6 ms·

from my experience IT people normally worship windows for some bizarre reason, which imo is a joke of an OS compared to the other two

ranger207 3y ago
Windows's fleet management features are far better than Mac and Linux. Centralized user management, patching, policies, and application deployment all built into the OS "just works" for IT in the same way Macs "just work" for users. It's not something that can be seen as easily from a user perspective though. I've been... frustradedly enjoying watching the IT department from the company that acquired us attempt to recreate Active Directory in aggregate with a bunch of third party tools on our Macs. An example: last week I had a meeting with IT because one of their tools wasn't collecting logs or whatever. Turns out the tool didn't have the full disk access permission turned on. No good enterprise management solution should allow the endpoint to override settings from corporate, and especially it should have a way to change every setting on the device remotely. Windows has that built in to Pro and Enterprise editions, Linux has enough server management tools that you can sorta build one yourself, Macs like to think the company's laptops belong to the users.
- fiddlerwoaroof 3y ago
  I'm glad Apple's pushing back on the abilities of corporations to install rootkits and other spyware on their employee's laptops. One would think that, after things like the Solarwinds hack, IT departments would be more skeptical of making a big single point of failure for security issues: I don't think the purported DLP and other justifications for this software are really adequate.
  - ranger207 3y ago
    Well, I don't think employees should be bringing their own laptops to work anyway. It's extremely borderline with phones IMO and they have facilities like work profiles for handling that specifically. But the business should be able to do whatever it thinks necessary with the business's laptops it issues to employees. Sometimes it's even required to legally.
    - fiddlerwoaroof 3y ago
      I’m not talking about personal devices, I think the typically IT policies at large corporations cause more problems than they solve and I think Apple making certain things impossible is a great idea to help push back on these policies: for example, IT should not need on-demand screen recording or key logging access and, especially, should not be able to put such software on an employee’s work laptop without explicit consent on the part of the employee.
      - glhaynes 3y ago
        Yes. It doesn't surprise me that some organizations want to spy on their users, but I'm thankful Apple is making it harder for them to do so without making it transparent to the end users what's going on.
      - ranger207 3y ago
        I'm sorry, my last comment was unnecessarily snarky. I was coming back to delete it and write a more respectful one but you had already replied. BLUF: For reasons of security and compliance, licensing, and low levels of computer skills among users, privacy-invading enterprise management tools give IT departments the best and most efficient way to accomplish their goals. IMO if you don't want work looking at personal stuff, then don't do personal stuff on work devices. In short, this discussion highlights the difference between computer power users (developers in particular) and IT. If you're a dev, you're likely highly motivated to get work done, practice security best practices, and keep your system in a well-running configuration. The average employee (which does include many devs) is not like that. When you think of the things you might want privacy for on your work device, it's probably going to be things like checking the news, listening to music, maybe putting YouTube on in the background. Innocent stuff that a micromanager might not like but is probably better for employee mental health anyway. When IT thinks of what an average user would want privacy for, their experience tells them that it's Facebook, porn, and shady gambling sites that say "you've won $1 million just click notmalware.exe to claim it!!!". I and most IT departments wouldn't mind if everyone used their work computers for only the former non-work activities. I'd bet that the vast, vast majority of IT guys think that "boss constantly monitors your screen" software is creepy and unethical. 99% of users don't get their computers infected trying to download more RAM because Excel is slow because they have a dozen workbooks open. But there's one user that does, it's hard to identify who it is in advance, and once it happens once management wants it to never happen again. As far as immediate screen recording or key logging, I can tell you from personal experience that some people cannot do anything outside of their established workflow. That includes clicking the link in the email I sent them, clicking the "download support tool" button, clicking the downloaded file, and clicking "allow access". Walking someone through that series of steps over the phone during COVID was about half an hour of wasted time for both me and them. The next time they needed support though, I could just hop on via the support tool immediately. (Just for clarification, the tool was approved and licensed for us to use; it wasn't just Teamviewer I got the user to install. For administrative reasons though, many of the systems that were our responsibility were not installed by us.) The creepy micromanaging screen logging stuff that runs constantly is not good. Those capabilities are good and useful in many circumstances, but in the type of stuff I think you're thinking about I agree it's horribly unethical. To be frank, I don't think that OS permissions preventing that from working is the right line of defense against that though. If it gets to the point where management thinks that's even an appropriate solution then management has clearly lost the plot and OS permissions won't help. Automatically installing software is also difficult. What should IT do if, for example, Docker Desktop changes their licensing terms and now we need to move everyone to Rancher Desktop? What if networking wants to move everyone from some horrible IPSec VPN installed in 2013 to a new and modern Wireguard-based client? What if the helpdesk is inundated with tickets asking how to install the new version of Acrobat since the corporate newsletter announced we now had it? Just install it individually for user after user after user, or install it for everyone at once and be done with it? (Acrobat was the worst. IIRC I had to install three different versions over the course of a year once, and one of those versions required that you completely remove every trace of the old version first or else the new version would fail silently when you tried to start it. And of course Adobe's uninstaller wasn't comprehensive enough. I remember a ~2 week period where three quarters of my tickets were manually removing the old version of Acrobat and installing the new one.) You said installing software should require the user's explicit consent. Linda in HR is probably going to dismiss the popup asking to install the new VPN because she doesn't know what it means. It's bad enough already with updates. If you don't have automatic silent background installs, that means that the day after the old VPN stops working, Linda and a dozen other people are going to submit tickets saying they can't access the network anymore. You won't have problems: you know what a VPN is, you read the emails from IT detailing that they're upgrading, you know that the new version will be faster. Not everybody is as good with computers as that. Automatically installing new software often means avoiding a bunch of tickets allowing helpdesk to work on actually meaningful things. Those privacy-invasive tools are critical to IT getting their work done. Now, I absolutely get why people have bad attitudes towards IT. IT is often unfairly biased against users. After all, the only users they interact with most of the time are morons, and that paints an unfair stereotype. Like, for example, the stereotype that those users are morons: it's not the user's job to use a computer, it's the user's job to do whatever their job it, and the computer is a tool to do that. Yeah, users should know a little bit about how to use their tools, but that's a little difficult to enforce. IT guys in general have a terrible attitude towards the people it's part of their jobs to help, and that makes interacting with them unpleasant. And corporate-ordered creepiness is often implemented via IT. IT gets a bad rap and they often deserve part of it. But regardless, not using those tools is like managing a fleet of servers by SSHing into each one individually. Even if you have failproof processes where you never forget a step, it just doesn't scale. IT has management breathing down their neck constantly, along with half a dozen other teams all with their own concerns and problems: networking keeps moving switchports to different VLANs and forgetting that they need to update the routes to the printers; security says they need this AV tool installed to hit a certification management wants to put on the homepage; management found out last week about a guy who's done nothing but manage his fantasy football team for the past three months and thinks the solution is to watch everyone's screen at work. I'm not claiming IT is unique in this regard to be clear: devs with too many project managers have the same sorts of complaints. But fundamentally when IT does something stupid to your computer, there's a very good chance that it's been caused by something akin to someone in a completely different department doing something insecure and now IT has to prevent that from happening again. Centralized tools that allow you to control computers remotely, install software automatically, and change settings as a super-superuser are required for managing a fleet of devices operated by people who want to get things done. My personal policy is that work-owned equipment is for work stuff only and I will never use it for personal stuff. If I want to listen to music or whatever, I'll use my own device. This avoids every problem with employee privacy on work devices. If I could wave a magic wand and make every person follow that perfectly then none of this would even be a controversy. But people do want to do personal things on work computers, and IT departments have things they need to get done across entire fleets, and the intersection of those things causes problems.
bandrami 3y ago
I say this as a dedicated Linux user of 25 years: neither Linux nor Mac have anything approaching the remote mass administration capabilities of Windows. Windows brings a ton of problems with it, but the ability to just GPO literally anything you want is the big reason it's popular among back office admins.

ranger207 3y ago

Windows's fleet management features are far better than Mac and Linux. Centralized user management, patching, policies, and application deployment all built into the OS "just works" for IT in the same way Macs "just work" for users. It's not something that can be seen as easily from a user perspective though. I've been... frustradedly enjoying watching the IT department from the company that acquired us attempt to recreate Active Directory in aggregate with a bunch of third party tools on our Macs. An example: last week I had a meeting with IT because one of their tools wasn't collecting logs or whatever. Turns out the tool didn't have the full disk access permission turned on. No good enterprise management solution should allow the endpoint to override settings from corporate, and especially it should have a way to change every setting on the device remotely. Windows has that built in to Pro and Enterprise editions, Linux has enough server management tools that you can sorta build one yourself, Macs like to think the company's laptops belong to the users.

fiddlerwoaroof 3y ago
I'm glad Apple's pushing back on the abilities of corporations to install rootkits and other spyware on their employee's laptops. One would think that, after things like the Solarwinds hack, IT departments would be more skeptical of making a big single point of failure for security issues: I don't think the purported DLP and other justifications for this software are really adequate.
- ranger207 3y ago
  Well, I don't think employees should be bringing their own laptops to work anyway. It's extremely borderline with phones IMO and they have facilities like work profiles for handling that specifically. But the business should be able to do whatever it thinks necessary with the business's laptops it issues to employees. Sometimes it's even required to legally.
  - fiddlerwoaroof 3y ago
    I’m not talking about personal devices, I think the typically IT policies at large corporations cause more problems than they solve and I think Apple making certain things impossible is a great idea to help push back on these policies: for example, IT should not need on-demand screen recording or key logging access and, especially, should not be able to put such software on an employee’s work laptop without explicit consent on the part of the employee.
    - glhaynes 3y ago
      Yes. It doesn't surprise me that some organizations want to spy on their users, but I'm thankful Apple is making it harder for them to do so without making it transparent to the end users what's going on.
    - ranger207 3y ago
      I'm sorry, my last comment was unnecessarily snarky. I was coming back to delete it and write a more respectful one but you had already replied. BLUF: For reasons of security and compliance, licensing, and low levels of computer skills among users, privacy-invading enterprise management tools give IT departments the best and most efficient way to accomplish their goals. IMO if you don't want work looking at personal stuff, then don't do personal stuff on work devices. In short, this discussion highlights the difference between computer power users (developers in particular) and IT. If you're a dev, you're likely highly motivated to get work done, practice security best practices, and keep your system in a well-running configuration. The average employee (which does include many devs) is not like that. When you think of the things you might want privacy for on your work device, it's probably going to be things like checking the news, listening to music, maybe putting YouTube on in the background. Innocent stuff that a micromanager might not like but is probably better for employee mental health anyway. When IT thinks of what an average user would want privacy for, their experience tells them that it's Facebook, porn, and shady gambling sites that say "you've won $1 million just click notmalware.exe to claim it!!!". I and most IT departments wouldn't mind if everyone used their work computers for only the former non-work activities. I'd bet that the vast, vast majority of IT guys think that "boss constantly monitors your screen" software is creepy and unethical. 99% of users don't get their computers infected trying to download more RAM because Excel is slow because they have a dozen workbooks open. But there's one user that does, it's hard to identify who it is in advance, and once it happens once management wants it to never happen again. As far as immediate screen recording or key logging, I can tell you from personal experience that some people cannot do anything outside of their established workflow. That includes clicking the link in the email I sent them, clicking the "download support tool" button, clicking the downloaded file, and clicking "allow access". Walking someone through that series of steps over the phone during COVID was about half an hour of wasted time for both me and them. The next time they needed support though, I could just hop on via the support tool immediately. (Just for clarification, the tool was approved and licensed for us to use; it wasn't just Teamviewer I got the user to install. For administrative reasons though, many of the systems that were our responsibility were not installed by us.) The creepy micromanaging screen logging stuff that runs constantly is not good. Those capabilities are good and useful in many circumstances, but in the type of stuff I think you're thinking about I agree it's horribly unethical. To be frank, I don't think that OS permissions preventing that from working is the right line of defense against that though. If it gets to the point where management thinks that's even an appropriate solution then management has clearly lost the plot and OS permissions won't help. Automatically installing software is also difficult. What should IT do if, for example, Docker Desktop changes their licensing terms and now we need to move everyone to Rancher Desktop? What if networking wants to move everyone from some horrible IPSec VPN installed in 2013 to a new and modern Wireguard-based client? What if the helpdesk is inundated with tickets asking how to install the new version of Acrobat since the corporate newsletter announced we now had it? Just install it individually for user after user after user, or install it for everyone at once and be done with it? (Acrobat was the worst. IIRC I had to install three different versions over the course of a year once, and one of those versions required that you completely remove every trace of the old version first or else the new version would fail silently when you tried to start it. And of course Adobe's uninstaller wasn't comprehensive enough. I remember a ~2 week period where three quarters of my tickets were manually removing the old version of Acrobat and installing the new one.) You said installing software should require the user's explicit consent. Linda in HR is probably going to dismiss the popup asking to install the new VPN because she doesn't know what it means. It's bad enough already with updates. If you don't have automatic silent background installs, that means that the day after the old VPN stops working, Linda and a dozen other people are going to submit tickets saying they can't access the network anymore. You won't have problems: you know what a VPN is, you read the emails from IT detailing that they're upgrading, you know that the new version will be faster. Not everybody is as good with computers as that. Automatically installing new software often means avoiding a bunch of tickets allowing helpdesk to work on actually meaningful things. Those privacy-invasive tools are critical to IT getting their work done. Now, I absolutely get why people have bad attitudes towards IT. IT is often unfairly biased against users. After all, the only users they interact with most of the time are morons, and that paints an unfair stereotype. Like, for example, the stereotype that those users are morons: it's not the user's job to use a computer, it's the user's job to do whatever their job it, and the computer is a tool to do that. Yeah, users should know a little bit about how to use their tools, but that's a little difficult to enforce. IT guys in general have a terrible attitude towards the people it's part of their jobs to help, and that makes interacting with them unpleasant. And corporate-ordered creepiness is often implemented via IT. IT gets a bad rap and they often deserve part of it. But regardless, not using those tools is like managing a fleet of servers by SSHing into each one individually. Even if you have failproof processes where you never forget a step, it just doesn't scale. IT has management breathing down their neck constantly, along with half a dozen other teams all with their own concerns and problems: networking keeps moving switchports to different VLANs and forgetting that they need to update the routes to the printers; security says they need this AV tool installed to hit a certification management wants to put on the homepage; management found out last week about a guy who's done nothing but manage his fantasy football team for the past three months and thinks the solution is to watch everyone's screen at work. I'm not claiming IT is unique in this regard to be clear: devs with too many project managers have the same sorts of complaints. But fundamentally when IT does something stupid to your computer, there's a very good chance that it's been caused by something akin to someone in a completely different department doing something insecure and now IT has to prevent that from happening again. Centralized tools that allow you to control computers remotely, install software automatically, and change settings as a super-superuser are required for managing a fleet of devices operated by people who want to get things done. My personal policy is that work-owned equipment is for work stuff only and I will never use it for personal stuff. If I want to listen to music or whatever, I'll use my own device. This avoids every problem with employee privacy on work devices. If I could wave a magic wand and make every person follow that perfectly then none of this would even be a controversy. But people do want to do personal things on work computers, and IT departments have things they need to get done across entire fleets, and the intersection of those things causes problems.

bandrami 3y ago

I say this as a dedicated Linux user of 25 years: neither Linux nor Mac have anything approaching the remote mass administration capabilities of Windows. Windows brings a ton of problems with it, but the ability to just GPO literally anything you want is the big reason it's popular among back office admins.