Why do we need full-fledged workstations running massive OSes with massive software?

Question

I've grown up with computers. While watching old computer TV programmes and documentaries and reading the news about constant issues with these modern systems -- everything from the sheer amount of change/bloat/costs to all the security and privacy issues -- one thing that really stikes me hard is:

Why do normal people need computers that are so powerful and complicated?

In decades past, we used simpler, less powerful computers to perform all kinds of tasks, without the issues we face today.

I'm not suggested we swap out current computers for thin clients. I'm simply saying that current computers seem more powerful than necessary for vast majority of tasks that any person employed by an average company would logically need.

Even in the early 1990s, computers had advanced to the point where "all basic input/output tasks" were "solved". If I were running a company, I would create a minimal computer terminal which runs a minimal OS, and which just boots up and displays a "browser-like" interface that talks over HTTPS to my "mainframe". I'd use a simple username/password system, with no password resets or two-factor auth, and once logged in, the employee would see only the sections that are relevant for them, coded by me. For example, a secretary would see a basic form where she can input appointments, list current ones, etc. A different kind of employee, whose job is just to deal with customer support, would only see a minimal list of current support tickets and only have the ability to respond to these in a manner which cannot be misunderstood or abused. I'd log every action so that I can later look up exactly who messed up or went rogue.

I notice that modern systems don't seem to work that way. Instead, we have full-fledged PCs with expensive, bloated, and insecure Microsoft or Linux software. We spend enormous amounts of time, effort, and money to educate employees on how to use it, maintain it, and deal with all the problems that inevitably arise from exposing the general public to such complicated systems.

Why is this? Why is the only choice between a complex Windows system, a fragile Linux, or some kind of ChromeOS thin client that exposes my data to Google? Why don't we have a privacy-respecting, minimal thin client OS that can't do anything but display basic HTML, basic CSS and connect over HTTPS, has no system storage or ability to change it, and is just something you hook up to a standard display and network cable and mouse and keyboard.

I realize one still needs to administer the server/mainframe, but presumably this could be done by skilled professionals, rather than the general public.

Can you help me understand why computing works this way today?

Answer 1

You are conflating a number of issues here.

Why does my software have all these features to begin with?

Because other computers' software has those features, and network effects punish any software developer who doesn't follow the herd.

Let's take an example from your question: Why does my web browser need to do anything other than basic HTML and CSS? Well, have you ever tried browsing the modern internet with all JavaScript disabled? It's functionally unusable. The problem is that, once JavaScript existed in a widely used browser (Netscape), people started using it in their webpages. That meant that other browsers had to add support for it to prevent their users from complaining that webpages are broken. And once more users had support for it in their browsers, more webpage authors started assuming that users had it. Round and round the positive feedback loop goes.

Software developers have strong incentives for adding features to software, and strong disincentives for removing them or even changing them.

It's taking 25 years to kill Flash Player, despite it being an incredibly complicated, bug-ridden, security nightmare black box that Adobe themselves no longer wants anything to do with. You know that all hell is going to break loose on December 31, 2020 when the plug finally gets pulled and people can no longer play their beloved Flash games from 2001.

Why do employees of a company need to have full PCs rather than dumb terminals that can only view intranet pages?

Because intranet pages work great until an employee needs to do anything other than the specific tasks that the programmer has predetermined are that person's job.

What happens when someone else (either inside or outside the company—let's call her "Alice") wants to send you a presentation to review and edit? Every person at every job role at my company has had to do that at some point—managers, engineers, administration, facilities, you name it.

You can receive Alice's presentation file on your internal webmail, but you need some way to edit it. And that means your computer needs to be able to edit PowerPoint files, because that's what everyone uses. And PowerPoint files are ludicrously flexible in what sort of content can be contained in them. So we're back to the network effects problem. If Alice sends me a PowerPoint file and I can't edit on my computer because it uses features that my software doesn't support, that's my problem as far as Alice is concerned.

It's functionally impossible to forsee all the things that someone might need to do for most modern jobs, for the simple reason that if it were possible, that job would probably already be fully automated. And that's not even accounting for the fact that many companies allow their employees to use company computers for all sorts of things that are not strictly part of their job description, such as streaming music.

There's also a more general principle here. As you correctly point out, most PCs are "fundamentally overpowered and overcomplicated for the vast majority of tasks that any person employed by a normal, non-highly specialized IT company, or government entity, would logically need." The problem is that a computer that does all the tasks you need 95% of the time but is useless the remaining 5% of the time when you need to do something weird and specialized—is useless as a computer.

I've heard it said that in software design, 10% of the features cover 90% of what any user needs, but that the remaining 10% of what any user needs is different for each user. If you take the set of features used by each user and intersect all of these sets, the result is not sufficient for any user.

"This interface would have a simple username/password system, with no demands to reset passwords or 'two-factor auth' or any of that nonsense"

This gets its own subheading, because this is a totally separate class of issues from everything else you mention. Go over to Security.SE and read about why these things exist. There are very specific reasons for these security practices, that are totally orthogonal to any discussion about complexity of software.

Answer 2

Since the other answers go pretty well into why companies just buy general purpose computers, I wanted to give an answer about security. In a lot of ways, it's easier to secure a system you know is insecure, than to secure a system you are pretty sure is secure but don't know in what ways it might be insecure. Windows 10 may have security vulnerabilities, but Microsoft has a passable track record of fixing them soon after they become well-known, and in many instances ahead of any actual use of the vulnerability in the wild. Windows 10 is also used by a huge share of the market and has security specialists analyzing it all the time, so vulnerabilities are more likely to be caught by the "good guys" and sent to Microsoft for patching. If on the other hand your company uses an OS that only does one thing but only a few companies use, you cannot be all that sure that the one thing it does is secure. Windows makes a reasonable guarantee that if someone is running as an unprivileged user, they won't be able to make privileged changes to the system, so the security team can be reasonably sure about what a malicious program or user can and can't do, and the fact that it's maintained by a reputable company and tested by lots of people unaffiliated with that company makes it easy for a security team to palate using.

There's also a question of training. Most people use Windows at home, and Windows and Mac are similar enough that people can use them interchangeably for basic use. So, your security training can focus on the important stuff - "Use a strong password, use different passwords for different sites" (or give them a Password Manager and show them how to use that, there may not be one available on your off-brand OS), "How to spot phishing emails," etc, as well as training for your particular company's processes, and you don't need to spend any time training your employees on how to do basic actions like opening files. Plus, by using the same OS as the company they are coming from, you get the benefit that they likely already have training from their previous company on the same standard policies and advice.

This does not just apply to regular employees, but your security team and sysadmins too. The fact is, if everyone trains on the same few OS's, then there is a much bigger pool of experienced candidates who can staff your IT department. On the other hand, everyone has to take remedial training to understand your special OS if you use one, increasing cost to the company.

Finally, I wanted to touch on a basic idea of security you have that is wrong. It seems like you believe the best way to secure a system is to lock it down as tight as possible and make it difficult to use. There is a common security approach that revolves around "three pillars" - Confidentiality, Integrity and Availability. The third one is important here, the purpose of security isn't just to prevent unauthorized users from modifying or viewing data, but to keep the systems a company needs to function available for users. Sure, you could have systems that are in their own LAN with no Internet access, but what happens when someone needs to communicate with another company? You cannot open up the network since you designed it to have no Internet communication and therefore "This interface [has] a simple username/password system, with no demands to reset passwords or 'two-factor auth' or any of that nonsense". So, either your company is the only company in your sector that doesn't have email (or a website), or you have to find another solution. If you take the first option, your company won't exist in 3 months, so you'll have to go with the second option. Well, perhaps your security team won't come up with the solution, your users will. That solution will be doing everything over personal email (or we set up a company domain with our department's budget and use a cloud email service with it). It might be to contract with an external cloud service to set up a website. I've been the user that doesn't want to deal with the security team and creates this kind of "shadow IT", and I've been the guy who has to deal with the fallout of "shadow IT" that gets created in companies with insufficient Availability, so I know some of what users can do without the security team's consent. I'll leave you with a very relevant quote, AviD's Rule of Usability:

Security at the expense of usability comes at the expense of security.

Actually, one last thing. You say

Yes, there's still the nightmare of dealing with the actual "mainframe"/server (I honestly don't understand why even a massive company would require more than one in this day and age, given their immense power)

No sane company has only one data center - either they have at least two so that they have redundancy if there is a natural disaster, or they contract with a cloud provider who does that for them. If your employees at least have laptops that can do most basic functions, even if there is a problem with your network they can still work on things on their local computer, but if they have to be connected to the network than any network issue grinds your whole company to a halt.

Answer 3

"If I were running a company ... the employee would see only the "sections" that are relevant for them, coded by me."

You are not prescient. You cannot predict the future requirements of all your employees with sufficient accuracy to know the minimum set of "section" that are relevant or suitable for any given employee.

The work required to refine this impossible prediction is far outweighed by negative consequences of your self belief that you know how best to do everyone else's job.

Answer 4

I'd use a simple username/password system, with no password resets or two-factor auth

Password resets are required somewhere because people forget passwords. 2FA is required sometimes because they leak, as it turns out that building software free of security bugs is incredibly difficult.

and once logged in, the employee would see only the sections that are relevant for them, coded by me. For example, a secretary would see a basic form where she can input appointments, list current ones, etc. A different kind of employee, whose job is just to deal with customer support, would only see a minimal list of current support tickets and only have the ability to respond to these in a manner which cannot be misunderstood or abused. I'd log every action so that I can later look up exactly who messed up or went rogue.

This is indeed the standard IBM 3270 kind of workflow. Modern versions are available through things like SAP. Note that in order to do this, you have to have your own fully or mostly custom system with its staff of developers. And you have to have a process for making changes to the system, and then approving those changes.

Not to mention that the software required by specific jobs tends to be both complex and demanding - everything from "desktop publishing" to video editing to circuit design. There are a lot of these niches. It's much easier for there to be a few possibilities that everyone in the trade uses rather than each company having their own .. which requires a general purpose software platform.

It turns out that "enumerate all the possible required actions in advance" tends to both produce a huge list, and be incomplete. Requirements management is hard. That pushes up the cost of the solution. And the delay between a department requiring changes and them being implemented. Entire multi-billion-dollar software projects have failed due to poor requirements planning.

The two big revolutions against central mainframe style working, the "personal computer" and the "cloud", both came about as means of escaping the inefficiency and delay caused by central control of IT. You could place a fully general purpose system on your desk, and do anything without needing approval! The efficiency gains of this were enough to overturn entire industries. Cloud was even more revolutionary because you didn't even have to set up and maintain the system. All it requires is a manager with enough authority to approve invoices.

Answer 5

I would argue that the premise of the question makes a wrong assumption:

There is an enormous amount of people that use computers set up to perform a single task. Behind the scenes, they're generic systems running a full OS and having all capability, but the machine has been specialized for some tasks.

For example:

• Cashiers use machines which are commonly running Windows. They do not have access to the computer's OS: the machine boots up in the only interface they'll use during the day and they do not need all the complexity.

• In supermarkets, devices scanning for prices and even electronic scales are sometimes running a full OS, but the user doesn't see it.

• Your TV set-top box might be running Linux and could be doing a lot of things, but it is abstracted from you and you just see the interface designed for you.

• In many offices, people have access to a single piece of software, to perform their tasks, and never see the OS.

In the professional world, you have a lot of situation where the complexities of the system are hidden from the user because they are locked in a single software (cashiers are the most obvious example).

When the work is less repetitive, people will have access to the computer OS because they will need a variety of software to perform their tasks; in this case, they'll need some basic computer skills.

For economical reasons, it's better to get standard PCs with one of the common OS and then specialize as much as you need from there. This is easier to setup, maintain, update, etc than a custom solution that might be locked in by a vendor.

Some companies, like http://www.citrix.com for example, are providing solution that turns a full flexible PC (read cheap and common computer) into a specialized device that will run specialized apps so that employees have all technical problems abstracted from them.

As I was saying at the beginning: I believe the premise of the question is flawed in the sense that there are millions of flexible computers set up to let employees just use the features they need and nothing else. In that context, all complexity is abstracted and usability is directly linked to the designed of the apps they'll be using.

When it comes to personal computing, it's a different story since every user has his/her own use cases.

Answer 6

TL;DR: Modern computers are general purpose tools. They have a huge diversity of capabilities which will never be used simultaneously. All of these capabilities integrate with each other which creates huge complexity. More specialised systems are not created because generally it is more expensive to make and sell a reduced feature system than an existing general purpose system. Plus, you might need some features that you did not expect, and in that case it is nice to have bought the general purpose system anyway. But check out KolibriOS.

Your question touches on 2 issues so my answer has two parts.

Modern computer systems (ie. hardware + software) are general purpose tools. You can create a text document in your preferred editor and open a web browser (at the same time). You can then copy some Thai text out of the web browser and paste it into your text document. It will display how it will actually look on a printed page. You can then save your text document to your preferred form of media, for example flash drive. If you make a mistake and put the wrong drive in, you can take it out and put another one in, it will not crash the computer. You can then open the text document on a different computer with a different operating system with a different working language in a different editor, and your Thai text will be displayed correctly. If the Thai text is copied from the high scores table of a 3d game in your browser, you can do that. This kind of workflow was not possible in previous eras of computing. Each of these capabilities is complicated to implement. To implement them so they simultaneously integrate is even more complicated. The more complicated the system the less efficiently we will typically implement it, so it becomes more complicated still. This explains where the complexity comes from.

Your question also touches on why we have complicated systems when we do not need them. Why can computers play 3d games that will only be used in the office? Why can computers do encryption if they are only going to be used by one person offline? There are several aspects to this. The main one is that it is more expensive to make more specialised systems than to use a more general one that you have already. As to your example, if you already have a "full featured" authentication module, which is fully tested and widely used, very resilient against attacks and errors, it is easier to use that than to make a new one. Even if there are already configuration options available on the module to disable some features that are not needed, sometimes it is quicker just to leave them enabled! Also there is a convenience factor. If you plug in a wifi adaptor, you do not want to have to download and install drivers somehow before it will work. So the operating system providers just bundle up the drivers in the system.

But, while new capabilities are being added all the time, continuous simplifying of existing features and designs is being done also. It is a long task but I think it is progressing!

You talk about a thin client OS. But similar things already exist. For example KolibriOS. It may not be as minimal as you propose but it is closer. It is only 1.44 MB after all. Why not give that a try? I think you will soon come back to Linux or Windows or whatever you use. But maybe not! And if not that will be great!

Answer 7

Real-world software is not designed to run on a single computer, but on an ecosystem, meaning that it interfaces with other software components, based on standards that have all kinds of different governance structures behind them. Complex ecosystems like this evolve on their own terms, and solutions do not scale elegantly, but given enough time they may form intricate and elegant architectures. Given enough time. Can we speed these things up? That's the trillion dollar question.

Hardware also forms an ecosystem, but one on which the number and complexity of the interfaces is much simpler, mostly because we decided to externalize complexity to software, as much as possible. It could have been different, and it may be different in the future. In rigorous scientific terms, the distinction between software and hardware is not as simple and clear as it may seem at a first glance.

Answer 8

Why not?

Many would dispute the weight of your criticisms.

we have full-fledged PCs with expensive, bloated, and insecure Microsoft or Linux software

Expensive? GNU/Linux is free of charge; Windows comes bundled with most PCs often contributing less than 10% to the price (sort of.) Web browsers are free. Some applications aren't free, but if you don't install them you aren't affected by their bloat.

Yes, workplaces install big office suites instead of using a simple plain-text mail client for staff to send information between each other. You have to weigh this up against the added features. And the amount of training (per workflow) needed for using simple software isn't much less than for complicated software.

Bloated? That's a subjective term. Are you talking about poor performance? Or a user experience which is overwhelming for users? OSes certainly do a lot of things they didn't use to, and it slows them down, but boot times have improved over the decades (with the help of faster hardware) and generally OSes don't chew up much CPU.

Application software is the real culprit of getting slower and more bloated, partly due to the transition to "slower" languages (I'm looking at you, Python). This is a simple business case of "spend less on development, plus get less buggy software." (Very roughly speaking.) In the Free Software world, your pool of volunteers is limited so there's pressure to use languages where you can get more done, faster.

Insecure? Well, yeah. (But do remember that the number 1 security problem with a computer software is the human.)

We spend enormous amounts of time, effort, and money to educate employees on how to use it, maintain it

Training? As I said, the amount of training per workflow is not that different. But software that has more functionality allows more workflows.

deal with all the problems that inevitably arise

Yes. More can go wrong. There are so many more "broken" configurations. This is definitely expensive. Security problems are rife. This is something you really have to weight against the benefits.

To be clear, I'm unhappy with the sprawling resource usage of modern software, but I appreciate that due to practical concerns it's quite hard to fight it.

Some less obvious benefits to "massive software"

• Aesthetic user experience (this has substantial psychological effects)
• Interfaces that are more "real world" (e.g. touch and pinch)
• Economies of scale of software development (software developed for thousands of clients is so much cheaper than one client developing in-house, even though you get features you don't need)
• Tools that are thoroughly tested at scale, instead of home-grown software to meet the same needs which is flaky
• Keeping pace with the growing complexity and competitiveness of the business world (to stay afloat businesses have to watch several social networks, review sites, who is viewing their website and why, lead-conversion funnels; this is all growing)

And IMO,

• actualising the tremendous potential of technology.

Answer 9

the employee would see only the sections that are relevant for them, coded by me.

This is a very dangerous mindset for any programmer. A company is comprised of lots of people with various evolving and changing roles. You often cannot standardize their jobs to a degree to decide what is relevant for them all the time. There are some jobs where we try to, e.g. call centers but these are often hated by all because often the problems presented cannot be solved by the thought up answers.

To give another example: My wife is a biologist who analyses the genome for birth defects. For this, she needs Word, Excel and some special biologic tools .But she also does some marketing (writing info sheets for doctors), interfaces with an external company developing a CRM tool and covers different analysis which all need different tools, data and access. You can give her a general purpose PC and the ability to configure her PC like she needs or you can spend all of your IT Buget trying to keep her from doing it itself. Her company chooses the latter and loses people and money to this.

Answer 10

What you were asking for in the "If I were a manager" part is in fact a thin client, and they were made quite for the reasons you named. Beside the huge mainframes and TTY terminals of the stone ages, in relatively recent past there was a very solid platform called Sun Ray as a terminal able to display X11 sessions from a Linux or Solaris server (and related to it, originally Tarantella's Sun Global Desktop for the browser-based remote desktop/app access, and later Sun VDI for dynamic per-employee VMs). The benefit here was that the "Desktop Terminal Unit" had no mechanical parts and no brains, it was on your desk for 10-15 years and as servers and technological abilities (X11, browser, vdi, ...) behind it were upgraded your desktop unit never had to change. And if some condensor did die, you just picked another DTU from the closet and plugged it in, and the user with their smartcard had their same session continued instantly. With about 400Kb(!) of firmware making it a remote video/keyboard/usb connection it virtually had no attack surface (marketing boasted just 4 issues found over almost 20 years on the market, 2 of which were found internally and never reached the open market), and had a good seating in companies, banks, military... until literally one day an Oracle exec said they disband the project, ciao to the team.

A modern equivalent is a small terminal computer with minimized Linux or similar distro, though not in Sun Rays' range of lack of attack surface, but also offloading (much of) computation and data to the secure central servers. Being a computer, they are more capable than Sun Rays for the modern office needs, from the useless video effects of transparent menus and window shadows, to the more useful video, VoIP etc. support and/or acceleration where supported by respective remote-desktop protocols.

I did not watch this area lately, so can't recommend what is good today. However, at the time of Sun Rays' untimely demise, many community members discussed migration to ThinLinc as their top choice; I'd assume this influx of geeks and ideas and battle-proven expectations could improve that ecosystem.

Answer 11

I just paid for a New Year's ball I will be attending with my wife. My iPad remembers my address. To enter my credit card, it suggests to scan the card which I did, just had to hold my card so that the camera can see it. The information is sent in a way that no hacker can get at it.

What kind of OS do you think is needed for that? For example, scanning that credit card and getting the number and expiration date from it, that requires quite a bit of software. And that's just a tiny example.

Answer 12

The comparative change has a much simpler drivers: commercialism and non-rigid work life. Nobody does the same task over and over as a job, because if they did it would be automated. And commercial software only works if whoever builds it finds a way to make money off of it, including data sale, product sale, network effect amplification and training.

What you describe is possible, but not realistic in the work environment of today, not even in a legacy top-down organisation where the workforce has no control.

Answer 13

There are already a lot of excellent answers that address the cs specific "science". I would like to answer a bit differently, by invoking a more general evolutionary analogy. It has been said* that computers and their operating systems today are an innovation similar in impact to the impact electric motors had on society at the turn of the last century.

• link to PDF http://www.dklevine.com/archive/refs4115.pdf

My particular line of argument will be better served, however, by directing notice to the parallel between the modern computer and another general purpose engine, one that figured prominently in what sometimes is called the "second Industrial Revolution"-namely, the electric dynamo. (But, see also Herbert Simon, 1986.)

Back then, electric motors were big, expensive, stand-alone devices with lots of attachments one could use to power multiple other machines. Need to run a load of laundry? roll the motor over to the washing machine and hook up the belt. Need to cut some lumber? roll the motor over to the table saw and hook up the belt. Need to vacuum your floors? or knead bread? hook up the belt and connect the motor to the appropriate device. Over time however, electric motors got smaller, more efficient, more powerful, and much cheaper to produce. The trend continued. Today, we hardly think about all the "electric motors" surrounding us. We only think about the vacuums, refrigerators, and table saws; the tools we use that happen to be powered by internal electric motors.

A very similar trend is occurring with "computers". The "(computing) power" is disappearing inside the tools. (You already carry more computing power in your phone than (insert your favorite comparison here) and you can already buy a refrigerator that can send you emails). The days of the "general purpose OS" computer being a ubiquitous "stand alone" attachment (or host) for running "any" software are numbered.

When pressed, I imagine a future where people who "have a computer" actually have what would today be called a laptop or tablet "dock". Where the "dock" is their personal hardware/human interface to any software they might want to run. At a minimum the future "human interface dock" would just have audio and a touch screen interface; but the interface could also include keyboard, mouse, pen, touch, multi-screen, printer, network, scanner, etc... Then, similar to old-school video games, all "software" would actually be more-or-less self-contained "computers" that users plug into a "docking slot" (such that all "software" has a dedicated, known, tested hardware "engine" (inside the cartridge) that the "software runs on", and all interaction between the user and the software traverses standard, ubiquitous, I/O interfaces [the only "software" in the "dock" is the various standard "drivers" for keyboard, mouse, monitor, whatever interface devices happen to be connected). Want to do "word processing"? plug-in the "Word" cartridge. Want to do "photo editing"? plug in the "Photoshop" cartridge. (Are you just editing "phone pictures" for Facebook? buy the 4GB cartridge. Are you editing professional images for print publication? buy the 64 GB cartidge) Want to do "Ultrasound"? plug in the "Sonogram" cartridge and the dedicated Wand. Etc. (Want to do both "word processing" and "spreadsheet-ing" at the same time, buy two or more "app docking slots")

The only reason NOT to build an electric motor into every washing machine and refrigerator is if those electric motors are bulky and expensive (so marketers want to externalize that cost). Once the price and efficiency fall into line, it's actually much cheaper and easier to build a washing machine and/or refrigerator with a dedicated internal motor "customized" to specifically power that specific washing machine or refrigerator model than to build one meant to run "universally" (meant to always run safely and correctly while hooked up to any third party's motor and/or belt assembly). The same logic already applies to "computers". The price, performance, and efficiency trends will continue along similar slopes.

The general situation you seek will become the norm. It's only a matter of time.