16 ms·

Microsoft Windows is prohibited at Gitlab

234 points by filenox 4y ago

andsoitis 4y ago
"macOS is preinstalled on Apple computers and Linux is available free of charge. To approve the use of Windows, GitLab would have to purchase Windows Professional licenses, as Windows Home Edition does not satisfy GitLab's security guidelines."
PaulHoule 4y ago
It's a fairly odd that that IT cultures are segregated into places that have nothing but Macs and other places that have nothing but Windows. I think it's risky because a small computing monoculture can feel complete but commit a software business to failure at the very beginning by rejecting 90% of the potential market.
- ericbarrett 4y ago
  Device management becomes much more complicated when you have multiple OSes, though. Unless your company is small enough that self-management remains viable, you have to hire for both Windows and Mac administration experience, and/or shell out a pretty penny for cross-platform "enterprise" device management software.
  - Xylakant 4y ago
    They do allow linux though, and I have yet to find a competent device management software that supports Mac, Windows and Linux at the same time (or even Mac and Linux). I‘d be happy to hear recommendations.
    - dijit 4y ago
      What are you looking for? Managing Linux at scale is extremely easy as you can leverage basically all the tooling that sysadmins use(d) for management of infrastructure fleets. You can even get a pretty GUI if it’s saltstack enterprise.
      - nikau 4y ago
        Something like saltstack is not in the same league as point and drool windows solutions.
        dijit 4y ago
        Is there something you can’t do? Or are you assuming sysadmins don’t learn their tools. Arguably learning the idiosyncracies of proprietary management tools is harder long-term as there are myriads of edge cases and they get replaced with completely new tools quite often. Exceptions are SCCM maybe, but people are avoiding that as much as possible IME.
        nikau 4y ago
        Most Windows compliance tools are seen as a tick in a box so ease of use and low effort deployment is often the most important thing. I'm sure you could achieve similar results with Salt but it will be some bespoke contraption requiring a lot of engineering effort where you cant just hire new staff off the street to maintain it.
        dijit 4y ago
        Tell me what you need and I’ll tell you how hard it is. I’m sure certain things are a tick of a box, with salt it’s usually 3-5 lines of yaml. It’s not like you’re writing a management system by hand in a general purpose programming language.
        nikau 4y ago
        where I work there are controls to block USB media devices, they block certain software publishers (eg. cant run firefox), all sorts of annoying things.
- dijit 4y ago
  Microsoft ecosystem is really hard to dip a toe into. Properly supporting a handful of machines practically means bringing AzureAD or Exchange. AzureAD brings in elements of Exchange (like outlook), which brings in weird default settings like teams/sharepoint/onedrive. Apple has done a lot of work in supporting Microsoft Exchange, but it's still janky as hell (just browse r/macsysadmin and you'll see). So, you have two choices. 1) support the monoculture, life will be easier. 2) get a bigger IT department. People are happy to spend a boatload of money avoiding the second option, so, monoculture it is.
habnds 4y ago
>> GitLab approves the use of Linux, and Apple's macOS. Microsoft Windows is prohibited for the following reasons: Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware. macOS is preinstalled on Apple computers and Linux is available free of charge. To approve the use of Windows, GitLab would have to purchase Windows Professional licenses, as Windows Home Edition does not satisfy GitLab's security guidelines. As many purchases of laptops have occurred with employees making the purchases and then being reimbursed by GitLab, a remote employee would typically be making a purchase of a laptop pre-loaded with Windows Home Edition. Windows Home Edition is notoriously hard to secure. edit: after thinking about this for a bit, it occurs to me that their main competitor is github and that maybe they just aren't very excited to use MSFT products?
- smileybarry 4y ago
  You wouldn’t use Home SKUs for enterprises anyway, if you want to apply any policy you need Pro/Enterprise. In the end it’s about GitLab dismissing an entire laptop over a $70 upgrade key, or $200 Pro license.
- arkitaip 4y ago
  I haven't had problems with viruses, spyware and ransomware on Windows for years. Microsoft's builtin spyware marketed as telemetry and diagnostics otoh is very difficult to counter even with dedicated tools like O&O ShutUp10. I get why companies don't want to risk giving business secrets to Microsoft.
  - ziddoap 4y ago
    >I haven't had problems with viruses, spyware and ransomware on Windows for years. That's great and all, but I'm not sure what point you're trying to make. That there isn't a problem of malware/ransomware? Because there certainly is, and for most organizations the risk of malware/ransomware is much more significant than the fact that Windows gets some error reporting and usage statistics and such.
NeutralForest 4y ago
Seems like anyone can use Linux as well as long as you deal with your own support, good for them.
rubicks 4y ago
.
- mickael-kerjean 4y ago
  Me too, so many companies enforce windows only with no way to get a linux machine or a mac that it's great to see it playing differently, I can only hope things will change when a new generation who has never used windows will come in the workforce
  - Kaze404 4y ago
    I can't say I've never used Windows, but my first machine was Linux and I've been using it since then. This might happen sooner than you think :)
202206241203 4y ago
- icedchai 4y ago
  I assume this is sarcasm. They are a public company with a multi billion dollar market cap.
  - 202206241203 4y ago
    I guess you are right, it looks even worse then... Where is that money even going.
    - icedchai 4y ago
      Employees aren't cheap.
ironmagma 4y ago
This is being posted just a day after this tweet: https://twitter.com/allenholub/status/1555324387087097856 https://twitter.com/allenholub/status/1555324387087097856 I really wonder what it's like inside Gitlab. The product ticks all the boxes you'd want it to, but the user experience just resonates with sadness and misery.
- raverbashing 4y ago
  This self-description seems to be targeted at PHB that need convincing why their team should use Git
- shapefrog 4y ago
  To be fair ... they got a lot of middle management catch phrases into that description. Going to be an easy sell to the board.
  - ironmagma 4y ago
    There’s something telling about companies that put sales over common sense.
    - shapefrog 4y ago
      The sales team still gets "pro" laptops.
- jrochkind1 4y ago
  Woah, that tweet led me to: "GitLab plans to automatically delete projects if they've been inactive for a year and are owned by users of its free tier." Which I hadn't heard. That's.... something.
  - Etheryte 4y ago
    If I'm not mistaken they rolled this idea back real quick once it leaked and everyone got mad.
horsawlarway 4y ago
I'm no fan of Windows myself, but I find this a fairly bad policy. If nothing else - what's not used is not tested. And if you expect any real population of users to be using Windows machines with your products, you should have developers/PMs/QA/support interacting with your products using Windows machines. I see this as: We're saving a bit of money and making ITs life easier, and in exchange users will get a worse product. Realistically - that's a bad trade. It is almost never the right decision to prioritize IT quality of life over basically any other business need.
- wkdneidbwf 4y ago
  developers using windows isn’t necessary to test web software on browsers on windows.
- salzig 4y ago
  Gitlab is essentially a website, and Microsoft Edge is just Chrome. I think there isn't any reason to test on windows anymore.
  - commandlinefan 4y ago
    Famous last words.
    - chrisan 4y ago
      There are definitely differences between mac and windows (possibly linux) when it comes to font availability/rendering(maybe?) I've seen more than once a mac design use some font in a light weight that comes across almost invisible on Windows. I'm the only windows guy at our shop and "everyone has access to windows VMs to test" (lol) Outside of that, now that Edge is on Chromium most of our edge cases seem to be Safari these days (everyone uses chrome/firefox except a couple management using Safari). Which all in all I guess is a testament to our lack of full browser testing :) ¯\_(ツ)_/¯
  - horsawlarway 4y ago
    Developing "essentially a website" is my full time job - if you genuinely don't think there are differences between platforms, you aren't paying attention. The browser is wired into the OS in real ways, and they matter. Everything from "How does the os manage passwords" or "how are system notifications presented" or "How much screen real estate do I have have on a given window size (scrollbars...)" to subtle differences in how the network stack behaves, or how windows are rendered. Hell, I can list about 20 differences just off the top of my head - and a damn good part of that is because I've been forced to pay attention to each of those platforms. Which clearly you have not... I read your comment as "I only use a mac, and I don't understand".
bzxcvbn 4y ago
Seems weird to harp on the cost of a windows license when they're buying Mac OS licenses instead (although hidden in the device's prie).
- jhickok 4y ago
  Although not even hinted at in the doc, I personally find the tedium of buying and provisioning and monitoring licenses worse than the cost of it. I suppose you are also inviting risk in the form of an audit.
  - Xylakant 4y ago
    Most windows laptops today come with a license key baked into the BIOS. So no need to manage licenses here.
    - jhickok 4y ago
      I do not believe those are sufficient for enterprise licenses, which must be provided separately.
      - Xylakant 4y ago
        They are sufficient for pro licenses, though, which are what they mention as the required baseline.
      - jaywalk 4y ago
        There's no requirement to purchase an enterprise license. Large companies just do that to save money.
        trelane 4y ago
        Wait, they buy a second license to save money? How does that work and, more importantly, how can I convince lots of folks to buy my product twice to save money?!
      - 4y ago
dsr_ 4y ago
This is pretty similar to the policy at my company: you get a Mac, unless you specifically request a Linux laptop. If you need Windows for testing, Microsoft makes VM images available with a browser pre-installed at https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/ https://developer.microsoft.com/en-us/microsoft-edge/tools/v...
- rlv-dan 4y ago
  As a long time Windows user, it would take me a considerable amount of time to get used to the operating system and all applications and utilities that I need to be productive. Not saying Windows is great, but it works for me. And I'm pretty sure they don't hire people to learn an operating system.
  - dsr_ 4y ago
    As a long time multiple OS user and administrator, I can assure you that people figure out MacOS in the first two weeks. It's not anywhere near as strange as getting used to git for the first time. We don't hire people in order for them to learn Linux, per se. We hire junior sysadmins who already have at least a home lab level of experience there -- a standard interview request is to describe a disaster that you caused, what went wrong, how you solved it, and what you could have done to prevent it and what you did do differently afterwards.
  - sneak 4y ago
    Another good feature of this policy is that it rules out people who explicitly identify themselves as "$OPERATING_SYSTEM user"s. Tying your identity (personal or professional) to some proprietary software brand is a little silly.
    - celdon25 4y ago
      There are plenty of good developers who haven’t had the time to become masters at multiple operating systems yet. In this economy, it’s better to stick with what you know well.
    - 4y ago
Halan 4y ago
I am curious about the M1 max for the top performing configuration, wonder if there is a business need for it over an M1 pro with the same storage and memory. Especially since they are mentioning the few hundred dollars a windows pro licence would cost as a reason not to get windows laptops.
- mwint 4y ago
  I bought an M1 Max for the extra displays support, and the 64gb RAM support. Not that I need 64g, that was more because I found a decent deal on one that happened to be 64g. But I sure don’t complain about it :)
  - Halan 4y ago
    Good point for the extra displays but in this case they are using only 32gb which makes it a bit overkill unless they do video editing work
    - mobiuscog 4y ago
      Or they use docker for mac
      - Halan 4y ago
        Exactly, is hard to get really high memory usage pressure with 32gb and only by running containers with docker for mac latest engine. Sure, it would try grab as many GB as you set in its configuration but you won’t actually get high memory usage unless running something like a dozen of KinD clusters with worker nodes all at the same time
      - mwint 4y ago
        I run Docker for Mac with like 10 MariaDB and Redis containers, no memory issues. I limit Docker to 8GB and see no problems.
    - baal80spam 4y ago
      Docker will eat this 32GB for breakfast.
seydor 4y ago
> Due to MacOs' dominance in GitLab, it is now most targetted by MacOs spyware, viruses, and ransomware who wish to steal corporate secrets.
- leeter 4y ago
  This is why I find this policy ironic and silly. MacOS is the largest target of choice for bad actors as late because the ratio of high value/low chance of rejection users have migrated to Mac over the past few years because of the whole "Macs are safer" myth. To the point that an exploit for MacOS goes for a lot more money not because they are all that rare but because the value of the targets is greater. MacOS CVE details as late: https://www.cvedetails.com/vulnerability-list/vendor_id-49/product_id-156/Apple-Mac-Os-X.html https://www.cvedetails.com/vulnerability-list/vendor_id-49/p... Windows: https://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-32238/version_id-677478/Microsoft-Windows-10-21h2.html https://www.cvedetails.com/vulnerability-list/vendor_id-26/p... Note how the windows ones are more up to date and patched faster? That's because Mac only does major updates on a cycle and doesn't patch out of band ever if they can avoid it. So yeah I think this is all theater and people's own biases being silly. But if it works for them then that's fine.
  - ziddoap 4y ago
    >MacOS is the largest target of choice for bad actors as late I work in cybersec and am in daily contact with a few threat analysts. Not one of them has said this or believes this. Do you have some reputable source that can confirm this, or is this just a feeling you have? >Note how the windows ones are more up to date and patched faster? The presence of, frequency of, and patching of CVEs has very little relation to real-life attack frequency and targets. People are still getting owned by EternalBlue on unpatched machines from 5 years ago, doesn't matter how fast the patch is released if people aren't applying it. >That's because Mac only does major updates on a cycle and doesn't patch out of band ever Same with Windows. Heard of Patch Tuesday? The regular cycle of once per month that Windows does updates? They avoid releasing updates on other days unless it is high severity and there is evidence of active exploitation, and when they do out-of-band security updates it's almost always covered in some media and/or CISA releases because out-of-band updates are noteworthy.
gizmo 4y ago
The pretext for banning Windows is comically bad. Paying extra for Mac hardware is perfectly fine (no, encouraged!), but paying $100 or so to upgrade Windows Home to Windows Professional is prohibitively expensive? That's such a joke. I have no trouble with companies mandating one OS or the other. But when the justification for the policy is so bad it looks petty and ideological as opposed to the result of a level-headed cost/benefit analysis.
- nazgulsenpai 4y ago
  What if they're worried about the telemetry that would be going to their biggest direct competitor? Not a defense, just a curious thought.
  - unnouinceput 4y ago
    Telemetry can be turned off. You can do it at org level, at department level, or individually. Use WPD, best tool for this.
    - switch007 4y ago
      To be clear, you're saying there is a way to prevent _any_ and _all_ data about the device and its usage ever being sent to MSFT? And it won't be overridden by Windows updates or any nonsense like that?
      - unnouinceput 4y ago
        yes to 1st part, no to 2nd part. after update re-run WPD, and if anything was enabled, do disable it. Takes 2 minutes.
- nix23 4y ago
  And make a screenshot to verify that you encrypted your disk ;)))) The lost art of (fleet-)administration.
- pessimizer 4y ago
jchw 4y ago
This is not actually that unusual; in fact, if I'm not misremembering, Google also does not generally allow Windows, aside from some limited, less privileged stuff.
- ShakataGaNai 4y ago
  IIRC Apple is the same way. It requires extremely special dispensation to even get a Windows VM (ex: iTunes & Safari on Windows groups). It's not uncommon at all, to be honest. I've done IT at startups where we said "Mac Only". Why? Because supporting multiple platforms is a lot of work. You need to do everything twice. All the software security done twice (and differently for each). Rolling out something new to the employee base? Two different sets of instructions. Setting up conference rooms with power bricks and video adapters? Had to be done twice (though this was a while ago, that is less of an issue now). For small teams, it's just a workload that may not be doable. It's not like someone in IT says "I hate Windows, we're going to go Apple only", but often times a "Well, we're 90% Mac already, lets stick to just that". And yes, even with the "Apple Tax" its still overall cheaper to buy/support just macs.
- nunez 4y ago
  Yep; you basically cannot fully enforce a moratorium on Windows without seriously pissing off finance (Excel on Mac is a joke, and Excel Online can't run macros, which is 98% of the value behind Excel)
  - trelane 4y ago
    in what way is excel on Mac a joke? I don't use Excel (greatly prefer to own my data, so use LibreOffice) so I really have no idea. :)
pjmlp 4y ago
I guess Gitlab doesn't care about having customers that work on Windows platforms. Meanwhile Github works just great for us.
- josephcsible 4y ago
  You don't need Windows to build Web apps that run on it.
  - pjmlp 4y ago
    - detaro 4y ago
      except they do.
      - pjmlp 4y ago
        I wonder how, when Windows isn't allowed. Must be some special Pixie dust.
        detaro 4y ago
        Unsurprisingly, they don't run CI on developer laptops, which the linked page is about.
        pjmlp 4y ago
        So their developers do indeed use Pixie dust when debugging Windows build pipelines and compilers.
        detaro 4y ago
        Virtual machines aren't that magic I'd say, but sure, if you think they are pixie dust, then I guess its pixie dust...
rr888 4y ago
Most x86 hardware comes with Windows license already. If build your own, I bought a Windows 11 Pro license last week for $13. Cost shouldn't be an issue.
eminence32 4y ago
I wonder if this has anything to do with the fact that gitlab is fully remote. In an office where you have on-site IT staff, and a local corporate LAN, you can require every windows machine to be part of AD, have group security policies pushed out, and generally have tools available for central management. But with gitlab, everyone is working in their own networks around the world. That sounds like a very hard environment in which to globally apply the types of security policies that are needed to keep Windows secure.
- nix23 4y ago
  >But with gitlab, everyone is working in their own networks around the world. VPN? You know like dial in into your lan?...the original use-case for vpn's?
- Xylakant 4y ago
  Mobile device management is the topic. You can manage windows devices remotely, just as you can manage MacOS devices. No need for them to check in. It „just“ takes some effort, and if you have multiple operating systems to support, the effort is multiplied. But a company of their market cap and size probably should have the funds for a team dedicated to this.
  - unixfg 4y ago
    BYOD certainly has its problems, but it doesn't seem like they're even trying. "To provide proof of Full Disk Encryption, please do the following depending on the system you are running..." Having your users send you a screenshot to verify device compliance is ridiculous.
    - nikau 4y ago
      Yeah its impossible, they can't meet the audit industry gold standard of the windows clock in the screenshot to validate its authenticity.
- MattGaiser 4y ago
  Don’t they have software like Intune for this purpose?
polskibus 4y ago
How do they develop and test the gitlab runner for Windows then?
- Tajnymag 4y ago
  In a VM.
  - davidmichael 4y ago
    Wouldn't they still have the same licensing issues then? Maybe this is just a workstation issue and they still allow/support some Windows server OSes.
Havoc 4y ago
Doesn’t seem unreasonable. My work is entirely windows cause workload is primarily MS office Whatever works. There isn’t some sort of diversity and inclusion requirement for OSs
- MattGaiser 4y ago
  People would have accepted this reasoning had they claimed it.
- jareds 4y ago
  There may not be a "diversity and inclusion" requirement, but I wonder if using an alternative OS could be considered reasonable accommodations in disability law? I'm totally blind and interviewed at a startup and when I told them I needed a Windows machine for accessibility reasons they decided it wasn't worth having me do the take-home coding project. At that point I decided if they were going to refuse to make what I consider a reasonable accommodation I'm glad I found out before wasting time on a take-home project. If the job was IOS development, then they'd have a point, but it was all back-end work that could just as easily be done with WSL under Windows as Mac OS.
marcodiego 4y ago
> Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware. Consider linux dominance on end-users devices through android and embedded systems like smart tv's. There are more instances of linux running and being used right now by end-users than windows. UNIX legacy and a long maturation process on HPC and servers probably has to do with how linux systems evolved to be so secure today compared to windows; also because of "bad-habits" windows historically brings. It may sound cheesy and although I'd like to see linux more used on the desktop, I'm pretty happy with the current situation.
politelemon 4y ago
> Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware. This is poor reasoning and a misunderstanding of how security works. Any org should be happy with any OS, as long as sufficient security controls for it exist. Anyone who oversees Windows estates, or works in desktop security, can tell you that they exist and are extensive, and are effective. I suspect this is a policy that's been pushed out by a C-level who simply hates Windows but is being justified with >15 year old reasonings. > macOS is preinstalled on Apple computers and Linux is available free of charge. To approve the use of Windows, GitLab would have to purchase Windows Professional licenses, as Windows Home Edition does not satisfy GitLab's security guidelines. More tenuous reasoning - macOS is not 'free'. By their logic they should _only_ be allowing Linux. But I think that just tells us it isn't driven by logic.
- jaywalk 4y ago
  I think there's a good bit of simple butthurt behind it as well, seeing as Microsoft owns their biggest (and far larger) competitor.
  - mc32 4y ago
    This is probably key. They probably will be avoiding O365 in favor of the other dominant office SaaS solution.
  - sneak 4y ago
    I mean, Windows has a ton of telemetry and spyware in it. It does not make any sense at all to run spyware from your largest competitor inside your competing business. That's nothing to do with "butthurt".
  - lbotos 4y ago
    Heh. So, no, it was always a Mac/Linux place and around 2019 is when the team grew large enough that some new hires asked if they could get a Windows machine. That's when it was written down: https://gitlab.com/gitlab-com/www-gitlab-com/-/commit/3a47ffa6c1d2dba2a8918e806892a0dfe113a418 https://gitlab.com/gitlab-com/www-gitlab-com/-/commit/3a47ff... This was after the GitHub acquisition but I know for a fact there was one engineer who really wanted a Windows machine but IT was not interested in adding it to the fleet as we were already heavily Mac/Linux. (Source: I work there.)
ansible 4y ago
From the Gitlab approved hardware list, today I learned that Dell has some 15.6in screen laptops that don't have a numeric keypad: https://www.dell.com/en-us/work/shop/laptops/new-15-5560-workstation/spd/precision-15-5560-laptop/xctop556015us_vp https://www.dell.com/en-us/work/shop/laptops/new-15-5560-wor... Also supports ECC, nice! I strongly dislike numeric keypads in general, and especially on a laptop. I want to be centered on the display, not shoved to the side. I only rarely use the numeric keypad.
- mmcnl 4y ago
  I had a 15" Inspiron 15R SE almost 10 years ago, I loved that it had a big screen without a numpad.
  - ansible 4y ago
    2015 / 2016 I bought the original HP Omen gaming laptop because it didn't have a numeric keypad. There weren't a lot of other choices in the 15.6in category.
mandeepj 4y ago
> Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware. Seriously? Microsoft is not sitting idle and let them create havoc. >a remote employee would typically be making a purchase of a laptop pre-loaded with Windows Home Edition How hard is it for them to mandate a Windows Pro edition?
Mikeb85 4y ago
I mean, they use Rails, and Ruby/Rails are annoying to use on Windows. I imagine Windows is a massive headache not worth dealing with considering their stack...
- lukaszkups 4y ago
  I think WSL solves that problem
- therealasdf 4y ago
  Even with WSL2?
  - Mikeb85 4y ago
    Or you can just use the hardware the employer is paying for, plus paying you to use...
stillbourne 4y ago
I run docker desktop on my windows machine which I have setup for k8s and have gitlab running as a helm deployment. What's wrong with having windows but using WSL for dev work. That's how most of my flow works, I installed gitlab this way because I want to learn its cicd stuff without having to rely on the work instance or gitlab.com. I prefer selfhosting.
Kukumber 4y ago
Same for me How i use windows (when i REALLY need it, it's rare nowadays): - in a VM, behind a firewall, with a linux host I maintain a minimal image, and i copy it whenever i use it, and i throw it once i finish using the VM And you can even play your favorite games using that technique, KVM/GPU passthrough to the rescue https://www.youtube.com/watch?v=h7SG7ccjn-g https://www.youtube.com/watch?v=h7SG7ccjn-g
jaclaz 4y ago
Reading further on the page, the "Laptop Repair" part is interesting : >If your laptop is broken and needs to be repaired you can take it into an Apple repair store. You should ensure that you have a recent backup before doing so, and that your laptop is not your only registered device for iCloud two-factor authentication. >If the repair is not going to be too expensive (more than $1000 dollars USD), go ahead and repair and expense. If the repair is going to take longer than a day then you need to make sure you have a back up laptop to work on that is non-Windows. It seems like you need to have TWO Apple devices, to be on the safe side...
- prmoustache 4y ago
  No you can just buy another one on the spot if repair lead time is too long.
- Xylakant 4y ago
  That‘s very funny since almost all repairs on apple devices that I‘ve seen took longer than a day. Apple had [1] some very funky policies about shipping spare parts that essentially required the repair shop to have the laptop on their workbench before ordering the spares. [1] or even still has, it‘s been a while
  - rubslopes 4y ago
    That's was my experience while trying to replace a battery. I proposed to pay in advance and only leave it there for the swap, but they can only order the battery if I hand over the macbook. Moreover, where I live they take at least a week to give your computer back for a simple battery swap. I ended up giving up.
- switch007 4y ago
  And you need to have an appropriate Time Machine backup target...
grumple 4y ago
This is bad reasoning. > Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware. Being targeted less frequently != more secure. MacOS and Safari have had plenty of critical vulnerabilities in recent years. > macOS is preinstalled on Apple computers and Linux is available free of charge. To approve the use of Windows, GitLab would have to purchase Windows Professional licenses, as Windows Home Edition does not satisfy GitLab's security guidelines. > As many purchases of laptops have occurred with employees making the purchases and then being reimbursed by GitLab, a remote employee would typically be making a purchase of a laptop pre-loaded with Windows Home Edition. Come on. A PC with Windows Pro is going to be way cheaper than a comparable mac. This is just disengenuous. > Windows Home Edition is notoriously hard to secure. Their last point was literally about how they would force users to get Pro, why does this matter? I'd issue a counterpoint: there is far more expertise out there in securing fleets of Windows machines, and I'll guess most corporate Windows systems are more hardened to threats than the typical developer's macbook. The real reason to use Macs is that you get a functional unix-like environment where you don't have to constantly jump through hoops in order to work with Rails. They don't have to fabricate security reasons.
jareds 4y ago
I'll make sure to mark Gitlab off a company I apply at if I look for a new job. I'm totally blind and have been using Windows screen readers for the last 25 years. The switching cost to Mac or Linux appears to be incredibly high. I've attempted to use both and after brief usage was not able to get close to my productivity on Windows. Maybe that would change if they were my only option but I'm not going to risk poor productivity at a new job on that. I focus on back-end development and since WSL came out, I've not run into any situation where I can't do what I need using Windows, WSL, and VS Code.
- deleted 4y ago
  [deleted]
talentedcoin 4y ago
This is idiotic. Gitlab will shell out for MacBooks but not for a copy of Windows Pro?
sylware 4y ago
good start, now interop with noscript/basic (x)html browsers.
deleted 4y ago
[deleted]
smm11 4y ago
Web-based. Reset Windows daily.
dgan 4y ago
This seems in phase with their anti-Microsoft wave riding, which brought many (speculating here) new customers. Interestingly, my employer too uses GitLab, and we too prefer Linux among employees ... so i think targeting is on point
scottydelta 4y ago
> As many purchases of laptops have occurred with employees making the purchases and then being reimbursed by GitLab, a remote employee would typically be making a purchase of a laptop pre-loaded with Windows Home Edition. Windows Home Edition is notoriously hard to secure. This is a totally valid point. Anyone who has worked for big companies know how companies secure systems using security policies which are not available on home edition and tough to setup on Profesional license bought by user. If a user really wants to do something on windows then I am sure they can run it in VirtualBox or VMware on their system.
- 1970-01-01 4y ago
  >Windows Home Edition is notoriously hard to secure. This is bullshit. In Windows 10 Home the Group Policy Editor is removed, and domain-join is not supported, however bulk security changes (i.e. Security Policies) can still be implemented directly to the registry with scripting.
  - scottydelta 4y ago
    >Windows Home Edition is notoriously hard to secure. This is more from the perspective of a company to be able to control the security policies of the system and remotely manage it. In an organization with thousands of people, no one has time to help someone setup custom security policies manually.
gigel82 4y ago
The grapes are sour anyway... /s
j_barbossa 4y ago
> Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware. What a stupid reason is that?! It really sounds like the Head of IT at Gitlab just doesn't like Windows and is doing what he can to find excuses.
cosmiccatnap 4y ago
Using a fork to eat your soup is prohibited at Soups Only (tm) HN: While I agree that eating a soup with a fork is bad, I think the employees should be able to try.
stuckinhell 4y ago
I'm a fan, I'd even ban mac/apple stuff if I could from my place of work. It's clear corporations are seeking more and more intrusive control of our applications both business and personal. A large and popular software vendor we have used for 7 years has approached us recently and wants to charge us a variable amount depending how integral their product is to our business. Now management understands the threat, and we are shifting resources to convert things to FOSS, and build up the software community more.
xtracto 4y ago
Gitlab OpenSource is one of those software that I wish would go the way of LibreOffice/MariaDB: I wish that some foundation took the good open-source part and forked it to implement a real, full, no strings attached open source application.
rosmax_1337 4y ago
I believe: 1) The reasons shown as to why Windows is prohibited are essentially parallel construction. 2) The real reason is because someone has an agenda against Windows and Microsoft. 3) This is quite alright. It might be a net loss in the short term for everyone, but a net win in the long term for everyone. Microsoft has a lot of bad stuff coming their way, for good reason.
- azangru 4y ago
  > Microsoft has a lot of bad stuff coming their way, for good reason. There are several good things that are currently coming out of microsoft: - vscode - typescript - github - npm - edge (at the moment, microsoft at least as strong supporter of PWAs as Google; and possibly even stronger) Windows is probably not one of them.
  - unnouinceput 4y ago
    - github was acquired, not their "invention" - edge and chrome are same stuff under the hood. Firefox is better.
    - azangru 4y ago
      > Firefox is better. Firefox refuses to implement project Fugu's apis. For me, this makes Blink-based browsers better.
  - kevwil 4y ago
    npm is currently a security nightmare, so while it provides a ton of useful functionality it also goes to Gitlab's position on the security of Microsoft products.
glonq 4y ago
Is it wrong that I can visualize the length of neckbeard while reading this?
tasuki 4y ago
Well, I once had a work-provided computer on which I was prohibited from running anything but Microsoft Windows. Serves them well!
cronix 4y ago
We don't want to have to pay for a windows pro license, therefore we will use a generally more expensive machine with a "free" OS?
rkv 4y ago
They create a policy to prevent the use of Windows laptops but they are unable to create a policy to enforce purchasing the correct Operating System?
nunez 4y ago
In this instance, I suspect "prohibited" == "we can still use Windows, but you'd better have a really really REALLY good reason"
nisegami 4y ago
A company forbidding the use of Windows (and more broadly Microsoft products/services) would be a huge green flag to me. I don't even care why. I would miss VS Code though.
- gls2ro 4y ago
  VS Code works on both MacOS and Linux See https://code.visualstudio.com/download https://code.visualstudio.com/download
  - nisegami 4y ago
    That was concerning my bit in parentheses: "more broadly Microsoft products/services".
- trelane 4y ago
  Allowing (especially encouraging?) Linux is a huge green flag for me. I personally don't care if they also allow others to use other OSes. If the company can support the systems and they can interoperate with me, it's fine with me.
- nikau 4y ago
  Going to an anti Microsoft shop sounds good on paper, then you find out garbage like Miro and Confluence is the replacement for office and you change your mind...
asah 4y ago
Google did this 15+ years ago, and while the transition took a couple of years, they never looked back. Productivity shot up for all the usual reasons.
rochak 4y ago
Having to use a Windows laptop for work is the main reason I rejected working for Microsoft. Don’t get me wrong, it’s a great OS, but not for me and I just couldn’t bring myself to using it. I get their logic to have engineers use this, but it was a great dealbreaker for me.
switch007 4y ago
What do their Finance team use? I thought Excel on Mac was basically a toy compared to Windows?
penguin_booze 4y ago
Avoiding Windows operating would be an ethical choice going forward, in my opinion. Windows has become a bloatware; it's a memory hog - no amount of RAM is enough. And to top if off, with every update, your hardware becomes obsolete because it lacks a fancy chip. With Office products being increasingly accessible via the web browser, I think corporations should really start thinking about weaning themselves off Windows.
hd363gvcYf 4y ago
Given Microsoft’s history of severe vulnerabilities, I welcome this news for any company. Apple and Ubuntu have enough popularity and support options making this policy completely supportable. If not Ubuntu, IBM Red Hat seems to be a great alternative as well. At this point it is clear that Microsoft’s monopoly is over.

234 points by filenox 4y ago

"macOS is preinstalled on Apple computers and Linux is available free of charge. To approve the use of Windows, GitLab would have to purchase Windows Professional licenses, as Windows Home Edition does not satisfy GitLab's security guidelines."

PaulHoule 4y ago

It's a fairly odd that that IT cultures are segregated into places that have nothing but Macs and other places that have nothing but Windows. I think it's risky because a small computing monoculture can feel complete but commit a software business to failure at the very beginning by rejecting 90% of the potential market.

ericbarrett 4y ago
Device management becomes much more complicated when you have multiple OSes, though. Unless your company is small enough that self-management remains viable, you have to hire for both Windows and Mac administration experience, and/or shell out a pretty penny for cross-platform "enterprise" device management software.
- Xylakant 4y ago
  They do allow linux though, and I have yet to find a competent device management software that supports Mac, Windows and Linux at the same time (or even Mac and Linux). I‘d be happy to hear recommendations.
  - dijit 4y ago
    What are you looking for? Managing Linux at scale is extremely easy as you can leverage basically all the tooling that sysadmins use(d) for management of infrastructure fleets. You can even get a pretty GUI if it’s saltstack enterprise.
    - nikau 4y ago
      Something like saltstack is not in the same league as point and drool windows solutions.
      - dijit 4y ago
        Is there something you can’t do? Or are you assuming sysadmins don’t learn their tools. Arguably learning the idiosyncracies of proprietary management tools is harder long-term as there are myriads of edge cases and they get replaced with completely new tools quite often. Exceptions are SCCM maybe, but people are avoiding that as much as possible IME.
        nikau 4y ago
        Most Windows compliance tools are seen as a tick in a box so ease of use and low effort deployment is often the most important thing. I'm sure you could achieve similar results with Salt but it will be some bespoke contraption requiring a lot of engineering effort where you cant just hire new staff off the street to maintain it.
        dijit 4y ago
        Tell me what you need and I’ll tell you how hard it is. I’m sure certain things are a tick of a box, with salt it’s usually 3-5 lines of yaml. It’s not like you’re writing a management system by hand in a general purpose programming language.
        nikau 4y ago
        where I work there are controls to block USB media devices, they block certain software publishers (eg. cant run firefox), all sorts of annoying things.
dijit 4y ago
Microsoft ecosystem is really hard to dip a toe into. Properly supporting a handful of machines practically means bringing AzureAD or Exchange. AzureAD brings in elements of Exchange (like outlook), which brings in weird default settings like teams/sharepoint/onedrive. Apple has done a lot of work in supporting Microsoft Exchange, but it's still janky as hell (just browse r/macsysadmin and you'll see). So, you have two choices. 1) support the monoculture, life will be easier. 2) get a bigger IT department. People are happy to spend a boatload of money avoiding the second option, so, monoculture it is.

habnds 4y ago

>> GitLab approves the use of Linux, and Apple's macOS. Microsoft Windows is prohibited for the following reasons: Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware. macOS is preinstalled on Apple computers and Linux is available free of charge. To approve the use of Windows, GitLab would have to purchase Windows Professional licenses, as Windows Home Edition does not satisfy GitLab's security guidelines. As many purchases of laptops have occurred with employees making the purchases and then being reimbursed by GitLab, a remote employee would typically be making a purchase of a laptop pre-loaded with Windows Home Edition. Windows Home Edition is notoriously hard to secure. edit: after thinking about this for a bit, it occurs to me that their main competitor is github and that maybe they just aren't very excited to use MSFT products?

smileybarry 4y ago
You wouldn’t use Home SKUs for enterprises anyway, if you want to apply any policy you need Pro/Enterprise. In the end it’s about GitLab dismissing an entire laptop over a $70 upgrade key, or $200 Pro license.
arkitaip 4y ago
I haven't had problems with viruses, spyware and ransomware on Windows for years. Microsoft's builtin spyware marketed as telemetry and diagnostics otoh is very difficult to counter even with dedicated tools like O&O ShutUp10. I get why companies don't want to risk giving business secrets to Microsoft.
- ziddoap 4y ago
  >I haven't had problems with viruses, spyware and ransomware on Windows for years. That's great and all, but I'm not sure what point you're trying to make. That there isn't a problem of malware/ransomware? Because there certainly is, and for most organizations the risk of malware/ransomware is much more significant than the fact that Windows gets some error reporting and usage statistics and such.

NeutralForest 4y ago

Seems like anyone can use Linux as well as long as you deal with your own support, good for them.

rubicks 4y ago

mickael-kerjean 4y ago
Me too, so many companies enforce windows only with no way to get a linux machine or a mac that it's great to see it playing differently, I can only hope things will change when a new generation who has never used windows will come in the workforce
- Kaze404 4y ago
  I can't say I've never used Windows, but my first machine was Linux and I've been using it since then. This might happen sooner than you think :)

202206241203 4y ago

icedchai 4y ago
I assume this is sarcasm. They are a public company with a multi billion dollar market cap.
- 202206241203 4y ago
  I guess you are right, it looks even worse then... Where is that money even going.
  - icedchai 4y ago
    Employees aren't cheap.

ironmagma 4y ago

This is being posted just a day after this tweet: https://twitter.com/allenholub/status/1555324387087097856 https://twitter.com/allenholub/status/1555324387087097856 I really wonder what it's like inside Gitlab. The product ticks all the boxes you'd want it to, but the user experience just resonates with sadness and misery.

raverbashing 4y ago
This self-description seems to be targeted at PHB that need convincing why their team should use Git
shapefrog 4y ago
To be fair ... they got a lot of middle management catch phrases into that description. Going to be an easy sell to the board.
- ironmagma 4y ago
  There’s something telling about companies that put sales over common sense.
  - shapefrog 4y ago
    The sales team still gets "pro" laptops.
jrochkind1 4y ago
Woah, that tweet led me to: "GitLab plans to automatically delete projects if they've been inactive for a year and are owned by users of its free tier." Which I hadn't heard. That's.... something.
- Etheryte 4y ago
  If I'm not mistaken they rolled this idea back real quick once it leaked and everyone got mad.

horsawlarway 4y ago

I'm no fan of Windows myself, but I find this a fairly bad policy. If nothing else - what's not used is not tested. And if you expect any real population of users to be using Windows machines with your products, you should have developers/PMs/QA/support interacting with your products using Windows machines. I see this as: We're saving a bit of money and making ITs life easier, and in exchange users will get a worse product. Realistically - that's a bad trade. It is almost never the right decision to prioritize IT quality of life over basically any other business need.

wkdneidbwf 4y ago
developers using windows isn’t necessary to test web software on browsers on windows.
salzig 4y ago
Gitlab is essentially a website, and Microsoft Edge is just Chrome. I think there isn't any reason to test on windows anymore.
- commandlinefan 4y ago
  Famous last words.
  - chrisan 4y ago
    There are definitely differences between mac and windows (possibly linux) when it comes to font availability/rendering(maybe?) I've seen more than once a mac design use some font in a light weight that comes across almost invisible on Windows. I'm the only windows guy at our shop and "everyone has access to windows VMs to test" (lol) Outside of that, now that Edge is on Chromium most of our edge cases seem to be Safari these days (everyone uses chrome/firefox except a couple management using Safari). Which all in all I guess is a testament to our lack of full browser testing :) ¯\_(ツ)_/¯
- horsawlarway 4y ago
  Developing "essentially a website" is my full time job - if you genuinely don't think there are differences between platforms, you aren't paying attention. The browser is wired into the OS in real ways, and they matter. Everything from "How does the os manage passwords" or "how are system notifications presented" or "How much screen real estate do I have have on a given window size (scrollbars...)" to subtle differences in how the network stack behaves, or how windows are rendered. Hell, I can list about 20 differences just off the top of my head - and a damn good part of that is because I've been forced to pay attention to each of those platforms. Which clearly you have not... I read your comment as "I only use a mac, and I don't understand".

bzxcvbn 4y ago

Seems weird to harp on the cost of a windows license when they're buying Mac OS licenses instead (although hidden in the device's prie).

jhickok 4y ago
Although not even hinted at in the doc, I personally find the tedium of buying and provisioning and monitoring licenses worse than the cost of it. I suppose you are also inviting risk in the form of an audit.
- Xylakant 4y ago
  Most windows laptops today come with a license key baked into the BIOS. So no need to manage licenses here.
  - jhickok 4y ago
    I do not believe those are sufficient for enterprise licenses, which must be provided separately.
    - Xylakant 4y ago
      They are sufficient for pro licenses, though, which are what they mention as the required baseline.
    - jaywalk 4y ago
      There's no requirement to purchase an enterprise license. Large companies just do that to save money.
      - trelane 4y ago
        Wait, they buy a second license to save money? How does that work and, more importantly, how can I convince lots of folks to buy my product twice to save money?!
    - 4y ago

dsr_ 4y ago

This is pretty similar to the policy at my company: you get a Mac, unless you specifically request a Linux laptop. If you need Windows for testing, Microsoft makes VM images available with a browser pre-installed at https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/ https://developer.microsoft.com/en-us/microsoft-edge/tools/v...

rlv-dan 4y ago
As a long time Windows user, it would take me a considerable amount of time to get used to the operating system and all applications and utilities that I need to be productive. Not saying Windows is great, but it works for me. And I'm pretty sure they don't hire people to learn an operating system.
- dsr_ 4y ago
  As a long time multiple OS user and administrator, I can assure you that people figure out MacOS in the first two weeks. It's not anywhere near as strange as getting used to git for the first time. We don't hire people in order for them to learn Linux, per se. We hire junior sysadmins who already have at least a home lab level of experience there -- a standard interview request is to describe a disaster that you caused, what went wrong, how you solved it, and what you could have done to prevent it and what you did do differently afterwards.
- sneak 4y ago
  Another good feature of this policy is that it rules out people who explicitly identify themselves as "$OPERATING_SYSTEM user"s. Tying your identity (personal or professional) to some proprietary software brand is a little silly.
  - celdon25 4y ago
    There are plenty of good developers who haven’t had the time to become masters at multiple operating systems yet. In this economy, it’s better to stick with what you know well.
  - 4y ago

Halan 4y ago

I am curious about the M1 max for the top performing configuration, wonder if there is a business need for it over an M1 pro with the same storage and memory. Especially since they are mentioning the few hundred dollars a windows pro licence would cost as a reason not to get windows laptops.

mwint 4y ago
I bought an M1 Max for the extra displays support, and the 64gb RAM support. Not that I need 64g, that was more because I found a decent deal on one that happened to be 64g. But I sure don’t complain about it :)
- Halan 4y ago
  Good point for the extra displays but in this case they are using only 32gb which makes it a bit overkill unless they do video editing work
  - mobiuscog 4y ago
    Or they use docker for mac
    - Halan 4y ago
      Exactly, is hard to get really high memory usage pressure with 32gb and only by running containers with docker for mac latest engine. Sure, it would try grab as many GB as you set in its configuration but you won’t actually get high memory usage unless running something like a dozen of KinD clusters with worker nodes all at the same time
    - mwint 4y ago
      I run Docker for Mac with like 10 MariaDB and Redis containers, no memory issues. I limit Docker to 8GB and see no problems.
  - baal80spam 4y ago
    Docker will eat this 32GB for breakfast.

seydor 4y ago

> Due to MacOs' dominance in GitLab, it is now most targetted by MacOs spyware, viruses, and ransomware who wish to steal corporate secrets.

leeter 4y ago
This is why I find this policy ironic and silly. MacOS is the largest target of choice for bad actors as late because the ratio of high value/low chance of rejection users have migrated to Mac over the past few years because of the whole "Macs are safer" myth. To the point that an exploit for MacOS goes for a lot more money not because they are all that rare but because the value of the targets is greater. MacOS CVE details as late: https://www.cvedetails.com/vulnerability-list/vendor_id-49/product_id-156/Apple-Mac-Os-X.html https://www.cvedetails.com/vulnerability-list/vendor_id-49/p... Windows: https://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-32238/version_id-677478/Microsoft-Windows-10-21h2.html https://www.cvedetails.com/vulnerability-list/vendor_id-26/p... Note how the windows ones are more up to date and patched faster? That's because Mac only does major updates on a cycle and doesn't patch out of band ever if they can avoid it. So yeah I think this is all theater and people's own biases being silly. But if it works for them then that's fine.
- ziddoap 4y ago
  >MacOS is the largest target of choice for bad actors as late I work in cybersec and am in daily contact with a few threat analysts. Not one of them has said this or believes this. Do you have some reputable source that can confirm this, or is this just a feeling you have? >Note how the windows ones are more up to date and patched faster? The presence of, frequency of, and patching of CVEs has very little relation to real-life attack frequency and targets. People are still getting owned by EternalBlue on unpatched machines from 5 years ago, doesn't matter how fast the patch is released if people aren't applying it. >That's because Mac only does major updates on a cycle and doesn't patch out of band ever Same with Windows. Heard of Patch Tuesday? The regular cycle of once per month that Windows does updates? They avoid releasing updates on other days unless it is high severity and there is evidence of active exploitation, and when they do out-of-band security updates it's almost always covered in some media and/or CISA releases because out-of-band updates are noteworthy.

gizmo 4y ago

The pretext for banning Windows is comically bad. Paying extra for Mac hardware is perfectly fine (no, encouraged!), but paying $100 or so to upgrade Windows Home to Windows Professional is prohibitively expensive? That's such a joke. I have no trouble with companies mandating one OS or the other. But when the justification for the policy is so bad it looks petty and ideological as opposed to the result of a level-headed cost/benefit analysis.

nazgulsenpai 4y ago
What if they're worried about the telemetry that would be going to their biggest direct competitor? Not a defense, just a curious thought.
- unnouinceput 4y ago
  Telemetry can be turned off. You can do it at org level, at department level, or individually. Use WPD, best tool for this.
  - switch007 4y ago
    To be clear, you're saying there is a way to prevent _any_ and _all_ data about the device and its usage ever being sent to MSFT? And it won't be overridden by Windows updates or any nonsense like that?
    - unnouinceput 4y ago
      yes to 1st part, no to 2nd part. after update re-run WPD, and if anything was enabled, do disable it. Takes 2 minutes.
nix23 4y ago
And make a screenshot to verify that you encrypted your disk ;)))) The lost art of (fleet-)administration.
pessimizer 4y ago

jchw 4y ago

This is not actually that unusual; in fact, if I'm not misremembering, Google also does not generally allow Windows, aside from some limited, less privileged stuff.

ShakataGaNai 4y ago
IIRC Apple is the same way. It requires extremely special dispensation to even get a Windows VM (ex: iTunes & Safari on Windows groups). It's not uncommon at all, to be honest. I've done IT at startups where we said "Mac Only". Why? Because supporting multiple platforms is a lot of work. You need to do everything twice. All the software security done twice (and differently for each). Rolling out something new to the employee base? Two different sets of instructions. Setting up conference rooms with power bricks and video adapters? Had to be done twice (though this was a while ago, that is less of an issue now). For small teams, it's just a workload that may not be doable. It's not like someone in IT says "I hate Windows, we're going to go Apple only", but often times a "Well, we're 90% Mac already, lets stick to just that". And yes, even with the "Apple Tax" its still overall cheaper to buy/support just macs.
nunez 4y ago
Yep; you basically cannot fully enforce a moratorium on Windows without seriously pissing off finance (Excel on Mac is a joke, and Excel Online can't run macros, which is 98% of the value behind Excel)
- trelane 4y ago
  in what way is excel on Mac a joke? I don't use Excel (greatly prefer to own my data, so use LibreOffice) so I really have no idea. :)

pjmlp 4y ago

I guess Gitlab doesn't care about having customers that work on Windows platforms. Meanwhile Github works just great for us.

josephcsible 4y ago
You don't need Windows to build Web apps that run on it.
- pjmlp 4y ago
  - detaro 4y ago
    except they do.
    - pjmlp 4y ago
      I wonder how, when Windows isn't allowed. Must be some special Pixie dust.
      - detaro 4y ago
        Unsurprisingly, they don't run CI on developer laptops, which the linked page is about.
        pjmlp 4y ago
        So their developers do indeed use Pixie dust when debugging Windows build pipelines and compilers.
        detaro 4y ago
        Virtual machines aren't that magic I'd say, but sure, if you think they are pixie dust, then I guess its pixie dust...

rr888 4y ago

Most x86 hardware comes with Windows license already. If build your own, I bought a Windows 11 Pro license last week for $13. Cost shouldn't be an issue.

eminence32 4y ago

I wonder if this has anything to do with the fact that gitlab is fully remote. In an office where you have on-site IT staff, and a local corporate LAN, you can require every windows machine to be part of AD, have group security policies pushed out, and generally have tools available for central management. But with gitlab, everyone is working in their own networks around the world. That sounds like a very hard environment in which to globally apply the types of security policies that are needed to keep Windows secure.

nix23 4y ago
>But with gitlab, everyone is working in their own networks around the world. VPN? You know like dial in into your lan?...the original use-case for vpn's?
Xylakant 4y ago
Mobile device management is the topic. You can manage windows devices remotely, just as you can manage MacOS devices. No need for them to check in. It „just“ takes some effort, and if you have multiple operating systems to support, the effort is multiplied. But a company of their market cap and size probably should have the funds for a team dedicated to this.
- unixfg 4y ago
  BYOD certainly has its problems, but it doesn't seem like they're even trying. "To provide proof of Full Disk Encryption, please do the following depending on the system you are running..." Having your users send you a screenshot to verify device compliance is ridiculous.
  - nikau 4y ago
    Yeah its impossible, they can't meet the audit industry gold standard of the windows clock in the screenshot to validate its authenticity.
MattGaiser 4y ago
Don’t they have software like Intune for this purpose?

polskibus 4y ago

How do they develop and test the gitlab runner for Windows then?

Tajnymag 4y ago
In a VM.
- davidmichael 4y ago
  Wouldn't they still have the same licensing issues then? Maybe this is just a workstation issue and they still allow/support some Windows server OSes.

Havoc 4y ago

Doesn’t seem unreasonable. My work is entirely windows cause workload is primarily MS office Whatever works. There isn’t some sort of diversity and inclusion requirement for OSs

MattGaiser 4y ago
People would have accepted this reasoning had they claimed it.
jareds 4y ago
There may not be a "diversity and inclusion" requirement, but I wonder if using an alternative OS could be considered reasonable accommodations in disability law? I'm totally blind and interviewed at a startup and when I told them I needed a Windows machine for accessibility reasons they decided it wasn't worth having me do the take-home coding project. At that point I decided if they were going to refuse to make what I consider a reasonable accommodation I'm glad I found out before wasting time on a take-home project. If the job was IOS development, then they'd have a point, but it was all back-end work that could just as easily be done with WSL under Windows as Mac OS.

marcodiego 4y ago

> Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware. Consider linux dominance on end-users devices through android and embedded systems like smart tv's. There are more instances of linux running and being used right now by end-users than windows. UNIX legacy and a long maturation process on HPC and servers probably has to do with how linux systems evolved to be so secure today compared to windows; also because of "bad-habits" windows historically brings. It may sound cheesy and although I'd like to see linux more used on the desktop, I'm pretty happy with the current situation.

politelemon 4y ago

> Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware. This is poor reasoning and a misunderstanding of how security works. Any org should be happy with any OS, as long as sufficient security controls for it exist. Anyone who oversees Windows estates, or works in desktop security, can tell you that they exist and are extensive, and are effective. I suspect this is a policy that's been pushed out by a C-level who simply hates Windows but is being justified with >15 year old reasonings. > macOS is preinstalled on Apple computers and Linux is available free of charge. To approve the use of Windows, GitLab would have to purchase Windows Professional licenses, as Windows Home Edition does not satisfy GitLab's security guidelines. More tenuous reasoning - macOS is not 'free'. By their logic they should _only_ be allowing Linux. But I think that just tells us it isn't driven by logic.

jaywalk 4y ago
I think there's a good bit of simple butthurt behind it as well, seeing as Microsoft owns their biggest (and far larger) competitor.
- mc32 4y ago
  This is probably key. They probably will be avoiding O365 in favor of the other dominant office SaaS solution.
- sneak 4y ago
  I mean, Windows has a ton of telemetry and spyware in it. It does not make any sense at all to run spyware from your largest competitor inside your competing business. That's nothing to do with "butthurt".
- lbotos 4y ago
  Heh. So, no, it was always a Mac/Linux place and around 2019 is when the team grew large enough that some new hires asked if they could get a Windows machine. That's when it was written down: https://gitlab.com/gitlab-com/www-gitlab-com/-/commit/3a47ffa6c1d2dba2a8918e806892a0dfe113a418 https://gitlab.com/gitlab-com/www-gitlab-com/-/commit/3a47ff... This was after the GitHub acquisition but I know for a fact there was one engineer who really wanted a Windows machine but IT was not interested in adding it to the fleet as we were already heavily Mac/Linux. (Source: I work there.)

ansible 4y ago

From the Gitlab approved hardware list, today I learned that Dell has some 15.6in screen laptops that don't have a numeric keypad: https://www.dell.com/en-us/work/shop/laptops/new-15-5560-workstation/spd/precision-15-5560-laptop/xctop556015us_vp https://www.dell.com/en-us/work/shop/laptops/new-15-5560-wor... Also supports ECC, nice! I strongly dislike numeric keypads in general, and especially on a laptop. I want to be centered on the display, not shoved to the side. I only rarely use the numeric keypad.

mmcnl 4y ago
I had a 15" Inspiron 15R SE almost 10 years ago, I loved that it had a big screen without a numpad.
- ansible 4y ago
  2015 / 2016 I bought the original HP Omen gaming laptop because it didn't have a numeric keypad. There weren't a lot of other choices in the 15.6in category.

mandeepj 4y ago

> Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware. Seriously? Microsoft is not sitting idle and let them create havoc. >a remote employee would typically be making a purchase of a laptop pre-loaded with Windows Home Edition How hard is it for them to mandate a Windows Pro edition?

Mikeb85 4y ago

I mean, they use Rails, and Ruby/Rails are annoying to use on Windows. I imagine Windows is a massive headache not worth dealing with considering their stack...

lukaszkups 4y ago
I think WSL solves that problem
therealasdf 4y ago
Even with WSL2?
- Mikeb85 4y ago
  Or you can just use the hardware the employer is paying for, plus paying you to use...

stillbourne 4y ago

I run docker desktop on my windows machine which I have setup for k8s and have gitlab running as a helm deployment. What's wrong with having windows but using WSL for dev work. That's how most of my flow works, I installed gitlab this way because I want to learn its cicd stuff without having to rely on the work instance or gitlab.com. I prefer selfhosting.

Kukumber 4y ago

Same for me How i use windows (when i REALLY need it, it's rare nowadays): - in a VM, behind a firewall, with a linux host I maintain a minimal image, and i copy it whenever i use it, and i throw it once i finish using the VM And you can even play your favorite games using that technique, KVM/GPU passthrough to the rescue https://www.youtube.com/watch?v=h7SG7ccjn-g https://www.youtube.com/watch?v=h7SG7ccjn-g

jaclaz 4y ago

Reading further on the page, the "Laptop Repair" part is interesting : >If your laptop is broken and needs to be repaired you can take it into an Apple repair store. You should ensure that you have a recent backup before doing so, and that your laptop is not your only registered device for iCloud two-factor authentication. >If the repair is not going to be too expensive (more than $1000 dollars USD), go ahead and repair and expense. If the repair is going to take longer than a day then you need to make sure you have a back up laptop to work on that is non-Windows. It seems like you need to have TWO Apple devices, to be on the safe side...

prmoustache 4y ago
No you can just buy another one on the spot if repair lead time is too long.
Xylakant 4y ago
That‘s very funny since almost all repairs on apple devices that I‘ve seen took longer than a day. Apple had [1] some very funky policies about shipping spare parts that essentially required the repair shop to have the laptop on their workbench before ordering the spares. [1] or even still has, it‘s been a while
- rubslopes 4y ago
  That's was my experience while trying to replace a battery. I proposed to pay in advance and only leave it there for the swap, but they can only order the battery if I hand over the macbook. Moreover, where I live they take at least a week to give your computer back for a simple battery swap. I ended up giving up.
switch007 4y ago
And you need to have an appropriate Time Machine backup target...

grumple 4y ago

This is bad reasoning. > Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware. Being targeted less frequently != more secure. MacOS and Safari have had plenty of critical vulnerabilities in recent years. > macOS is preinstalled on Apple computers and Linux is available free of charge. To approve the use of Windows, GitLab would have to purchase Windows Professional licenses, as Windows Home Edition does not satisfy GitLab's security guidelines. > As many purchases of laptops have occurred with employees making the purchases and then being reimbursed by GitLab, a remote employee would typically be making a purchase of a laptop pre-loaded with Windows Home Edition. Come on. A PC with Windows Pro is going to be way cheaper than a comparable mac. This is just disengenuous. > Windows Home Edition is notoriously hard to secure. Their last point was literally about how they would force users to get Pro, why does this matter? I'd issue a counterpoint: there is far more expertise out there in securing fleets of Windows machines, and I'll guess most corporate Windows systems are more hardened to threats than the typical developer's macbook. The real reason to use Macs is that you get a functional unix-like environment where you don't have to constantly jump through hoops in order to work with Rails. They don't have to fabricate security reasons.

jareds 4y ago

I'll make sure to mark Gitlab off a company I apply at if I look for a new job. I'm totally blind and have been using Windows screen readers for the last 25 years. The switching cost to Mac or Linux appears to be incredibly high. I've attempted to use both and after brief usage was not able to get close to my productivity on Windows. Maybe that would change if they were my only option but I'm not going to risk poor productivity at a new job on that. I focus on back-end development and since WSL came out, I've not run into any situation where I can't do what I need using Windows, WSL, and VS Code.

deleted 4y ago
[deleted]

talentedcoin 4y ago

This is idiotic. Gitlab will shell out for MacBooks but not for a copy of Windows Pro?

sylware 4y ago

good start, now interop with noscript/basic (x)html browsers.

deleted 4y ago

[deleted]

smm11 4y ago

Web-based. Reset Windows daily.

dgan 4y ago

This seems in phase with their anti-Microsoft wave riding, which brought many (speculating here) new customers. Interestingly, my employer too uses GitLab, and we too prefer Linux among employees ... so i think targeting is on point

scottydelta 4y ago

> As many purchases of laptops have occurred with employees making the purchases and then being reimbursed by GitLab, a remote employee would typically be making a purchase of a laptop pre-loaded with Windows Home Edition. Windows Home Edition is notoriously hard to secure. This is a totally valid point. Anyone who has worked for big companies know how companies secure systems using security policies which are not available on home edition and tough to setup on Profesional license bought by user. If a user really wants to do something on windows then I am sure they can run it in VirtualBox or VMware on their system.

1970-01-01 4y ago
>Windows Home Edition is notoriously hard to secure. This is bullshit. In Windows 10 Home the Group Policy Editor is removed, and domain-join is not supported, however bulk security changes (i.e. Security Policies) can still be implemented directly to the registry with scripting.
- scottydelta 4y ago
  >Windows Home Edition is notoriously hard to secure. This is more from the perspective of a company to be able to control the security policies of the system and remotely manage it. In an organization with thousands of people, no one has time to help someone setup custom security policies manually.

gigel82 4y ago

The grapes are sour anyway... /s

j_barbossa 4y ago

> Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware. What a stupid reason is that?! It really sounds like the Head of IT at Gitlab just doesn't like Windows and is doing what he can to find excuses.

cosmiccatnap 4y ago

Using a fork to eat your soup is prohibited at Soups Only (tm) HN: While I agree that eating a soup with a fork is bad, I think the employees should be able to try.

stuckinhell 4y ago

I'm a fan, I'd even ban mac/apple stuff if I could from my place of work. It's clear corporations are seeking more and more intrusive control of our applications both business and personal. A large and popular software vendor we have used for 7 years has approached us recently and wants to charge us a variable amount depending how integral their product is to our business. Now management understands the threat, and we are shifting resources to convert things to FOSS, and build up the software community more.

xtracto 4y ago

Gitlab OpenSource is one of those software that I wish would go the way of LibreOffice/MariaDB: I wish that some foundation took the good open-source part and forked it to implement a real, full, no strings attached open source application.

rosmax_1337 4y ago

I believe: 1) The reasons shown as to why Windows is prohibited are essentially parallel construction. 2) The real reason is because someone has an agenda against Windows and Microsoft. 3) This is quite alright. It might be a net loss in the short term for everyone, but a net win in the long term for everyone. Microsoft has a lot of bad stuff coming their way, for good reason.

azangru 4y ago
> Microsoft has a lot of bad stuff coming their way, for good reason. There are several good things that are currently coming out of microsoft: - vscode - typescript - github - npm - edge (at the moment, microsoft at least as strong supporter of PWAs as Google; and possibly even stronger) Windows is probably not one of them.
- unnouinceput 4y ago
  - github was acquired, not their "invention" - edge and chrome are same stuff under the hood. Firefox is better.
  - azangru 4y ago
    > Firefox is better. Firefox refuses to implement project Fugu's apis. For me, this makes Blink-based browsers better.
- kevwil 4y ago
  npm is currently a security nightmare, so while it provides a ton of useful functionality it also goes to Gitlab's position on the security of Microsoft products.

glonq 4y ago

Is it wrong that I can visualize the length of neckbeard while reading this?

tasuki 4y ago

Well, I once had a work-provided computer on which I was prohibited from running anything but Microsoft Windows. Serves them well!

cronix 4y ago

We don't want to have to pay for a windows pro license, therefore we will use a generally more expensive machine with a "free" OS?

rkv 4y ago

They create a policy to prevent the use of Windows laptops but they are unable to create a policy to enforce purchasing the correct Operating System?

nunez 4y ago

In this instance, I suspect "prohibited" == "we can still use Windows, but you'd better have a really really REALLY good reason"

nisegami 4y ago

A company forbidding the use of Windows (and more broadly Microsoft products/services) would be a huge green flag to me. I don't even care why. I would miss VS Code though.

gls2ro 4y ago
VS Code works on both MacOS and Linux See https://code.visualstudio.com/download https://code.visualstudio.com/download
- nisegami 4y ago
  That was concerning my bit in parentheses: "more broadly Microsoft products/services".
trelane 4y ago
Allowing (especially encouraging?) Linux is a huge green flag for me. I personally don't care if they also allow others to use other OSes. If the company can support the systems and they can interoperate with me, it's fine with me.
nikau 4y ago
Going to an anti Microsoft shop sounds good on paper, then you find out garbage like Miro and Confluence is the replacement for office and you change your mind...

asah 4y ago

Google did this 15+ years ago, and while the transition took a couple of years, they never looked back. Productivity shot up for all the usual reasons.

rochak 4y ago

Having to use a Windows laptop for work is the main reason I rejected working for Microsoft. Don’t get me wrong, it’s a great OS, but not for me and I just couldn’t bring myself to using it. I get their logic to have engineers use this, but it was a great dealbreaker for me.

switch007 4y ago

What do their Finance team use? I thought Excel on Mac was basically a toy compared to Windows?

penguin_booze 4y ago

Avoiding Windows operating would be an ethical choice going forward, in my opinion. Windows has become a bloatware; it's a memory hog - no amount of RAM is enough. And to top if off, with every update, your hardware becomes obsolete because it lacks a fancy chip. With Office products being increasingly accessible via the web browser, I think corporations should really start thinking about weaning themselves off Windows.

hd363gvcYf 4y ago

Given Microsoft’s history of severe vulnerabilities, I welcome this news for any company. Apple and Ubuntu have enough popularity and support options making this policy completely supportable. If not Ubuntu, IBM Red Hat seems to be a great alternative as well. At this point it is clear that Microsoft’s monopoly is over.