Hacker News Reader

Comment by jms429 | Hacker News Reader

I was an IT manager in a school (not any more), and was asked by a parent why I wasn’t using Linux everywhere.

Our Microsoft licensing cost £1000 per year, and our MSP cost about £10,000 for remote support and a weekly onsite.

Using Linux, our licensing cost would have gone, and maybe we’d have gotten another year or two from desktop hardware, but our support costs would have increased massively - I couldn’t find a local msp who’d do desktop Linux support the same way we were getting. not to mention all the training for teachers, and the nightmare of finding replacements for things like smart notebook, custom assessment software, and windows only curriculum software.

Biggest headache would have been the teachers. Some of them found windows 10 too difficult to use, and pushing them onto Linux would have needed a full time techie on hand.

linux is better is not always the case.

View on HN

It's Free software, there's no earthly reason that every school should be individually figuring out how to support Linux. Open a state office of Linux support and stock it full of developers and techs. Create a federal network of those to work on large projects.

We need to shed the consumer mentality when it comes to FOSS. It gives us bizarre expectations of it, and we impose unnecessary limitations on ourselves without thinking. It's ours, and we can do what we want with it.

Just use https://www.skolelinux.de/en/

There are endless options. School systems have thousands of employees and administrators; if they can't figure out how to support what are generally wonderfully crafted, complex pieces of software handed to them on a plate, they're not really fit for purpose. We're outsourcing institutional self-sufficiency to Microsoft and Google.

The average enterprise with more than 1000 employees use 150 different SaaS products.

https://explodingtopics.com/blog/saas-statistics

Should they also brings those in house?

Yes, governments and public institutions like schools should do that.

You seriously think that every school district should have the expertise to develop software that 150different software companies specialize in?

Bring them in house as in encourage them to release their work on Linux, and if they don't, reimplement whatever thing it is in Linux. Should all be FOSS too if they can manage it. Public money, after all, should have public code.

The idea of re-implementing all those SaaS web apps as Linux apps is completely absurd and doesn’t benefit the end user.

Not all, only those that don't work in Linux for some inexplainable reason and whose developers no longer want government contract money. I think you'll find that that number is basically zero.

So it’s okay to have proprietary software as long as it is running on an open source operating system?

If you want, but why would you want that when there are as good and often better FOSS alternatives. With FOSS stuff you can have your cake and use any kind of plate you want to eat it from.

Is there a “better” alternative to an Office 365 subscription that comes with Word, Excel, PowerPoint, One Drive online storage, hosted email and each user csn use the same set of software between Macs, Windows, Web, Android, iPhones, iPads, etc?

A business can get that at retail for $160/year. A student can buy that for $79.00/4 years.

Those are retail prices. I can guarantee you that large organizations aren’t paying retail.

And don’t overlook the online component and the governance and the SSO. I know plenty of MS shops that use MS’s hosted SSO solution to log in to AWS.

It amazes me how little HN understands about the needs of large enterprises.

Heck I work for one of the Big 5 tech companies (FAANG - Netflix + Microsoft) and it isn’t MS and we all have Microsoft licenses.

What does a student need the MS Office package for in a school context?

The average enterprise also has massive competitive pressures to stay ahead of the curve.

Schools have no such pressures and in fact are better served by being conservative in how quickly they change what they do.

That’s how you get stuck with Lotus as your email system and IE6 in 2022, and frustrating competent admins with old technology.

And how you get mainframes managing their unemployment systems that can’t handle the load when unemployment spikes during a worldwide crises like what happened two years ago.

It’s a great idea and the only thing that makes sense, but if you do that you’ll get an uproar that government is infringing upon private enterprise and distorting the market and all that.

If you aren't completely against ALL government intervention, people might like the fact that teaching Linux is teaching independence.

The people that love private enterprise are the often same people that think small engine repair is an essential life skill, and don't want big tech watching them.

It's not greasy and rumbly and subjectively "real" like the easy-to-market stuff, but it's still a form of self reliance to remove your dependence on a company known for randomly changing stuff whenever they want.

Same with electric cars really. Research into sustainable nonlithium batteries and cheap PV means a possibility for you to never need to buy gas again for the 30 year life of your solar panels if they pull it off.

Then again, some people don't like anything that doesn't feel solid and substantial, and the people most interested in independence might want completely tech free schools. Seems like a lot of people want to go back to paper.

Yeah that's true. However, realistically the uproar will be from lobbyists that will use their skills and money to persuade those people better than I can :(

That sounds like a US only problem to me

So let’s just spend more money on it and create more bureaucracy.

Do you think that maybe the FOSS community isn’t offering consumers what they need?

It's all there, just need to get over the fear of change hurdle. Once schools use it by default, everyone will learn it, and things that aren't like it will become the hurdles.

I happen to work with governments (cloud consulting department at BigTech) the expertise definitely isn’t there.

Then it will come with the money. You think those companies that currently offer it for windows will just fold? No. They'll spend a week learning the difference, and claim to have 20 years experience administering Linux or whatever.

You think it only takes a week to transistors an entire large enterprise?

My old company had to use Skype for business for over a year because Teams didn't support phone calls! It was ridiculous. And that's with the so called 'support' Microsoft provided.

They survived.

You haven’t been on either side of a large technical migration. It literally takes years and millions of dollars.

I have been doing just that for years, first at smaller companies and now working with large organizations on the other side at BigTech.

I believe you. I'm sure it's quite a challenge.

> Once schools use it by default, everyone will learn it

that's putting the cart before the horse.

Schools, like most non-tech enterprises, have problems to solve that are bigger than the choice of OS on their IT systems. If the end result of switching out of windows is basically the same outcome as having windows (aka, they've replaced some office programs, and other domain specific programs with a linux compatible version), then what is the value proposition _to the school_? The only value proposition of this switch is to society and free software movement in general, which the school doesn't really directly benefit from.

Well if schools are just kid jail, then sure. But if they're a place for raising future generations, then as a benefit to society, it sounds pretty good to me. And all for a, let's face it, trivial amount of effort.

If the school boards change or the gov changes, so will the software makers. Support groups will be plentiful because they all just follow the money. Just like they did for chromeOS, only this time there will be less built-in spyware.

Public schools are kid jail.

>But if they're a place for raising future generations, then as a benefit to society

Anyone who has been to a public school should be well aware they are not a place that breeds greatness. More a place that hammers it down.

It truly is a sad state of affairs, isn't it?

>It's all there, just need to get over the fear of change hurdle

How’s accessibility on Linux? I mean considering the situations with even basic things like drag and drop, copy and paste, video chat and screen sharing I don’t have high hopes that “it’s all there”

Some of those things are the same (everyone has Chrome and Firefox), but drag and drop, and copy/paste are functionally superior in, for example, KDE plasma so I'm not sure I know what you're talking about.

I have to use Windows at work. I choose to use Linux at home.

> not to mention all the training for teachers, and the nightmare of finding ... windows-only ... software

This was the traditional argument against moving away from MS products.

Suddenly, most of these folks moved to Google products a few years back. Somehow these points didn't factor in. Why do you think that is?

Because Google manages most of the complexity.

They do manage a lot of things, but not the two things OP mentioned and I copied.

What happened is that Google has enough money to take the purchasing people out for drinks once a year.

That’s not how IT government procurement works. We go through training specifically aimed at what we can and can’t do when trying to get government contracts. I don’t work for Google, I work at another BigTech company that sells consulting services to government.

I'm glad youre an honest person, but I've seen the procurement process of my government happen in real time. It's not a diligent process. The requirements are often written based off previous winning project agreements, in a way that nearly guarantees certain companies always win. Sometimes this is due to the incompetence of the gov, but usually it's because the people writing the specs have to work with the people that win so they choose the ones that they like the best. What's a good way to make someone like you without a bribe? Invite them out.

It's a job you can get. Sometimes it's called Relationship Manager.

There are also policies and procedures around preventing those types of conflicts of interests.

I’ve been a dev manager working with contracting companies in the private sector, I know how they work. I got free box seats to go to pro baseball and basketball games, got invited to lunch by the attractive sales person , etc. Could we get away with that in the public sector without a lot of red tape, lawyers, and public disclosures? Heck no.

I mean, I hear yah, and again I'm glad you don't do that. It's real nice to talk with someone with ethics like that. But I have seen it happen. You can google it if you want. It happens.

Yes, and you saw the shit show it caused when the contract had to be rebid. There is a reason everyone is more careful these days. I can only speak about the process the big cloud providers go through from first hand experience.

Because Google products are good and work exactly the same on any kind of computer or phone (i.e. no differences between distros or hardware)

Probably because of

> I couldn’t find a local msp who’d do desktop Linux support the same way we were getting.

You could find competent third-party GWorkspace support, plus unless you fully moved to ChromeOS, you will still support Windows in one way or another (although students usually gets Chromebooks, try moving a teacher using a 15-year old application that still works on latest versions of Windows). RHEL is geared towards enterprise but not education sectors, and I'm not aware of a commercial support which specialty is in the education sector.

Tech changed. Most of the google suite exists within the browser. While the teachers had to learn new tools, they didn’t have to learn a new OS. Even if the OS learning was trivial, it could still make for a hard transition. It was foreign. It was scary.

Google is Google. They’ve been using it for years. They’re ok with the browser. Less emotional load.

I think you're on to something. Though using a browser on any OS has been pretty similar for a few decades, the "scary" thing must be a larger factor than I've considered before.

That's the point everyone should consider in the Windows/Linux debate. Windows/Office is not the de facto standard because they are superior technology - they won because Microsoft produced good enough software, employed every business trick in the book while also pioneering some, and because they covered the bases OP pointed out. Service and user experience is not only a very important part to provide, but often the part that makes or breaks the product.

That said, what schools teach is just some legislation away. I believe regulation could make it happen even now, if the regulators wanted so. But, of course, regulators are people too and therefore, yet again, it's not up to the technology itself to be better.

I think you’re missing OPs main point that any money saved from switching to open source would be eaten away and reversed dramatically with support costs.

Can you get unlimited remote support and a weekly on-site tech for $10k a year? No way.

I'm not missing that at all, I'm saying two things, that for one, Microsoft does this support thing well enough and two, legislation doesn't have to take the easier way, if they'd say that schools must teach X, the market would figure it out somehow. It would probably even be a worse experience as it is currently, but that never stopped any legislator.

Yes, just like the “market” figured out how to increase privacy after the GDPR and not just a shit ton of cookie pop ups.

The problem with regulating what kind of tech you should use is that it can be surprisingly hard to change or update after the fact.

South Korea mandated usage of ActiveX in the 1990s as one of the first countries to push into online shopping, and it took until 2020 to get rid of it (and Internet Explorer) altogether.

It's unlikely mandating open standards would result in that flavor of lock-in.

> It's unlikely mandating open standards would result in that flavor of lock-in.

Considering the difficulty of switching from IPv4 to IPv6 and extremely creative ways to update TCP (before everyone gave up), I'm not sure of that.

Is Office even the de facto outside of the accounting industries reliance on Excel?

Are most schools and offices not running Google Docs these days for the word processing/presentation side of things?

For this to work we would need a specialized, simplified, "just works" distribution with a well defined set of hardware support and software packages. Slow moving, standardized, minimal configuration capabilities and with laser focus on security, "non-technical" and educational UX and documentation.

Companies and institutions could build on that foundation to provide support and integration. It could enable a kind of specialized market for IT in education that can be relied on.

Sounds like a monumental effort. But doable. Are there any attempts at this?

Turkish government attempted twice and mostly failed: https://www.pardus.org.tr

Cromebooks have filled this niche for better or worse.

I would imagine that Debian (with the benefit of community+repository size and inertia) or Fedora (with the benefit of community+repository size, and something adjacent to commercial support) might be the best bet for such a distribution. Rolling anything different is likely to fragment avenues for support. IMHO, even Linux Mint / Pop OS feel too niche. Rolling a custom distro is almost surely a bad idea.

https://www.skolelinux.de/en/

Would it work if that distribution were Win11, since it's got WSL2 ?

Mint already provides a distro like that. I think the missing part is application software.

My school district has all of the machines on their domain.

Linux still doesn't have anything remotely as capable as Active Directory.

Now that almost everything is accessed by a web browser... what do you even need Active Directory for? Like printers or something?

For locking down the machines so the kids don't mess them up. For pushing policy down when they need to change something. All of the stuff that's routine for an AD administrator.

Don’t know why we just don’t give people a laptop and a login for the web services they need. If they can run a laptop at home just fine why does it need to be any more locked down than that for school work? And what policies do you need to just run a web browser? It’s not the NSA.

So, your entire tech support will be inundated with undoing scams and ransomware perpetrated by malicious search ads, for one.

Chrome is outright terrifying to have on a computer if you don't push down about four pages of enterprise policies to lock it down.

The idea of letting employees have administrative access to PCs that sensitive corporate data or childrens' personal info is on is downright terrifying.

But letting them access that same data on their personal computers and laptops is fine?

If banks can let you access your account information on non-bank owned machines and parents can access their kids personal info from their phones I think we can manage a fleet of untrusted endpoints.

Many tens of billions of dollars are stolen via those untrusted endpoints every year, mostly targeting at risk groups like senior citizens.

Yes, because the school district is not legally liable for parents doing stupid things outside of school grounds, but it is legally liable for its employees' conduct.

> If they can run a laptop at home just fine

The number of times I have seen people being okay with computer slowdown due to adware or viruses is insane. Some folks I know go with policy of computer format over every year because it is "natural" for computer to get slow over time according to them. Really most people are fine with downloading any software they see from web. There is a reason that fake software are highest paid ad category and only porn sites shows it.

Group Policy is low key the most powerful thing in tech. Secure all the clients? Yes. Personalize all the clients? Yes. Install software? Sure. Disable unsafe browser features in third party browsers? Also yes!

Group policy is such an insanely convenient configure-once-apply-everywhere system, I'm still not sure why anyone would run a corporate network without it. Modern MDM solutions don't even come close to the extensive level of customization you can do with a GPO.

> Now that almost everything is accessed by a web browser... what do you even need Active Directory for?

What about signing in with your firstname.lastname account, with the particular web app talking with the AD server through something like LDAP?

Thus, your credentials for all of the integrated software should be managed centrally, in the particular AD server or a similar solution.

Or maybe even SSO with something like Kerberos or an alternative?

There a tons of free SSO services, such as Google.

And why do you need to control people’s laptop login? That can be local.

> And why do you need to control people’s laptop login? That can be local.

Some organizations might want to ensure that your account follows certain policies in regards to the password expiry dates or how "secure" they are.

Furthermore, if you leave an organization, they might want to remove all of your access credentials to all of the linked platforms/devices in one fell swoop.

While you are in the organization, they might want to allow you to use certain pieces of software (say, GitLab, Nextcloud, Mattermost, anything that talks LDAP) by giving you a particular group membership, such as everything for PROJECT_X/CLASS_X and so on.

Similarly, when a certain platform requires user credentials, they might also want to explicitly allow this platform to integrate with their account management software, by giving it certain credentials to talk to the AD server, which can later be revoked.

Oh, and password resets are also nice to centralize, in case you ever screw up.

Sometimes their hand might also be forced due to compliance reasons: imagine Google basically owning your company and information about all of the accounts/devices due to them having the actual data.

The argument is that because so much is now cloud services in the browser, it makes centralised AD far less holistic hence better assess the cloud services settings for compliance. There is some truth and risk in that, go reset the password of those 3 services not supporting SSO. Reality about security is to deal with the admin trouble, MS isn't removing processes, education, trust, and their costs, it likes to give the impression that it does hence asking you money for removing the difficult invonvenience of actual security needs

FreeIPA combined with something like ansible will do it.

Can you find someone to install it, configure it, maintain it and update it, and support it (including on-site once a week) for less than $10K a year?

Microsoft is losing money to have schools run this software.

Do Microsoft do that work directly?

No, but you can throw a rock and find cheap good enough managed service providers that can do it — ie Microsoft partners. MS has been building out the network for decades.

FreeIPA is a Redhat upstream thing (389 Server or something?) so yea I’d imagine Redhat would probably work with a school district for wicked good pricing.

I'd pay $10k/yr. out of pocket not to use FreeIPA again. It's no substitute for AD and when it breaks, it breaks hard.

> Linux still doesn't have anything remotely as capable as Active Directory.

I legitimately want more people to talk about this and to share their experiences. Do people run OpenLDAP? Something like FreeIPA? Maybe 389 Server?

What's the most popular or maybe easiest to use *nix solution for managing lots of accounts and devices, policy etc.? What about solutions for just managing accounts/login information or integrating with self-hosted software of all sorts?

Honestly, the best domain server for Linux is active directory and if you have but a single Windows machine in your school it’s mandatory anyway so unless you’re managing massive fleets to warrant the FreeIPA bridge sssd-ad is more than good enough.

Every edu ive worked with using Linux rolls an ubuntu derivative which has for six LTS versions supported easy AD integration. Smaller subsets just use Ansible + AWX but they are typically just manging the basics.

The AD integration on Linux is just getting you login. It doesn't support much local configuration of the endpoints, which is the killer feature of AD. I have also found the AD PAM modules to be a bit fragile. I keep having machines that work for awhile, then suddenly need 5 minutes to log in or simply can't log in at all after some time. It has been kind of frustrating for me. I want to tell people "just use your domain login, it will work", but its a lie too often.

Active Directory is an implementation of LDAP and uses Kerberos, both OSS. So, in effect, Linux has something exactly as capable as Active Directory.

Spoken like someone who has never in their lives tried to do any of the things AD does in Linux.

> Spoken like someone who has never in their lives tried to do any of the things AD does in Linux.

Spoken like someone with identifiable personality disorder. Get evaluated and stop pathetically trying to hurt others when it is clear the deep anxieties are yours.

AD is only miraculous in that it is the one thing, the one and only thing among a vast many, that Microsoft got right. And the reason they got it right is that AD is LDAP and Kerberos. IOW, AD is a Microsoft-esque gui for LDAP and Kerberos. Really. It does not slice and dice, it does not blend; it is merely authentication and authorization. If you'd like, AD will auth Linux boxen users all day long. Anything else AD does is only germane to Windows.

I've heard this is why schools are switching to Chromebooks now - massively reduced support costs.

> Some of them found windows 10 too difficult to use

That’s probably because Windows 10 is more confusing to use than most general audience Linux distros.

Some need to start with it, IT support will follow after what people use. Still, there are unresolved problems. A common school distribution would be good, also central group policies for Linux. This infrastructure is sadly often lacking for Linux and any self-made solution cannot scale beyond individual schools.

But I think using Linux would increase technical competence of pupils massively. They don't learn anything from using another iPad. They can use that better than their parents anyway because they already have phones.

Far point regarding support, but I’ve found that Linux is often actually a lot more friendly for non technical people than windows a long as you don’t step beyond what is possible in the UI.

What were the use cases you've found success at? I've only found Linux (Ubuntu etc) to be a smooth and stable experience when not installing things beyond what's included by default. Have tried some variant of Linux every other year for the past 20. Turns into dependency hell and arcane incantations.

It might be that you're thwarted by trying to install it on bleeding edge machines. I've run Debian stable on my home servers and Debian testing on my workstations for years. Nothing ever goes wrong, it's boring. Debian stable is rock solid.

The only things I've had issues with were:

- Device drivers and configuration of things like the X Server. From what I've heard this can be mitigated by buying well-supported hardware.

- Software that wasn't included in the distro's package repositories. This is where linux can really fall down in my experience, along with the fact software like MS Office isn't supported at all. But if you don't need anything beyond standard software then it can often "just work" more smoothly than something like Windows.

Same experience re standard software - Generally works great out of the box if you can get through the installation process. Should have clarified re distro's packages working great too.

It's actually more friendly in the command line too. I've done support on both.

Anything reaching a high level of complexity basically falls apart on Windows. I can tell someone on Unix: "Type exactly X" into the command prompt.

If I want someone to get there editing the registry, using the Window terminal and/or modifying complex system settings through a GUI which changes seemingly every week, it's basically a dead-end.

Kids learn terminals fine too.

You’ve never had to support Linux if you think this. Hardware support is absolutely all over the board. It works but often requires tinkering, which is a support nightmare when you have hundreds of potentially thousands of users.

Sounds like a sweet reason for laptop vendors to provide the best linux hardware support once schools mandate free software!

Presumably if you did this for a school you’d have standardised hardware that you control.

Linux works perfectly fine for completely non-technical people, who can do everything and anything in a browser, and who doesn't game, use a lot of different peripherals beyond maybe a printer, and upgrades their system every 15 years or so. Like my parents.

You can take away their root access, and if needed, ssh in and do remote support if needed.

Obviously, linux also work excellently for advanced users, those who can just fire up a windows VM and pass through a GPU if they want some windows functionality. (Exactly what I'm doing now. I like to run Windows on top of zfs, as since snapshots make backups/clones, etc so easy.).

For those inbetween, that do intermediate complexity tasks and don't want to struggle with the OS to do them, Windows/Mac is easier.

I work for an open source agency that aims to solve a similar problem for non-profits, by re-skinning an existing open source tool to make it more usable, and only charging them for implementation rather than software fees.

I don't see why a similar solution couldn't exist for education, to pass the benefits of the open source ecosystem onto less technical users.

Also many comments here forget people have both work computer and personal computers. Most people are familiar with the Windows eco system from their personal computer. Forcing them to learn a different system is just unrealistic.

I don't know, 25 years ago most people didn't even have a personnal computer at home yet they were forced to learn to use desktops from windows, os2, solaris cde, mac os or sometimes just an arcane text based terminal. Not so long ago people were still working mostly with a fullscreen curse based window from a telnet client.

One third of households had computers by 1997

https://www.statista.com/statistics/214641/household-adoptio...

Most of those were Windows PCs. OS/2 never took off for home users.

Schools were using either Windows or a few were using Macs - both running MS Office.

No, it separates school from home. It isn't like Debian stable with a MATE desktop could confuse anyone.

>Most people are familiar with the Windows eco system from their personal computer.

Think you might be shocked just how few people have a “personal computer” anymore. Most children and even most adults these days experience computing though tablets and phones.

Wow, I guess this was a small school? Was it "only" Microsoft Office licenses, or was other software included too?

Microsoft knows the value of having people used to their software.

You can get absolutely insane educational discounts.

Non-profit here. Getting an E5 license is simply a no brainer. It’s insane.

Agreed. Once kids learned it at school, they are reluctant to switch - just listen what people say about teachers... That's Microsoft's strategy.

That value needs to be understood and exploited by the OSS competition to Microsoft.

At the time, MS educational licensing was cheap as hell, we paid a set price per teacher and that then included windows & office for everyone.p, including free licenses for the kids to download office at home. I’m sure it’s changed now.

It's not a matter of better, but a matter of society: no single surveillance capitalism software must be allowed for children nor public institutions in general, by law. States who allow that are already in a deep threat, and no, I'm not joking.

Beside that: Microsoft have invested big money on desktops, their own way, it's normal you find better support around, and that's because schools do not teach anything IT related as they MUST, witch means for users, not against them...

Reply on news.ycombinator.com