7 ms·
This article is missing a key detail: that the expected workflow is that the workstations are basically just build machines. My workstation is just an SSH serv
by danpalmer 3y ago
This article is missing a key detail: that the expected workflow is that the workstations are basically just build machines.
My workstation is just an SSH server that I do builds on, everything else is on my laptop. I can’t remember the last time I used the internet on my workstation. I install packages but those come via a mirror, I scp files back and forth but that’s internal only.
Lots of people aren’t on this workflow yet, but I don’t think anyone is suggesting airgapping the main interface people are using.
- strogonoff 3y agoI wonder if more package management tools should adopt the zero-install approach of Yarn Berry. You don’t even need a mirror: everything is right there in the repository. Want to update a dependency? That’s a commit, thank you very much.
- codetrotter 3y agoI imagine parent commenter meant OS-level packages. I.e. things like installing and updating clang, cmake, etc
- danpalmer 3y agoYep. It's one of the few things I'm doing on my workstation that ostensibly needs the internet, except because of the mirror it also doesn't.
- Jenk 3y agowe do the same. Codespaces, gitpod, or coder.dev all provide for this kind of workflow and honestly it just makes so much sense. Corporate desktop for comms and internet, ssh to a devcontainer (or vm if that is desired) for development activity.
- danpalmer 3y agoExactly. It's really just about isolating builds and code that runs from everything else. If you can afford the infrastructure, and can afford to make the infrastructure work well for everyone (arguably much harder), then it's a good idea with few downsides.
- wffurr 3y agoAll the coverage on this memo has missed this point. I guess they can’t imagine a company giving its employees two computers! You can BYO ChromeOS devices too which make great thin terminals to a remote workstation or cloud VM. I have a whole bunch from dogfooding preproduction Chromebooks.
- danpalmer 3y agoI feel like much of the internal coverage missed the point. There were a lot of people arguing in bad faith, ignoring the fact that the whole idea was clearly tied to the rollout of the particular workflow where no internet would be needed on the machines in question. Most devs still aren't working like that yet, and so pushed back hard.
- deleted 3y ago[deleted]
- lokar 3y agoA bunch of people with admin access used a setup like this for a while shortly after the china hack years ago. It’s not that bad.
- jeffbee 3y agoBy “bunch” you mean the entire SRE org. I felt like it was a good setup, but I also felt that the long-term strategy of reducing the access necessary to operate the infrastructure was a good one. But why not both, as the child in the meme asks?
- lokar 3y agoFar from all, mostly traffic and a few others
- hinkley 3y agoMy first job out of college I ended up with the absolutely slowest box in the office, which definitely pushed me toward optimizing our app (it wasn't even good on fast machines, but it was tragic on slow), but compile times were murder. We had a Sparcstation somewhere in the office being used as a mail server and nothing else. I don't recall how but I managed to SMB or NFS mount a directory so that I could edit code on my piddly little desktop but compile it on the Sparc. First time Java really worked as advertised for me. Saved me loads of time and let me iterate on ideas that I don't think I or my boss would have had the patience for otherwise. I'm not entirely keen on language servers, but those would be another area where distributed computing could come in handy. I think what might be missing though is a multitenant version. Everyone on my team has a duplicate model of our dependencies loaded into Webstorm and it's a pig.
- deleted 3y ago[deleted]
- kyrra 3y agoI have a number of co-workers that do the same, but I can't live without my full Linux desktop environment. This is especially true if you use intelliJ or other desktop apps. Yes you can remote desktop, but it's just not the same.
- tyrust 3y agoYou can run this workflow with a Linux laptop.
- Arainach 3y agoFor various workflows, the only viable solution is to remote desktop into my workstation and run the browser there. SSH isn't enough. And don't get me started on the disaster of trying to do things locally (Cmd+C) and remotely (Ctrl+C) simultaneously or the awful experience of mixing screen DPI when connecting a linux laptop to external monitors...
- eptcyka 3y agoIf all you need is a browser, you can use SSH as a SOCKS proxy for your browser.
- Arainach 3y agoWe can't use proxy servers on corp-provisioned machines.
- swexbe 3y agoVSc over ssh? Jetbrains Gateway? I think both work decently.
- Cagrosso 3y agoVSC Remote I can agree with. Gateway feels like such an after thought. So many bugs and it's very resource intense in my experience. I really like Jetbrains products but their remote offerings are lacking. Makes me wonder if that’s why they are working on Fleet to fill that gap.
- hamandcheese 3y agoHow do you ssh in to your workstation? Via some internet-connected bastion host?
- danpalmer 3y agoTldr: no, but it’s complicated. Have a read of the Beyond Corp paper for more details.
- hinkley 3y agoUnless I've misunderstood the documentation, I think Jetbrain's new Fleet editor is planned to support this sort of workflow.
- croes 3y agoAre you sure? Why would a build machine need access to GMail? >The report says Google's new pilot program "will disable Internet access on the select desktops, with the exception of internal web-based tools and Google-owned websites like Google Drive and Gmail. https://arstechnica.com/gadgets/2023/07/to-defeat-hackers-google-wants-employees-to-work-without-internet-access/ https://arstechnica.com/gadgets/2023/07/to-defeat-hackers-go...
- beebmam 3y agoWhy would a "desktop" be a build machine in this era?
- ValleZ 3y agoWhy not?
- rejectfinite 3y agoI have noticed here on HN that a lot of people don't have desktops and think they are as good as laptops in terms of performance. lol
- mgraczyk 3y agoGPU
- Pannoniae 3y agoLaptops almost always have cooling which definitely won't sustain 100% CPU or GPU usage for 2 hours for a buildjob. On my desktop with fairly standard, non-fancy air cooling, I could run it on 100% for hours, and the only thing which would happen is the fans spinning loudly. On my work laptop, the poor thing (with an i9!) begins to heat up like crazy after 5-10 minutes of virtual machine usage.
- praptak 3y agoMy build machine sometimes needs to send logs to attach to bugs or have other humans inspect them. This obviously doesn't have to be Gmail but it comes pretty handy.
- mgraczyk 3y agoMany people at Google still use desktop Linux workstations. Those would be airgapped too under this plan and force these people to change to another workflow. There are at least hundreds of people who have been there 10+ years still using desktops for all development. For example on the team I was previously on, 4/8 people used a desktop workstation as their main device. I used a cloud VM as my main machine, and still used internet all the time. I used github to sync my configuration (using a proxy would be out of date and no way to push), amongst other things.
- LargeTomato 3y ago~5 years ago I had desktop Linux and a chrome book. All compilation happened via cloud build and the preferred IDE was the cloud-based web app. I didn't really use my desktop for anything, not even ssh. I switched to a Chromebook in the pandemic and honestly it was fine. My workflow barely changed. I wasn't a vim fanatic at the time so I didn't really care.
- mgraczyk 3y agoMany people don't do that. They sit in front of a desktop with a monitor plugged into it and use the desktop for everything, including stack overflow etc
- deleted 3y ago[deleted]
- LargeTomato 3y agoThey don't need the desktop for stack overflow. They're launching a browser. They can launch the browser in any computer without breaking their workflow.
- mgraczyk 3y agoThat doesn't make sense to me. You can't copy-paste into and out of your editor across machines. You see an error message on your desktop, you want to search for it. What do you do?
- IX-103 3y agoThe other key detail missing was that this was just an experiment that was going to be active only on a small set of machines for a limited time. They wanted to get data on how much it impacts users workflows, what the opt out rate is, etc. There's not even a current plan to continue limiting access after the trial period ends, much less a plan for expanding it to more machines.
- jppittma 3y agoA lot of people I know don't use them like that. They have a chromebook and RDP onto their cloudtop and never close it. One thing I like(d) about google is that they let you bring whatever workflow you're most productive with, rather than prescribing an "expected" workflow on you.
- joelwilliamson 3y agoHow do you remote access an air-gapped workstation? Seems like you'd need to be constantly switching whether your laptop is on the internet-connected network or the isolated network. If the laptop can switch between them automatically, wouldn't that make it possible for an attacker to jump the gap? Even just having hosts that are sometimes internet connected and sometimes on the airgap network will greatly weaken the isolation. Stuxnet could cross an airgap with just static media, allowing thousands of computers that sometimes connect to the internet across the airgap seems like a fatal weakness.
- quietbritishjim 3y agoThe other key detail missing is presumably that the workstation is not air gapped at all, just prevented from accessing the internet with some firewall rules. For those that don't know: air gapped means completely disconnected, as in literally pull the network cable out the back and never back in again. File transfers have to happen using some physical medium (traditionally write-once CDs/DVDs). You can have an air gapped network so long as the machines are just connected to each other and there's no physical route whatsoever to the internet.