3 ms·

Showing a list of devices is very different than accurate user <-> device attribution. Doing that in competing solutions to Fleetsmith requires at least: (1) ha

Showing a list of devices is very different than accurate user <-> device attribution. Doing that in competing solutions to Fleetsmith requires at least: (1) having an LDAP server (2) configuring server details, including TLS etc. (3) LDAP attribute mapping in the MDM solution, and then (4) manually assigning each device to a user one a time -- a process that usually involves repeating the following procedure for each device: 1. Copy S/N to clipboard 2. Tab over to inventory spreadsheet 3. Command-F and pray your IT helpdesk recorded which employee the device belongs to 4. Tab back over to the MDM solution, select the employee from the dropdown menu. This becomes extremely time intensive if you have hundreds or thousands of devices. As for FDE--enforcing it is easy. Doing that while also reliability and securely escrowing its recovery key is a much different story. On the reliability side--not every solution out there is equally reliable when it comes to ensuring that the recovery keys actually make it into the MDM. On the security side, I believe we're the only vendor that does CA pinning across the entire management lifecycle. Those stages are covered in great detail in the previously linked BlackHat whitepaper. On the server side, I believe we're the only vendor to automatically encrypt sensitive fields (such as FileVault keys) before the hit the database, with per-customer AES keys (key generation and key management handled by Hashicorp Vault's transit backend). Last but not least, there's the matter of generating evidence for auditors to prove you're doing the things you claim to do. We automatically surface the status of these things in the product, instead of requiring people to input boolean logic and generate custom reports. Overall, Fleetsmith is just much more "turnkey" when it comes to checking the boxes for SOC 2 than competing MDM solutions.

lvh 7y ago
I'm guessing we have a different opinion on what "competing solutions" or "accurate user <-> device attribution" or "setting up an LDAP server" mean. I'm sure there's a version of this story where somebody picks Intune (it manages everything!) and then decides to run their own AD install (inexplicably) where that description is accurate, but we've seen a pile of people deploy Jamf Pro/Connect to GSuite/Okta and what you're describing does not match my experience. With GSuite in particular, nobody set up any LDAP. It's an OIDC app, you do not run Connect Verify or Connect Sync. There's LDAP going on when you're authing against Azure, but if you're in that situation AD seems like what you want? I read your description as suggesting that if you pick anything other than your product, there's necessarily an AD DS or slapd in your future, and I hope we can agree that's definitely not the case. In the most common case for our audience (startups) it's not even any LDAP at all. Is it fewer clicks in Fleetsmith? Maybe? Probably? And you have to know whatever the hell a "PreStage Enrollment" is which is not as easy as it could be. But I think you're making it sound a lot more hairy than it is, particularly for a deployment with "hundreds or thousands of devices". The hard problem facing that IT team is not finding someone who is unafraid of the words "Preference Domain", come on. (To reiterate my position: I am not saying Fleetsmith is bad, I'm saying that I think your post makes it sound like anything besides Fleetsmith is a world of pain, and I accept that you probably extra-believe that as someone who founded Fleetsmith (not in the sense of "you're lying" but in the sense of you don't bet the farm on trying to fix things you don't think are broken), but, I think a) whatever Fleetsmith is fine and yes it's probably better at doing the limited set of things you should be doing but b) compared to our experience this is a pretty wide exaggeration of how bad anything else is like.)

lvh 7y ago

I'm guessing we have a different opinion on what "competing solutions" or "accurate user <-> device attribution" or "setting up an LDAP server" mean. I'm sure there's a version of this story where somebody picks Intune (it manages everything!) and then decides to run their own AD install (inexplicably) where that description is accurate, but we've seen a pile of people deploy Jamf Pro/Connect to GSuite/Okta and what you're describing does not match my experience. With GSuite in particular, nobody set up any LDAP. It's an OIDC app, you do not run Connect Verify or Connect Sync. There's LDAP going on when you're authing against Azure, but if you're in that situation AD seems like what you want? I read your description as suggesting that if you pick anything other than your product, there's necessarily an AD DS or slapd in your future, and I hope we can agree that's definitely not the case. In the most common case for our audience (startups) it's not even any LDAP at all. Is it fewer clicks in Fleetsmith? Maybe? Probably? And you have to know whatever the hell a "PreStage Enrollment" is which is not as easy as it could be. But I think you're making it sound a lot more hairy than it is, particularly for a deployment with "hundreds or thousands of devices". The hard problem facing that IT team is not finding someone who is unafraid of the words "Preference Domain", come on. (To reiterate my position: I am not saying Fleetsmith is bad, I'm saying that I think your post makes it sound like anything besides Fleetsmith is a world of pain, and I accept that you probably extra-believe that as someone who founded Fleetsmith (not in the sense of "you're lying" but in the sense of you don't bet the farm on trying to fix things you don't think are broken), but, I think a) whatever Fleetsmith is fine and yes it's probably better at doing the limited set of things you should be doing but b) compared to our experience this is a pretty wide exaggeration of how bad anything else is like.)