Hacker News Reader

Comment by habnds | Hacker News Reader

>> GitLab approves the use of Linux, and Apple's macOS. Microsoft Windows is prohibited for the following reasons:

    Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware.

    macOS is preinstalled on Apple computers and Linux is available free of charge. To approve the use of Windows, GitLab would have to purchase Windows Professional licenses, as Windows Home Edition does not satisfy GitLab's security guidelines.

    As many purchases of laptops have occurred with employees making the purchases and then being reimbursed by GitLab, a remote employee would typically be making a purchase of a laptop pre-loaded with Windows Home Edition.
    Windows Home Edition is notoriously hard to secure.

edit: after thinking about this for a bit, it occurs to me that their main competitor is github and that maybe they just aren't very excited to use MSFT products?

View on HN

I‘m a bit surprised that they care about the cost so much - the Dell laptops and the Apple Laptops come in at a price point of 2000 - 3000 USD and the Dell they specifically recommend for Linux use comes with Windows Pro preinstalled. The price difference to the equivalent Linux version is around 70USD. That‘s a negligible difference, especially when you start comparing to the employees wage (It‘s probably about 1 hour of their time, one-time cost)

If they‘d make the point based on lack of internal support capacity, I‘d understand, but caring about the one-time cost of the license is a very weak point.

Where did they mention cost concerns? I’m reading this that it’s an IT/procurement hassle dealing with the Windows Pro upgrade licenses, on a platform they don’t feel is secure, not a cost issue.

Any laptop above the absolute bottom tier can be purchased with a pre-installed Windows Professional license. It's a complete non-issue.

The linux laptop they propose comes by default with an included Pro license, home edition would need to be selected extra. I haven‘t used Dell in a while, but I‘d assume that it behave like Lenovo and has the License Key baked right into the EFI, so there‘s literally no need to deal with any upgrade license if you proscribe which Laptop Model people are allowed to purchase (which they do)

They also mention multiple times that Linux and MacOS are free, as opposed to Windows Pro - which can reasonably be read as „we don’t want to spend money here“, since otherwise you could just strike these arguments and revert to „we don‘t believe Windows Pro is secure“, which incidentally they never say.

They specifically mention Dell laptops with Ubuntu preinstalled.

If you follow the link to the model in their page, it selects the default version with Windows 11 PRO. You can explicitly choose Ubuntu, but it‘s not the default. My point here is „acquiring the license for a windows based laptop is a non-issue if you‘re willing to spend the 70USD it costs.“.

The problem is generally less the individual pro license and the associated enterprise licensing costs that come with managing said device in Azure AD/InTune.

It is really weak argument. The software cost for example is included for MacBook price for sure. It just is not specifically separated.

Most places I've worked at (Windows shops largely) had management tools that worked well on Windows but not as well on other devices. The IT staff was skilled largely in Windows, as well. The biggest argument against other OS options was that we simply did not have the tools and experience to effectively manage the other options. It's a valid argument, and seemed disingenuous to take digs at the other OS options when the reality was that we simply couldn't support a Mac well in an enterprise environment.

I entirely agree - supporting multiple operating systems is effort at every level and from a certain size on, you need people with dedicated knowledge of each OS. But if that’s the problem, make that point instead of finding excuses.

It wasn't a limitation of the places you've worked at - endpoint management tools for Windows are light years ahead of the ones for Apple. Moreover said tools simply don't exist in Linux land.

Linux has the best endpoint management tools: Ansible, Chef, Puppet, Terraform?

Server management you say? How is a server different from a Laptop? It has Wayland installed or X11?

Apple and windows aren't even in the same ballpark.

Microsoft Windows with AzureAd and Intune provides a suite of tools for managing your fleet of laptops at little to no additional cost. It's honestly so much for free that running any other suite of laptops becomes arduous and expensive. It all just works out of the box and it's easy to bolt things on. The viruses and malware argument is ludicrous if you do any amount of end point protection.

Apple is a walled garden. Everything is a degree of difficulty or two harder and you often run into weird ecosystem shit like some aspects of laptop mdm registration only working if the user has an iPhone. The tooling is 5-10 years behind, non-existent, or expensive because the third parties know they got you by the short and curlies.

Linux is a build your own from open source ecosystem and what understaffed overworked IT team has time for that. I mean Google manages their Linux laptop fleet by rolling their own distro. Never mind all the compatibility issues with other required tooling that may or may not work.

Some of these issue may have been easier to conquer in OnSite roles where laptops could be dropped at an IT cage but for full remote the Windows ecosystem has just gained more ground because of the iceberg of features most users never see.

You are missing an important point: engineers want to use the tools that work best for them. They don’t care much about the things they can’t see. Taking a job with a super restrictive IT environment that would prevent me from doing my job effectively would be a deterrent to work for that company. I know many people who feel similar to this. The opportunity cost of not being able to hire those people or giving them other incentives to alleviate those concerns is easily orders of magnitude more expensive than just buying a device management as a service solution for other OSes.

I’ve rarely seen people being very enthusiastic Windows users btw.

I've rarely seen individuals be very happy with Linux / Unix outside a few very dedicated, stereotypical hacker-types. Safe to say anecdotes don't work.

I'd also think twice about the consequences of these decisions. If Gitlab and co decide Linux/Mac is the answer for market share, it's only a matter of time before hackers start targeting those platforms en masse. If the answer to Windows was restriction galore, I fail to see how humans won't repeat history and do the same to Unix.

Seems like its a pretty good filter to me, anyone not adaptable to a different operating system is probably not a great fit for a company like gitlab.

Tell me you haven't used Windows in a decade without telling me you haven't used Windows in a decade

Until 4 months ago, I was leading a team responsible for a cross platform desktop app with 20 million daily users, most of them on Windows. I used Windows daily and found/reported numerous bugs to Microsoft. I would never have made it my primary development environment, but I had some people on my team who liked it for that.

I think your uninformed ad hominem attacks are really impolite by the way.

Speaking of ad hominim's I am confused. Have you "I’ve rarely seen people being very enthusiastic Windows users btw" or "had some people on my team who liked it for that."

From my perspective Windows in 2022...

- I can seamlessly develop in Linux on Windows using WSL2 - I can manage my machine with a package manager (winget) - I can run Linux Native GUI application (wslg win 11) - I get Microsoft's epic backwards compatability - I get guaranteed comparability with 99% of the software and hardware available today - I get a suite of expandable back office tools for managing my fleet

Honestly, there are days I spending in visual studio code and windows terminal where it doesn't even feel like I'm on Windows. I can get the best of both environments out of the box.

...but tell me again how there is nothing to be enthusiastic about windows.

Obviously there's a spectrum and my personal experience is not representative for the industry as a whole. From the people I've worked with in 2 decades, maybe 2% choose Windows over Unix when given the choice, even when most customers were using Windows. At my current job, I literally know nobody using Windows (>$1B software company with high 3 digit or low 4 digit number of engineers). Not sure why anybody thinks a Windows only policy would be a great idea in this labor market.

Neither Azure AD nor InTune are free, not remotely so.

Last time I checked it was quite expensive

That was the only real benefit of having a mac in my experience - they were always a niche and off the radar and didn't have the 20 different security tools on them crippling performance like the Windows SOE.

Thankfully WSL2 on Windows is now an option, its also off the radar so whatever happens inside the Linux VM doesn't cop a performance hit.

I didn't read it as cost, but management overhead. It's easily possible to secure a Windows computer in an enterprise environment. They are fully remote and primarily a Mac shop, so they don't have that expertise or infrastructure. If you are running Linux on a Dell, then they assume you have the ability to manage that yourself.

I see this more as a function of them being fully remote more than anything else.

Then just say so instead of making excuses about security and cost. We also only buy a selected range of hardware and support a selected range of Operating Systems. But the reason is stated as “We currently don’t have the administrative capacity to support more than this. Period.” And that’s a fair reason and good reason and everyone understands that.

You wouldn’t use Home SKUs for enterprises anyway, if you want to apply any policy you need Pro/Enterprise. In the end it’s about GitLab dismissing an entire laptop over a $70 upgrade key, or $200 Pro license.

> Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware.

That may be true, but a much higher proportion of downloaded Mac software lacks code signing. Opting in to that as a developer on the Mac will carry a lot of risk of kafkaesque deactivation and, and most don’t want to deal with that. On Windows, on the other hand, it’s like getting an SSL certificate. Apple’s philosophy on the developer program is antiquated, obsolete, and has compromised the security of the platform.

How many Mac users do you think limit themselves to only signed apps? It’s much easier to do this on Windows (but requires a small amount of technical understanding, or is it too much for Gitlab employees?). But when you enforce the policy at the corporate domain level, you won’t be neutering the machine’s usefulness as you would on the Mac. Unsigned apps on Windows tend to be the janky ones, while the signed apps found on the Apple Store tend to be garbage in my experience.

Relying on “less malware is created for Mac” is a terrible idea in general. This isn’t the 90’s. When you are Gitlab, a high value target for sophisticated, targeted attacks, that won’t help you.

Good Security is a balancing act between safety and convenience, and Apple gets it completely wrong. Therefore I would be very cautious about trusting Gitlab’s security posture given their apparent ignorance on the subject.

From https://developer.apple.com/support/certificates/

> If your certificate expires, users can no longer launch installer packages for your Mac applications that were signed with this certificate.

> Apple Developer Program membership is required to request, download, and use signing certificates issued by Apple.

> Note: Apple can revoke digital certificates at any time at its sole discretion. For more information, read the Apple Developer Program License Agreement in your developer account.

… and many paragraphs detailing what parts of your app will break when certificates are revoked.

There are more nuances involved than I care to list in full here, though I’d be happy to be proven wrong about this.

I can’t remember the last time I allowed an unsigned app to run on Mac, I can’t even think of examples recently where I’ve gone “oh **, this thing is unsigned?!”. I’d love examples of high quality apps without a basic codesigned certificate, maybe we have a disagreement over the term “quality”.

“App Store apps are garbage” is also kinda rich, it’s not windows, the Mac App Store is the go-to source for distributing Mac apps at this point. There’s some examples of popular apps not on the MAS but they grow fewer by the year.

> I’d love examples of high quality apps without a basic codesigned certificate, maybe we have a disagreement over the term “quality”.

We're not talking AAA rated, but Kdiff3 and Zenmap should qualify.

> the Mac App Store is the go-to source for distributing Mac apps at this point.

I wouldn't say the verdict is in yet.

https://9to5mac.com/2022/06/09/setapp-mac-developer-survey-r...

> There’s some examples of popular apps not on the MAS but they grow fewer by the year.

Well, yeah, the success stories have the budgets to handle compliance issues, and to manage risk appropriately. Apple will also be more lenient with large publishers for a number of reasons. I wasn't talking about popular apps, I was talking about apps that make me productive. Things made for power users. Popular isn't a concern there. But if BigCo doesn't allow me to install it, that's a dealbreaker for me working there. Experienced that in 2010 when working for a Fortune 50. One approved text editor, one approved browser. The productivity apps I use are not on the app store. They are signed, but chances are that a locked down Mac will require App Store installations only, while a Microsoft configuration would be more optimal.

For the record, I DO prefer a Mac for productivity. But when it comes to security, Microsoft wins. Or even better, Linux (though Microsoft is giving it a run for its money with W11)

Kdiff3 had its last release in 2014, old multiplatform apps that weren’t updated would have this problem. Zenmap seemed to not be unsigned? Wireshark was definitely signed, which I was kinda surprised about. I wouldn’t have expected QT apps to be signed, but looks like even those have some support. I’d also argue there’s better Mac apps, at least in terms of kdiff3 ;-).

Fair enough on App Store / popularity, my point was mainly saying the apps on the App Store are of “lesser quality” / the lowest quality is ridiculous. It’s not like the 30% of setapps not-on-the-AppStore apps are explicitly not doing it from a quality standpoint. Most are just because they don’t want to / financially can’t afford the revenue split.

> a much higher proportion of downloaded Mac software lacks code signing

Citation? I can't recall the last time I ran across a Mac app that wasn't signed - most are Notarized.

>> [..] Windows is the platform most targetted by spyware, viruses, and ransomware.

Neither spyware, virus or ransomware has slowed my computer to a halt as much as using GitLab.

All of the reasons are perfectly valid. Just not extremely relevant.

Normally any company looking at that level of operational detail has a problem. But on their case, yes, it's probably because Windows comes from their competitor.

Adding a bunch of work, costs, and risk to yourself that will only benefit your competitor does not feel good. No matter how relevant are the work, costs, and risk.

I haven't had problems with viruses, spyware and ransomware on Windows for years. Microsoft's builtin spyware marketed as telemetry and diagnostics otoh is very difficult to counter even with dedicated tools like O&O ShutUp10. I get why companies don't want to risk giving business secrets to Microsoft.

>I haven't had problems with viruses, spyware and ransomware on Windows for years.

That's great and all, but I'm not sure what point you're trying to make. That there isn't a problem of malware/ransomware? Because there certainly is, and for most organizations the risk of malware/ransomware is much more significant than the fact that Windows gets some error reporting and usage statistics and such.

Having such a supermajority of desktop operating systems in use means you get most of the developer attention. Unfortunately, it seems to surprise folks that malware also has developers responding to the overall market conditions.

Microsoft is certainly doing their best to mitigate the negative consequences of the monoculture, but it remains a fact and an issue. Just like in biological systems, diversity in software is also critically important for the health of the population.

Hey, quick question. I have been the same for years, using Windows without any problems (at least that I know of!).

But soon I will have to go to the offices of the startup that I work for (I work remotely) and they all use Mac, and I am a bit worried if they start asking question about how I keep my computer secure. Anyone (not only parent author) can recommend something? A software to install or anything like that?

So they banned a wildly popular OS because it does not satisfy their security guidelines. I just checked, they have no guidelines for securing Windows. So you can't satisfy their Windows security guidelines because the guidelines for securing Windows were never written. What a joke.

> So they banned a wildly popular OS because it does not satisfy their security guidelines.

I think banning Linux and Mac for those reasons is much more common, really.

Isn't that a case of the wetware that procures the laptops being not quite on the samepage, especially for someone working in geared towards developers company.

A buy something with windows pro is not hard to communicate...

I wonder if the main concern is buying Windows licenses via volume licensing and paying for Software Assurance.

Reply on news.ycombinator.com