18 ms·

Yeah, the identity side of MS products is really dysfunctional. Every time I try to use teams or azure it ends up in hours of finding out the right procedure to

by theK 4y ago

Yeah, the identity side of MS products is really dysfunctional. Every time I try to use teams or azure it ends up in hours of finding out the right procedure to log in or switch an account effectively. And then you get the people asking naively "why are you getting so mad at them"...

AtlasBarfed 4y ago
This is a buyer beware of some security policies. I just want to point out that this entire described scenario, by a company with decades and decades of security products being shoehorned into "just good enough" cloud infrastructure.... Sure the security folks will say hardened infrastructure with fine grained least privilege is doable ... if you're at greenfield ... maybe. But the issue with lots of IT orgs is that they are MESSY, and fine grained least privilege is fragile. Messy + fragile = not good things. I agree with least privilege as an aspiration, but security is a top-down authoritarian entity in organizations, and fundamentally they don't care if their policies disrupt your daily work process. IMO this is because most security orgs don't provide solutions. Specifically, by solution I do not mean "picked an enterprise security product bam we have a solution", I mean you have a security architecture and then have the people with bandwidth to help boots on ground devs get the job done quickly so security isn't a blocker).
ly3xqhl8g9 4y ago
Solution: run Windows in a VM, one machine per account, nuke it from orbit when-not-if something goes awry. Hundreds of hours of frustration prevented from a system that is not even able to have the same UI across all its windows.
- ccouzens 4y ago
  Or run apps like Teams in a web browser. Web browsers have good isolation techniques like Chrome's profiles and Firefox's containers. Teams is written using web technologies so you're getting the same experience as the app.
  - adamzochowski 4y ago
    This doesn't work perfectly well if you are on multiple calls at the same time. Desktop Teams allows you to join multiple calls at once, and switch between them is easy. Web browser teams disconnects you from one meeting to join another. The only solution is to open multiple browser profiles, each for different call, and then manage the 'mute tab' manually. Additionally, web browser edition has something to detect if tab is active, and will downscale / delay video stream if tab is not active. This is extremely annoying when you have meeting active on one monitor, and want to double check what is being discussed on another. Saying all this, web browser teams at least works. Desktop one stops working because as the whole discussion here points out, accounts get mixed up. I can't join team meetings anonymously because desktop edition thinks I have an account, but when I try to login it tells me my account doesn't have Teams enabled.
  - ly3xqhl8g9 4y ago
    The problem is that Windows 11 and above (try very hard to) require a Microsoft account, because these orcas of computing want to remind you with every step that you don't own the device you bought. Hence it's simpler/better to just virtualize everything. Besides, there is a very satisfactory feeling when something doesn't work for whatever reason, you do a quick search and see that apparently you must edit some awfully named HKEY_LOCAL_MACHINE register or rename some <username>/AppData to .old (just had to do this yesterday, wild), and then, when the quick fix doesn't work, instead of trying to look for more fixes you just give up and start cussing until the VM is restored to a working backup.
    - Strom 4y ago
      > The problem is that Windows 11 and above require a Microsoft account It is not quite a requirement, I have my Windows 11 Pro running just fine with no Microsoft account. They do attempt really hard to make it look like it's required though. Even going as far as showing a fullscreen app after Windows update that only has options for registering or login, but luckily Alt+F4 closes that abomination.
      - 4y ago
- nix23 4y ago
  The real solution is not to use systems who allows that.
  - ly3xqhl8g9 4y ago
    Of course, the problem is that in the last 38 years [1] plenty of programs have been developed for Windows-only, especially when you have to interact with the state [2]: there are still tutorials out there that require you open a website in Internet Explorer (!) if you want to validate a tax form or whatever other trivial task. [1] https://en.wikipedia.org/wiki/Microsoft_Windows_version_history#Windows_1.0 https://en.wikipedia.org/wiki/Microsoft_Windows_version_hist... [2] All the backroom deals for Windows/Office licenses for state-use certainly helped in this regard, https://www.zdnet.com/article/linux-not-windows-why-munich-is-shifting-back-from-microsoft-to-open-source-again https://www.zdnet.com/article/linux-not-windows-why-munich-i...
    - nix23 4y ago
      So you think Azure is the only "cloud"-platform that can run windows? I talked about Azure not an OS, this has nothing todo with Windows, DOS or Xenix.
- nytesky 4y ago
  How do you get an instance of licensed Windows to run within the VM?
  - ly3xqhl8g9 4y ago
    It's a more or less regular install: a quick search [1]. [1] https://geekflare.com/windows-11-in-virtual-box https://geekflare.com/windows-11-in-virtual-box.
- Gud 4y ago
  Even better: Use Wine. I am so tired of running a windows VM.
- theK 4y ago
  Yeah, this would be my preffered way as well. I dont use any MS products any more in my personal life or my own ventures but if I would, that would be the way. But this is not a global cure. This probably will work fine in a household or small business environment but there are tons of reasons why it most probably probably will not work in a corporate environment.
- pizzamig 4y ago
  > Solution: run Windows in a VM, one machine per account, nuke it from orbit when-not-if something goes awry. Hundreds of hours of frustration prevented from a system that is not even able to have the same UI across all its windows. Better solution: don't use M$ product, if you can. Despite the efforts and resources Microsoft spends in improving its products, languages, tools, they are just an enterprise company: very expensive buggy products.
- phpisthebest 4y ago
  Or run FireFox Containers and the browser version of apps... works great for MS Accounts
dustedcodes 4y ago
How do organisations justify so many lost hours of a day where employees just struggle with Microsoft’s abysmal software instead of doing real work.
- pmontra 4y ago
  Because they think that they must use Windows no matter how bad it is.
  - philliphaydon 4y ago
    Windows is no more bad than macOS or any distro of linux.
    - blep_ 4y ago
      > At least my [...] Windows licenses are still working—but could the school revoke that access too? This, at least, is a thing I have never even had to consider as a remote possibility on Linux.
      - philliphaydon 4y ago
        Sure. But every OS has its flaws. They are all good and bad in their own way.
        synecdoche 4y ago
        This statement says next to nothing but may give the impression that it does to anyone who doesn't think twice on what it actually says. OS X and OS Y both have their good and bad sides but not necessarily near similar in terms of features and execution. It's not an argument not should it be used as such.
        philliphaydon 4y ago
        Saying an OS is bad is offering nothing when it’s factually incorrect. It’s not an argument nor should it be used as such.
Meph504 4y ago
They have actually made a lot of improvements to this process recently allowing for multi tenant login in a single browser. If you use firefox, you can use each other the container types to host different login accounts, it makes it easier than switching between private windows and doesn't require you to enable extensions on your private tabs
- dicknuckle 4y ago
  Container tabs with MS and AWS has been a huge help for me at work.

by theK 4y ago

AtlasBarfed 4y ago

This is a buyer beware of some security policies. I just want to point out that this entire described scenario, by a company with decades and decades of security products being shoehorned into "just good enough" cloud infrastructure.... Sure the security folks will say hardened infrastructure with fine grained least privilege is doable ... if you're at greenfield ... maybe. But the issue with lots of IT orgs is that they are MESSY, and fine grained least privilege is fragile. Messy + fragile = not good things. I agree with least privilege as an aspiration, but security is a top-down authoritarian entity in organizations, and fundamentally they don't care if their policies disrupt your daily work process. IMO this is because most security orgs don't provide solutions. Specifically, by solution I do not mean "picked an enterprise security product bam we have a solution", I mean you have a security architecture and then have the people with bandwidth to help boots on ground devs get the job done quickly so security isn't a blocker).

ly3xqhl8g9 4y ago

Solution: run Windows in a VM, one machine per account, nuke it from orbit when-not-if something goes awry. Hundreds of hours of frustration prevented from a system that is not even able to have the same UI across all its windows.

ccouzens 4y ago
Or run apps like Teams in a web browser. Web browsers have good isolation techniques like Chrome's profiles and Firefox's containers. Teams is written using web technologies so you're getting the same experience as the app.
- adamzochowski 4y ago
  This doesn't work perfectly well if you are on multiple calls at the same time. Desktop Teams allows you to join multiple calls at once, and switch between them is easy. Web browser teams disconnects you from one meeting to join another. The only solution is to open multiple browser profiles, each for different call, and then manage the 'mute tab' manually. Additionally, web browser edition has something to detect if tab is active, and will downscale / delay video stream if tab is not active. This is extremely annoying when you have meeting active on one monitor, and want to double check what is being discussed on another. Saying all this, web browser teams at least works. Desktop one stops working because as the whole discussion here points out, accounts get mixed up. I can't join team meetings anonymously because desktop edition thinks I have an account, but when I try to login it tells me my account doesn't have Teams enabled.
- ly3xqhl8g9 4y ago
  The problem is that Windows 11 and above (try very hard to) require a Microsoft account, because these orcas of computing want to remind you with every step that you don't own the device you bought. Hence it's simpler/better to just virtualize everything. Besides, there is a very satisfactory feeling when something doesn't work for whatever reason, you do a quick search and see that apparently you must edit some awfully named HKEY_LOCAL_MACHINE register or rename some <username>/AppData to .old (just had to do this yesterday, wild), and then, when the quick fix doesn't work, instead of trying to look for more fixes you just give up and start cussing until the VM is restored to a working backup.
  - Strom 4y ago
    > The problem is that Windows 11 and above require a Microsoft account It is not quite a requirement, I have my Windows 11 Pro running just fine with no Microsoft account. They do attempt really hard to make it look like it's required though. Even going as far as showing a fullscreen app after Windows update that only has options for registering or login, but luckily Alt+F4 closes that abomination.
    - 4y ago
nix23 4y ago
The real solution is not to use systems who allows that.
- ly3xqhl8g9 4y ago
  Of course, the problem is that in the last 38 years [1] plenty of programs have been developed for Windows-only, especially when you have to interact with the state [2]: there are still tutorials out there that require you open a website in Internet Explorer (!) if you want to validate a tax form or whatever other trivial task. [1] https://en.wikipedia.org/wiki/Microsoft_Windows_version_history#Windows_1.0 https://en.wikipedia.org/wiki/Microsoft_Windows_version_hist... [2] All the backroom deals for Windows/Office licenses for state-use certainly helped in this regard, https://www.zdnet.com/article/linux-not-windows-why-munich-is-shifting-back-from-microsoft-to-open-source-again https://www.zdnet.com/article/linux-not-windows-why-munich-i...
  - nix23 4y ago
    So you think Azure is the only "cloud"-platform that can run windows? I talked about Azure not an OS, this has nothing todo with Windows, DOS or Xenix.
nytesky 4y ago
How do you get an instance of licensed Windows to run within the VM?
- ly3xqhl8g9 4y ago
  It's a more or less regular install: a quick search [1]. [1] https://geekflare.com/windows-11-in-virtual-box https://geekflare.com/windows-11-in-virtual-box.
Gud 4y ago
Even better: Use Wine. I am so tired of running a windows VM.
theK 4y ago
Yeah, this would be my preffered way as well. I dont use any MS products any more in my personal life or my own ventures but if I would, that would be the way. But this is not a global cure. This probably will work fine in a household or small business environment but there are tons of reasons why it most probably probably will not work in a corporate environment.
pizzamig 4y ago
> Solution: run Windows in a VM, one machine per account, nuke it from orbit when-not-if something goes awry. Hundreds of hours of frustration prevented from a system that is not even able to have the same UI across all its windows. Better solution: don't use M$ product, if you can. Despite the efforts and resources Microsoft spends in improving its products, languages, tools, they are just an enterprise company: very expensive buggy products.
phpisthebest 4y ago
Or run FireFox Containers and the browser version of apps... works great for MS Accounts

dustedcodes 4y ago

How do organisations justify so many lost hours of a day where employees just struggle with Microsoft’s abysmal software instead of doing real work.

pmontra 4y ago
Because they think that they must use Windows no matter how bad it is.
- philliphaydon 4y ago
  Windows is no more bad than macOS or any distro of linux.
  - blep_ 4y ago
    > At least my [...] Windows licenses are still working—but could the school revoke that access too? This, at least, is a thing I have never even had to consider as a remote possibility on Linux.
    - philliphaydon 4y ago
      Sure. But every OS has its flaws. They are all good and bad in their own way.
      - synecdoche 4y ago
        This statement says next to nothing but may give the impression that it does to anyone who doesn't think twice on what it actually says. OS X and OS Y both have their good and bad sides but not necessarily near similar in terms of features and execution. It's not an argument not should it be used as such.
        philliphaydon 4y ago
        Saying an OS is bad is offering nothing when it’s factually incorrect. It’s not an argument nor should it be used as such.

Meph504 4y ago

They have actually made a lot of improvements to this process recently allowing for multi tenant login in a single browser. If you use firefox, you can use each other the container types to host different login accounts, it makes it easier than switching between private windows and doesn't require you to enable extensions on your private tabs

dicknuckle 4y ago
Container tabs with MS and AWS has been a huge help for me at work.