The biggest threat to China's IT security isn't Windows (as bad as it is), but rather the rampant software piracy. Anyone who thinks that the NSA, and any other state actor, can't sneak malicious code into software which is distributed in a black market is kidding themselves.

I guess an attempt already exists in the form of Ubuntu Kylin [1], ominously sponsored by the National University of Defense technology [2]. But I have a hard time determining how serious the project is, and how prevalent it is in China.

[1] http://www.ubuntu.com/desktop/ubuntu-kylin [2] http://en.wikipedia.org/wiki/National_University_of_Defense_...

It is quite successful apparently

Downloads from the Ubuntu Kylin community sites in China are continuing to gain momentum, with over three million people downloading Ubuntu Kylin in the first 12 months. The initial adoption of Ubuntu Kylin 14.04 LTS, launched in April, has been phenomenal, with over one million additional new downloads.

https://insights.ubuntu.com/2014/05/15/huge-downloads-for-ub...

Just for perspective, 3 million users in China is the equivalent of about 700k users in the US.

It's not insignificant, but neither is it like every third Chinese person is running Kylin. Heck, even OSX has 20 million or so users in the US[0]

[0] http://www.pcworld.com/article/2050510/windows-8-users-now-o...

There are larger villages than that in China. Still you can visit a computer market in China and about 40% of the computers will be displayed with Ubuntu. So the average Chinese consumer is getting exposure to Ubuntu which is a good thing.

Based on the partners listed on the Ubuntu Kylin page, it has more traction with significant ISVs in China than Ubuntu Desktop has in the US.

There is a bit of irony in that the first Ubuntu Kylin OEM is HP. Presumably those machines will not be shipped from the US.

It looks like it is possible to build Ubuntu Kylin from source code. The ISVs probably have closed source apps. But it is interesting that a large swathe of users in China are being encouraged to use an OS that supports a lot of privacy-oriented software.

That's funny, when I looked at the description on Canonical's page, I had exactly the opposite intuition. (I thought "wow, I bet the China-specific apps have no end-to-end cryptographic security, and I bet several are even proprietary".)

Maybe it's a glass-is-half-full / glass-is-half-empty kind of phenomenon.

Looking more closely, I guess the Lotus IM app doesn't support OTR (but neither does the official release of Empathy) and the Kingsoft cloud storage doesn't directly support client-side encryption (but neither did Ubuntu One).

Everyone uses Windows in China. Half the sites won't even render correctly unless you use IE.

This is the government we are talking about. They visit websites outside the Great Firewall. So they need a modern browser.

A major Hong Kong Bank even listed IE as a required browser you needed to use to access your account. Insane.

If they fear NSA spying why still use XP ?

If you use Windows 8 you're vulnerable to talented crackers and governments. If you still use Win XP you're vulnerable to anybody.

Maybe they're just afraid of integration of Azure / Skydrive / whatever the new name is that could possibly create embarrassing sharing mistakes.

Maybe because they've fixed XP for their security concerns: http://www.prnewswire.com/news-releases/qihoo-360-announces-...

Interesting. Can't find any info about in on http://360safe.com/ though...

It's part of their "360 Safe Guard"[1] software. But I think it's only available in Chinese. They also have an "enterprise" edition.

[1] http://www.360.cn/weishi/index.html

Ah, thanks.

@unicornporn, Agree, I wanted to use it as a solution and I was not able to find it.

> If you use Windows 8 you're vulnerable to talented crackers and governments. If you still use Win XP you're vulnerable to anybody.

And government is essentially like management. Honesty: 0. Integrity: 0. Sanity: 0. That answers your question.

They had one called Red Flag Linux, but apparently it shut down recently:

http://en.wikipedia.org/wiki/Red_Flag_Linux

Same reason USA want Huawei out.

How much money has China's government paid Microsoft for OS in the past?

(The question I'm really asking: how much piracy did China do in the past, and how likely is that going to just continue as is?)

I would think nation states already work under the assumption that the NSA and other agencies are actively trying to infiltrate their systems. The recent NSA revelations can't be news to them. So why stop using it now I wonder?

Red Flag Linux is dead. Are they going to try it again?

Linux is really not an easy thing for people working in Chinese government.

Linux Deepin may be another choice beyond Ubuntu Kylin.

>they don't believe a US company to provide them with an operating system that even has a slight chance to be NSA secure feels quite sensible

Or a British company or an Canadian company or an Australian etc. etc.