deleted by creator

Yeah, I remember your previous post. They were irritated at you secretly subverting security restrictions put in place by your company to use an unapproved OS on THEIR company machine and network without their permission. Not that it’s “not ready”. They were also warning you that you were treading in dangerous water, legally.

Now you’re manipulating us by telling us it was just all about IT admins “not being ready” for Linux, not about it being a major security breach.

You have no rights on other people’s machines and networks that you do not own unless explicitly granted. Period. The same would apply if you were to bring a Windows workstation into a Linux-based organization.

Downvoting because of point #4. That’s a catastrophically naive mindset, and a sure recipe to get your shit pwned if you’re running an IT org and you think that’s an accurate statement.

I feel like OP has never worked in a corporate IT job before and has zero clue what it actually entails to manage a large fleet of desktop PCs used by the average office worker.

Linux is ready for workplaces and has been for a very very long time. That is irrelevant if workplace IT support is not ready for Linux and has no budget or time to get ready for it. All your points are meaningless and have never been the problem. The problem is with management, policies and getting in house support for things and all the work involved in that. Depending on the size of the company it can take a lot of time effort and money to retrain IT staff to support Linux. And IT staff are already overworked, under-budgeted and don’t always have the time to support extra things.

Not an IT expert, not a sysadmin, not a tech guru by a long shot, but as Linux user, I call this post bullshit.

The biggest problem wouldn’t be about having it manage all the machines in a network; it would be having to deal with every dick and jane complain about how they can’t change their desktop background or some other trivial thing they can do on windows or how a specific program is not available or doesn’t feel the same.

Transition into an all-Linux production environment would require a top-down non-negotiable decision and the willingness from top brass to provide trainning down the line and deal with a good deal of shennanigans from middle management.

And no virus on Linux? Yes, it has some built in features that make a bit more robust but there are rootkits and other malware out in the wild capable of hurting a linux system. And if popularity is to come to Linux, at some point there will be a need to harden the standard security protocols to ensure system safety, not forgetting that 90% of the time the main problem is between the chair and the keyboard.

the only thing I’ll say is the piece about “no viruses” would kinda go away if desktop Linux picked up at all. the security on a default Linux system is worse than macos and windows with substantial hardening efforts needed. the only reason viruses and other malware isn’t common on Linux as is is because of the tiny user base.

with all this said, if enterprise use got more common, security would quickly become an important aspect.

Point 2 is a reason it’s not used or used for very specific use cases within a company. Companies don’t want to make a custom distro that they have to support themselves, that costs money.

The final point you made yourself the IT guys don’t have Linux knowledge but they do have Windows knowledge. Easier and safer to stick with what you know than what you don’t.

This feels like it was written by someone who hasn’t done sysadmin of a Windows network in a long time. Everything is online and is almost always one click now. Provisioning, removing permissions, updating email filters, adding users. Each item is so much easier now than it used to be. I loving running my PopOs install but let’s not pretend that SysAdmin is the 90s nightmare it once was.

The only thing better than good in the world of business is standard. Windows may be bad, but it’s the industry standard for a ton of commercial applications. A lot of software that companies use are designed for Windows, from antivirus software to Microsoft’s office suite to audio and video editing software and more. Every copy of Windows is also a lot more standard than Linux distros; the customizability of Linux makes it a lot harder to provide support compared to every single Windows user being locked into certain things. As far as the IT team being “lazy” or having “a lack of knowledge” on supporting Linux, they’re working on the company’s dollar, and unless there’s a strong, justifiable reason to increase their workload by supporting another operating system, it’s an unnecessary expense for the company. There certainly are cases where there are strong, justifiable reasons such as with Google, who maintains two Linux based operating systems and needs their staff to know how to work with them, or in situations where Linux substantially outperforms Windows for the tasks employees are doing to the point that supporting Linux is worth it, but “it can do most of what Windows can alongside features that don’t matter to the companies’ operation” isn’t the best selling point

At best, it means sysadmin have to support both Linux and windows. You’re going to double everyone’s tools.

This reads like an engineer who is way too invested in using their toolset and thinks everyone else is stupid for not using the same. Like someone who has never worked in management or had to make business decisions. They are looking at it only through a tech viewpoint.

Not only would you need to have an IT team that knew how to manage and support it (which costs money and time) but you then have to train your entire work force which costs insane amounts of time. You would have to do IT training for every new hire for them to even use their computer. That sort of time and training (which takes two employees, the trainer and trainee) costs a lot of money, far more than any OS licensing or end user software costs. Plus the decreased work output while the user to get used to the toolset.

In a software development company, sure, Linux might be a valid option. But it’s not ready for most companies main workforce. And it’s not a technological issue. It’s a human resources issue.

I mean yeah it’s possible, but the reality is that most people in the company will likely want Windows anyway, and use things like Microsoft Office and a heap of other Windows only software. Probably not the developers, but accounting, HR, and so on. There’s also sales but nowadays they demand MacBooks because of status symbol and apparently it sorta matters, at least according to sales.

As an IT department, if you can get away with supporting only one platform and even one model/brand of computer, it’s much easier. Maybe two so sales and devs get their MacBooks. Adding a third is asking a fair bit from the IT department, and it starts adding up to a really rare skillset. I know very few that are absolutely proficient in all three main OSes.

There’s also the compliance aspect. The reason my current company can’t support Linux users is InfoSec/compliance. Not because Linux is insecure, but because all the standards are written for Windows. You can argue all you want about how Linux doesn’t need an antivirus, tough luck, SOC2, ISO and also insurance policies all explcitly require “controls against malware” and firewalls with every OS held to the swiss cheese security of Windows. So each OS basically requires the InfoSec and IT department to write out unnecessarily detailed procedures and policies about all the security measures, for every OS in use. What antivirus runs, is it a reputable brand, how do you validate that it runs, how do you test that it detects malware, how do you validate and ensures that the incident gets reported, what tooling does the software gives you to establish the root cause and entry point, what exact user action happened that led to the exploit chain, what was the exploit chain, how you’re going to mitigate and clean up after exploitation, how do you know exactly what data was compromised, and so on and on and on.

Right now most vendors support barely support the current version of Windows and macOS (especially macOS, I swear the AV software is always holding back major updates for several months every release). Very few support Linux. So either you have an entirely separate policy and audit for Linux, or you just don’t support Linux.

We’ll see companies open up to Linux when all the vendors also start supporting Linux, and even then, with those that do, it’s a shitshow of only supporting the last version of Ubuntu or RHEL with pinned kernel versions and blatant GPL violations and GPL condoms and binary only kernel modules with no hope of recompiling/adapting them to the current version. The ClamAV trick no longer works, auditors now want real AV software with the whole exploit chain tracking I described. Which is also why those company computers are so damn slow, much slower than you’d expect. They scanning everything and tracking everything, every process tree, what spawned it, what user action led to it. My MacBook started feeling like a Dell Latitude from 7 years ago once they loaded up all the crapware on it. We had to reserve a whole bunch of extra capacity on the Linux servers just for AV to exist and do nothing because it’s all locked up in containers and SELinux policies and it takes a pretty bad 0day to pwn those.

If I was the IT guy, I would also struggle to even begin to make a case for supporting Linux and justifying the time and cost. I don’t like my OS, but I do my work on it, cash my paycheck and move on to enjoy my Linux machines off work.

Why are you posting a screenshot of text instead of just linking to the source?

Downvoted. Were better than this.

The post if overall very naive and while I do agree with using Linux for IT work he doesn’t give the best point either.

First of all, the customization. A lot of Linux users LOVE to point this out but 1. it isn’t for everyone 2. it won’t be compatible with every softwares. While modern Linux OS’s tend to be well tailored for devs due to most the work being command bases and having version control, it will not work out for everyone either as for a lot people it won’t be convenient. Most users just want an out of the box and ready to use OS rather than a never ending mess of fixing and customizing stuff.

Second, and the most stupid thing from this post, is that Linux will never have any malwares due to it being “well secured”. The reason why linux malwares aren’t viral is because about 3% of people using a computer in the world use linux, even less for work considering that a lot of these people use SteamOS for playing games. Other than that, Linux is a kernel, It runs code. So on this basis Linux is as vulnerable as windows. And considering the biggest attack vector isn’t some fancy exploits but someone sitting on chair in front of his computer, you can guess that Linux isn’t out of risk of any cyber attacks.

I’ve run Linux in the workplace, with permission of course (because I’m not stupid). In this case, everyone was their own IT person, and it was everyone’s responsibility to maintain their Linux system. Major software updates often failed on dev machines and required help from more knowledgeable Linux users, but it was doable. The whole thing was a security nightmare, though. The place ran on dark IT, firewalls and antivirus were a joke, half the team needed a Windows VM to test features, and every year there was someone who found out during an audit that their computer hadn’t received updates in nine months. The soft rule was that if you took more than four hours to bring a broken system back to life, you’d just install windows because time is money.

There’s basically no remote administration or patch management. Restricting users to non-root accounts breaks tons of important things, like “applying security updates”. Flatpak has made the application side of things easier, though. There’s kerberos integration, but no active directory. Saltstack and alternatives works great if you know how to use it; most IT teams don’t.

Linux has the advantage thst most kids coming out of school don’t know how computers work anyway. They do all of their work on phones and tablets growing up, so when they get into the office it doesn’t really matter what kind of computer you put in front of them. Could he a Chromebook, could be Fedora, could be Windows.

The most challenging problem is that as a business, you need to pick a software stack and company hardware. Most hardware is built to he used with Windows, most professional software doesn’t even run on Linux, even with WINE. If your entire company runs in a web browser then sure, Linux is an option, if you can find the right hardware. You’ll be spending quite some time configuring systems to disable root, connect to the management system, and force things like updates and security configurations, though.

Then there’s drivers and external facing software to consider. Printers, for example, are quite necessary. Easy access to email is also essential, but getting ActiveSync or EAS to work on any Linux system is a massive pain. The closest I’ve gotten to is using Thunderbird with a few addons, but that still required entering my credentials three times. I believe Gnome may integrate with contact and email sync these days, but the account providers seem to be limited to Google and Microsoft. You need to take special care to select laptops that will work with things like docks and beamers for presentations and working on site. To get some docks to work, you may need to set up your own repository to provide packages like evdi and DisplayLink with drivers signed by the company’s secure boot keys.

Technical support can be done. You won’t get anything as useful as RDP or plain old Teamviewer, but as long as you force X11, you can do remote support at least. Local support works well, though you may need a working network connection to authenticate your sudo-user. Boot repair and system restore can be done mostly, assuming you’ve set up a big enough /efi partition.

There’s no good UI for updating things like the password of an encrypted drive, so that’ll be a problem for your end users. All solutions require root access, which means someone from IT needs to initiate and monitor the process of changing the encryption password, which is rather annoying. Support for TPM+PIN with any kind of modern KDF is also mediocre, you need to pick a distro with sysyemd-boot to get thst to work.

Secure boot can be pulled off, though thst does require managing keys, which your IT team needs to be set up for. You’ll need to pick a vendor thst has some kind of Linux-based firmware management tool to distribute these keys during first boot up, but you can mash together a provisioning boot USB, I suppose. This has the added benefits of preventing people from messing with their corporate laptops and trying to circumvent IT policy, assuming the password on the firmware is good enough.

Antivirus is quite difficult on Linux. Enabling ClamAV works, but vulnerability management and intrusion detection on Linux is geared towards servers. Vendors like Microsoft provide endpoint security for Linux systems, but if you’re going to run Windows Defender, you may as well just stick Windows on the damn thing.

You’ll still end up with annoying problems that Linux hasn’t solved yet, like “hibernate doesn’t function unless you disable all security”, but Linux has made some great usability strides.

I agree that claims thst Linux doesn’t work in the workplace is based mostly on ignorance. However, it doesn’t make business sense to train and hire a team of Linux maintainers when there are tons of trained and prepared Windows admins out there. Can it be done? Definitely. Should it be done? If you, as the boss of your company, care about Linux, sure, why not. Just make sure to set up training sessions, sane defaults (sane for the end user, not for you), good Linux images, the right support infrastructure, and the right business processes before you start.

Should you use Linux to save cost? No, that’s ridiculous. An hour of IT debugging some kind of application crash is worth the money to buy multiple Windows licenses. Should you use Linux because of the user freedom it provides? Sure, if you don’t mind dealing with customers that have ISO security requirements for their vendors and if you absolutely trust everyone in your company to know the difference between a kernel and an initramfs. Should you tolerate the lone warrior who insists on installing Linux on their managed company device? If they sign a document that states they’ll pay for any and all damages to the company and its hardware in case they mess up, maybe. Getting those millions of lost revenue after a ransomware attack will be a challenge though, it’s probably best to forbid unmanaged operating systems.

Edit: as for the Google example, it got replaced by gLinux. Googlers can use Windows, macOS, some versions of Linux, and ChromeOS. Nobody is forcing them to use Linux.