4 ms·

Good luck maintaining a fleet of this junk. Want to get your data from a non booting machine? Gotta break the screen! Batteries can't be replaced with breaking

Good luck maintaining a fleet of this junk. Want to get your data from a non booting machine? Gotta break the screen! Batteries can't be replaced with breaking the screen either. Defiantly not a "business class" machine you can swap parts to keep your fleet going... Try fumbling around with one for more than an hour, garbage!

tonyztan 8y ago
On the flip side, they are tamper resistant. It would be incredibly difficult for someone to tamper with a Surface tablet siting in a hotel room without leaving marks. This is probably good for travel with a corporate device.
- craftyguy 8y ago
  With physical access, you could execute any number of attacks over usb to get access to data on the device.
  - p2t2p 8y ago
    That what BitLocker is for and Surfaces come with that thing enabled by default. (let's suppose you're not being targeted by NSA for simplicity of the discussion) =)
    - craftyguy 8y ago
      BitLocker doesn't matter if the device is on, and that the owner has picked a reasonably strong passphrase (people generally fail to do so).
      - tonyztan 8y ago
        Hence users who may be targeted should not leave the computer unattended AND powered-on. They need to set a TPM PIN and power down the computer when it's not being used. BitLocker only allows you ten attempts to enter the TPM PIN, and if the bootloader is modified by an attacker, the TPM will refuse to release the key.
        p2t2p 8y ago
        > TPM PIN TIL Also does it require it when comes from hibernation? Because by default Surface Pro powers off after certain time in connected standby, therefore if BitLocker pin is active after wake up the user is safe.
        tonyztan 8y ago
        I believe it's required after hibernation (because the device is powered off), but not after sleep.
- HammerJack 8y ago
  Do you really think anyone short of a state agency is going to break into your hotel room and attempt to install malicious hardware? Since I assume you'd have drive encryption in such a hostile environment?
  - tonyztan 8y ago
    Full disk encryption does not protect against hardware keyloggers, but obviously tampered hardware (broken screen) could lead to the user not entering the passphrase. Also, this is not for my threat model, but it could be appropriate for certain corporate travelers or journalists.
chrisseaton 8y ago
Is that any worse than a MacBook or an iPad? People manage to run huge enterprise deployments of those.
- p2t2p 8y ago
  Windows is much worse than MacOS as general purpose OS and much worse than iOS for cases people are using iPads for. Hardware in Surfaces is fine. Edit: I mean quality of Windows is much worse. It may have ingenious design internally but what user sees is just awful.
  - deleted 8y ago
    [deleted]
  - Devagamster 8y ago
    That is well and truly your opinion. I for one can't stand Mac OS but I won't go spouting that as fact for all users. Come on now...
    - p2t2p 8y ago
      I’m talking about quality, not the design or features. I can use both just fine since introduction of WSL. Quality and the way it updates kill the experience for me. I agree that design or certain features can be very much personal preference thingy so I’m only discussing quality.
solatic 8y ago
How are you running a business fleet of machines and still relying on offline edge storage? Employees should be working directly out of networked storage, only needing an offline cache for the rare unconnected circumstance e.g. flight without WiFi. How many employees do you really have who a) worked on a flight AND b) broke their machine at the end of a flight, before they could sync, AND c) it would take less time to recover the data from a machine with better maintainability (remember: you don't know where the changes are to be found, and your employee doesn't remember) than it would to re-write from the last networked save? For any non-trivially large fleet, you should a) be wiping the disk on a frequent basis so that users don't save work locally, b) have replacement "cattle" machines ready to go whenever an employee comes into the shop, rather than fixing the employee's "pet" machine and having the employee wait for the fix. It may be more expensive to run a Surface fleet, for the reasons you mention, but that doesn't mean it's not a business-class machine, it means that maybe Surface economics don't work out for your company.

tonyztan 8y ago

On the flip side, they are tamper resistant. It would be incredibly difficult for someone to tamper with a Surface tablet siting in a hotel room without leaving marks. This is probably good for travel with a corporate device.

craftyguy 8y ago
With physical access, you could execute any number of attacks over usb to get access to data on the device.
- p2t2p 8y ago
  That what BitLocker is for and Surfaces come with that thing enabled by default. (let's suppose you're not being targeted by NSA for simplicity of the discussion) =)
  - craftyguy 8y ago
    BitLocker doesn't matter if the device is on, and that the owner has picked a reasonably strong passphrase (people generally fail to do so).
    - tonyztan 8y ago
      Hence users who may be targeted should not leave the computer unattended AND powered-on. They need to set a TPM PIN and power down the computer when it's not being used. BitLocker only allows you ten attempts to enter the TPM PIN, and if the bootloader is modified by an attacker, the TPM will refuse to release the key.
      - p2t2p 8y ago
        > TPM PIN TIL Also does it require it when comes from hibernation? Because by default Surface Pro powers off after certain time in connected standby, therefore if BitLocker pin is active after wake up the user is safe.
        tonyztan 8y ago
        I believe it's required after hibernation (because the device is powered off), but not after sleep.
HammerJack 8y ago
Do you really think anyone short of a state agency is going to break into your hotel room and attempt to install malicious hardware? Since I assume you'd have drive encryption in such a hostile environment?
- tonyztan 8y ago
  Full disk encryption does not protect against hardware keyloggers, but obviously tampered hardware (broken screen) could lead to the user not entering the passphrase. Also, this is not for my threat model, but it could be appropriate for certain corporate travelers or journalists.

chrisseaton 8y ago

Is that any worse than a MacBook or an iPad? People manage to run huge enterprise deployments of those.

p2t2p 8y ago
Windows is much worse than MacOS as general purpose OS and much worse than iOS for cases people are using iPads for. Hardware in Surfaces is fine. Edit: I mean quality of Windows is much worse. It may have ingenious design internally but what user sees is just awful.
- deleted 8y ago
  [deleted]
- Devagamster 8y ago
  That is well and truly your opinion. I for one can't stand Mac OS but I won't go spouting that as fact for all users. Come on now...
  - p2t2p 8y ago
    I’m talking about quality, not the design or features. I can use both just fine since introduction of WSL. Quality and the way it updates kill the experience for me. I agree that design or certain features can be very much personal preference thingy so I’m only discussing quality.

solatic 8y ago

How are you running a business fleet of machines and still relying on offline edge storage? Employees should be working directly out of networked storage, only needing an offline cache for the rare unconnected circumstance e.g. flight without WiFi. How many employees do you really have who a) worked on a flight AND b) broke their machine at the end of a flight, before they could sync, AND c) it would take less time to recover the data from a machine with better maintainability (remember: you don't know where the changes are to be found, and your employee doesn't remember) than it would to re-write from the last networked save? For any non-trivially large fleet, you should a) be wiping the disk on a frequent basis so that users don't save work locally, b) have replacement "cattle" machines ready to go whenever an employee comes into the shop, rather than fixing the employee's "pet" machine and having the employee wait for the fix. It may be more expensive to run a Surface fleet, for the reasons you mention, but that doesn't mean it's not a business-class machine, it means that maybe Surface economics don't work out for your company.