Dutch government builds its own Linux to escape Microsoft

What this video covers

• Why the Dutch government is building DAWO on NixOS
• How reproducible configurations help administer a government workplace
• What AP reported about the ICC prosecutor's email and what Microsoft disputed
• Why GitHub-hosted inputs remain part of the sovereignty problem

Transcript

The Dutch off switch: a sanctions list, not a hacker

0:00 You'd think the thing that can shut down a government's office is a hacker. The Dutch government decided it's a sanctions list in Washington, so it's building its own Linux desktop to get off Microsoft. In this video, three questions. How does a court lose its email? Why did the Dutch pick NixOS, a Linux most people have never heard of? And can a government actually leave Microsoft? And one more thing.

0:22 Their own code has a comment in it that made me laugh out loud, and I'll get to it at the end. It's Tuesday, September twenty-ninth, and this is The Daily Diff.

How the ICC prosecutor lost his Microsoft email

0:31 Three stories today, and the big one starts in The Hague. In February last year, the US sanctioned the International Criminal Court and its chief prosecutor, and the order threatens any company that gives him technological support. In May, the Associated Press reported that Microsoft cancelled the prosecutor's email address, citing court staff, and that he moved to Proton Mail in Switzerland. Microsoft didn't answer AP's request for comment. Microsoft tells it differently.

0:57 Its president, Brad Smith, told reporters that at no point did Microsoft cease or suspend its services to the court. So one side says the mailbox vanished. The other says the service never stopped. And the Dutch government, which hosts the court, drew its own conclusion. The off switch exists, and it sits in another country.

Dawo: the Dutch government's own NixOS desktop

1:15 The Dutch answer is called Dawo, short for a Dutch phrase meaning digitally autonomous workplace for government. It covers the operating system, the office apps and the cloud behind them. In July it became an official order, three big government IT shops are building it, and eight municipalities are testing it right now. The pilots run on old laptops the government had already written off, the kind Windows 11 refuses to install on. One core developer built a point-and-click admin panel so Windows admins can

1:44 come along, while admitting he's not a GUI guy. Another told Tweakers, we're not hardliners.

Why NixOS: openSUSE out, Fedora out, one file per laptop

1:49 So why NixOS? They tried open Suse first, then Fedora, and dropped both over who owns them. Suse has changed hands before and could be sold again, and Fedora belongs to Red Hat, which belongs to IBM. NixOS has no company behind it, and it started as a PhD project at Utrecht University, which is about as Dutch as software gets. Here's the trick, the way I'd explain it at a bar. On a normal system, installs write into shared folders,

2:15 so two laptops that start identical drift apart by Friday. On NixOS every package gets its own folder, named after a hash of everything that built it, and nobody can edit it afterwards. The whole machine is a text file. Copy the file, and you've copied the laptop. The developers say eighty to ninety percent of that code carries over from one deployment to the next, and for a government that's the whole business case. On Hacker News the first thread passed a thousand points,

2:42 and the cynics showed up on time. One predicts that after the next election, Microsoft promises a local headquarters. Then, he says, the Dutch roll back to Windows at twice the price, which is exactly what happened in Munich.

Munich went back; Schleswig-Holstein and the ICC moved on

2:54 Munich did go back, in twenty twenty, after years on Linux. This time the Dutch have company. Germany's Schleswig-Holstein moved forty thousand accounts off Microsoft last year, and the court at the center of all this is moving to openDesk, a German open-source office suite. The developers hope for version one next year, and Victor Gevers told Tweakers that twenty twenty-seven will be the year of Linux on the desktop, a prophecy that has come true every single year, next year.

3:21 Speaking of switches someone else controls.

Firebase crashes iPhone apps, London's 500,000 faces

3:23 On Monday evening, California time, Google's Firebase served a bad config from its own servers. iPhone apps using its analytics started crashing within a second of launch, including builds nobody had touched. Gergely Orosz called it amateur. Google had a rollback going within two hours and apologized. And as one Hacker News commenter put it, pinning versions doesn't save you when the config comes from their server.

3:46 And in London, a six-month trial of live facial recognition at railway stations scanned more than half a million faces. It cost over three hundred twenty thousand pounds and produced one alert, which was the wrong person, and no arrests, according to documents shared with the Guardian. Police have already extended it to the Underground. Half a million faces, zero for one.

The comment in Dawo's own code: fetched from GitHub

4:08 Now, that comment I promised. The Dutch escape from Microsoft is a public repo, and the top of its main build file says every input is currently fetched from github dot com. GitHub belongs to Microsoft. To be fair, the same comment sets a goal of zero foreign-hosted dependencies, mirrored onto the government's own code server. So the plan to leave Microsoft still downloads itself from Microsoft, and they wrote that down in public, which is more honesty than most roadmaps.

4:33 If you'd rather read this than hear me say it, the diff lands in your inbox every morning, free at the daily diff dot dev, link below.

Verdict: SHIP IT + finish the mirror

4:41 So, today's verdict on the Dutch workplace. SHIP IT. I'd ship it because the risk is real whoever you believe about that mailbox, and a laptop described in one public file is a kind of sovereignty you can actually check. Just finish the GitHub mirror first. And that's the diff for today. I'm Niko from Axrisi. Merge responsibly.

Sources

1. Tom's Hardwarewww.tomshardware.com
2. Tweakers (NL)tweakers.net
3. It's FOSSitsfoss.com
4. DAWO-Core codecodeberg.org
5. APapnews.com
6. The Register (Brad Smith, ICC to openDesk)www.theregister.com
7. Hacker Newsnews.ycombinator.com
8. Hacker News (Sep 25)news.ycombinator.com
9. Firebase issuegithub.com
10. Gergely Orosztwitter.com
11. The Guardianwww.theguardian.com