6 ms·

>> GitLab approves the use of Linux, and Apple's macOS. Microsoft Windows is prohibited for the following reasons: Due to Microsoft Windows' dominance in d

by habnds 4y ago

>> GitLab approves the use of Linux, and Apple's macOS. Microsoft Windows is prohibited for the following reasons: Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware. macOS is preinstalled on Apple computers and Linux is available free of charge. To approve the use of Windows, GitLab would have to purchase Windows Professional licenses, as Windows Home Edition does not satisfy GitLab's security guidelines. As many purchases of laptops have occurred with employees making the purchases and then being reimbursed by GitLab, a remote employee would typically be making a purchase of a laptop pre-loaded with Windows Home Edition. Windows Home Edition is notoriously hard to secure. edit: after thinking about this for a bit, it occurs to me that their main competitor is github and that maybe they just aren't very excited to use MSFT products?

smileybarry 4y ago
You wouldn’t use Home SKUs for enterprises anyway, if you want to apply any policy you need Pro/Enterprise. In the end it’s about GitLab dismissing an entire laptop over a $70 upgrade key, or $200 Pro license.
arkitaip 4y ago
I haven't had problems with viruses, spyware and ransomware on Windows for years. Microsoft's builtin spyware marketed as telemetry and diagnostics otoh is very difficult to counter even with dedicated tools like O&O ShutUp10. I get why companies don't want to risk giving business secrets to Microsoft.
- ziddoap 4y ago
  >I haven't had problems with viruses, spyware and ransomware on Windows for years. That's great and all, but I'm not sure what point you're trying to make. That there isn't a problem of malware/ransomware? Because there certainly is, and for most organizations the risk of malware/ransomware is much more significant than the fact that Windows gets some error reporting and usage statistics and such.
  - trelane 4y ago
    Having such a supermajority of desktop operating systems in use means you get most of the developer attention. Unfortunately, it seems to surprise folks that malware also has developers responding to the overall market conditions. Microsoft is certainly doing their best to mitigate the negative consequences of the monoculture, but it remains a fact and an issue. Just like in biological systems, diversity in software is also critically important for the health of the population.
- 101008 4y ago
  Hey, quick question. I have been the same for years, using Windows without any problems (at least that I know of!). But soon I will have to go to the offices of the startup that I work for (I work remotely) and they all use Mac, and I am a bit worried if they start asking question about how I keep my computer secure. Anyone (not only parent author) can recommend something? A software to install or anything like that?
Xylakant 4y ago
I‘m a bit surprised that they care about the cost so much - the Dell laptops and the Apple Laptops come in at a price point of 2000 - 3000 USD and the Dell they specifically recommend for Linux use comes with Windows Pro preinstalled. The price difference to the equivalent Linux version is around 70USD. That‘s a negligible difference, especially when you start comparing to the employees wage (It‘s probably about 1 hour of their time, one-time cost) If they‘d make the point based on lack of internal support capacity, I‘d understand, but caring about the one-time cost of the license is a very weak point.
- mikeryan 4y ago
  Where did they mention cost concerns? I’m reading this that it’s an IT/procurement hassle dealing with the Windows Pro upgrade licenses, on a platform they don’t feel is secure, not a cost issue.
  - jaywalk 4y ago
    Any laptop above the absolute bottom tier can be purchased with a pre-installed Windows Professional license. It's a complete non-issue.
  - Xylakant 4y ago
    The linux laptop they propose comes by default with an included Pro license, home edition would need to be selected extra. I haven‘t used Dell in a while, but I‘d assume that it behave like Lenovo and has the License Key baked right into the EFI, so there‘s literally no need to deal with any upgrade license if you proscribe which Laptop Model people are allowed to purchase (which they do) They also mention multiple times that Linux and MacOS are free, as opposed to Windows Pro - which can reasonably be read as „we don’t want to spend money here“, since otherwise you could just strike these arguments and revert to „we don‘t believe Windows Pro is secure“, which incidentally they never say.
    - mananaysiempre 4y ago
      They specifically mention Dell laptops with Ubuntu preinstalled.
eixiepia 4y ago
>> [..] Windows is the platform most targetted by spyware, viruses, and ransomware. Neither spyware, virus or ransomware has slowed my computer to a halt as much as using GitLab.
ReptileMan 4y ago
Isn't that a case of the wetware that procures the laptops being not quite on the samepage, especially for someone working in geared towards developers company. A buy something with windows pro is not hard to communicate...
celdon25 4y ago
> Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware. That may be true, but a much higher proportion of downloaded Mac software lacks code signing. Opting in to that as a developer on the Mac will carry a lot of risk of kafkaesque deactivation and, and most don’t want to deal with that. On Windows, on the other hand, it’s like getting an SSL certificate. Apple’s philosophy on the developer program is antiquated, obsolete, and has compromised the security of the platform. How many Mac users do you think limit themselves to only signed apps? It’s much easier to do this on Windows (but requires a small amount of technical understanding, or is it too much for Gitlab employees?). But when you enforce the policy at the corporate domain level, you won’t be neutering the machine’s usefulness as you would on the Mac. Unsigned apps on Windows tend to be the janky ones, while the signed apps found on the Apple Store tend to be garbage in my experience. Relying on “less malware is created for Mac” is a terrible idea in general. This isn’t the 90’s. When you are Gitlab, a high value target for sophisticated, targeted attacks, that won’t help you. Good Security is a balancing act between safety and convenience, and Apple gets it completely wrong. Therefore I would be very cautious about trusting Gitlab’s security posture given their apparent ignorance on the subject. From https://developer.apple.com/support/certificates/ https://developer.apple.com/support/certificates/ > If your certificate expires, users can no longer launch installer packages for your Mac applications that were signed with this certificate. > Apple Developer Program membership is required to request, download, and use signing certificates issued by Apple. > Note: Apple can revoke digital certificates at any time at its sole discretion. For more information, read the Apple Developer Program License Agreement in your developer account. … and many paragraphs detailing what parts of your app will break when certificates are revoked. There are more nuances involved than I care to list in full here, though I’d be happy to be proven wrong about this.
- awinder 4y ago
  I can’t remember the last time I allowed an unsigned app to run on Mac, I can’t even think of examples recently where I’ve gone “oh **, this thing is unsigned?!”. I’d love examples of high quality apps without a basic codesigned certificate, maybe we have a disagreement over the term “quality”. “App Store apps are garbage” is also kinda rich, it’s not windows, the Mac App Store is the go-to source for distributing Mac apps at this point. There’s some examples of popular apps not on the MAS but they grow fewer by the year.
marcosdumay 4y ago
All of the reasons are perfectly valid. Just not extremely relevant. Normally any company looking at that level of operational detail has a problem. But on their case, yes, it's probably because Windows comes from their competitor. Adding a bunch of work, costs, and risk to yourself that will only benefit your competitor does not feel good. No matter how relevant are the work, costs, and risk.
1970-01-01 4y ago
So they banned a wildly popular OS because it does not satisfy their security guidelines. I just checked, they have no guidelines for securing Windows. So you can't satisfy their Windows security guidelines because the guidelines for securing Windows were never written. What a joke.
- trelane 4y ago
  > So they banned a wildly popular OS because it does not satisfy their security guidelines. I think banning Linux and Mac for those reasons is much more common, really.
yuhong 4y ago
I wonder if the main concern is buying Windows licenses via volume licensing and paying for Software Assurance.

by habnds 4y ago

smileybarry 4y ago

You wouldn’t use Home SKUs for enterprises anyway, if you want to apply any policy you need Pro/Enterprise. In the end it’s about GitLab dismissing an entire laptop over a $70 upgrade key, or $200 Pro license.

arkitaip 4y ago

I haven't had problems with viruses, spyware and ransomware on Windows for years. Microsoft's builtin spyware marketed as telemetry and diagnostics otoh is very difficult to counter even with dedicated tools like O&O ShutUp10. I get why companies don't want to risk giving business secrets to Microsoft.

ziddoap 4y ago
>I haven't had problems with viruses, spyware and ransomware on Windows for years. That's great and all, but I'm not sure what point you're trying to make. That there isn't a problem of malware/ransomware? Because there certainly is, and for most organizations the risk of malware/ransomware is much more significant than the fact that Windows gets some error reporting and usage statistics and such.
- trelane 4y ago
  Having such a supermajority of desktop operating systems in use means you get most of the developer attention. Unfortunately, it seems to surprise folks that malware also has developers responding to the overall market conditions. Microsoft is certainly doing their best to mitigate the negative consequences of the monoculture, but it remains a fact and an issue. Just like in biological systems, diversity in software is also critically important for the health of the population.
101008 4y ago
Hey, quick question. I have been the same for years, using Windows without any problems (at least that I know of!). But soon I will have to go to the offices of the startup that I work for (I work remotely) and they all use Mac, and I am a bit worried if they start asking question about how I keep my computer secure. Anyone (not only parent author) can recommend something? A software to install or anything like that?

Xylakant 4y ago

I‘m a bit surprised that they care about the cost so much - the Dell laptops and the Apple Laptops come in at a price point of 2000 - 3000 USD and the Dell they specifically recommend for Linux use comes with Windows Pro preinstalled. The price difference to the equivalent Linux version is around 70USD. That‘s a negligible difference, especially when you start comparing to the employees wage (It‘s probably about 1 hour of their time, one-time cost) If they‘d make the point based on lack of internal support capacity, I‘d understand, but caring about the one-time cost of the license is a very weak point.

mikeryan 4y ago
Where did they mention cost concerns? I’m reading this that it’s an IT/procurement hassle dealing with the Windows Pro upgrade licenses, on a platform they don’t feel is secure, not a cost issue.
- jaywalk 4y ago
  Any laptop above the absolute bottom tier can be purchased with a pre-installed Windows Professional license. It's a complete non-issue.
- Xylakant 4y ago
  The linux laptop they propose comes by default with an included Pro license, home edition would need to be selected extra. I haven‘t used Dell in a while, but I‘d assume that it behave like Lenovo and has the License Key baked right into the EFI, so there‘s literally no need to deal with any upgrade license if you proscribe which Laptop Model people are allowed to purchase (which they do) They also mention multiple times that Linux and MacOS are free, as opposed to Windows Pro - which can reasonably be read as „we don’t want to spend money here“, since otherwise you could just strike these arguments and revert to „we don‘t believe Windows Pro is secure“, which incidentally they never say.
  - mananaysiempre 4y ago
    They specifically mention Dell laptops with Ubuntu preinstalled.

eixiepia 4y ago

>> [..] Windows is the platform most targetted by spyware, viruses, and ransomware. Neither spyware, virus or ransomware has slowed my computer to a halt as much as using GitLab.

ReptileMan 4y ago

Isn't that a case of the wetware that procures the laptops being not quite on the samepage, especially for someone working in geared towards developers company. A buy something with windows pro is not hard to communicate...

celdon25 4y ago

> Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware. That may be true, but a much higher proportion of downloaded Mac software lacks code signing. Opting in to that as a developer on the Mac will carry a lot of risk of kafkaesque deactivation and, and most don’t want to deal with that. On Windows, on the other hand, it’s like getting an SSL certificate. Apple’s philosophy on the developer program is antiquated, obsolete, and has compromised the security of the platform. How many Mac users do you think limit themselves to only signed apps? It’s much easier to do this on Windows (but requires a small amount of technical understanding, or is it too much for Gitlab employees?). But when you enforce the policy at the corporate domain level, you won’t be neutering the machine’s usefulness as you would on the Mac. Unsigned apps on Windows tend to be the janky ones, while the signed apps found on the Apple Store tend to be garbage in my experience. Relying on “less malware is created for Mac” is a terrible idea in general. This isn’t the 90’s. When you are Gitlab, a high value target for sophisticated, targeted attacks, that won’t help you. Good Security is a balancing act between safety and convenience, and Apple gets it completely wrong. Therefore I would be very cautious about trusting Gitlab’s security posture given their apparent ignorance on the subject. From https://developer.apple.com/support/certificates/ https://developer.apple.com/support/certificates/ > If your certificate expires, users can no longer launch installer packages for your Mac applications that were signed with this certificate. > Apple Developer Program membership is required to request, download, and use signing certificates issued by Apple. > Note: Apple can revoke digital certificates at any time at its sole discretion. For more information, read the Apple Developer Program License Agreement in your developer account. … and many paragraphs detailing what parts of your app will break when certificates are revoked. There are more nuances involved than I care to list in full here, though I’d be happy to be proven wrong about this.

awinder 4y ago
I can’t remember the last time I allowed an unsigned app to run on Mac, I can’t even think of examples recently where I’ve gone “oh **, this thing is unsigned?!”. I’d love examples of high quality apps without a basic codesigned certificate, maybe we have a disagreement over the term “quality”. “App Store apps are garbage” is also kinda rich, it’s not windows, the Mac App Store is the go-to source for distributing Mac apps at this point. There’s some examples of popular apps not on the MAS but they grow fewer by the year.

marcosdumay 4y ago

All of the reasons are perfectly valid. Just not extremely relevant. Normally any company looking at that level of operational detail has a problem. But on their case, yes, it's probably because Windows comes from their competitor. Adding a bunch of work, costs, and risk to yourself that will only benefit your competitor does not feel good. No matter how relevant are the work, costs, and risk.

1970-01-01 4y ago

So they banned a wildly popular OS because it does not satisfy their security guidelines. I just checked, they have no guidelines for securing Windows. So you can't satisfy their Windows security guidelines because the guidelines for securing Windows were never written. What a joke.

trelane 4y ago
> So they banned a wildly popular OS because it does not satisfy their security guidelines. I think banning Linux and Mac for those reasons is much more common, really.

yuhong 4y ago

I wonder if the main concern is buying Windows licenses via volume licensing and paying for Software Assurance.