User:Louis/Desktop Windows is the wrong choice for an unattended train departure board

On June 9, 2026, a public Swiss Federal Railways (SBB) passenger-information display at a Zürich station was caught showing the Windows desktop and two stacked error dialogs instead of train departures, in a video that has since drawn 335,829 views.^[1] The Swiss technology site watson.ch answered the clip seriously, arguing that desktop Windows is a fine choice for such a screen and that the failure says nothing about the platform.^[2] The opposite is true: the failure that watson describes, and the one the earlier Swiss press documented in February 2024, is exactly the failure a purpose-built signage platform is engineered to survive without a rider ever seeing it.

The screen had dropped out of its full-screen application to the bare Windows desktop, with desktop icons and a taskbar visible.^[1] Two dialogs sat on top of the wallpaper. One was Firefox's crash reporter, "Mozilla Absturzmelder," offering to restart or quit Firefox.^[1] The other was a Windows dialog reading "Der Computer hat nicht genügend Arbeitsspeicher" (the computer does not have enough memory), instructing whoever was standing there to save their files and close their programs.^[1] There's nobody standing there. It's a departure board.

The window chrome is the older classic Win32 style: solid-color title bars, three-dimensional beveled buttons, no Aero glass and none of the flat design Microsoft shipped with Windows 8 and later.^[1] That styling is consistent with Windows 7, and it isn't the default look of Windows 10 or Windows 11, but the exact version can't be proven from the photo alone. The version is unknowable from the outside for one reason: SBB declined to give it. The railway's spokesman, Moritz Weisskopf, told watson only that the unit is a "Betriebslagemonitor" and that "Hierzu können wir aus Sicherheitsgründen keine genaueren Angaben machen" (for security reasons we cannot provide more detailed information).^[2]

The rebuttal target is an article by Daniel Schurter, published on watson.ch on June 19, 2026, headlined "Amerikanischer YouTuber veräppelt SBB wegen uralter Windows-Software."^[2] It makes three claims, quoted below in the original German with a translation, and each is answered in turn.

Schurter's central claim:

"Weder ist Windows per se die falsche Wahl für solche Kiosk-Systeme, noch liegt ein akutes Sicherheitsrisiko für den Schweizer ÖV vor."^[2]

In translation: neither is Windows per se the wrong choice for such kiosk systems, nor is there an acute security risk for Swiss public transport.

The claim is undercut by what the screen did. A passenger-information board is a fixed-function, unattended device, and Microsoft sells a separate product line built for exactly that job. Windows IoT Enterprise is, in Microsoft's words, the version that "powers many ATM machines, point-of-sale terminals, industrial automation systems, thin clients, medical devices, digital signage, kiosks, and other fixed purpose devices."^[3] Its Long-Term Servicing Channel "is designed for fixed purpose devices and use cases where functionality and features remain constant for the life of the device," and Microsoft supports each LTSC release for 10 years.^[3] Desktop Windows, the edition a person uses to read email and empty the recycle bin, isn't that product.

The visible Explorer desktop, complete with icons, is the tell. A device locked down with Microsoft's own kiosk tooling never shows it. Under Assigned Access, "a single Universal Windows Platform (UWP) application or Microsoft Edge is executed in full screen, above the lock screen," Microsoft lists "Interactive digital signage" as a use case, and, critically, "If the kiosk app is closed, it automatically restarts."^[4] Microsoft's Shell Launcher goes further and replaces the Explorer shell entirely with the chosen app for "kiosks, ATMs, and digital signage," then "monitors the process to identify when the custom shell exits" and restarts it.^[5] Neither is available on the consumer Home edition; Assigned Access needs Pro or higher, and Shell Launcher needs Enterprise, Education, or IoT Enterprise.^[4][5] A board that falls all the way back to the wallpaper, icons and all, is running none of this. The platform choice is judged by how it fails, and this one failed open to a desktop that invited a stranger to close its programs.

Schurter's second move is to pin the crash on the browser rather than the operating system:

"Firefox lädt im sogenannten Kiosk-Modus über Tage oder Wochen hinweg permanent Live-Daten wie Zugverspätungen oder Gleisänderungen nach. Wenn aber der nicht mehr benötigten Speicherplatz nicht sauber freigegeben wird, kommt es früher oder später zum Programm-Absturz."^[2]

In translation: in so-called kiosk mode Firefox continuously reloads live data such as train delays or platform changes over days or weeks, and if the memory it no longer needs is not cleanly released, sooner or later the program crashes.

Two problems. First, the press that covered the same failure in February 2024 blamed Windows, not Firefox. When the identical "nicht genügend Arbeitsspeicher" dialog appeared on platform 33/34 at Zürich Hauptbahnhof on February 12, 2024, blue News reported, quoting the technology magazine Chip, that the cause was "vermutlich der standardmässig zu klein bemessene Systemzwischenspeicher, der «Desktopheap»,"^[6] the Windows desktop heap. That is a real Windows-specific limit, documented by Microsoft as KB 947246: the desktop heap is a per-window-station kernel resource governed by the SharedSection value under the Session Manager\SubSystems registry key, and, when it is exhausted, "applications attempt to create new windows but fail to do so."^[7] Microsoft is explicit that this isn't a hardware shortfall: "The physical RAM on the computer doesn't affect the desktop heap size. You can't improve the performance by adding physical RAM."^[7] So the two competing explanations, a Firefox leak and the Windows desktop heap, are both Windows-platform failure modes, and one of them is a win32k limit that has nothing to do with the browser at all.

Second, and more important, the cause is beside the point. A purpose-built signage stack is designed so that a single leaking process doesn't become a public failure. The OS or a watchdog kills the process and restarts the app, which is precisely the behavior Microsoft documents for its kiosk tooling.^[4][5] On a board configured that way, a Firefox that leaks for two weeks gets restarted and the rider sees a momentary flicker, not a crash reporter. That a userspace memory leak escalated all the way to a desktop-visible Windows dialog is the proof there was no watchdog, no auto-restart, and no resource isolation in front of it.

Weisskopf told watson the problem had "bisher kaum aufgetreten" (hardly occurred so far) and could be "rasch behoben" (quickly remedied).^[2] The same out-of-memory failure was on a Zürich board on February 12, 2024 and on Rossmann's video on June 9, 2026.^[6][1] Rebooting doesn't fix a memory leak; it resets the countdown, and the board leaks back to the same dialog. A fit-and-forget platform doesn't need a human to notice it and reboot it.

Schurter's third claim concedes the OS might be ancient and argues it does not matter:

"Es ist anzunehmen, dass solche Anzeigetafeln in komplett isolierten Netzwerken (sogenannten VLANs) ohne direkten Internetzugang betrieben werden. Damit ist Panikmache bezüglich fehlender Sicherheitsupdates unbegründet, selbst wenn es ein veraltetes Windows 10 oder Windows 7 wäre."^[2]

In translation: it is to be assumed that such display boards run in completely isolated networks (so-called VLANs) without direct internet access, so panic about missing security updates is unfounded, even if it were an outdated Windows 10 or Windows 7.

This mixes up two different problems. Network isolation addresses remote exploitation, an attacker reaching the box over the network. It does nothing for reliability, and reliability is what failed on that platform. The board did not crash because somebody attacked it; it crashed because a process ran the system out of a kernel resource.^[7] A VLAN does not free the desktop heap.

The argument also runs on an admitted guess. Schurter writes "Es ist anzunehmen," it is to be assumed, because nobody outside SBB knows the network design either; SBB would not say.^[2] And the air-gap picture sits badly next to his own previous paragraph: the board is pulling "Live-Daten wie Zugverspätungen oder Gleisänderungen" off a data source, so it's networked to something, not sealed off.^[2] Air-gapping an unsupported operating system only means admitting it can never be patched, so the wall stands in for maintenance the machine will never get.

On the version, Schurter himself raises Windows 7, and if that is what it is, the security concern is arithmetic. Windows 7 left extended support on January 14, 2020, and even the paid Extended Security Updates ended on January 10, 2023.^[8] On public infrastructure in 2026, that is more than three years past the last patch Microsoft will ever ship for it. Even Windows 10 reaches end of support on October 14, 2025, after which only the LTSC editions keep getting fixes.^[9][3] The coverage hedges on whether the OS is outdated only because SBB refused to name the version,^[2] not because there is real doubt that running an unpatched OS on public infrastructure is a problem.

Schurter's framing is that the YouTuber filmed a real failure but drew the wrong conclusion from it. Rossmann pointed a camera at a public board that had crashed to a Windows desktop and named the cause written on the screen.^[1] Concluding from a consumer desktop crashing in public that the platform was the wrong fit is the correct read of the failure mode. The author, by contrast, had to assume the network design ("Es ist anzunehmen") and couldn't name the OS, because the one party that knows, SBB, declined to say.^[2]