Microsoft Dependency Has Risks

I think the current subtrends of things like a resurgence of interest in mechanical watches, fountain pens, steampunk, etc, are sort of a large excursion on a dampening social problem: that technology is too far beyond our comprehension.

Can you even even tell what network stack got you this packet?

How about the protocols that got it from the network to your screen?

How about the quantum mechanics of the phosphors that pushed out the photons?

There are certainly techno-luddites/visionaries who are running their own email servers, but it's a pretty hostile environment for personal email servers. Ignoring the spam, just getting the existing big boys to trust you can be humiliating exercise in futility.

Can I get by without Excel? Sure. Google Sheets? Sure. No spreadsheet at all? Gonna be hard.

Everything feeds everything else. If Apple had a stack and a business model that worked for game developers, you’d see a different stack.

Microsoft is where it is because they are viciously competitive at different layers of the stack. Apple wants a piece of every nickel, Microsoft wants a piece of every computer. They license windows for every Mac user in a company.

It’s been done for years. You can also always pirate windows if there’s a trade embargo.

The problem is that the modern approach is to run Entra directory in the cloud.

Active Directory is not one single product. It is an ecosystem. Windows desktops, Windows servers, Microsoft Office, Azure, third party apps running on Windows using Windows APIs and Microsoft server products are all supporting it.

Here is a typical office use case in an engineering environment:

A user logs into their Windows laptop. It uses a Windows domain which is part of Active Directory system. It connects to the domain server to check the credentials. Those credentials are regularly cached into the Windows laptop. Moreover the company issues smartcards for sensitive access. The user can use the smartcard to login to the laptop too. Active Directory handles the certificates. The manufacturer's driver software integrates with Windows and the Active Directory system.

Group Policy is also stored by the domain server and depending on the user's credentials and the roles in the Active Directory system, the relevant engineering apps can be automatically installed on the user's laptop (let's say Altium or Autodesk). The engineering app then integrates with Active Directory to associate the license with the user's identity on Active Directory.

The user does their work and want to save a report from the engineering app (let's say a Bill of Materials report), it can be automatically saved to user's OneDrive account as an Excel file. The user can then take this report and share it on SharePoint which is OneDrive but more businessy and it supports creating web pages. So now the user can publish this as a web page in their department's SharePoint instance which they use as the main documentation portal. All of the other third party software like VPN logins, HR systems etc. are all also depend on Active Directory to get the credentials.

The scenario above is not just hypothetical. A majority of the biggest conglomerates and even smaller companies are completely locked in. Most of the Western governments too. The usual infrastructure roads, pipelines, power lines etc. were all designed and managed in Active Directory connected Windows PCs.

You cannot just replace Active Directory. You need to replace all the infrastructure around it. That includes not only Microsoft systems but also all the third party software that integrates with it. It is a multi-hundered billion dollar industry of proprietary apps all integrating with each other.

> Out of curiosity, how hard would it be to copy Active Directory in an open source project (like how Excel is copied by LibreOffice)? > > Like if orgs need this capability why is there no good open source solution?

Btw if you think LibreOffice Calc is anywhere close to being an alternative to Excel, you are very mistaken. Just in the basic set of functionality, Calc is 2 decades behind. Excel has a lot of integration with databases to automatically fetch data and update the fields accordingly. If you have a big spreadsheet, Calc struggles a lot while Excel can scale millions of rows quite easily.

Why there is no open-source solution? Because it requires a central entity to develop those elementary APIs combined with an operating system and office suite combo. The entity needs to convince all those multi-billion dollar companies to buy their product. Then it needs to send engineers to work with both clients and software vendors to handle all sorts of kinks and weird use cases.

Microsoft has been doing this since 90s. The entire corporate desktop ecosystem has developed around them and they ensured that Windows and Office would be a centerpiece of all those systems. A bazaar-style open source ecosystem will not be able to manage the scale. Without a central vision and strong product management, it is not possible to mesh multiple projects together. The current open-source systems cannot even agree on which GUI display protocol to use which is just microscopic compared to everything else.

Only a very determined government with virtually unlimited funds and very stable decision making (very likely to be authoritarian) can force all the companies to switch something else. China is that government and they are somewhat successful but not entirely.

Massive. AD isn't just LDAP and Policies. There's somewhere around 14 services that are involved, even NetLogin still has it's tiny part to play. AD uses LDAP referrals, expects clients to follow them, and use the SRV records to find the DC in the same site (if one exists). AD as it is typically deployed is active/active multimaster with per-record tiebreaking based on edit time, client-based load balancing with proximity awareness, ACLs for every possible field and record, overridable at any point in the tree (389ds can do this, but openldap is a nightmare). There's a full automated PKI in there for managing certs for everything, and that's before we get into the KDC logic, the strange things SYSVOL can do, and various other things that integrate with AD.

Samba, krb5 &co can handle small cases, but it's architecture is still stuck in the nt4 days, and there's limited cohesive integration with LDAP and the other services.