Black Thursday has arrived. It’s a day I was expecting, yet hoping could be avoided. Oh, I didn’t know what day of the week it would be — it could just as easily have been Black Wednesday — but I knew it was coming. Management kept dropping hints. Licensing costs, alternative pilots, architectural changes. And, tragically, the day has arrived. The announcement has been made. The death knell rung. The wake cancelled. What might this tragic news be? My management (if you know who I work for you, you can fill in the details yourself) announced today that we are reversing our original decision to proceed with all new development in Java, with our new direction to be tied to Microsoft’s .Net. "What’s wrong with that?" one might ask. Allow me to expound.
Those of you in the technology field may look at my distaste for Microsoft products and write me off as a Linux zealot. After all, Microsoft puts out a quality product, right? Wrong, I think, on both counts. First off, I’m not a Linux zealot. I am, though, a huge fan. I have installed and run Linux boxes at my current job, as well as my last one. I also run it almost exclusively at home. Personally, I find Linux to be much more fun and rewarding than a Windows experience. Professionally, I feel you should select the best tool for the job (which can be a difficult metric to define and evaluate), and I have seen precious few scenarios where a Microsoft solution makes better sense.
As far as the quality of Microsoft’s products goes, I think the facts speak for themselves. For those who have used MS offering exclusively, you’re probably pretty happy and impressed with the current crop. They’re more powerful and more stable than past versions. Your assessment, I think, is correct. However, when you compare what MS offers to what other vendors, not just Linux (which isn’t actually a vendor, but work with me here), have to offer, and you’ll begin to see a vast disparity in terms of quality, security, stability, and reliability. Microsoft got where it was by being first. With the leg up that Big Blue gave them, they were the first to offer an operating system for the PC platform, which was cheaper (and still is) than the possibly superior offerings from Apple, among others. They maintain where they are by sheer monopoly force. Windows needs regular reboots to maintain sanity, and is prone to viruses and worms. Exchange and Outlook are high-priced vectors for "email" viruses (which should be termed Outlook viruses, as no other mail clients are affected). Office is over-priced and bloated, and has its own demons to fight with regards to viruses. While no software package is 100% secure or perfect, but Microsoft products, as a general rule, trail the pack.
So what does this have to do with my current employer? The decision was made to upgrade to Exchange 2003, but to do that, we need to upgrade to Active Directory. To do that, we either go through severe pain and anguish in trying to migrate our Win2K domains to AD, or install Windows Server 2003. The result of that decision is left as an exercise for the reader. This highlights the Microsoft business model nicely. "If you want to run the new version of Foo, you have to upgrade to the latest version Bar." With the level of integration Microsoft demands, which apologists applaud, installing the latest version of a Windows product strengthens the stranglehold Microsoft has on said enterprise. Being beholden to any one company, whether it’s Microsoft, IBM, Novell, or Red Hat, is not a good business decision, as now your enterprises are tied to the whims of your provider of choice.
Furthermore, too much from one company produces a monoculture, a scenario that security experts decry as dangerous. For example, with Microsoft sharing so much code (as well as tying non-essential systems like web browsers to the operating system) a flaw in a given piece of code will affect every product that uses that code. Let’s say, for example, that there’s a remotely exploitable bug in the authentication code in SQL Server that allows an attacker to gain system privileges. Now, for the sake of argument (as we have no real way of knowing) that Windows, Exchange, ISA, and every other Microsoft product uses the same piece of code to handle authentication. What does that get us if your shop is Microsoft-bound? A vulnerability on every server and desktop in the enterprise. On the other hand, if your web server is Apache, your directory server is Novell and your email server is Oracle Collaboration Suite, you have limited your exposure significantly. Granted, such and extreme mix of vendors can make managing an IT shop more difficult as you have to maintain a wider variety of skill sets, but security is not, nor will it probably ever be, easy or cheap.
So where does this leave my shop? In my opinion, heading down the road toward a life of constant updating and patching, forever running the Microsoft upgrade treadmill. Since it’s usually cheaper to upgrade than migrate, once you make a commitment the size we are making now, you are most likely forever tied to that vendor, and that will spell problems at some point. Will we be bitten by this? Time will tell, but if I were a betting man, it’s going to take just one new virus or exploit to sneak behind the firewall, and we’re going to rue this day.