on the rollout side
It doesn’t have the foundation try it internally, but it does call for a strategic rollout. The way I read it, the organization is only supposed to manage the transition and rollout, while people who are actually using computers for work will be the ones to test it. It will start with those who are less likely to be affected by any teething issues.
This is also a part of the first phase, which IMO is more important:
He does also talk about MS Office & M365
It was a well thought out paper. I thought it was particularly interesting that they just drop any pretense and refer to cloud hosting in the US as a security risk.
I thought it was also very interesting that they describe the Munich case as a risk to the program. If they referenced a technological reason for Munich’s reversal then I missed it, but instead the reversal was purely due to economic leverage (MS dropped prices) and political reasons (MS offices moved to Munich). I’ll bet there’s probably some saavy computer science student working on an economics minor (or vice versa) that could go back and look at that and recast it in modern terms of a ransomware attack to be able to assign some economic risk to it. How low would microsoft have to drop their prices before it’s no longer cost effective to make the jump (ignoring the desire for digital autonomy).
The paper does a really good job putting everything in dollar terms. Even disgregarding the digital autonomy desire, it still seems cost effective to make the jump if you’re willing to eat the transition phase, and their suggestions about setting up a funded foundation, with legislative backing, and a five year sunset gives a good shot at getting started. I think they’re probably underestimating the difficulty with the document formats, though. Somewhere in Canada there’s at least one zip file embedded in a Word document that an organization is dependent on, but has never reached a point where younger people with all their new-fangled techniques has been able to replace. They do cover this (“Acknowledging Lehman’s laws of software evolution, which dictate that software must continuously adapt or face progressive degradation”).
Some of this might have to be self-underwritten. It’s not like MS service agreements are worth anything, anyway, in light of the ICC shenanigans going on. Nobody should feel proud reducing attack surface and increasing uptime by signing a contract with the Attack Surface.
They also reference all the backend stuff they’re already using Linux with. The paper almost reads like they don’t expect any technological barriers. They’re going to need a replacement for Active Directory that Active Directory can authenticate against, and they’re going to need something that works like Teams.
Debian LTS is a good choice. I opened the door in the comments by talking about Nix because the Netherlands picked it, but really anything would work. After doing “some research” it looks like Italy and Austria have this either completed or underway1.
I think there’s every chance of this “just working,” and I hope it does.
[1] Italy moved to LibreOffice so long ago that I can’t find a recent article about it, so I assume it either worked great or they quietly backed off. Austria is doing something simliar so after some “research” it looks like Canada may be late to the party.