I'm no fan of Windows myself, but I find this a fairly bad policy.
If nothing else - what's not used is not tested. And if you expect any real population of users to be using Windows machines with your products, you should have developers/PMs/QA/support interacting with your products using Windows machines.
I see this as: We're saving a bit of money and making ITs life easier, and in exchange users will get a worse product.
Realistically - that's a bad trade. It is almost never the right decision to prioritize IT quality of life over basically any other business need.
I mean, Gitlab is a web platform. It's pretty easy to test how it's going to work on different platforms without needing full machines. Heck, you can even just get Microsoft Edge binaries on macOS and Linux if you want to test Edge. But failing that, VMs are pretty sufficient.
If you would have kept reading, you would have noticed that employees can apply for an exception to the policy.
So if, for example, you are a UX dev and need to test your CSS on Edge, they have a process that allows you to do that.
And it's not "just a bit of money", Microsoft's enterprise product licensing is truly onerous. It's almost a career unto itself just to make sense of it, and it requires a non-trivial amount of infrastructure to support.
I agree. If nothing else they won’t be able to replicate Windows typography, which is different from Linux and OS X. Base fonts are different; kerning and anti-aliasing are different. Web design is still 90% typography, and cutting the largest install base out of your test matrix seems silly to me.
Windows is a specific set of skills that takes a lot of people to do properly at any scale. The dedicated resources required are essentially a drain on the whole of IT. My company also bans Windows for the same reasons.
For many years, and in so many companies, the policy has been the opposite.
All company laptops must have windows, anything else needs to be vetted by the IT admin.
Now that the Edge browser works fine on Linux, there's really no need for all these licenses, and someone needs to start to break the unhealthy dependency every company has on Active Directory.
Testing for Windows on a non-Windows machine is far easier than testing for macOS on a non-macOS machine. Of course, having people use both is better. IIRC, Steve Klabnik uses Windows to ensure that Rust supports the platform well.
It doesn't sound like Gitlab doesn't allow windows at all.
This sounds to refer explicitly to using interim personal laptops until departmental hardware is issued formally (which, as I understood it, may then run windows).
you're gonna have a bad day if you're depending on random employees for testing a site used by millions.
instead, invest in:
- real automated testing (to the extent technically and economically feasible). One hack is to get customers and partners to fund it, then leverage outsourcing.
- feedback from users - make it easy, streamline responses, setup escalation. Understand that you can't nail down everything and quickly triage issues. Scale the team so at least you can do the triage.
Realistically... Microsoft owns GitHub, and the weird Azure devops-ish solution for git. If an enterprise is on Microsoft, they're going to use one of those two solutions instead of GitLab.
Making IT's life _vastly harder_ to allow employees to maybe use Windows and see a solution the testing team didn't see is not a good trade-off.
That's not even going into how, exactly, Windows is going to make anyone's life better than using a Mac. Realistically, they're at least at parity.
The trade-off here is "make every IT support and supply line more filled with friction" to gain "people can use Windows if they'd really prefer, instead of Mac or Linux". That's a terrible trade-off, and GitLab is making good decisions.
Take into account that they prohibit Windows Home specifically.
In my company I am dealing with buying laptops for new hires - there is no way I am buying laptop with Windows Home edition.
That is problem with explaining people that they should buy laptop with Windows Professional. Whatever the cost is - company is paying. New hires are shy to expense company THAT is the problem.
So I think problem is that people try to buy cheapest laptop they can to "be cheap".
If my company would be on scale of GitLab I probably would not be able to control that but I am specifically buying laptops via my manager - and there is no way we would buy Windows Home laptop.
Does anyone know if this policy is causing GitLab's product quality to suffer? I see your argument, but products like BrowserStack and VMs can be employed to mitigate some of the negative effects. It seems premature to call the policy bad without examples of harm it has caused.
I guess is is for developers and business but in some other areas Windows would be hard to avoid: physical security systems, guest management systems and a few others.
On top of that, the justification seems more like a baseless rant, citing only one blog post as a source. Ranting engineers should not make business decisions.
What are they going to test on Windows? It's a web platform that runs on a Linux server... And Rails is kinda annoying to develop on using Windows, you definitely won't put it on a Windows server, what's the point?
>> GitLab approves the use of Linux, and Apple's macOS. Microsoft Windows is prohibited for the following reasons:
Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware.
macOS is preinstalled on Apple computers and Linux is available free of charge. To approve the use of Windows, GitLab would have to purchase Windows Professional licenses, as Windows Home Edition does not satisfy GitLab's security guidelines.
As many purchases of laptops have occurred with employees making the purchases and then being reimbursed by GitLab, a remote employee would typically be making a purchase of a laptop pre-loaded with Windows Home Edition.
Windows Home Edition is notoriously hard to secure.
edit: after thinking about this for a bit, it occurs to me that their main competitor is github and that maybe they just aren't very excited to use MSFT products?
I‘m a bit surprised that they care about the cost so much - the Dell laptops and the Apple Laptops come in at a price point of 2000 - 3000 USD and the Dell they specifically recommend for Linux use comes with Windows Pro preinstalled. The price difference to the equivalent Linux version is around 70USD. That‘s a negligible difference, especially when you start comparing to the employees wage (It‘s probably about 1 hour of their time, one-time cost)
If they‘d make the point based on lack of internal support capacity, I‘d understand, but caring about the one-time cost of the license is a very weak point.
You wouldn’t use Home SKUs for enterprises anyway, if you want to apply any policy you need Pro/Enterprise. In the end it’s about GitLab dismissing an entire laptop over a $70 upgrade key, or $200 Pro license.
> Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware.
That may be true, but a much higher proportion of downloaded Mac software lacks code signing. Opting in to that as a developer on the Mac will carry a lot of risk of kafkaesque deactivation and, and most don’t want to deal with that. On Windows, on the other hand, it’s like getting an SSL certificate. Apple’s philosophy on the developer program is antiquated, obsolete, and has compromised the security of the platform.
How many Mac users do you think limit themselves to only signed apps? It’s much easier to do this on Windows (but requires a small amount of technical understanding, or is it too much for Gitlab employees?). But when you enforce the policy at the corporate domain level, you won’t be neutering the machine’s usefulness as you would on the Mac. Unsigned apps on Windows tend to be the janky ones, while the signed apps found on the Apple Store tend to be garbage in my experience.
Relying on “less malware is created for Mac” is a terrible idea in general. This isn’t the 90’s. When you are Gitlab, a high value target for sophisticated, targeted attacks, that won’t help you.
Good Security is a balancing act between safety and convenience, and Apple gets it completely wrong. Therefore I would be very cautious about trusting Gitlab’s security posture given their apparent ignorance on the subject.
> If your certificate expires, users can no longer launch installer packages for your Mac applications that were signed with this certificate.
> Apple Developer Program membership is required to request, download, and use signing certificates issued by Apple.
> Note: Apple can revoke digital certificates at any time at its sole discretion. For more information, read the Apple Developer Program License Agreement in your developer account.
… and many paragraphs detailing what parts of your app will break when certificates are revoked.
There are more nuances involved than I care to list in full here, though I’d be happy to be proven wrong about this.
All of the reasons are perfectly valid. Just not extremely relevant.
Normally any company looking at that level of operational detail has a problem. But on their case, yes, it's probably because Windows comes from their competitor.
Adding a bunch of work, costs, and risk to yourself that will only benefit your competitor does not feel good. No matter how relevant are the work, costs, and risk.
I haven't had problems with viruses, spyware and ransomware on Windows for years. Microsoft's builtin spyware marketed as telemetry and diagnostics otoh is very difficult to counter even with dedicated tools like O&O ShutUp10. I get why companies don't want to risk giving business secrets to Microsoft.
So they banned a wildly popular OS because it does not satisfy their security guidelines. I just checked, they have no guidelines for securing Windows. So you can't satisfy their Windows security guidelines because the guidelines for securing Windows were never written. What a joke.
Isn't that a case of the wetware that procures the laptops being not quite on the samepage, especially for someone working in geared towards developers company.
A buy something with windows pro is not hard to communicate...
> Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware.
This is poor reasoning and a misunderstanding of how security works. Any org should be happy with any OS, as long as sufficient security controls for it exist. Anyone who oversees Windows estates, or works in desktop security, can tell you that they exist and are extensive, and are effective.
I suspect this is a policy that's been pushed out by a C-level who simply hates Windows but is being justified with >15 year old reasonings.
> macOS is preinstalled on Apple computers and Linux is available free of charge. To approve the use of Windows, GitLab would have to purchase Windows Professional licenses, as Windows Home Edition does not satisfy GitLab's security guidelines.
More tenuous reasoning - macOS is not 'free'. By their logic they should _only_ be allowing Linux. But I think that just tells us it isn't driven by logic.
So very obtuse of them to word it this way. Windows has a cheaper license for HOME users who don't need Pro features of a business. It's not the other way.
Considering all the security software my corporation forces on all of us, each product hammering my CPU and RAM while I try to compile...windows is an issue for developer productivity. (I'm a windows based developer, I feel the pain)
I'll make sure to mark Gitlab off a company I apply at if I look for a new job. I'm totally blind and have been using Windows screen readers for the last 25 years. The switching cost to Mac or Linux appears to be incredibly high. I've attempted to use both and after brief usage was not able to get close to my productivity on Windows. Maybe that would change if they were my only option but I'm not going to risk poor productivity at a new job on that. I focus on back-end development and since WSL came out, I've not run into any situation where I can't do what I need using Windows, WSL, and VS Code.
This is pretty similar to the policy at my company: you get a Mac, unless you specifically request a Linux laptop. If you need Windows for testing, Microsoft makes VM images available with a browser pre-installed at https://developer.microsoft.com/en-us/microsoft-edge/tools/v...
As a long time Windows user, it would take me a considerable amount of time to get used to the operating system and all applications and utilities that I need to be productive. Not saying Windows is great, but it works for me. And I'm pretty sure they don't hire people to learn an operating system.
I once worked at a CDN (you know, 99.9% *nix) that didn't allow Linux machines because corporate IT didn't know how to fix them and their remote cough spyware cough didn't work on them. We even told them they don't need to support us at all and we're all old school unix admins, didn't matter, corporate policy. Windows or mac.
The pretext for banning Windows is comically bad. Paying extra for Mac hardware is perfectly fine (no, encouraged!), but paying $100 or so to upgrade Windows Home to Windows Professional is prohibitively expensive? That's such a joke.
I have no trouble with companies mandating one OS or the other. But when the justification for the policy is so bad it looks petty and ideological as opposed to the result of a level-headed cost/benefit analysis.
I would suspect that there's a valid reason (probably along the lines of "we are set up to remote manage a bunch of linux and macos machines, and our tools work on them; we don't want to add more overhead") but that the person writing the page didn't entirely understand the reason.
"Mac or linux, but not windows" is a somewhat common policy, or certainly used to be, and it's never about the cost _of the licenses_ (except for tiny companies, perhaps).
Although not even hinted at in the doc, I personally find the tedium of buying and provisioning and monitoring licenses worse than the cost of it. I suppose you are also inviting risk in the form of an audit.
I had to look again and might have missed it, but I didn’t see where Gitlab expressed concerns about the cost of Windows Professional version. They had concerns with team members sourcing they’re own Windows laptops which would traditionally come with Home Edition and need to be upgraded adding to the IT overhead.
Where were the cost concerns on buying windows licenses?
I wonder how much that goes back to predatory enforcement where one person using a home/personal license inappropriately could lead to costly audit requests … or the suggestion that if you buy an enterprise license the problem will go away. People have long memories about that kind of thing.
No harping on cost was done. This is a overhead issue, and the same things apply to IBM and Oracle software. Whenever the product needs artificial management to only deal with the specifics of contracts and licences that's just a drain on the business.
While I think not allowing windows is a silly policy, Apple laptops still sell for a serious premium after 3 or 4 years of use. I've worked for companies where this was the sole reason for Mac being the default laptop you got. If you wanted/needed anything else, you had to specifically ask for it.
I really wonder what it's like inside Gitlab. The product ticks all the boxes you'd want it to, but the user experience just resonates with sadness and misery.
I work there. (And have for the last 5 years.) Obviously I can't divulge anything confidential, but ask a more specific question and I'm happy to answer from my vantage.
I'm a fan, I'd even ban mac/apple stuff if I could from my place of work.
It's clear corporations are seeking more and more intrusive control of our applications both business and personal.
A large and popular software vendor we have used for 7 years has approached us recently and wants to charge us a variable amount depending how integral their product is to our business.
Now management understands the threat, and we are shifting resources to convert things to FOSS, and build up the software community more.
I wonder if this has anything to do with the fact that gitlab is fully remote.
In an office where you have on-site IT staff, and a local corporate LAN, you can require every windows machine to be part of AD, have group security policies pushed out, and generally have tools available for central management.
But with gitlab, everyone is working in their own networks around the world. That sounds like a very hard environment in which to globally apply the types of security policies that are needed to keep Windows secure.
Mobile device management is the topic. You can manage windows devices remotely, just as you can manage MacOS devices. No need for them to check in. It „just“ takes some effort, and if you have multiple operating systems to support, the effort is multiplied. But a company of their market cap and size probably should have the funds for a team dedicated to this.
My corporate win 10 laptop does all those things fine when WFH.
They just set it up, couriered it to my house, gave me my password and off I went.
It does all its GPO update, carbon black policies etc. over the VPN exactly the same as if I was in the office.
Worst case scenario gitlab would just need to courier equipment globally via a decent carrier like DHL, but probably a drop in the ocean compared to other staff costs.
> Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware.
Being targeted less frequently != more secure. MacOS and Safari have had plenty of critical vulnerabilities in recent years.
> macOS is preinstalled on Apple computers and Linux is available free of charge. To approve the use of Windows, GitLab would have to purchase Windows Professional licenses, as Windows Home Edition does not satisfy GitLab's security guidelines.
> As many purchases of laptops have occurred with employees making the purchases and then being reimbursed by GitLab, a remote employee would typically be making a purchase of a laptop pre-loaded with Windows Home Edition.
Come on. A PC with Windows Pro is going to be way cheaper than a comparable mac. This is just disengenuous.
> Windows Home Edition is notoriously hard to secure.
Their last point was literally about how they would force users to get Pro, why does this matter?
I'd issue a counterpoint: there is far more expertise out there in securing fleets of Windows machines, and I'll guess most corporate Windows systems are more hardened to threats than the typical developer's macbook.
The real reason to use Macs is that you get a functional unix-like environment where you don't have to constantly jump through hoops in order to work with Rails. They don't have to fabricate security reasons.
This is not actually that unusual; in fact, if I'm not misremembering, Google also does not generally allow Windows, aside from some limited, less privileged stuff.
IIRC Apple is the same way. It requires extremely special dispensation to even get a Windows VM (ex: iTunes & Safari on Windows groups).
It's not uncommon at all, to be honest. I've done IT at startups where we said "Mac Only". Why? Because supporting multiple platforms is a lot of work. You need to do everything twice. All the software security done twice (and differently for each). Rolling out something new to the employee base? Two different sets of instructions. Setting up conference rooms with power bricks and video adapters? Had to be done twice (though this was a while ago, that is less of an issue now).
For small teams, it's just a workload that may not be doable. It's not like someone in IT says "I hate Windows, we're going to go Apple only", but often times a "Well, we're 90% Mac already, lets stick to just that". And yes, even with the "Apple Tax" its still overall cheaper to buy/support just macs.
Yep; you basically cannot fully enforce a moratorium on Windows without seriously pissing off finance (Excel on Mac is a joke, and Excel Online can't run macros, which is 98% of the value behind Excel)
I strongly dislike numeric keypads in general, and especially on a laptop. I want to be centered on the display, not shoved to the side. I only rarely use the numeric keypad.
> As many purchases of laptops have occurred with employees making the purchases and then being reimbursed by GitLab, a remote employee would typically be making a purchase of a laptop pre-loaded with Windows Home Edition.
Windows Home Edition is notoriously hard to secure.
This is a totally valid point. Anyone who has worked for big companies know how companies secure systems using security policies which are not available on home edition and tough to setup on Profesional license bought by user.
If a user really wants to do something on windows then I am sure they can run it in VirtualBox or VMware on their system.
>Windows Home Edition is notoriously hard to secure.
This is bullshit. In Windows 10 Home the Group Policy Editor is removed, and domain-join is not supported, however bulk security changes (i.e. Security Policies) can still be implemented directly to the registry with scripting.
It's a fairly odd that that IT cultures are segregated into places that have nothing but Macs and other places that have nothing but Windows.
I think it's risky because a small computing monoculture can feel complete but commit a software business to failure at the very beginning by rejecting 90% of the potential market.
Device management becomes much more complicated when you have multiple OSes, though. Unless your company is small enough that self-management remains viable, you have to hire for both Windows and Mac administration experience, and/or shell out a pretty penny for cross-platform "enterprise" device management software.
Microsoft ecosystem is really hard to dip a toe into.
Properly supporting a handful of machines practically means bringing AzureAD or Exchange. AzureAD brings in elements of Exchange (like outlook), which brings in weird default settings like teams/sharepoint/onedrive.
Apple has done a lot of work in supporting Microsoft Exchange, but it's still janky as hell (just browse r/macsysadmin and you'll see).
So, you have two choices.
1) support the monoculture, life will be easier.
2) get a bigger IT department.
People are happy to spend a boatload of money avoiding the second option, so, monoculture it is.
Reading further on the page, the "Laptop Repair" part is interesting :
>If your laptop is broken and needs to be repaired you can take it into an Apple repair store. You should ensure that you have a recent backup before doing so, and that your laptop is not your only registered device for iCloud two-factor authentication.
>If the repair is not going to be too expensive (more than $1000 dollars USD), go ahead and repair and expense. If the repair is going to take longer than a day then you need to make sure you have a back up laptop to work on that is non-Windows.
It seems like you need to have TWO Apple devices, to be on the safe side...
That‘s very funny since almost all repairs on apple devices that I‘ve seen took longer than a day. Apple had [1] some very funky policies about shipping spare parts that essentially required the repair shop to have the laptop on their workbench before ordering the spares.
This is why I find this policy ironic and silly. MacOS is the largest target of choice for bad actors as late because the ratio of high value/low chance of rejection users have migrated to Mac over the past few years because of the whole "Macs are safer" myth. To the point that an exploit for MacOS goes for a lot more money not because they are all that rare but because the value of the targets is greater.
Note how the windows ones are more up to date and patched faster? That's because Mac only does major updates on a cycle and doesn't patch out of band ever if they can avoid it. So yeah I think this is all theater and people's own biases being silly. But if it works for them then that's fine.
I mean, they use Rails, and Ruby/Rails are annoying to use on Windows. I imagine Windows is a massive headache not worth dealing with considering their stack...
1) The reasons shown as to why Windows is prohibited are essentially parallel construction.
2) The real reason is because someone has an agenda against Windows and Microsoft.
3) This is quite alright. It might be a net loss in the short term for everyone, but a net win in the long term for everyone. Microsoft has a lot of bad stuff coming their way, for good reason.
There may not be a "diversity and inclusion" requirement, but I wonder if using an alternative OS could be considered reasonable accommodations in disability law? I'm totally blind and interviewed at a startup and when I told them I needed a Windows machine for accessibility reasons they decided it wasn't worth having me do the take-home coding project. At that point I decided if they were going to refuse to make what I consider a reasonable accommodation I'm glad I found out before wasting time on a take-home project. If the job was IOS development, then they'd have a point, but it was all back-end work that could just as easily be done with WSL under Windows as Mac OS.
> Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware.
Consider linux dominance on end-users devices through android and embedded systems like smart tv's. There are more instances of linux running and being used right now by end-users than windows. UNIX legacy and a long maturation process on HPC and servers probably has to do with how linux systems evolved to be so secure today compared to windows; also because of "bad-habits" windows historically brings.
It may sound cheesy and although I'd like to see linux more used on the desktop, I'm pretty happy with the current situation.
A company forbidding the use of Windows (and more broadly Microsoft products/services) would be a huge green flag to me. I don't even care why. I would miss VS Code though.
Allowing (especially encouraging?) Linux is a huge green flag for me. I personally don't care if they also allow others to use other OSes. If the company can support the systems and they can interoperate with me, it's fine with me.
Going to an anti Microsoft shop sounds good on paper, then you find out garbage like Miro and Confluence is the replacement for office and you change your mind...
Avoiding Windows operating would be an ethical choice going forward, in my opinion. Windows has become a bloatware; it's a memory hog - no amount of RAM is enough. And to top if off, with every update, your hardware becomes obsolete because it lacks a fancy chip.
With Office products being increasingly accessible via the web browser, I think corporations should really start thinking about weaning themselves off Windows.
Google did this 15+ years ago, and while the transition took a couple of years, they never looked back. Productivity shot up for all the usual reasons.
I run docker desktop on my windows machine which I have setup for k8s and have gitlab running as a helm deployment. What's wrong with having windows but using WSL for dev work. That's how most of my flow works, I installed gitlab this way because I want to learn its cicd stuff without having to rely on the work instance or gitlab.com. I prefer selfhosting.
Given Microsoft’s history of severe vulnerabilities, I welcome this news for any company. Apple and Ubuntu have enough popularity and support options making this policy completely supportable. If not Ubuntu, IBM Red Hat seems to be a great alternative as well. At this point it is clear that Microsoft’s monopoly is over.
I am curious about the M1 max for the top performing configuration, wonder if there is a business need for it over an M1 pro with the same storage and memory. Especially since they are mentioning the few hundred dollars a windows pro licence would cost as a reason not to get windows laptops.
Having to use a Windows laptop for work is the main reason I rejected working for Microsoft. Don’t get me wrong, it’s a great OS, but not for me and I just couldn’t bring myself to using it. I get their logic to have engineers use this, but it was a great dealbreaker for me.
"macOS is preinstalled on Apple computers and Linux is available free of charge. To approve the use of Windows, GitLab would have to purchase Windows Professional licenses, as Windows Home Edition does not satisfy GitLab's security guidelines."
Gitlab OpenSource is one of those software that I wish would go the way of LibreOffice/MariaDB: I wish that some foundation took the good open-source part and forked it to implement a real, full, no strings attached open source application.
Most x86 hardware comes with Windows license already. If build your own, I bought a Windows 11 Pro license last week for $13. Cost shouldn't be an issue.
Me too, so many companies enforce windows only with no way to get a linux machine or a mac that it's great to see it playing differently, I can only hope things will change when a new generation who has never used windows will come in the workforce
100% Agreed. The really aggressive "fuck Microsoft" rhetoric is going to burn a lot of these startups over the long haul. It's incredible to me the number that still seem to be operating in an ideological bubble that was originally created 2 decades ago.
A lot of Serious Business happens on top of Microsoft technology right now, and the companies responsible for tending to solutions in this space are made extraordinarily uncomfortable by this kind of aura being given off by vendors like Gitlab.
Can Gitlab really afford to alienate double-digit % of its TAM in favor of this ideological position? It seems like they are already having financial difficulties based upon other recent articles.
horsawlarway|3 years ago
If nothing else - what's not used is not tested. And if you expect any real population of users to be using Windows machines with your products, you should have developers/PMs/QA/support interacting with your products using Windows machines.
I see this as: We're saving a bit of money and making ITs life easier, and in exchange users will get a worse product.
Realistically - that's a bad trade. It is almost never the right decision to prioritize IT quality of life over basically any other business need.
jchw|3 years ago
bityard|3 years ago
So if, for example, you are a UX dev and need to test your CSS on Edge, they have a process that allows you to do that.
And it's not "just a bit of money", Microsoft's enterprise product licensing is truly onerous. It's almost a career unto itself just to make sense of it, and it requires a non-trivial amount of infrastructure to support.
sonofhans|3 years ago
salzig|3 years ago
huslage|3 years ago
Shorel|3 years ago
All company laptops must have windows, anything else needs to be vetted by the IT admin.
Now that the Edge browser works fine on Linux, there's really no need for all these licenses, and someone needs to start to break the unhealthy dependency every company has on Active Directory.
magnio|3 years ago
tpoacher|3 years ago
This sounds to refer explicitly to using interim personal laptops until departmental hardware is issued formally (which, as I understood it, may then run windows).
Did I misread?
asah|3 years ago
instead, invest in:
- real automated testing (to the extent technically and economically feasible). One hack is to get customers and partners to fund it, then leverage outsourcing.
- feedback from users - make it easy, streamline responses, setup escalation. Understand that you can't nail down everything and quickly triage issues. Scale the team so at least you can do the triage.
chrisfosterelli|3 years ago
octokatt|3 years ago
Making IT's life _vastly harder_ to allow employees to maybe use Windows and see a solution the testing team didn't see is not a good trade-off.
That's not even going into how, exactly, Windows is going to make anyone's life better than using a Mac. Realistically, they're at least at parity.
The trade-off here is "make every IT support and supply line more filled with friction" to gain "people can use Windows if they'd really prefer, instead of Mac or Linux". That's a terrible trade-off, and GitLab is making good decisions.
ozim|3 years ago
In my company I am dealing with buying laptops for new hires - there is no way I am buying laptop with Windows Home edition.
That is problem with explaining people that they should buy laptop with Windows Professional. Whatever the cost is - company is paying. New hires are shy to expense company THAT is the problem.
So I think problem is that people try to buy cheapest laptop they can to "be cheap".
If my company would be on scale of GitLab I probably would not be able to control that but I am specifically buying laptops via my manager - and there is no way we would buy Windows Home laptop.
kazinator|3 years ago
They probably have some Windows machines at Gitlab for verifying the experience of Gitlab users/customers who use Windows.
I imagine a developer doing that would have a dedicated Windows machine, or possibly a guest VM, for that activity.
rpdillon|3 years ago
unknown|3 years ago
[deleted]
phkahler|3 years ago
mc32|3 years ago
mmcnl|3 years ago
hatware|3 years ago
How many engineers have you worked with that ONLY worked in Windows, and did it better than anyone else...?
It's just a filter.
wkdneidbwf|3 years ago
gsich|3 years ago
Mikeb85|3 years ago
What are they going to test on Windows? It's a web platform that runs on a Linux server... And Rails is kinda annoying to develop on using Windows, you definitely won't put it on a Windows server, what's the point?
habnds|3 years ago
Xylakant|3 years ago
If they‘d make the point based on lack of internal support capacity, I‘d understand, but caring about the one-time cost of the license is a very weak point.
smileybarry|3 years ago
Nuzzerino|3 years ago
That may be true, but a much higher proportion of downloaded Mac software lacks code signing. Opting in to that as a developer on the Mac will carry a lot of risk of kafkaesque deactivation and, and most don’t want to deal with that. On Windows, on the other hand, it’s like getting an SSL certificate. Apple’s philosophy on the developer program is antiquated, obsolete, and has compromised the security of the platform.
How many Mac users do you think limit themselves to only signed apps? It’s much easier to do this on Windows (but requires a small amount of technical understanding, or is it too much for Gitlab employees?). But when you enforce the policy at the corporate domain level, you won’t be neutering the machine’s usefulness as you would on the Mac. Unsigned apps on Windows tend to be the janky ones, while the signed apps found on the Apple Store tend to be garbage in my experience.
Relying on “less malware is created for Mac” is a terrible idea in general. This isn’t the 90’s. When you are Gitlab, a high value target for sophisticated, targeted attacks, that won’t help you.
Good Security is a balancing act between safety and convenience, and Apple gets it completely wrong. Therefore I would be very cautious about trusting Gitlab’s security posture given their apparent ignorance on the subject.
From https://developer.apple.com/support/certificates/
> If your certificate expires, users can no longer launch installer packages for your Mac applications that were signed with this certificate.
> Apple Developer Program membership is required to request, download, and use signing certificates issued by Apple.
> Note: Apple can revoke digital certificates at any time at its sole discretion. For more information, read the Apple Developer Program License Agreement in your developer account.
… and many paragraphs detailing what parts of your app will break when certificates are revoked.
There are more nuances involved than I care to list in full here, though I’d be happy to be proven wrong about this.
eixiepia|3 years ago
Neither spyware, virus or ransomware has slowed my computer to a halt as much as using GitLab.
marcosdumay|3 years ago
Normally any company looking at that level of operational detail has a problem. But on their case, yes, it's probably because Windows comes from their competitor.
Adding a bunch of work, costs, and risk to yourself that will only benefit your competitor does not feel good. No matter how relevant are the work, costs, and risk.
arkitaip|3 years ago
1970-01-01|3 years ago
ReptileMan|3 years ago
A buy something with windows pro is not hard to communicate...
yuhong|3 years ago
politelemon|3 years ago
This is poor reasoning and a misunderstanding of how security works. Any org should be happy with any OS, as long as sufficient security controls for it exist. Anyone who oversees Windows estates, or works in desktop security, can tell you that they exist and are extensive, and are effective.
I suspect this is a policy that's been pushed out by a C-level who simply hates Windows but is being justified with >15 year old reasonings.
> macOS is preinstalled on Apple computers and Linux is available free of charge. To approve the use of Windows, GitLab would have to purchase Windows Professional licenses, as Windows Home Edition does not satisfy GitLab's security guidelines.
More tenuous reasoning - macOS is not 'free'. By their logic they should _only_ be allowing Linux. But I think that just tells us it isn't driven by logic.
jaywalk|3 years ago
chrisan|3 years ago
So very obtuse of them to word it this way. Windows has a cheaper license for HOME users who don't need Pro features of a business. It's not the other way.
Definitely a c-level with an axe to grind.
cwbrandsma|3 years ago
tootie|3 years ago
jareds|3 years ago
unknown|3 years ago
[deleted]
dsr_|3 years ago
rlv-dan|3 years ago
swozey|3 years ago
gizmo|3 years ago
I have no trouble with companies mandating one OS or the other. But when the justification for the policy is so bad it looks petty and ideological as opposed to the result of a level-headed cost/benefit analysis.
rsynnott|3 years ago
"Mac or linux, but not windows" is a somewhat common policy, or certainly used to be, and it's never about the cost _of the licenses_ (except for tiny companies, perhaps).
nazgulsenpai|3 years ago
pessimizer|3 years ago
mmcnl|3 years ago
nix23|3 years ago
The lost art of (fleet-)administration.
bzxcvbn|3 years ago
jhickok|3 years ago
mikeryan|3 years ago
Where were the cost concerns on buying windows licenses?
acdha|3 years ago
oneplane|3 years ago
koffiezet|3 years ago
ironmagma|3 years ago
I really wonder what it's like inside Gitlab. The product ticks all the boxes you'd want it to, but the user experience just resonates with sadness and misery.
jrochkind1|3 years ago
"GitLab plans to automatically delete projects if they've been inactive for a year and are owned by users of its free tier."
Which I hadn't heard. That's.... something.
Lutger|3 years ago
I have, extensively, and found the user experience excellent. Still miss it now I'm using github plus a bunch of other tools.
lbotos|3 years ago
marcosdumay|3 years ago
How is wanting your products to be aligned with their vision evidence of dysfunction?
shapefrog|3 years ago
raverbashing|3 years ago
stuckinhell|3 years ago
A large and popular software vendor we have used for 7 years has approached us recently and wants to charge us a variable amount depending how integral their product is to our business.
Now management understands the threat, and we are shifting resources to convert things to FOSS, and build up the software community more.
eminence32|3 years ago
In an office where you have on-site IT staff, and a local corporate LAN, you can require every windows machine to be part of AD, have group security policies pushed out, and generally have tools available for central management.
But with gitlab, everyone is working in their own networks around the world. That sounds like a very hard environment in which to globally apply the types of security policies that are needed to keep Windows secure.
Xylakant|3 years ago
nix23|3 years ago
VPN? You know like dial in into your lan?...the original use-case for vpn's?
Kwpolska|3 years ago
Nah, GitLab just hates Microsoft.
nikau|3 years ago
They just set it up, couriered it to my house, gave me my password and off I went.
It does all its GPO update, carbon black policies etc. over the VPN exactly the same as if I was in the office.
Worst case scenario gitlab would just need to courier equipment globally via a decent carrier like DHL, but probably a drop in the ocean compared to other staff costs.
MattGaiser|3 years ago
grumple|3 years ago
> Due to Microsoft Windows' dominance in desktop operating systems, Windows is the platform most targetted by spyware, viruses, and ransomware.
Being targeted less frequently != more secure. MacOS and Safari have had plenty of critical vulnerabilities in recent years.
> macOS is preinstalled on Apple computers and Linux is available free of charge. To approve the use of Windows, GitLab would have to purchase Windows Professional licenses, as Windows Home Edition does not satisfy GitLab's security guidelines. > As many purchases of laptops have occurred with employees making the purchases and then being reimbursed by GitLab, a remote employee would typically be making a purchase of a laptop pre-loaded with Windows Home Edition.
Come on. A PC with Windows Pro is going to be way cheaper than a comparable mac. This is just disengenuous.
> Windows Home Edition is notoriously hard to secure.
Their last point was literally about how they would force users to get Pro, why does this matter?
I'd issue a counterpoint: there is far more expertise out there in securing fleets of Windows machines, and I'll guess most corporate Windows systems are more hardened to threats than the typical developer's macbook.
The real reason to use Macs is that you get a functional unix-like environment where you don't have to constantly jump through hoops in order to work with Rails. They don't have to fabricate security reasons.
jchw|3 years ago
ShakataGaNai|3 years ago
It's not uncommon at all, to be honest. I've done IT at startups where we said "Mac Only". Why? Because supporting multiple platforms is a lot of work. You need to do everything twice. All the software security done twice (and differently for each). Rolling out something new to the employee base? Two different sets of instructions. Setting up conference rooms with power bricks and video adapters? Had to be done twice (though this was a while ago, that is less of an issue now).
For small teams, it's just a workload that may not be doable. It's not like someone in IT says "I hate Windows, we're going to go Apple only", but often times a "Well, we're 90% Mac already, lets stick to just that". And yes, even with the "Apple Tax" its still overall cheaper to buy/support just macs.
nunez|3 years ago
ansible|3 years ago
https://www.dell.com/en-us/work/shop/laptops/new-15-5560-wor...
Also supports ECC, nice!
I strongly dislike numeric keypads in general, and especially on a laptop. I want to be centered on the display, not shoved to the side. I only rarely use the numeric keypad.
mmcnl|3 years ago
scottydelta|3 years ago
Windows Home Edition is notoriously hard to secure.
This is a totally valid point. Anyone who has worked for big companies know how companies secure systems using security policies which are not available on home edition and tough to setup on Profesional license bought by user.
If a user really wants to do something on windows then I am sure they can run it in VirtualBox or VMware on their system.
1970-01-01|3 years ago
This is bullshit. In Windows 10 Home the Group Policy Editor is removed, and domain-join is not supported, however bulk security changes (i.e. Security Policies) can still be implemented directly to the registry with scripting.
Kukumber|3 years ago
How i use windows (when i REALLY need it, it's rare nowadays):
- in a VM, behind a firewall, with a linux host
I maintain a minimal image, and i copy it whenever i use it, and i throw it once i finish using the VM
And you can even play your favorite games using that technique, KVM/GPU passthrough to the rescue
https://www.youtube.com/watch?v=h7SG7ccjn-g
PaulHoule|3 years ago
I think it's risky because a small computing monoculture can feel complete but commit a software business to failure at the very beginning by rejecting 90% of the potential market.
ericbarrett|3 years ago
dijit|3 years ago
Properly supporting a handful of machines practically means bringing AzureAD or Exchange. AzureAD brings in elements of Exchange (like outlook), which brings in weird default settings like teams/sharepoint/onedrive.
Apple has done a lot of work in supporting Microsoft Exchange, but it's still janky as hell (just browse r/macsysadmin and you'll see).
So, you have two choices.
1) support the monoculture, life will be easier.
2) get a bigger IT department.
People are happy to spend a boatload of money avoiding the second option, so, monoculture it is.
jaclaz|3 years ago
>If your laptop is broken and needs to be repaired you can take it into an Apple repair store. You should ensure that you have a recent backup before doing so, and that your laptop is not your only registered device for iCloud two-factor authentication.
>If the repair is not going to be too expensive (more than $1000 dollars USD), go ahead and repair and expense. If the repair is going to take longer than a day then you need to make sure you have a back up laptop to work on that is non-Windows.
It seems like you need to have TWO Apple devices, to be on the safe side...
Xylakant|3 years ago
[1] or even still has, it‘s been a while
prmoustache|3 years ago
switch007|3 years ago
NeutralForest|3 years ago
seydor|3 years ago
leeter|3 years ago
MacOS CVE details as late: https://www.cvedetails.com/vulnerability-list/vendor_id-49/p...
Windows: https://www.cvedetails.com/vulnerability-list/vendor_id-26/p...
Note how the windows ones are more up to date and patched faster? That's because Mac only does major updates on a cycle and doesn't patch out of band ever if they can avoid it. So yeah I think this is all theater and people's own biases being silly. But if it works for them then that's fine.
Mikeb85|3 years ago
therealasdf|3 years ago
lukaszkups|3 years ago
mandeepj|3 years ago
Seriously? Microsoft is not sitting idle and let them create havoc.
>a remote employee would typically be making a purchase of a laptop pre-loaded with Windows Home Edition
How hard is it for them to mandate a Windows Pro edition?
rosmax_1337|3 years ago
1) The reasons shown as to why Windows is prohibited are essentially parallel construction.
2) The real reason is because someone has an agenda against Windows and Microsoft.
3) This is quite alright. It might be a net loss in the short term for everyone, but a net win in the long term for everyone. Microsoft has a lot of bad stuff coming their way, for good reason.
azangru|3 years ago
There are several good things that are currently coming out of microsoft:
Windows is probably not one of them.j_barbossa|3 years ago
What a stupid reason is that?! It really sounds like the Head of IT at Gitlab just doesn't like Windows and is doing what he can to find excuses.
Havoc|3 years ago
Whatever works. There isn’t some sort of diversity and inclusion requirement for OSs
jareds|3 years ago
MattGaiser|3 years ago
nunez|3 years ago
cronix|3 years ago
glonq|3 years ago
marcodiego|3 years ago
Consider linux dominance on end-users devices through android and embedded systems like smart tv's. There are more instances of linux running and being used right now by end-users than windows. UNIX legacy and a long maturation process on HPC and servers probably has to do with how linux systems evolved to be so secure today compared to windows; also because of "bad-habits" windows historically brings.
It may sound cheesy and although I'd like to see linux more used on the desktop, I'm pretty happy with the current situation.
talentedcoin|3 years ago
dgan|3 years ago
Interestingly, my employer too uses GitLab, and we too prefer Linux among employees ... so i think targeting is on point
nisegami|3 years ago
trelane|3 years ago
gls2ro|3 years ago
See https://code.visualstudio.com/download
nikau|3 years ago
polskibus|3 years ago
Tajnymag|3 years ago
penguin_booze|3 years ago
With Office products being increasingly accessible via the web browser, I think corporations should really start thinking about weaning themselves off Windows.
asah|3 years ago
rkv|3 years ago
cosmiccatnap|3 years ago
HN: While I agree that eating a soup with a fork is bad, I think the employees should be able to try.
stillbourne|3 years ago
unknown|3 years ago
[deleted]
hd363gvcYf|3 years ago
Halan|3 years ago
mwint|3 years ago
Not that I need 64g, that was more because I found a decent deal on one that happened to be 64g. But I sure don’t complain about it :)
rochak|3 years ago
andsoitis|3 years ago
xtracto|3 years ago
rr888|3 years ago
tasuki|3 years ago
gigel82|3 years ago
switch007|3 years ago
smm11|3 years ago
rubicks|3 years ago
mickael-kerjean|3 years ago
sylware|3 years ago
202206241203|3 years ago
[deleted]
icedchai|3 years ago
pjmlp|3 years ago
Meanwhile Github works just great for us.
salzig|3 years ago
It's just their workforce, where they don't want to see anyone working with windows.
bob1029|3 years ago
A lot of Serious Business happens on top of Microsoft technology right now, and the companies responsible for tending to solutions in this space are made extraordinarily uncomfortable by this kind of aura being given off by vendors like Gitlab.
Can Gitlab really afford to alienate double-digit % of its TAM in favor of this ideological position? It seems like they are already having financial difficulties based upon other recent articles.
josephcsible|3 years ago