Slashdot Mirror
Cisco IT Manager Targeting 70% Linux
RMX writes "LinuxWorld Australia has an
interesting article discussing Linux Desktop adoption in Cisco.
Cisco "already converted more than 2,000 of its engineers to Linux desktops...plans to move many laptop users to the platform over the next few years...the driver for Linux on the desktop is not cost savings, but easier support. Manning estimates that it takes a company approximately one desktop administrator to support 40 Windows PCs, while one administrator can support between 200 and 400 Linux desktops.'"
Ha, 40:1 ratio for desktop support personell for windows? Tell that to alot of IT managers, in particular, my former employer. Try 200:1
Don't Tread on Me
I wonder if those microsoft studies that show Windows' TCO better than Linux's account for the "productivity" of a linux engineer...
What i'm sure it doesn't show is that a linux engineer handling 200 computers can provide a much better service (due to the fact that more is "known and controllable" in linux than windows) than a windows sysadmin handling the same amount of computers, resulting in lower costs of security, less costs related to spywares, viruses, user support calls, etc.
There are two kinds of people in the world: Those with good memory.
"... the driver for Linux on the desktop is not cost savings, but easier support. Manning estimates that it takes a company approximately one desktop administrator to support 40 Windows PCs, while one administrator can support between 200 and 400 Linux desktops."
Isn't this still Cost Savings, when you don't need to hire as many admins?
Okay by this you assume that the (security) design of windows, unix and all other OS'es out there are the same and have the same effects? Naïve at least.
Frankly 2003 with SP1 and XP with SP2 is getting there, it only took them a while.
Apart from the ease of creating a company software update ftp (apt-get, yeast, swaret, slapt-get, etc), I really think the license and CD administration to be a pain in the Windows admin's butt.
My Windows co-workers often need a CD either because they need new software, or due to their computer requesting a CD due to some function not already installed. Finding the RIGHT CD (they are like 1000 cd's every month, and they are neatly marked in INVISIBLE, but very fancy, writing) is a total pain. Then, there is the issue of which key is used for this one (oh, you used the english version!) really turns this into a nightmare.
Folks running windows run all kinds of different versions of their software. Why, upgrading costs time and money. On my Slackware machines, swaret has done all upgrades for me, totally automatically! Just upgraded one PC from Slackware 9.0 to 10.1 - swaret --upgrade wait for a while (was a 200mhz...) and reboot when all is done. No keys, no CDs, no cost. Totally brilliant!
A clever person solves a problem. A wise person avoids it. -- Einstein
Little if any functionality of most worms requires root privileges. They could run just fine as a user process.
about the worst thing that can happen is the home directory to be wiped out
Which is usually the only directory on a workstation that contains any information of value.
Delete all your home directories, rsync or rdiff your backup in and magically things just work.
You could restore the entire filesystem on any computer to achieve the same thing.
There are many factors that make Linux less worm-prone than windows. Taken together, they add up to a huge disparity in malware prevalence between the two OSes. However, no single factor is a magic bullet, and that includes the relative difficulty of running with root privileges. It's just one small piece of the puzzle.
but usually patches for OSS vulnerabilities are not bundled along with all sorts of other updates. This means that far less testing is usually needed for OSS security patches. (Or, that's the theory, anyway.)
HAND.
Linux is easier to maintain than Windows, largely thanks to IBM. Linux is more reliable and is less prone to infection by viruses and malware (e.g. spyware) than Windows. IBM ensures that any OS (whether it is commercial or free) shipped to customers on its computer systems meets stringent requirements for reliability.
IBM has been vindicated. IBM initially tried to dethrone Microsoft by producing OS/2, but it was a failure. Now, IBM has thrown its weight behind a product (i.e. Linux) developed outside of IBM, and that product is succeeding in hurting Windows.
Considering that Linux is not monoculture and Linux machines never run as root the way Windows machines do, the support ratio will not change. Cisco's internal distribution might be monoculture but how do you suppose virus writers will figure out company changes? They won't.
Virus and general malicious software is difficult to write when everyone is running Linux. People will continue to try but only the hardcore. Script kiddies, in contrast, would become extinct.
Laws are for people with no friends.
lists and you'll find that most vulnerabilities are either buffer overflows or string format vulnerabilities. There are very few circumstances where fixing those with a one-liner patch would change behavior in a way that other code depends on. If there were any such code then that in itself indicate possible data corruption bugs in the currently running software.
In short: When you don't bundle fixes you typically have one-line fixes which don't break code which isn't already broken (by relying on buggy behavior). Hence, testing time is minimized.
HAND.
Why do people keep bringing this up? It's a logical fallacy. I understand that it seems to make sense that if more people use linux, as much as they use windows, it will be a bigger target and easier to hit.
However, this is simply not the case. Windows is a very homogenous system. Every win2k box is a win2k box. The only differences are slight differences in configuration.
Linux is heterogenous. I mean even if you take a distribution like fedora core 3. Every FC3 box has the same kernel. And if they are up to date they all have the same versions of stuff like glibc. A linux box is a collection of many small pieces of software. Windows is one giant blob of software. So maybe you find a hole in a particular version of openssh. Lots of linux boxes have openssh of varying versions. So you might be able to hit a bunch of them. But it is very difficult to target linux the way you target windows because the number of systems that are similar enough is very small, even if the whole world used it.
You would literally have to find a hole that is present in all 2.4 an 2.6 kernels regardless of patches applied in order to get enough of the linux boxen. And some people still use 2.2. 2.0?
The GeekNights podcast is going strong. Listen!
What about this idea...
If a support tech can only support 40 windows PCs, but another support tech can support 200 Linux PCs, is the difference the amount of support or the intelligence of the tech.
Now I run windows, and have administered windows and I develop software for windows. However, Linux is not as straightforward to administer as windows. I think it requires someone with more skills to administer a Linux box than a windows box.
Someone with more skills will likely be better at administration in general, regardless of which OS. So it is kind of a split problem. To administer linux boxes, you need someone with a good skill set, but they can administer more boxes, but probably at a higher salary. To administer windows boxes, you may not have to pay as much but each tech supports fewer boxes.
It is dangerous to be right on a subject on which the established authorities are wrong. - Voltaire
At my company, we have over 5,000 Windows XP workstations; notebooks and desktops. A team of about 10 people manage the entire system.
With the help of Active Directory, some really neat software (Marimba) and some planning, you can manage thousands of Windows workstations with a minimal staff.
You lock down the machines (no admin logins) you manage the software versions and patches (centralized software distribution) and you don't allow users to install software on their own.
Denying admin logins alone stops 95% of all spyware.
40 workstations without any control WOULD be all an admin could handle, but when you deploy them correctly you can support over 10x that - just like any other system.
- It's not the Macs I hate. It's Digg users. -
Just like the Bible is the word of God according to the Bible. Some morans will believe anything
I work for a Cisco reseller, and I see Cisco sales guys all the time.
There are rumors that the CallManager software (Cisco's IP PBX) will be ported from Windows 2000 to Linux. As it is, to run this box safely today requires having the box on its own subnet with access lists, running anti-virus software on the box(es), running Cisco Security Agent (looks for anamolous behavior of running programs), and running the boxes in a redundant fashion. Not that porting to Linux would solve all problems, but a box that runs a web server, SQL2000, and Windows 2000 has a fair number of issues that could r0x the b0x. Not the least is that if you download a patch from Microsoft that Cisco hasn't approved, and it breaks the box, Cisco TAC will wash its hands of you.
However, Cisco and Microsoft are not only in bed with each other, they are spooning. Part of Cisco's new security initiative involves running Cisco software on desktops to check if the anti-virus and CSA software are up to date, and not allow them to join the network until they are. This is part of those Cisco commercials where the "Self-defending Network" comes in and stops attacks. Getting Cisco software to use the Microsoft API in a world where MS could simply roll their own software just like it for free is a tricky business. Cisco needs to know what Microsoft is doing, and Microsoft could just as easily start doing more business with Juniper should they want to.
What I'm saying is that Cisco uses Linux today for a good number of its products (Content Networking, CallManager, etc) because of its stability. However, the aims of this guy to publically change internal desktops to Linux would be nullified by just one phone call from Gates to Chambers (Cisco CEO).
cisco guys are going to be more technical. Such windows "power users" are much harder to support than office clerks. 200 or so was the norm in a big bureaucratic non-computing-industry corporation I once worked for - but the support necessary was just for windows, office (including Access) and IE, and various intranet web apps (IE-specific craptivex based, of course).
.rpm...), clear segregation of admin and ordinary users, etc., makes support linux workstations for technical people much easier than windows workstations. At my present work, 2 people admin about a hundred physicists' linux desktops, and about 20 windows ones. The linux ones are a centrally-administered breeze, even though each desktop has a different installation profile. So do the windows ones. They aren't a breeze.
The requirements for supporting an engineer's windows desktop securely would be much higher, if you support them at all. Whereas on linux, package management that actually works (.msi exists, but it's a whole lot worse than
>>Denying admin logins alone stops 95% of all spyware.
Hmm. Are you sure that wouldn't be 96.3% or 93.7%, or did you just pluck that percentage out of thin air?
OF COURSE no sysadmin worth the name (and its not much of a name in the first place seeing as how they are the bottom feeders of the IT world) would allow admin privileges for standard logins.
As the poster says, the driver for Linux on the desktop is not cost savings, but easier support
And EVERYONE knows that easier support doesn't save any cost.
Umm.. no. The home directory is mostly personal preferences and documents. They should be backed up regularly anyway, so an admin just needs to replace with a last known good backup.
The key is that it's very hard to destroy a system with a Linux virus.
The global economy is a great thing until you feel it locally.
It seems like this discussion is basically going like this:
"Linux is easy because we set up proper polcies and enforce them. Windows is hard because we haven't bothered to do so."
In other words, you guys are proposing a technological solution (Linux) to a political problem (user desktop control, admin saavy).
There are alot of things you CAN do with a windows box (ghosting for instance) that you need to buy software for most of the time, but then with linux you get the same tools and abilities for free and built in.
Wow. You didn't get the joke about Ballmer acting like a Chimpanzee ;-)
A couple of points:
1) I hold the following certs: MCSE, MCSA. LPIC-2, A+, Network+, Server+, Inet+
2) I spend at least as much time as a consultant working with Windows as I do helping my customers with Linux. I can design Windows networks and troubleshoot them with the best.
3) I used to work at Microsoft.
Ok...... Now for my opinions:
1) Windows sucks because it is TOO COMPLICATED.
2) Windows security sucks because Windows is too complicated and interdependent.
3) Windows is getting more technician/admin friendly but it is still full of braindead dependencies. This ensures a Sendmail-like security record on both the server and the desktop.
4) Linux costs less to support because it is simpler.
5) Training costs for corporate workstations is less with Linux than Windows because it is less complicated.
6) Linux is more predictable due to better quality code and more simplicity. This makes it easier than Windows for a newbie to learn.
The above comparisons assume that one can readily run similar programs on both operating systems. In areas where this is not the case, YMMV.
Sometimes I think that MS shills are invading slashdot!
LedgerSMB: Open source Accounting/ERP