Hacker News new | ask | show | jobs
by nyan4 3602 days ago
> It was also funny to see "Windows" as an approved security blessed OS and then Debian, Ubuntu, OpenBSD rejected

Bribes always help.

3 comments

We detached this subthread from https://news.ycombinator.com/item?id=12255106 and marked it off-topic.
Paying for certification is what's required. Governments require various certifications to sell to them, and that certification costs money in consultancies. RHEL paid for the testing, they get a certification and access to the customer.

It looks like this is probably referring to EAL [1][2].

In a market with a large number of vendors interacting with a large number of relatively unknowledgeable buyers, an oversight team is going to try to find a certification to give guidance (and ass covering).

Yes, this is a barrier to entry, but it's also a learned behaviour as buyers get repeatedly burned.

I would argue that this is equivalent to requiring your plumbers and electricians to be licensed.

[1] https://en.wikipedia.org/wiki/Evaluation_Assurance_Level [2] https://www.redhat.com/en/about/press-releases/red-hat-achie...

EAL (Common Criteria) and also FIPS-140-2 for crypto.
It's easy to see conspiracy everywhere, but the truth is usually much more mundane. It costs a lot of money to security-certify an OS, so they probably only wanted to certify a small number. Windows is obviously the most-used desktop OS for PCs, so that seems the logical choice.